#!/usr/bin/env bash
# Maprova duck — restore remote SSH access. Run ON the duck's Pi console:
#   curl -fsSL <url> | sudo bash
# It only adds the Maprova support PUBLIC key for the login user and makes
# sure sshd is on. No secrets here; it does nothing without the private key,
# which only Maprova holds. After this, Maprova finishes the update over SSH.
set -eu

U="${SUDO_USER:-rpi5}"; [ "$U" = root ] && U=rpi5
H="$(getent passwd "$U" | cut -d: -f6)"; [ -n "$H" ] || H="/home/$U"
K='ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJG9ZAbSWEuvodPMYn8sglvs4BWqHIlIH5tDLpxiDc/u maprova-duck-support'

install -d -m 700 -o "$U" -g "$U" "$H/.ssh"
touch "$H/.ssh/authorized_keys"
grep -qF "$K" "$H/.ssh/authorized_keys" || echo "$K" >> "$H/.ssh/authorized_keys"
chmod 600 "$H/.ssh/authorized_keys"
chown "$U:$U" "$H/.ssh/authorized_keys"

# sshd is normally already running; this only turns it on, no auth change.
systemctl enable --now ssh 2>/dev/null || systemctl enable --now sshd 2>/dev/null || true

echo "OK: SSH restored for ${U}@$(hostname). Maprova can now finish the update remotely."