#!/bin/bash
# Run as root after deployment is done - reverses bootstrap-host.sh by
# removing the temporary AppArmor-fix automation (sudoers rule + script).
# Keeps the elevated grant's lifetime scoped to "while actively deploying"
# rather than standing indefinitely.
#
# Safe to run even if bootstrap-host.sh was never run (both rm -f calls are
# no-ops on missing files). After this, create-graylog-lxc.sh falls back to
# printing the manual AppArmor fix instructions again, same as before
# bootstrap-host.sh existed - re-run bootstrap-host.sh whenever you need the
# automated path again (e.g. before recreating a container from scratch).
set -euo pipefail

[ "$(id -u)" -eq 0 ] || { echo "Must run as root." >&2; exit 1; }

rm -f /etc/sudoers.d/claude-deploy-apparmor
rm -f /usr/local/sbin/fix-lxc-apparmor.sh

echo "Removed AppArmor-fix automation (sudoers rule + script)."