From c17059ca8e3502e335210ff37b68ad03df261be0 Mon Sep 17 00:00:00 2001
From: rcourtman <courtmanr@gmail.com>
Date: Sun, 19 Oct 2025 09:02:28 +0000
Subject: [PATCH] fix: add ProxyJump key to all cluster nodes automatically

The setup script now adds both the restricted and unrestricted SSH keys
to ALL cluster nodes, not just the first one. This makes temperature
monitoring truly turnkey - you say 'yes' to configure cluster nodes and
it automatically sets up both keys on each node.

This ensures:
- All nodes can act as ProxyJump hosts if needed
- All nodes can provide temperature data via sensors
- No manual SSH key configuration required

Fixes turnkey cluster temperature monitoring setup.
---
 internal/api/config_handlers.go | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/internal/api/config_handlers.go b/internal/api/config_handlers.go
index 227b433..708bfde 100644
--- a/internal/api/config_handlers.go
+++ b/internal/api/config_handlers.go
@@ -4065,13 +4065,20 @@ SSH_RESTRICTED_KEY_ENTRY='$SSH_RESTRICTED_KEY_ENTRY'
 mkdir -p /root/.ssh
 chmod 700 /root/.ssh
 AUTH_KEYS=/root/.ssh/authorized_keys
+# Remove any old unrestricted keys
 if [ -f "\$AUTH_KEYS" ] && grep -qF "\$SSH_PUBLIC_KEY" "\$AUTH_KEYS" 2>/dev/null; then
     grep -vF "\$SSH_PUBLIC_KEY" "\$AUTH_KEYS" > "\$AUTH_KEYS.tmp"
     mv "\$AUTH_KEYS.tmp" "\$AUTH_KEYS"
 fi
+# Add restricted key for sensors
 if [ ! -f "\$AUTH_KEYS" ] || ! grep -qF "\$SSH_RESTRICTED_KEY_ENTRY" "\$AUTH_KEYS" 2>/dev/null; then
     echo "\$SSH_RESTRICTED_KEY_ENTRY" >> "\$AUTH_KEYS"
 fi
+# Add unrestricted key for ProxyJump
+SSH_PROXYJUMP_ENTRY="\$SSH_PUBLIC_KEY # pulse-proxyjump"
+if [ ! -f "\$AUTH_KEYS" ] || ! grep -qF "# pulse-proxyjump" "\$AUTH_KEYS" 2>/dev/null; then
+    echo "\$SSH_PROXYJUMP_ENTRY" >> "\$AUTH_KEYS"
+fi
 chmod 600 "\$AUTH_KEYS"
 if ! command -v sensors >/dev/null 2>&1; then
     echo "  - Installing lm-sensors..."