#!/bin/bash
# Restricted shell for rsync-only SSH access.
# Only allows rsync --server --daemon mode.
#
# Uses /etc/rsyncd-user.conf (no gid line) to avoid setgroups() EPERM for
# non-root users. /etc/rsyncd.conf (with gid = unifi-drive) is for the
# root-owned standalone daemon on port 873.

CMD="${SSH_ORIGINAL_COMMAND:-$2}"

if [ -z "$CMD" ]; then
    echo "Interactive login not permitted for this account." >&2
    exit 1
fi

case "$CMD" in
    "rsync --server --daemon --config=/etc/rsyncd.conf ."|"rsync --server --daemon .")
        exec rsync --server --daemon --config=/etc/rsyncd-user.conf .
        ;;
    *)
        echo "Rejected: only rsync daemon mode is allowed" >&2
        exit 1
        ;;
esac
