# Jalankan di MULTIMEDIA sebagai Administrator (PowerShell Admin)
# Tujuan: passwordless SSH dari laptop dev (key id_ed25519_geonet_proxmox)

$ErrorActionPreference = 'Stop'

$pubKey = 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDxlXfuXAb/A2YCji3XWckW37Hs7SP/yen2CQwgV5M4x proxmox-geonet'
$authFile = 'C:\ProgramData\ssh\administrators_authorized_keys'
$sshDir = 'C:\ProgramData\ssh'

if (-not (Test-Path $sshDir)) {
    New-Item -ItemType Directory -Path $sshDir | Out-Null
}

$existing = ''
if (Test-Path $authFile) {
    $existing = Get-Content $authFile -Raw -ErrorAction SilentlyContinue
}

if ($existing -and $existing.Contains('AAAAC3NzaC1lZDI1NTE5AAAAIDxlXfuXAb/A2YCji3XWckW37Hs7SP/yen2CQwgV5M4x')) {
    Write-Host 'Public key sudah ada di administrators_authorized_keys'
} else {
    Add-Content -Path $authFile -Value $pubKey
    Write-Host 'Public key ditambahkan ke administrators_authorized_keys'
}

icacls $authFile /inheritance:r | Out-Null
icacls $authFile /grant 'SYSTEM:(F)' | Out-Null
icacls $authFile /grant 'Administrators:(F)' | Out-Null

# Pastikan pubkey auth aktif
$sshdConfig = 'C:\ProgramData\ssh\sshd_config'
if (Test-Path $sshdConfig) {
    $cfg = Get-Content $sshdConfig -Raw
    if ($cfg -match '(?m)^#?\s*PubkeyAuthentication\s+no') {
        Write-Warning 'PubkeyAuthentication disabled di sshd_config — ubah manual ke yes lalu restart sshd'
    }
}

Restart-Service sshd
Write-Host 'sshd restarted.'
Write-Host ''
Write-Host 'Selesai. Tes dari laptop:'
Write-Host '  ssh multimedia hostname'