#!/bin/bash
# gitea-ssh-homelab init: copy the ESO-mounted SSH key to the path the
# harness-init `~/.ssh/config` expects.
#
# The harness-init dispatcher (`entrypoint/harness_init.py`) writes
# `~/.ssh/config` from the harness's `ssh_hosts:` block; for this provider
# the entry is `Host gitea.oreillyit.nz-homelab` with
# `IdentityFile /home/agent/.ssh/gitea-oreillyit-nz-homelab`.
#
# We only need to materialise the key file at that path. We MUST NOT append
# our own SSH config block — doing so would (a) duplicate harness-init's
# config (SSH first-match-wins, so the appended block becomes dead) and
# (b) any unaliased `Host gitea.oreillyit.nz` block would collide with
# other gitea harnesses (gitea-https, gitea-admin) when composed.
#
# Per H-SECRET-4: NO `export` of credentials here. The path to the key is
# not a secret; the key content is, and it stays in the file.
set -euo pipefail

SSH_KEY_SRC="/run/agent/secrets/gitea-ssh-homelab/id_ed25519"
SSH_KEY_DST="/home/agent/.ssh/gitea-oreillyit-nz-homelab"

if [ ! -r "$SSH_KEY_SRC" ]; then
    echo "ERROR: SSH key not found at $SSH_KEY_SRC — ESO ExternalSecret not Ready?" >&2
    exit 1
fi

mkdir -p /home/agent/.ssh
install -m 0600 -o agent -g agent "$SSH_KEY_SRC" "$SSH_KEY_DST"
echo "gitea-ssh-homelab: SSH key staged at $SSH_KEY_DST (0600 agent:agent)"