#!/bin/bash
set -euo pipefail

HOME_DIR=/home/developer
HOST_KEY_DIR="${HOME_DIR}/.ssh-host"
AUTH_KEYS_SRC=/etc/ssh-authorized-keys/authorized_keys

mkdir -p "${HOME_DIR}/.ssh" "${HOME_DIR}/workspace" "${HOST_KEY_DIR}"

# Persist host keys on the PVC so SSH fingerprints stay stable across restarts.
if [ ! -f "${HOST_KEY_DIR}/ssh_host_ed25519_key" ]; then
  ssh-keygen -t ed25519 -f "${HOST_KEY_DIR}/ssh_host_ed25519_key" -N "" -q
fi
if [ ! -f "${HOST_KEY_DIR}/ssh_host_rsa_key" ]; then
  ssh-keygen -t rsa -b 4096 -f "${HOST_KEY_DIR}/ssh_host_rsa_key" -N "" -q
fi

cat > /etc/ssh/sshd_config.d/98-hostkeys.conf <<EOF
HostKey ${HOST_KEY_DIR}/ssh_host_ed25519_key
HostKey ${HOST_KEY_DIR}/ssh_host_rsa_key
EOF

if [ -f "${AUTH_KEYS_SRC}" ]; then
  install -m 600 -o developer -g developer "${AUTH_KEYS_SRC}" "${HOME_DIR}/.ssh/authorized_keys"
fi
# sshd StrictModes rejects auth if $HOME is group/world-writable.
chmod 755 "${HOME_DIR}"
chmod 700 "${HOME_DIR}/.ssh"
chown -R developer:developer "${HOME_DIR}"

# DinD sidecar listens on TCP; ensure SSH login shells see DOCKER_HOST.
grep -q '^DOCKER_HOST=' /etc/environment 2>/dev/null \
  || echo 'DOCKER_HOST=tcp://127.0.0.1:2375' >> /etc/environment
if [ ! -f "${HOME_DIR}/.profile" ] || ! grep -q 'DOCKER_HOST' "${HOME_DIR}/.profile" 2>/dev/null; then
  printf '\nexport DOCKER_HOST=tcp://127.0.0.1:2375\n' >> "${HOME_DIR}/.profile"
  chown developer:developer "${HOME_DIR}/.profile"
fi

# Tiny HTTP for TrinityIngress / health (Traefik terminates TLS).
python3 -m http.server 8080 --bind 0.0.0.0 --directory /usr/share/devbox-http >/tmp/http-8080.log 2>&1 &

exec /usr/sbin/sshd -D -e