#!/bin/bash
# gitea-ssh init: copy the ESO-mounted SSH key to the path the harness-init
# `~/.ssh/config` expects.
#
# The harness-init dispatcher writes `~/.ssh/config` with
#   IdentityFile /home/agent/.ssh/gitea-oreillyit-nz-ai-enablement
# so the key must end up at that path with mode 0600 owned by agent.
#
# The ESO mount at /run/agent/secrets/gitea-ssh/private_key is read-only
# (V1VolumeMount(read_only=True)), so chmod against it would fail with EROFS.
# install(1) handles permissions/ownership atomically against the destination.
#
# Per M22 Phase 9 file-only delivery (H-SECRET-4): no credential value enters
# an env var.
set -euo pipefail

SSH_KEY_SRC="/run/agent/secrets/gitea-ssh/private_key"
SSH_KEY_DST="/home/agent/.ssh/gitea-oreillyit-nz-ai-enablement"

if [ ! -r "$SSH_KEY_SRC" ]; then
    echo "ERROR: SSH key not found at $SSH_KEY_SRC — ESO ExternalSecret not Ready?" >&2
    exit 1
fi

mkdir -p /home/agent/.ssh
install -m 0600 -o agent -g agent "$SSH_KEY_SRC" "$SSH_KEY_DST"
echo "gitea-ssh: SSH key staged at $SSH_KEY_DST (0600 agent:agent)"