# Setup SSH key — root@10.100.1.25 (main-db / PostgreSQL + SQL Server)
# SSOT: server-audit/docs/guide/ssh-access.md
# Usage: .\server-audit\scripts\setup-ssh-main-db.ps1

$ErrorActionPreference = 'Stop'
$hostIp = '10.100.1.25'
$key = Join-Path $env:USERPROFILE '.ssh\id_rsa_geonet_laptop'
$pub = "$key.pub"

if (-not (Test-Path $pub)) {
    Write-Host "Generating key $key ..."
    ssh-keygen -t rsa -b 4096 -f $key -C 'geonet-laptop' -N '""'
}

Write-Host "Fixing private key ACL..."
icacls $key /inheritance:r 2>$null | Out-Null
icacls $key /grant:r "${env:USERNAME}:(R)" 2>$null | Out-Null

Write-Host "Upload public key ke root@${hostIp} (password 1x)..."
type $pub | ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no -m hmac-sha1 "root@${hostIp}" -p 22 "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys && echo KEY_INSTALLED_OK"

Write-Host ""
Write-Host "Test key-only..."
ssh -i $key -o BatchMode=yes -o IdentitiesOnly=yes -o PreferredAuthentications=publickey -m hmac-sha1 "root@${hostIp}" -p 22 "echo KEY_AUTH_OK"

if ($LASTEXITCODE -ne 0) {
    Write-Host ""
    Write-Host "Masih gagal — cek auth log (password sekali):"
    Write-Host "  ssh -m hmac-sha1 root@${hostIp} -p 22 `"grep sshd /var/log/secure | tail -20`""
    exit 1
}

Write-Host "Success. Login: ssh main-db"