#!/bin/sh
set -euvo pipefail
passwd -d root
mkdir -p /root/.ssh
echo 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID6lzDKBzkUIcRe+nsfLGy53NawsrUdGTgHiltSbpMVx filimonic-eddsa-key-20250116' > /root/.ssh/authorized_keys
userdel tunneluser || true
rm -fr /home/tunneluser/ || true
useradd -m -s /usr/sbin/nologin tunneluser
echo "tunneluser:*" | chpasswd -e
mkdir -p /home/tunneluser/.ssh
echo -n '' > /home/tunneluser/.ssh/authorized_keys
echo 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBTsfnUuyXoAptGam8CzMQwD2f8V2oewNh4JWbrcG5N1 singbox_mars'  >> /home/tunneluser/.ssh/authorized_keys
echo 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIdMxaRT/GJ6RNOeZzatEHLsvEIw2aAH8+UGG2VHmD7b singbox_pluto' >> /home/tunneluser/.ssh/authorized_keys
chown -R tunneluser:tunneluser /home/tunneluser
chmod -R u=Xwr,g=,o= /home/tunneluser/
cat > /etc/ssh/sshd_config << 'EOF'
PermitRootLogin without-password
AuthenticationMethods publickey
PrintMotd no
PrintLastLog no
ClientAliveInterval 300
ClientAliveCountMax 2
AllowAgentForwarding yes
X11Forwarding no
UseDNS no
Protocol 2
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
Match User tunneluser
    AllowStreamLocalForwarding no
    AllowAgentForwarding no
    AllowTcpForwarding all
    PermitTunnel no
    ForceCommand echo "This account is for specific use only."
    PermitTTY no
    ClientAliveInterval 60
    ClientAliveCountMax 3
EOF
systemctl restart sshd