I'm trying to set up a lightweight, custom filesync system for myself. I'd like the server to watch for changes to a given folder (with
inotify -m), and when it detects any, to propagate them to clients connected to it.
My first thought was for the client computers to initiate an SSH tunnel (with
ssh -R 2222:127.0.0.1:22), and then for the server to scp the files back to the clients whenever appropriate. But in order to automate the process, I'd need to set up SSH keys, which means that if the server were compromised without my knowledge, my computer would then be exposed in turn. I understand there are ways to mitigate these risks, like chroot jail or scponly, but it seems a little clumsy to open up a great big hole just to patch it back up 99% of the way.
It has occurred to me that the security issue arises from allowing the server to push to the client, rather than having the client pull from the server. So is there any other program or protocol that I can use to open a tunnel so that the client, hidden behind a dynamic IP and home router, can monitor a given port for a signal from the server without opening it up to manipulation the way an SSH tunnel would?