From c7337a3bbc4973cc1e4f78ca96fec589fd3fb30e Mon Sep 17 00:00:00 2001
From: Daniel Arroyo <darroylat@gmail.com>
Date: Thu, 9 Jul 2026 20:58:48 -0400
Subject: [PATCH] fix: remove public key deployment from deploy-keys

Deploy-keys now only:
- Creates /var/lib/syncserver/ssh/keys on remote
- Uploads private keys of all other machines to that path
- Populates known_hosts with all other machine hosts

No longer touches authorized_keys or reads server public key.
---
 internal/api/handlers_machines.go | 16 ++--------------
 internal/sshmanager/deploy.go     | 24 +-----------------------
 web/src/api/client.ts             |  3 +--
 web/src/pages/Machines.tsx        |  2 +-
 4 files changed, 5 insertions(+), 40 deletions(-)

diff --git a/internal/api/handlers_machines.go b/internal/api/handlers_machines.go
index 0bed76e..77f7f92 100644
--- a/internal/api/handlers_machines.go
+++ b/internal/api/handlers_machines.go
@@ -7,7 +7,6 @@ import (
 	"fmt"
 	"log/slog"
 	"net/http"
-	"os"
 	"path/filepath"
 	"regexp"
 	"strconv"
@@ -341,8 +340,8 @@ func (h *MachineHandler) DeployKeys(w http.ResponseWriter, r *http.Request) {
 	}
 
 	var req struct {
-		KnownHostsHost    string `json:"known_hosts_host"`
-		IncludeServerKey  bool   `json:"include_server_key"`
+		KnownHostsHost   string `json:"known_hosts_host"`
+		IncludeServerKey bool   `json:"include_server_key"`
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 		writeError(w, http.StatusBadRequest, "invalid request body")
@@ -350,7 +349,6 @@ func (h *MachineHandler) DeployKeys(w http.ResponseWriter, r *http.Request) {
 	}
 
 	serverKeyPath := h.cfg.SSHDir() + "/id_ed25519"
-	serverPubKeyPath := h.cfg.SSHDir() + "/id_ed25519.pub"
 
 	if m.SSHKeyID != nil {
 		sshKeyRepo := models.NewSSHKeyRepository(h.db)
@@ -360,14 +358,6 @@ func (h *MachineHandler) DeployKeys(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	serverPubKey := ""
-	if req.IncludeServerKey {
-		data, err := os.ReadFile(serverPubKeyPath)
-		if err == nil {
-			serverPubKey = string(data)
-		}
-	}
-
 	allMachines, err := repo.GetAll()
 	if err != nil {
 		slog.Warn("failed to fetch machines for auto-detect", "error", err)
@@ -406,13 +396,11 @@ func (h *MachineHandler) DeployKeys(w http.ResponseWriter, r *http.Request) {
 	result, err := sshmanager.DeployKeysToMachine(
 		context.Background(),
 		serverKeyPath,
-		serverPubKey,
 		m.Host,
 		m.Port,
 		m.SSHUser,
 		keys,
 		knownHostsHosts,
-		req.IncludeServerKey,
 	)
 	if err != nil {
 		writeError(w, http.StatusInternalServerError, err.Error())
diff --git a/internal/sshmanager/deploy.go b/internal/sshmanager/deploy.go
index 21f18bf..1ebe82a 100644
--- a/internal/sshmanager/deploy.go
+++ b/internal/sshmanager/deploy.go
@@ -8,7 +8,6 @@ import (
 	"net"
 	"os"
 	"path/filepath"
-	"strings"
 	"time"
 
 	"golang.org/x/crypto/ssh"
@@ -26,7 +25,7 @@ type DeployResult struct {
 	Errors   []string
 }
 
-func DeployKeysToMachine(ctx context.Context, serverKeyPath, serverPubKey string, host string, port int, user string, keys []DeployKey, knownHostsHosts []string, addServerPubKey bool) (*DeployResult, error) {
+func DeployKeysToMachine(ctx context.Context, serverKeyPath string, host string, port int, user string, keys []DeployKey, knownHostsHosts []string) (*DeployResult, error) {
 	result := &DeployResult{Success: true, Messages: []string{}, Errors: []string{}}
 
 	addr := fmt.Sprintf("%s:%d", host, port)
@@ -163,27 +162,6 @@ func DeployKeysToMachine(ctx context.Context, serverKeyPath, serverPubKey string
 		}
 	}
 
-		if addServerPubKey && serverPubKey != "" {
-		session3, err := conn.NewSession()
-		if err != nil {
-			result.Errors = append(result.Errors, fmt.Sprintf("session for authorized_keys: %v", err))
-			result.Success = false
-		} else {
-			session3.Stdout = &stdout
-			session3.Stderr = &stderr
-			pubKeyClean := strings.TrimSpace(serverPubKey)
-			err := session3.Run(fmt.Sprintf("mkdir -p ~/.ssh && chmod 700 ~/.ssh && echo '%s' >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys", pubKeyClean))
-			session3.Close()
-			if err != nil {
-				slog.Warn("deploy: adding to authorized_keys failed", "host", host, "error", err)
-				result.Errors = append(result.Errors, fmt.Sprintf("adding to authorized_keys: %v (stderr: %s)", err, stderr.String()))
-				result.Success = false
-			} else {
-				result.Messages = append(result.Messages, fmt.Sprintf("Added server public key to %s@%s:~/.ssh/authorized_keys", user, host))
-			}
-		}
-	}
-
 	slog.Info("deploy keys result", "host", host, "success", result.Success, "messages", len(result.Messages), "errors", len(result.Errors))
 	return result, nil
 }
diff --git a/web/src/api/client.ts b/web/src/api/client.ts
index 1c344d2..90d2ae7 100644
--- a/web/src/api/client.ts
+++ b/web/src/api/client.ts
@@ -125,12 +125,11 @@ export interface DeployKeysResponse {
 
 export interface DeployKeysOptions {
   known_hosts_host?: string;
-  include_server_key?: boolean;
 }
 
 export async function deployKeys(machineId: number, options?: DeployKeysOptions): Promise<DeployKeysResponse> {
   return api<DeployKeysResponse>(`/api/machines/${machineId}/deploy-keys`, {
     method: 'POST',
-    body: options ?? { include_server_key: true },
+    body: options ?? {},
   });
 }
diff --git a/web/src/pages/Machines.tsx b/web/src/pages/Machines.tsx
index e154b1c..0784f75 100644
--- a/web/src/pages/Machines.tsx
+++ b/web/src/pages/Machines.tsx
@@ -217,7 +217,7 @@ export default function Machines() {
   async function handleDeployKeys(m: Machine) {
     setDeployModal({ machine: m, result: null, loading: true });
     try {
-      const result = await deployKeys(m.id, { include_server_key: true });
+      const result = await deployKeys(m.id);
       setDeployModal({ machine: m, result, loading: false });
     } catch (e: unknown) {
       setDeployModal({ machine: m, result: { success: false, messages: [], errors: [(e as Error).message] }, loading: false });