#cloud-config
{
 "packages": [
  "openssh-server"
 ],
 "disable_root": false,
 "ssh_pwauth": false,
 "write_files": [
  {
   "path": "/root/.ssh/authorized_keys",
   "owner": "root:root",
   "permissions": "0600",
   "content": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIExample me@host\n"
  },
  {
   "path": "/etc/ssh/sshd_config.d/10-iroh.conf",
   "owner": "root:root",
   "permissions": "0644",
   "content": "PermitRootLogin prohibit-password\nPasswordAuthentication no\n"
  },
  {
   "path": "/usr/local/bin/setup-iroh.sh",
   "owner": "root:root",
   "permissions": "0755",
   "content": "#!/bin/bash\nset -euo pipefail\n[ -x /usr/local/bin/dumbpipe ] && exit 0\ncase \"$(uname -m)\" in x86_64|amd64) A=x86_64 ;; aarch64|arm64) A=aarch64 ;; *) exit 1 ;; esac\nURL=\"https://github.com/n0-computer/dumbpipe/releases/download/v0.39.0/dumbpipe-v0.39.0-linux-${A}.tar.gz\"\nT=\"$(mktemp -d)\"\nfor i in 1 2 3 4 5; do\n  curl -fsSL \"${URL}\" | tar -xz -C \"${T}\" && install -m 0755 \"${T}/dumbpipe\" /usr/local/bin/dumbpipe && exit 0\n  sleep 5\ndone\nexit 1\n"
  },
  {
   "path": "/usr/local/bin/iroh-listener.sh",
   "owner": "root:root",
   "permissions": "0755",
   "content": "#!/bin/bash\nset -euo pipefail\nSECRET_FILE=/root/.iroh-secret\nif [ ! -s \"${SECRET_FILE}\" ]; then\n  umask 077\n  head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \\n' > \"${SECRET_FILE}\"\nfi\nexport IROH_SECRET=\"$(cat \"${SECRET_FILE}\")\"\nLOG=/run/guest-iroh.log\nrm -f /run/guest-iroh-ticket \"${LOG}\"\n/usr/local/bin/dumbpipe listen-tcp --host 127.0.0.1:22 2>>\"${LOG}\" &\nPID=$!\nTICKET=\"\"\nfor _ in $(seq 1 150); do\n  TICKET=\"$(grep -a 'connect-tcp' \"${LOG}\" 2>/dev/null | tail -n 1 | awk '{print $NF}')\" || true\n  [ -n \"${TICKET}\" ] && break\n  kill -0 \"${PID}\" 2>/dev/null || break\n  sleep 1\ndone\nif [ -n \"${TICKET}\" ]; then\n  printf 'iroh://%s\\n' \"${TICKET}\" > /run/guest-iroh-ticket\n  printf 'iroh://%s\\n' \"${TICKET}\" > /run/guest-fqdn.tmp\n  mv -f /run/guest-fqdn.tmp /run/guest-fqdn\nfi\nwait \"${PID}\"\n"
  },
  {
   "path": "/etc/systemd/system/iroh.service",
   "owner": "root:root",
   "permissions": "0644",
   "content": "[Unit]\nDescription=iroh dumbpipe listener in front of local sshd\nAfter=network-online.target\nWants=network-online.target\n[Service]\nExecStart=/usr/local/bin/iroh-listener.sh\nRestart=always\nRestartSec=5\n[Install]\nWantedBy=multi-user.target\n"
  },
  {
   "path": "/etc/socialweb-guest-agent/services.json",
   "owner": "root:root",
   "permissions": "0644",
   "content": "{\"shell\":{\"unix\":\"/run/socialweb-guest-agent/shell.sock\"}}\n"
  },
  {
   "path": "/etc/socialweb-guest-agent/tunnels.json",
   "owner": "root:root",
   "permissions": "0644",
   "content": "{\"tunnels\":[{\"tag\":\"shell\",\"unix\":\"/run/socialweb-guest-agent/shell.sock\"}]}\n"
  }
 ],
 "runcmd": [
  "/usr/local/bin/setup-iroh.sh",
  "systemctl daemon-reload",
  "systemctl enable --now --no-block iroh.service",
  "systemctl enable --now --no-block ssh || systemctl enable --now --no-block sshd"
 ]
}