The following are lines from ~rsyncer/.ssh/authorized-keys on my dbclone host – which gathers database backups from various hosts.

from="x8dtu.example.org,10.1.1.1",command="/usr/local/sbin/rrsync -ro /usr/home/rsyncer/backups/bacula-database/postgresql/" ssh-ed25519
AAAAC3thisisalsonotmyrealpublickeybcxpFeUMAC2LOitdpRb9l0RoW7vt5hnzwt rsyncer@x8dtu.example.org

The above appears on two lines to make it easier to read without horizontal scrolling – in the file, it’s all on one line.

This says:

• when an ssh connection comes in from a client at x8dtu.example.org, or 10.1.1.1
• run /usr/local/sbin/rrsync -ro /usr/home/rsyncer/backups/bacula-database/postgresql/
• and that client must have this key (as shown)
• rsyncer@x8dtu.example.org is a comment, and has no effect