From 2305f4099a57a2001f67beee5b82e22cbe2788a3 Mon Sep 17 00:00:00 2001
From: "K. Isom" <kyle@imap.cc>
Date: Fri, 25 Sep 2026 02:45:44 -0700
Subject: [PATCH] dixie: rsync --server --daemon sync key (no rrsync/python3 on
 dixie)

- authorized key forces rsync --server --daemon --config=/etc/rsyncd-dropsonde.conf
- environment.etc rsyncd-dropsonde.conf: cold + analysis modules, read only=false,
  use chroot=false, uid/gid dropsonde, max connections 2, lock file global
- tmpfiles: /srv/{cold,analysis}/dropsonde2 owned dropsonde
---
 hw/dixie/analysis.nix | 39 ++++++++++++++++++++++++++++++++++-----
 1 file changed, 34 insertions(+), 5 deletions(-)

diff --git a/hw/dixie/analysis.nix b/hw/dixie/analysis.nix
index 1ffea35..5b3bede 100644
--- a/hw/dixie/analysis.nix
+++ b/hw/dixie/analysis.nix
@@ -43,16 +43,43 @@ in
       home = "/home/dropsonde";
       createHome = true;
       shell = pkgs.bash;
-      # Hyperborea's nightly sync key (collector -> dixie). rrsync -wo /srv
-      # is the whole capability: write-only rsync rooted at /srv, no shell.
-      # rrsync is a separate nixpkgs package (not bundled with pkgs.rsync);
-      # its rsync + python paths are pinned to the store, so no PATH needed.
+      # Hyperborea's nightly sync key (collector -> dixie). The forced
+      # command runs rsync's own --server --daemon mode against the
+      # restricted config below — write-only (read only = false) modules
+      # rooted at the dropsonde2 dirs, no shell. pkgs.rsync only (no
+      # rrsync/python3 pulled onto dixie).
       openssh.authorizedKeys.keys = [
-        ''command="${pkgs.rrsync}/bin/rrsync -wo /srv",no-agent-forwarding,no-port-forwarding,no-pty,no-X11-forwarding ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKOGU2ZPL8d5iDWo/PIGRtulLbFqOL8XapgZPp1i8oii dropsonde-sync''
+        ''command="${pkgs.rsync}/bin/rsync --server --daemon --config=/etc/rsyncd-dropsonde.conf .",no-agent-forwarding,no-port-forwarding,no-pty,no-X11-forwarding ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKOGU2ZPL8d5iDWo/PIGRtulLbFqOL8XapgZPp1i8oii dropsonde-sync''
       ];
     };
     users.groups.dropsonde = {};
 
+    # --- rsync daemon-over-ssh for the sync key --------------------------------
+    # The dropsonde sync key's forced command runs `rsync --server --daemon`
+    # against this config: two write-only modules rooted at the dropsonde2
+    # subdirs. use chroot = false so /srv paths resolve directly; uid/gid
+    # force the transfer to run as dropsonde. lock file is a global rsyncd
+    # parameter, so it sits at file scope (not per-module).
+    environment.etc."rsyncd-dropsonde.conf".text = ''
+      lock file = /home/dropsonde/rsyncd.lock
+
+      [cold]
+          path = /srv/cold/dropsonde2
+          read only = false
+          use chroot = false
+          uid = dropsonde
+          gid = dropsonde
+          max connections = 2
+
+      [analysis]
+          path = /srv/analysis/dropsonde2
+          read only = false
+          use chroot = false
+          uid = dropsonde
+          gid = dropsonde
+          max connections = 2
+    '';
+
     # --- /srv/cold (5.5 TB HDD, by label) -------------------------------------
     # The wipe+format of sda happens once during deploy; this entry just mounts
     # by label with nofail so a missing disk never blocks boot.
@@ -75,6 +102,8 @@ in
     };
     systemd.tmpfiles.rules = [
       "d /var/lib/dropsonde-analysis 0755 dropsonde dropsonde"
+      "d /srv/cold/dropsonde2 0755 dropsonde dropsonde"
+      "d /srv/analysis/dropsonde2 0755 dropsonde dropsonde"
     ];
 
     # --- analysis.slice: bounded, best-effort, below llama-server -------------