#!/bin/sh
# Patrick Hart — sync ssh public keys into authorized_keys (managed block, idempotent)
# source: https://keys-f1y.pages.dev/patrick
# re-run anytime: adds new keys, removes revoked ones, never duplicates.
set -eu
mkdir -p "$HOME/.ssh" && chmod 700 "$HOME/.ssh"
AK="$HOME/.ssh/authorized_keys"
touch "$AK" && chmod 600 "$AK"
BEGIN="# >>> keys.hartforge.dev/patrick >>>"
END="# <<< keys.hartforge.dev/patrick <<<"

KEYS_TMP="$HOME/.ssh/.keys.$$"
cat > "$KEYS_TMP" <<'KEYS'
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMW/LPEPctc8sALGAE7yeHsPfzAFthzpwmhxoX3gvOSU admin@mac-mini
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDb+e6Z7Y1I27Hd7d1LtgKQZyf/lqGEq/Gg5pQq2QgZx patricks-mbp
KEYS

# rebuild authorized_keys: drop the old managed block and any stray copies of these keys,
# keep everything else, then append a fresh block. this is what enables revocation.
AK_TMP="$AK.sync.$$"
awk -v b="$BEGIN" -v e="$END" '
  FNR==NR { if ($0 != "") managed[$0]=1; next }
  $0==b { skip=1; next }
  $0==e { skip=0; next }
  skip==1 { next }
  ($0 in managed) { next }
  { print }
' "$KEYS_TMP" "$AK" > "$AK_TMP"
{
  echo "$BEGIN"
  cat "$KEYS_TMP"
  echo "$END"
} >> "$AK_TMP"
rm -f "$KEYS_TMP"
mv "$AK_TMP" "$AK"
chmod 600 "$AK"

echo "patrick: synced 2 key(s) into authorized_keys:"
echo "  SHA256:cR5R2Iq2DLy7DaHV6Cl3CpDIriaV/ByPG2VQUgtfmH4  patricks-macmini"
echo "  SHA256:2pLAiF1effU4ileRZZz7o3zBmU9VJFtaxg8xU4ivCds  patricks-mbp"