#!/bin/sh

# Set up `ssh` on a machine trusted with full access
#
# Install my public `ssh` keys into ~/.ssh/authorized_keys
# taken from the local `dotfiles` repository
# => Run `dotfiles pull` first to obtain the latest keys
#
# See: https://code.webartifex.de/alexander/dotfiles

set -eu


XDG_DATA_HOME="${XDG_DATA_HOME:-$HOME/.local/share}"

DOTFILES_DIR="${DOTFILES_DIR:-$XDG_DATA_HOME/dotfiles}"

SSH_KEYS_FILE="$HOME/.ssh/authorized_keys"



if [ ! -d "$DOTFILES_DIR" ]; then
    echo "" >&2
    echo "The dotfiles are not installed at: $DOTFILES_DIR" >&2
    echo "=> Run dotfiles-install first" >&2
    echo "" >&2

    exit 1
fi



_git() {
    git --git-dir="$DOTFILES_DIR" --work-tree="$HOME" "$@"
}



# Take my public `ssh` keys out of the local repository

_keys_path=$(mktemp)
trap 'rm -f "$_keys_path"' EXIT

_git show "HEAD:.ssh/authorized_keys_webartifex" > "$_keys_path"



# Show which keys are being authorized

echo ""
echo "Authorizing these keys:"
echo ""
if command -v ssh-keygen >/dev/null 2>&1; then
    ssh-keygen -lf "$_keys_path"
else
    cat "$_keys_path"
fi
echo ""



mkdir -p "$HOME/.ssh"



# Append only keys that are not already authorized

touch "$SSH_KEYS_FILE"

while IFS= read -r _key; do
    if ! grep -qxF "$_key" "$SSH_KEYS_FILE"; then
        echo "$_key" >> "$SSH_KEYS_FILE"
    fi
done < "$_keys_path"



chmod 700 "$HOME/.ssh"
chmod 600 "$SSH_KEYS_FILE"



echo "Installed the public keys into: $SSH_KEYS_FILE"