# NUC Cockpit: the web console (unprivileged) may apply data-port network changes and
# reissue its TLS certificate through a single validating helper.
nuc-cockpit ALL=(root) NOPASSWD: /usr/lib/nuc-cockpit/nuc-cockpit-netctl

# Restricted console (nuc-cockpit-console login shell): administrators, already authenticated at
# login, get the setup menu without a second password prompt. Only this exact command line.
%sudo ALL=(root) NOPASSWD: /usr/sbin/nuc-cockpit-setup --console
