#!/bin/bash
# From steel141: put the Mac's interactive pubkey on every LAN host in config/ssh_homelab, via
# claude's own aliases (same names, same target users). Idempotent; called by run.sh, safe alone.
# steel141 itself is the one exception: seth's authorized_keys needs sudo from the claude account.
set -euo pipefail
PUB=$(ssh -o BatchMode=yes mac cat .ssh/id_ed25519_homelab.pub)
[[ $PUB == ssh-ed25519\ AAAA* ]] || { echo "no ~/.ssh/id_ed25519_homelab on the Mac — run setup.sh first"; exit 1; }
ADD='umask 077; mkdir -p ~/.ssh; if grep -qF "$PUB" ~/.ssh/authorized_keys 2>/dev/null; then echo "[skip] $H"; else echo "$PUB" >> ~/.ssh/authorized_keys; echo "[set] $H"; fi'
for H in pve112 pve173 pve197 pve241 bedroom vdj-rig thinkcentre seth-pi pinail caddy openclaw2 rtorrent emby mcsmanager pihole arr; do
  ssh -o BatchMode=yes -o ConnectTimeout=5 "$H" "PUB='$PUB' H=$H bash -s" <<<"$ADD" || echo "[FAIL] $H"
done
sudo -n -u seth env PUB="$PUB" H=steel141 bash -c "$ADD"