[buildout]
parts =
  sshd-service
  sshd-add-authorized-key
  sshd-promise
  publish-connection-parameter

eggs-directory = ${buildout:eggs-directory}
develop-eggs-directory = ${buildout:develop-eggs-directory}
offline = true
extends = ${monitor2-template:output}

[directory]
recipe = slapos.cookbook:mkdirectory
home = $${buildout:directory}
etc = $${:home}/etc/
var = $${:home}/var/
run = $${:var}/run/
bin = $${:home}/bin/
services = $${:etc}/service/

[instance-parameter]
recipe = slapos.cookbook:slapconfiguration
computer = $${slap-connection:computer-id}
partition = $${slap-connection:partition-id}
url = $${slap-connection:server-url}
key = $${slap-connection:key-file}
cert = $${slap-connection:cert-file}

[user-info]
recipe = slapos.cookbook:userinfo

[slap-configuration]
recipe = slapos.cookbook:slapconfiguration
computer = $${slap-connection:computer-id}
partition = $${slap-connection:partition-id}
url = $${slap-connection:server-url}
key = $${slap-connection:key-file}
cert = $${slap-connection:cert-file}

[slap-network-information]
local-ipv4 = $${slap-configuration:ipv4-random}
global-ipv6 = $${slap-configuration:ipv6-random}

[slap-parameter]
recipe = slapos.recipe.build
slapparameter-dict = $${slap-configuration:configuration}
home = $${buildout:directory}
init =
  import json
  default_parameters = options.get('slapparameter-dict')
  # Default value if no ssh key is specified
  options['user-authorized-key'] = default_parameters.get('user-authorized-key', '')

[publish-connection-parameter]
recipe = slapos.cookbook:publish
ssh-command = ssh $${user-info:pw-name}@$${slap-network-information:global-ipv6} -p $${sshd-port:port}
ssh-url = ssh://$${user-info:pw-name}@[$${slap-network-information:global-ipv6}]:$${sshd-port:port}

# Deploy openssh-server
[sshd-port]
recipe = slapos.cookbook:free_port
minimum = 22222
maximum = 22231
ip = $${instance-parameter:ipv6-random}

[sshd-config]
recipe = slapos.recipe.template:jinja2
output = $${directory:etc}/sshd.conf
path_pid = $${directory:run}/sshd.pid
inline =
  PidFile $${:path_pid}
  Port $${sshd-port:port}
  ListenAddress $${instance-parameter:ipv6-random}
  Protocol 2
  HostKey $${sshd-ssh-host-rsa-key:output}
  HostKey $${sshd-ssh-host-ecdsa-key:output}
  PasswordAuthentication no
  PubkeyAuthentication yes
  AuthorizedKeysFile $${buildout:directory}/.ssh/authorized_keys
  Subsystem sftp ${openssh:location}/libexec/sftp-server

[sshd-service]
recipe = slapos.cookbook:wrapper
command-line = ${openssh:location}/sbin/sshd -D -e -f $${sshd-config:output}
hash-existing-files = $${buildout:directory}/buildout.cfg
wrapper-path = $${directory:services}/sshd
environment =
  HOME=$${directory:home}

[sshd-add-authorized-key]
recipe = slapos.cookbook:dropbear.add_authorized_key
home = $${buildout:directory}
key = $${slap-parameter:user-authorized-key}

[sshd-ssh-keygen-base]
recipe = plone.recipe.command
output = $${directory:etc}/$${:_buildout_section_name_}
command = ${openssh-output:keygen} -f $${:output} -N '' $${:extra-args}

[sshd-ssh-host-rsa-key]
<=sshd-ssh-keygen-base
extra-args=-t rsa
[sshd-ssh-host-ecdsa-key]
<=sshd-ssh-keygen-base
extra-args=-t ecdsa -b 521

[sshd-promise]
<= monitor-promise-base
promise = check_socket_listening
name = sshd.py
config-host = $${slap-network-information:global-ipv6}
config-port = $${sshd-port:port}
