#!/usr/bin/env bash
# Arch ISO emergency remote access. Only configures the live environment.
# OPTIONAL: Replace the placeholder with ONE PUBLIC SSH KEY from your Mac.
# Never put private keys, LUKS passwords or Tailscale auth keys in this file.
SSH_PUBLIC_KEY='ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAdSBMUPdA2ucQid9rsWNDqdwlDQd015tSFcM7tF5/Im priyansh'

set -Eeuo pipefail
trap 'echo; echo "SETUP FAILED at line $LINENO. Photograph this screen for the owner."' ERR

if [[ "$EUID" -ne 0 || ! -d /run/archiso ]]; then
  echo 'STOP: this is not a root shell in an Arch ISO live environment.'
  exit 1
fi

echo 'Setting up TEMPORARY remote access to Arch Live. Do not power off.'
pacman -Sy --noconfirm tailscale openssh

# Optional second SSH route, independent of Tailscale SSH policy.
# Only public-key authentication is allowed. Uses port 2222 to avoid
# conflicting with Tailscale SSH on port 22.
if [[ "$SSH_PUBLIC_KEY" == ssh-* || "$SSH_PUBLIC_KEY" == ecdsa-* ]]; then
  install -d -m 700 /root/.ssh /etc/ssh/sshd_config.d
  printf '%s\n' "$SSH_PUBLIC_KEY" > /root/.ssh/authorized_keys
  chmod 600 /root/.ssh/authorized_keys
  cat > /etc/ssh/sshd_config.d/90-arch-live-rescue.conf <<'SSHCONF'
Port 2222
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin prohibit-password
SSHCONF
  ssh-keygen -A
  if systemctl restart sshd; then
    echo 'OpenSSH key-based fallback started on port 2222.'
  else
    echo 'OpenSSH fallback failed; trying Tailscale SSH anyway.'
  fi
else
  echo 'No Mac public key configured; relying on Tailscale SSH policy.'
fi

systemctl start tailscaled
echo
echo 'IMPORTANT: Photograph the Tailscale login URL below and send it to the owner.'
echo 'The owner must open that URL to approve this machine.'
echo
tailscale up --ssh --hostname=arch-rescue

echo
echo '========== ARCH LIVE REMOTE ACCESS READY =========='
tailscale ip -4
echo 'Do not reboot, switch boot entries, or turn off the smart plug.'
echo 'The owner can now connect and retrieve the file.'
echo '=================================================='