#!/bin/bash
# gitea-ssh-accelerators init: copy the ESO-mounted SSH key to the path the
# harness-init `~/.ssh/config` expects (`IdentityFile /home/agent/.ssh/gitea-oreillyit-nz-accelerators`).
#
# Per H-SECRET-4: NO `export` of credentials. (The earlier draft set
# `GIT_SSH_COMMAND` here — a path, not a credential — but that export dies
# with the subshell and the harness-init's SSH config is the load-bearing
# path anyway.)
set -euo pipefail

SSH_KEY_SRC="/run/agent/secrets/gitea-ssh-accelerators/private_key"
SSH_KEY_DST="/home/agent/.ssh/gitea-oreillyit-nz-accelerators"

if [ ! -r "$SSH_KEY_SRC" ]; then
    echo "ERROR: SSH key not found at $SSH_KEY_SRC — ESO ExternalSecret not Ready?" >&2
    exit 1
fi

mkdir -p /home/agent/.ssh
install -m 0600 -o agent -g agent "$SSH_KEY_SRC" "$SSH_KEY_DST"
echo "gitea-ssh-accelerators: SSH key staged at $SSH_KEY_DST (0600 agent:agent)"