More restrictive sudoless setup for first-run

install/preflight/first-run-mode.sh

@@ -3,3 +3,11 @@
 # Set first-run mode marker so we can install stuff post-installation
 mkdir -p ~/.local/state/omarchy
 touch ~/.local/state/omarchy/first-run.mode
+
+# Setup sudo-less access for first-run
+sudo tee /etc/sudoers.d/first-run >/dev/null <<EOF
+$USER ALL=(ALL) NOPASSWD: /usr/bin/ufw
+$USER ALL=(ALL) NOPASSWD: /usr/bin/ufw-docker
+$USER ALL=(ALL) NOPASSWD: /bin/rm -f /etc/sudoers.d/first-run
+EOF
+sudo chmod 440 /etc/sudoers.d/first-run