It's a great time to build a NAS. /s. I was spinning up a small one at home for family photos to enable Digikam locally with an off-site backup and I wanted to aggregate the existing ZFS photos share I have on my existing NAS along with the latest copies from my laptop. The first step was to clone the ZFS share to the local NAS. I also wanted to have a blueprint for syncing ZFS snapshots between devices without using root account logins.

The first thing to do is to set the right permissions on the sender and receiver devices. In my case, I have a backup user which can only run specific commands over SSH.

For the sender side, both the send and hold permissions are required. (Hold shouldn't be required, but was indicated by this ZFS issue: https://github.com/openzfs/zfs/issues/16394)

zfs allow -u backup send,hold Pool/Photos

On the receiver side, there is a different set of permissions:

zfs allow -u backup create,mount,receive,hold exthdd/photos

With the right permissions in place, I could now add the command to the SSH authorized-keys list:

command="/usr/bin/zfs receive -F exthdd/photos",restrict,no-agent-forwarding,no-port-forwarding,no-pty,no-user-rc,no-X11-forwarding ssh-ed25519 <pubkey> <id>

The share is presently syncing across the network after running the following command as my backup user:

zfs send -Lec Pool/Photos@20261013 | pv | ssh -i ~/.ssh/zfs-id_ed25519 10.88.111.8 'zfs receive -F exthdd/photos'