{ pkgs, ... }:

{
  users = {
    users.deploy = {
      description = "deploys static websites from forgejo";
      shell = pkgs.dash; # gets restricted by authorized_keys
      isSystemUser = true;
      group = "deploy";
      openssh.authorizedKeys.keys = [
        "command=\"${pkgs.rsync}/bin/rsync --server -vlogDtpre.iLsfxCIvu . /srv/http/www/\",restrict ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPTUmrD0RMS0atfreGYjobnxBhppqo5XDEOUkLgUMWpD deploy@www.berlin.ccc.de production"
        "command=\"${pkgs.rsync}/bin/rsync --server -vlogDtpre.iLsfxCIvu . /srv/http/www-staging/\",restrict ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIenjEIMaOclgb+vg/LZf2P/eF9J1MaAHpSlYpmtKToB deploy@www.berlin.ccc.de staging"
      ];
    };
    groups.deploy = { };
  };

  services.openssh.extraConfig = ''
    Match User deploy
      Banner none
  '';
}