#!/bin/sh
# ensure-root-ssh-key - idempotently install managed SSH public keys into
# /root/.ssh/authorized_keys. Runs at boot (ensure-root-ssh-key.service) and
# can be run by hand at any time.
#
# Source of truth: /usr/local/share/root-ssh-keys/authorized_keys
# One key per line, same format as an authorized_keys file. Blank lines and
# lines starting with '#' are ignored. Keys already present are left alone;
# foreign keys in authorized_keys are never removed.

set -eu

KEY_DIR="${KEY_DIR:-/root/.ssh}"
AUTH_KEYS="$KEY_DIR/authorized_keys"
MANAGED_KEYS="${MANAGED_KEYS:-/usr/local/share/root-ssh-keys/authorized_keys}"

if [ ! -r "$MANAGED_KEYS" ]; then
    echo "ensure-root-ssh-key: cannot read $MANAGED_KEYS" >&2
    exit 1
fi

umask 077
install -d -m 0700 "$KEY_DIR"
[ -e "$AUTH_KEYS" ] || : > "$AUTH_KEYS"
chmod 0600 "$AUTH_KEYS"
chown root:root "$KEY_DIR" "$AUTH_KEYS"

added=0
checked=0
while IFS= read -r line <&3; do
    case "$line" in
        '' | \#*) continue ;;
    esac

    # Basic shape check: <algo> <base64> [comment]
    algo=${line%% *}
    case "$algo" in
        ssh-ed25519 | ssh-rsa | ssh-dss | ecdsa-sha2-* | sk-ecdsa-sha2-* | sk-ssh-ed25519-* | ssh-ed448) ;;
        *)
            echo "ensure-root-ssh-key: skipping unrecognised line: $line" >&2
            continue
            ;;
    esac

    checked=$((checked + 1))
    if grep -qxF -- "$line" "$AUTH_KEYS" 2>/dev/null; then
        continue
    fi
    printf '%s\n' "$line" >> "$AUTH_KEYS"
    added=$((added + 1))
    echo "ensure-root-ssh-key: installed key (${algo}, ${#line} chars)"
done 3< "$MANAGED_KEYS"

if [ "$added" -eq 0 ]; then
    echo "ensure-root-ssh-key: $checked managed key(s) already present in $AUTH_KEYS"
else
    echo "ensure-root-ssh-key: added $added key(s), $checked managed key(s) total"
fi

chmod 0600 "$AUTH_KEYS"
exit 0