#!/usr/bin/env bash
# Phase 2 Security: SSH key-based auth (disable password). Default: dry-run.
# Usage: ./scripts/security/setup-ssh-key-auth.sh [--dry-run|--apply]
# --apply: run on LOCAL host only. For remote: ssh root@host 'sudo sed -i.bak "s/^#*PasswordAuthentication.*/PasswordAuthentication no/" /etc/ssh/sshd_config && sudo systemctl reload sshd'

set -euo pipefail

DRY_RUN=true
[[ "${1:-}" == "--apply" ]] && DRY_RUN=false

echo "[Phase 2 Security] SSH: disable password auth (DRY_RUN=$DRY_RUN)"
if $DRY_RUN; then
  echo "On each host run: sudo sed -i.bak 's/^#*PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config && sudo systemctl reload sshd"
  echo "See: docs/03-deployment/OPERATIONAL_RUNBOOKS.md § Security"
  exit 0
fi
if [[ -f /etc/ssh/sshd_config ]]; then
  sudo sed -i.bak 's/^#*PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
  sudo systemctl reload sshd 2>/dev/null || true
  echo "[OK] PasswordAuthentication disabled on this host."
fi