#!/bin/bash
# Restricted shell for rsync-only SSH access.
# Only allows rsync --server --daemon mode.
#
# Uses /etc/rsyncd-user.conf (no gid line) to avoid setgroups() EPERM for
# non-root users. /etc/rsyncd.conf (with gid = unifi-drive) is for the
# root-owned standalone daemon on port 873.
#
# Security design notes:
#   - Exact string match is intentional (fail-closed). A broader prefix match
#     would widen the attack surface. If rsync upgrades change the server-side
#     argument format, connections will be safely rejected rather than allowing
#     unexpected commands. Update the whitelist when upgrading rsync.
#   - Config is overridden to rsyncd-user.conf regardless of what the client
#     requests, preventing a client from specifying an arbitrary config path.
#   - Interactive login is blocked; AllowTcpForwarding/X11/Tunnel are disabled
#     in the sshd Match block (see postinst).

CMD="${SSH_ORIGINAL_COMMAND:-$2}"

if [ -z "$CMD" ]; then
    echo "Interactive login not permitted for this account." >&2
    exit 1
fi

case "$CMD" in
    "rsync --server --daemon --config=/etc/rsyncd.conf ."|"rsync --server --daemon .")
        exec rsync --server --daemon --config=/etc/rsyncd-user.conf .
        ;;
    *)
        echo "Rejected: only rsync daemon mode is allowed" >&2
        exit 1
        ;;
esac
