Host-Key authentication and write-only access

[senpro-ingwersenk]

Hello!

I am trying to realize a little project for my company, where we have a dozen of little remote devices acting as monitoring agents. We configure them with NixOS and would like to quickly archive the configurations. Whilst Git would be an option, I have not found a good, automated, "dumb" way to bootstrap that. Most of the users here in the company only sporadically log in, change a value and rebuild. Their understanding of Linux is not very advanced yet. So, this is my job to automate and make easy.

I would like to achieve:

• Let the devices upload a file with a timestamped pattern (i.e. 2024/01/18/8_45 configuration.nix)
• Only allow those clients to write, not read.
• Authenticate using the $HOSTNAME as user and the per-device SSH host key (/etc/ssh/ssh_host_rsa_key[.pub])

So, something like this: scp /etc/nixos/configuration.nix $HOSTNAME@companyserver:$(date +"%Y/%m/%d/%H_%M")-configuration.nix

The backend should be a sub-path on local network's SMB share (i.e. \\sharehost\monitoring_agents\<path>).

We have a k3s cluster (I have no idea how that happened in this Windows-focused company) which would be where SFTPGo would end up running, probably with a suitable replication configured.

Do you have any idea?

Kind regards and have a nice day!