#!/bin/bash
set -e

# 1. 准备 SSH 目录
mkdir -p /root/.ssh
chmod 700 /root/.ssh
touch /root/.ssh/authorized_keys
touch /root/.ssh/environment

# 仅同步非敏感环境变量到 SSH environment
# (API Keys 通过 compose env_file 注入进程环境，不落盘，避免明文泄露)
printenv | grep -E '^(PATH|BUN|CARGO|RUST|TERM|SHELL|WORKSPACE)' > /root/.ssh/environment

# 2. 动态注入挂载的公钥 (每次启动重建 authorized_keys，避免旧公钥残留)
# 持久化公钥请通过 .env 的 SSH_PUB_KEY_PATH 配置
if [ -f /tmp/host_id_ed25519.pub ]; then
    echo "检测到挂载的公钥，正在注入..."
    cp /tmp/host_id_ed25519.pub /root/.ssh/authorized_keys
    echo "✅ 公钥注入成功"
else
    # 没有挂载公钥时保留已有 authorized_keys (用户可能用 make add-key 手动加过)
    touch /root/.ssh/authorized_keys
fi

# 3. 强制修复权限 (SSH 对此非常敏感)
chmod 600 /root/.ssh/authorized_keys
chown -R root:root /root/.ssh


# 根据不同 OS 启动 SSH
if [ -f /usr/sbin/sshd ]; then
    /usr/sbin/sshd  # Fedora 路径
else
    service ssh start # Ubuntu 路径
fi

exec "$@"