#!/usr/bin/env bash
# lib-ssh.sh — shared SSH deploy-key helpers for the pangolin deploy pipelines
# (site / server). `source` this from deploy-*.sh.
#
# Provides:
#   setup_ssh     -> writes $DEPLOY_SSH_KEY to a temp private key (mode 600),
#                    registers the deploy host in known_hosts, and exports
#                    SSH / RSYNC_SSH (ssh command strings) + SSH_KEY_FILE.
#   teardown_ssh  -> removes the temp private key.
#
# Requires env: DEPLOY_SSH_KEY (PEM content of the deploy private key,
# authorized for root on the target host).
#
# Target host is hardcoded to the pangolin1 VPS IP (103.119.13.48): the CI
# runner has no access to the user's local ~/.ssh/config, so the `pangolin1`
# alias cannot be resolved there — the bare IP is used instead. Override with
# DEPLOY_HOST / DEPLOY_PORT if a caller needs to retarget.
#
# No command substitution ($()) is used anywhere, per repo bash conventions.

DEPLOY_HOST="${DEPLOY_HOST:-103.119.13.48}"
DEPLOY_PORT="${DEPLOY_PORT:-22}"
SSH_KEY_FILE="${SSH_KEY_FILE:-/tmp/pangolin_deploy_key.$$}"

# setup_ssh — write the deploy key, register known_hosts, export SSH/RSYNC_SSH.
setup_ssh() {
  if [ -z "${DEPLOY_SSH_KEY:-}" ]; then
    echo "==> setup_ssh: DEPLOY_SSH_KEY is empty" >&2
    return 1
  fi

  mkdir -p ~/.ssh
  chmod 700 ~/.ssh

  # `printf '%s\n'` 末尾补一个换行：Forgejo/Gitea 存 secret 会去掉结尾换行,
  # 而缺结尾换行的 OpenSSH 格式私钥会被判为 "invalid format" 拒绝加载,
  # 退化成无密钥 → Permission denied。多补的换行对已含结尾换行的 PEM 无害。
  printf '%s\n' "${DEPLOY_SSH_KEY}" > "${SSH_KEY_FILE}"
  chmod 600 "${SSH_KEY_FILE}"

  ssh-keyscan -p "${DEPLOY_PORT}" -H "${DEPLOY_HOST}" >> ~/.ssh/known_hosts 2>/dev/null

  SSH="ssh -i ${SSH_KEY_FILE} -p ${DEPLOY_PORT} -o StrictHostKeyChecking=no"
  RSYNC_SSH="ssh -i ${SSH_KEY_FILE} -p ${DEPLOY_PORT} -o StrictHostKeyChecking=no"
  export SSH RSYNC_SSH SSH_KEY_FILE DEPLOY_HOST DEPLOY_PORT
  echo "==> setup_ssh: key written to ${SSH_KEY_FILE}, known_hosts updated for ${DEPLOY_HOST}:${DEPLOY_PORT}"
}

# teardown_ssh — remove the temp private key.
teardown_ssh() {
  rm -f "${SSH_KEY_FILE}"
  echo "==> teardown_ssh: removed ${SSH_KEY_FILE}"
}