#!/bin/bash
set -euo pipefail

# Extract SSH private key from decrypted env file and write to the per-host
# identity file path. The meta-init script generates ~/.ssh/config with
# IdentityFile /home/agent/.ssh/gitea-oreillyit-nz-ai-enablement
# matching the ssh_hosts alias in harness.yaml.

SSH_KEY_FILE="/home/agent/.ssh/gitea-oreillyit-nz-ai-enablement"

# Find the decrypted env file (dispatcher decrypts SOPS at dispatch time for K8s,
# or the meta-init script decrypts for Docker)
for env_file in /opt/harness/secrets/gitea-ssh/*.decrypted.env /opt/harness/secrets/gitea-ssh/*.env; do
    [ -f "$env_file" ] || continue
    while IFS='=' read -r key value; do
        # Skip comments and blank lines
        [[ "$key" =~ ^[[:space:]]*# ]] && continue
        [[ -z "$key" ]] && continue
        if [ "$key" = "GITEA_SSH_KEY" ]; then
            mkdir -p /home/agent/.ssh
            echo "$value" | base64 -d > "$SSH_KEY_FILE"
            chmod 600 "$SSH_KEY_FILE"
            chown agent:agent "$SSH_KEY_FILE"
            echo "SSH key written to $SSH_KEY_FILE"
            break 2
        fi
    done < "$env_file"
done

if [ ! -f "$SSH_KEY_FILE" ]; then
    echo "WARNING: GITEA_SSH_KEY not found in any env file under /opt/harness/secrets/gitea-ssh/"
fi