#!/bin/sh

set -eu

umask 022

if [ $# -ne 1 ]; then
    echo "Usage: $(basename "$0") <pubkey>" 1>&2
    exit 1
fi

_basedir="/srv/sshca"
_name="$1"

if ! echo "$_name" | grep -Eq '.foo.sh$'; then
    echo "ERROR: Only '*.foo.sh' certificates are allowed" 1>&2
    exit 1
fi

if [ ! -f "/srv/ansible/facts/${_name}" ]; then
    echo "ERROR: Cannot find host '${_name}'" 1>&2
    exit 1
fi

ssh-keygen -s "${_basedir}/ca/ca" -I "$_name" -n "$_name" -V -5m:+365d -h \
    "${_basedir}/pubkeys/${_name}.pub"