#!/usr/bin/env bash
# One-time setup of tgit-runner on the host (as root). Safe to re-run.
#   sudo infra/runner/install.sh /path/to/tgit-runner-key.pub [deploy-user]
# The key is the bot's runner key (RUNNER_SSH_KEY_B64 holds its private half); it is pinned to the runner only.
set -euo pipefail
PUB=${1:?usage: install.sh <runner-key.pub> [user]}
USER_NAME=${2:-tgit-deploy}
DIR=/srv/tgit/runner
HERE=$(cd "$(dirname "$0")" && pwd)

id "$USER_NAME" >/dev/null
install -d -o "$USER_NAME" -g "$USER_NAME" -m 700 "$DIR"
install -o "$USER_NAME" -g "$USER_NAME" -m 755 "$HERE/tgit-runner" "$DIR/tgit-runner"
touch "$DIR/egress-allow" && chown "$USER_NAME:" "$DIR/egress-allow" && chmod 600 "$DIR/egress-allow"

HOME_DIR=$(getent passwd "$USER_NAME" | cut -d: -f6)
install -d -o "$USER_NAME" -g "$USER_NAME" -m 700 "$HOME_DIR/.ssh"
AK=$HOME_DIR/.ssh/authorized_keys
touch "$AK" && chown "$USER_NAME:" "$AK" && chmod 600 "$AK"
KEY=$(awk '{print $1" "$2}' "$PUB")
LINE="command=\"$DIR/tgit-runner\",restrict $KEY tgit-runner"
if grep -qF "$KEY" "$AK"; then
  echo "key already in $AK — leaving it"
else
  echo "$LINE" >>"$AK"
  echo "added the runner key to $AK (forced command)"
fi
echo "runner installed in $DIR; allow internet for a service: echo <service> >> $DIR/egress-allow"