git/install.sh: keep hetzner-admin SSH key when installing authorized_keys

install.sh overwrote /root/.ssh/authorized_keys with server/authorized_keys,
dropping the restricted hetzner-admin key and making every admin UI
command fail with an SSH authentication error. Append it on install.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 13 insertions, 3 deletions

diff --git a/git/install.sh b/git/install.sh
index d4522ea..38bc8a8 100755
--- a/git/install.sh
+++ b/git/install.sh
@@ -8,6 +8,8 @@ APP_DIR="$(cd "$(dirname "$0")/.." && pwd)"
 REPOS_FILE="$APP_DIR/git/repos.txt"
 HOOKS_SRC="$APP_DIR/git/hooks"
 AUTH_KEYS_SRC="$APP_DIR/server/authorized_keys"
+ADMIN_PUBKEY="$APP_DIR/hetzner-admin/id_rsa.pub"
+ADMIN_KEY_RESTRICTION='command="/app/infra/hetzner-admin/run-command.sh",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty'
 
 if [[ "$(id -u)" -ne 0 ]]; then
     echo "ERROR: root として実行してください" >&2
@@ -18,11 +20,19 @@ echo "=== SSH authorized_keys ==="
 if [[ -f "$AUTH_KEYS_SRC" ]]; then
     mkdir -p /root/.ssh
     chmod 700 /root/.ssh
-    if diff -q "$AUTH_KEYS_SRC" /root/.ssh/authorized_keys >/dev/null 2>&1; then
+    # server/authorized_keys + hetzner-admin のコマンド制限付き鍵（あれば）で組み立てる。
+    # 丸ごと上書きすると hetzner-admin の鍵が消えて管理画面の操作が認証失敗になるため
+    tmp="$(mktemp)"
+    cat "$AUTH_KEYS_SRC" > "$tmp"
+    if [[ -f "$ADMIN_PUBKEY" ]]; then
+        echo "${ADMIN_KEY_RESTRICTION} $(cat "$ADMIN_PUBKEY")" >> "$tmp"
+    fi
+    if diff -q "$tmp" /root/.ssh/authorized_keys >/dev/null 2>&1; then
+        rm -f "$tmp"
         echo "  unchanged"
     else
-        cp "$AUTH_KEYS_SRC" /root/.ssh/authorized_keys
-        chmod 600 /root/.ssh/authorized_keys
+        install -m 600 "$tmp" /root/.ssh/authorized_keys
+        rm -f "$tmp"
         echo "  installed"
     fi
 fi