scripts/ssh-setup.sh

#!/usr/bin/env sh
set -eu

# Write SSH keys from env vars into /root/.ssh with correct permissions.
# Handles both real newlines and literal \n sequences in SSH_PRIVATE_KEY.

HOME_DIR="${HOME:-/root}"
SSH_DIR="$HOME_DIR/.ssh"

mkdir -p "$SSH_DIR"
chmod 700 "$SSH_DIR"

# Public key (optional)
if [ -n "${SSH_PUBLIC_KEY:-}" ]; then
  printf "%s\n" "$SSH_PUBLIC_KEY" > "$SSH_DIR/id_rsa.pub"
  chmod 644 "$SSH_DIR/id_rsa.pub"
fi

# Private key (optional)
if [ -n "${SSH_PRIVATE_KEY:-}" ]; then
  # If the key contains literal \n sequences, convert them to newlines.
  if printf "%s" "$SSH_PRIVATE_KEY" | grep -q '\\n'; then
    printf "%s" "$SSH_PRIVATE_KEY" | sed 's/\\n/\n/g' > "$SSH_DIR/id_rsa"
  else
    printf "%s" "$SSH_PRIVATE_KEY" > "$SSH_DIR/id_rsa"
  fi
  chmod 600 "$SSH_DIR/id_rsa"
fi

# Prime known_hosts to avoid host key prompts for common git hosts
if command -v ssh-keyscan >/dev/null 2>&1; then
  for host in github.com gitlab.com; do
    ssh-keyscan -H "$host" 2>/dev/null >> "$SSH_DIR/known_hosts" || true
  done
  # Optionally pre-seed remote backup host if provided via REMOTE_HOST (user@host)
  if [ -n "${REMOTE_HOST:-}" ]; then
    remote_host_domain="$(printf "%s" "$REMOTE_HOST" | awk -F'@' '{print $NF}')"
    if [ -n "$remote_host_domain" ]; then
      ssh-keyscan -H "$remote_host_domain" 2>/dev/null >> "$SSH_DIR/known_hosts" || true
    fi
  fi
  chmod 644 "$SSH_DIR/known_hosts" || true
fi

#Optionally run Claude config restore after SSH is ready
if command -v download_claude_backup.sh >/dev/null 2>&1; then
  echo "[ssh-setup] Running download_claude_backup.sh to restore config..." >&2
  download_claude_backup.sh || true
fi

# rm /app/scripts/*.sh
# rm ~/.ssh/id_rsa
# rm ~/.ssh/id_rsa.pub

exec "$@"