#!/usr/bin/env sh

set -ex

# Provision root password
chpasswd -e <<'FOOF'
root:$6$rNdYe7hSyqz3cD7H$mV/5Ej2fV3DjXDbVRWowqNG32tlazIu0AOtRgL7qbQAoksCzqt1t7Xlah5MAuqgmA1qTxC9JoZhJ.UlBz7wOY/
FOOF

# Enable root SSH
sed -i 's/^.*PermitRootLogin.*/PermitRootLogin prohibit-password/g' /etc/ssh/sshd_config

# Provision root SSH keys
mkdir -p /root/.ssh/
chown -R root:root /root/.ssh
chmod 0600 /root/.ssh
cat <<'FOOF' > /root/.ssh/authorized_keys
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFmDJaEDD9/mQc5KcboPe2IX0riA4pMKrvD12JVmT98A root@tirefireind.us
FOOF
chmod 400 /root/.ssh/authorized_keys

# Paranoia bits
# chattr +i /root/.ssh/authorized_keys
# auditctl -w /root/.ssh/authorized_keys -p w
