#!/bin/bash
set -euo pipefail

HOME_DIR=/home/developer
HOST_KEY_DIR="${HOME_DIR}/.ssh-host"
AUTH_KEYS_SRC=/etc/ssh-authorized-keys/authorized_keys

mkdir -p "${HOME_DIR}/.ssh" "${HOME_DIR}/workspace" "${HOST_KEY_DIR}"

# Persist host keys on the PVC so SSH fingerprints stay stable across restarts.
if [ ! -f "${HOST_KEY_DIR}/ssh_host_ed25519_key" ]; then
  ssh-keygen -t ed25519 -f "${HOST_KEY_DIR}/ssh_host_ed25519_key" -N "" -q
fi
if [ ! -f "${HOST_KEY_DIR}/ssh_host_rsa_key" ]; then
  ssh-keygen -t rsa -b 4096 -f "${HOST_KEY_DIR}/ssh_host_rsa_key" -N "" -q
fi

cat > /etc/ssh/sshd_config.d/98-hostkeys.conf <<EOF
HostKey ${HOST_KEY_DIR}/ssh_host_ed25519_key
HostKey ${HOST_KEY_DIR}/ssh_host_rsa_key
EOF

if [ -f "${AUTH_KEYS_SRC}" ]; then
  install -m 600 -o developer -g developer "${AUTH_KEYS_SRC}" "${HOME_DIR}/.ssh/authorized_keys"
fi
# sshd StrictModes rejects auth if $HOME is group/world-writable.
# Do not chown -R the whole PVC (tens of GB) — that blocks sshd past liveness and
# caused empty-home recovery restarts to loop. Ownership is uid 1000 (developer).
chmod 755 "${HOME_DIR}"
chmod 700 "${HOME_DIR}/.ssh"
chown developer:developer "${HOME_DIR}" "${HOME_DIR}/.ssh" "${HOME_DIR}/workspace" 2>/dev/null || true
chown -R developer:developer "${HOME_DIR}/.ssh-host" 2>/dev/null || true

# DinD sidecar listens on TCP; ensure SSH login shells see DOCKER_HOST.
grep -q '^DOCKER_HOST=' /etc/environment 2>/dev/null \
  || echo 'DOCKER_HOST=tcp://127.0.0.1:2375' >> /etc/environment
if [ ! -f "${HOME_DIR}/.profile" ] || ! grep -q 'DOCKER_HOST' "${HOME_DIR}/.profile" 2>/dev/null; then
  printf '\nexport DOCKER_HOST=tcp://127.0.0.1:2375\n' >> "${HOME_DIR}/.profile"
  chown developer:developer "${HOME_DIR}/.profile"
fi

# sshd does not forward container env to login shells. Mirror kube-injected
# proxy vars into /etc/environment + a profile.d snippet (same path as DOCKER_HOST).
proxy_env_file=/etc/profile.d/99-kube-proxy.sh
: > "${proxy_env_file}"
chmod 644 "${proxy_env_file}"
for v in HTTP_PROXY HTTPS_PROXY http_proxy https_proxy NO_PROXY no_proxy ALL_PROXY all_proxy; do
  val="${!v:-}"
  [ -n "${val}" ] || continue
  # Refresh /etc/environment line for this key.
  if grep -q "^${v}=" /etc/environment 2>/dev/null; then
    sed -i "s|^${v}=.*|${v}=${val}|" /etc/environment
  else
    echo "${v}=${val}" >> /etc/environment
  fi
  printf 'export %s=%q\n' "${v}" "${val}" >> "${proxy_env_file}"
done

# Tiny HTTP for TrinityIngress / health (Traefik terminates TLS).
python3 -m http.server 8080 --bind 0.0.0.0 --directory /usr/share/devbox-http >/tmp/http-8080.log 2>&1 &

exec /usr/sbin/sshd -D -e