dixie: dropsonde sync key — rrsync -wo /srv (write-only, hyperborea -> dixie)

2026-09-25 02:24:26 -07:00
parent 0ac90515bf
commit 2e4aa6ed57
1 changed files with 7 additions and 0 deletions
@@ -43,6 +43,13 @@ in
      home = "/home/dropsonde";
      createHome = true;
      shell = pkgs.bash;
+      # Hyperborea's nightly sync key (collector -> dixie). rrsync -wo /srv
+      # is the whole capability: write-only rsync rooted at /srv, no shell.
+      # rrsync is a separate nixpkgs package (not bundled with pkgs.rsync);
+      # its rsync + python paths are pinned to the store, so no PATH needed.
+      openssh.authorizedKeys.keys = [
+        ''command="${pkgs.rrsync}/bin/rrsync -wo /srv",no-agent-forwarding,no-port-forwarding,no-pty,no-X11-forwarding ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKOGU2ZPL8d5iDWo/PIGRtulLbFqOL8XapgZPp1i8oii dropsonde-sync''
+      ];
    };
    users.groups.dropsonde = {};