#!/bin/bash
set -euo pipefail

# Extract SSH private key from decrypted env file for the homelab identity.
# The meta-init script generates ~/.ssh/config with
# IdentityFile /home/agent/.ssh/gitea-oreillyit-nz-homelab
# matching the ssh_hosts alias in harness.yaml.

SSH_KEY_FILE="/home/agent/.ssh/gitea-oreillyit-nz-homelab"

for env_file in /opt/harness/secrets/gitea-ssh-homelab/*.decrypted.env /opt/harness/secrets/gitea-ssh-homelab/*.env; do
    [ -f "$env_file" ] || continue
    while IFS='=' read -r key value; do
        [[ "$key" =~ ^[[:space:]]*# ]] && continue
        [[ -z "$key" ]] && continue
        if [ "$key" = "GITEA_SSH_KEY" ]; then
            mkdir -p /home/agent/.ssh
            echo "$value" | base64 -d > "$SSH_KEY_FILE"
            chmod 600 "$SSH_KEY_FILE"
            chown agent:agent "$SSH_KEY_FILE"
            echo "SSH key written to $SSH_KEY_FILE"
            break 2
        fi
    done < "$env_file"
done

if [ ! -f "$SSH_KEY_FILE" ]; then
    echo "WARNING: GITEA_SSH_KEY not found in any env file under /opt/harness/secrets/gitea-ssh-homelab/"
fi