The `rssh` module manages this file with some sensible defaults and provides an interface for customisations. At the moment we're pulling the module in with librarian-puppet but not using. We can replace this code with the following in hiera:
```
classes:
…
  - rssh

rssh::allow:
  - rsync
```