Initial build

1 files changed, 26 insertions, 0 deletions

diff --git a/extras/estampa-ssh b/extras/estampa-ssh
new file mode 100755
index 0000000..f1cbd08
--- /dev/null
+++ b/extras/estampa-ssh
@@ -0,0 +1,26 @@
+#!/bin/sh
+# estampa-ssh: forced command for the upload account in ~/.ssh/authorized_keys.
+#
+# Usage in authorized_keys:
+#   command="/usr/local/bin/estampa-ssh /srv/estampa/pastes",no-pty,no-agent-forwarding,no-port-forwarding,no-X11-forwarding ssh-ed25519 AAAA... uploader
+#
+# On every incoming SSH session this:
+#   1. prunes pastes older than one week from $1 (best-effort, never blocks),
+#   2. then exec's the original scp/sftp command the client wanted to run.
+# Any other command is rejected.
+
+set -eu
+
+PASTE_DIR="${1:?usage: estampa-ssh <paste-dir>}"
+
+estampa --run "$PASTE_DIR" >/dev/null 2>&1 || true
+
+case "${SSH_ORIGINAL_COMMAND:-}" in
+    "scp -t "*|"scp -f "*|"/usr/lib/openssh/sftp-server"|"internal-sftp")
+        exec $SSH_ORIGINAL_COMMAND
+        ;;
+    *)
+        echo "estampa-ssh: only scp/sftp uploads are allowed" >&2
+        exit 1
+        ;;
+esac