#!/bin/bash
# ansipa-git-add-deploy-key.sh — register a node's read-only deploy key with
# the ANSIPA git server (see ansipa-git-server-setup.sh).
#
# The key is forced to git-upload-pack (fetch-only) at the transport layer —
# defense in depth; GPG commit signing remains the real trust boundary, so a
# leaked deploy key only grants read access to already-signed history.
#
# Usage (run inside the container, e.g. `docker exec freeipa ...`):
#   ansipa-git-add-deploy-key.sh "ssh-ed25519 AAAA...== node.example.com"

set -euo pipefail

PERSIST_BASE="/data/git-server"
AUTHKEYS="$PERSIST_BASE/authorized_keys"
GIT_HOME="/srv/git"
REPO_DIR="$GIT_HOME/ansipa-policy.git"

[[ $# -eq 1 ]] || { echo "Usage: $0 \"<ssh-public-key> [comment]\"" >&2; exit 1; }
PUBKEY="$1"

[[ "$PUBKEY" =~ ^(ssh-ed25519|ssh-rsa|ecdsa-sha2-) ]] || {
    echo "ERROR: doesn't look like an SSH public key" >&2; exit 1;
}

mkdir -p "$PERSIST_BASE"
touch "$AUTHKEYS"

LINE="command=\"git-upload-pack ${REPO_DIR}\",no-port-forwarding,no-X11-forwarding,no-pty,no-agent-forwarding ${PUBKEY}"

if grep -qF "$PUBKEY" "$AUTHKEYS" 2>/dev/null; then
    echo "Key already present — skipping." >&2
    exit 0
fi

echo "$LINE" >> "$AUTHKEYS"
cp "$AUTHKEYS" "$GIT_HOME/.ssh/authorized_keys"
chown git:git "$GIT_HOME/.ssh/authorized_keys"
chmod 600 "$GIT_HOME/.ssh/authorized_keys"

echo "Added read-only deploy key (forced git-upload-pack, ${REPO_DIR})."