#!/usr/bin/execlineb -P

# Debian's ssh.service has "ExecStartPre=/usr/sbin/sshd -t". We run it too, but
# deliberately NOT as a gate: ssh is the rescue anchor of every AEP machine and
# nothing in this run script may ever keep it from starting. "foreground" logs
# the parse errors into the ssh-log pipeline and then starts sshd anyway --
# sshd -D refuses a broken config on its own, with the same message, so no
# broken configuration slips through either way.
#
# 0.2.4 used "if { ... }" here. On the first s6 boot of a freshly built image
# that left the machine without sshd (hcloud/resolute, 2026-09-22) -- reachable
# on IP level, nothing listening on 22. Whatever made the check fail there, a
# pre-check must not be able to do that.
# Host keys BEFORE sshd, every time. "ssh-keygen -A" creates only the keys that
# are missing and is a no-op otherwise, so this costs nothing on a machine that
# has them.
#
# Why it has to be here and not in cloud-init: an image must not ship host keys
# -- every machine built from it would present the same identity, and any of
# them could impersonate any other. So the image build deletes them, and then
# the FIRST thing that must happen on the first boot is generating new ones.
# cloud-init runs too late and not everywhere: on 2026-09-22 rt-1 and rt-2 of
# tick-1 both answered with the same ed25519 key, one that was on neither
# machine's disk, because the keys were replaced only after sshd had already
# started (deploy session, commit 16e5508).
#
# Without keys sshd exits with "sshd: no hostkeys available -- exiting", so
# this step is also what keeps a key-less image from ending up with no ssh at
# all.
foreground { /usr/bin/ssh-keygen -A }
foreground { /usr/sbin/sshd -t }
run-script-daemon ssh
