#!/bin/sh
# dhai h65: let HOME (leaf1, tailnet 100.77.101.41) ssh into fenced wh-old as root. Public, no secret.
# Typed by davidad at wh-old's console:  curl -fsSL https://h65.dhai.uk | sudo sh
set -eu
L='from="100.77.101.41" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILmLAeHF8MufFfReLkiu+Up9pF7htIsMJekBw1DrUyXL dhai-home-leaf1-h65'
[ "$(id -u)" = 0 ] || { echo "h65: FAILED: not root; type it ending in | sudo sh"; exit 1; }
mkdir -p /root/.ssh && chmod 700 /root/.ssh
grep -qxF "$L" /root/.ssh/authorized_keys 2>/dev/null || echo "$L" >> /root/.ssh/authorized_keys
chmod 600 /root/.ssh/authorized_keys
F=/etc/ssh/authorized_keys.d/root
if [ -e "$F" ] && ! grep -qxF "$L" "$F"; then T=$(mktemp); cat "$F" > "$T"; echo "$L" >> "$T"; rm -f "$F"; install -m 444 "$T" "$F"; rm -f "$T"; fi
echo "h65: OK, key added:"; echo "$L" | ssh-keygen -lf - 2>/dev/null || true
echo "h65: nothing else changed. Reply 'done' to prime."