From 2e4aa6ed57432b5af4f0c4430dc2ebbfdd208005 Mon Sep 17 00:00:00 2001
From: "K. Isom" <kyle@imap.cc>
Date: Fri, 25 Sep 2026 02:24:26 -0700
Subject: [PATCH] =?UTF-8?q?dixie:=20dropsonde=20sync=20key=20=E2=80=94=20r?=
 =?UTF-8?q?rsync=20-wo=20/srv=20(write-only,=20hyperborea=20->=20dixie)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 hw/dixie/analysis.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/hw/dixie/analysis.nix b/hw/dixie/analysis.nix
index 7155ad5..1ffea35 100644
--- a/hw/dixie/analysis.nix
+++ b/hw/dixie/analysis.nix
@@ -43,6 +43,13 @@ in
       home = "/home/dropsonde";
       createHome = true;
       shell = pkgs.bash;
+      # Hyperborea's nightly sync key (collector -> dixie). rrsync -wo /srv
+      # is the whole capability: write-only rsync rooted at /srv, no shell.
+      # rrsync is a separate nixpkgs package (not bundled with pkgs.rsync);
+      # its rsync + python paths are pinned to the store, so no PATH needed.
+      openssh.authorizedKeys.keys = [
+        ''command="${pkgs.rrsync}/bin/rrsync -wo /srv",no-agent-forwarding,no-port-forwarding,no-pty,no-X11-forwarding ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKOGU2ZPL8d5iDWo/PIGRtulLbFqOL8XapgZPp1i8oii dropsonde-sync''
+      ];
     };
     users.groups.dropsonde = {};