fix(init): b64 pubkey transfer, shadow unlock and auto-increment srv alias

cmd/init/vps.sh

@@ -18,8 +18,6 @@ DISABLE_IPV6="${SRV_DISABLE_IPV6:-true}"
 DISABLE_ICMP="${SRV_DISABLE_ICMP:-false}"
 VERIFY_GATE="false"
 
-PUBKEY="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGY8TEByHoDFNsy18VG6BJALc8HUYeoKZz2PeKMyKMND atlas@core"
-
 while [[ $# -gt 0 ]]; do
     case "$1" in
         --verify|--test|-v)
@@ -82,17 +80,28 @@ if [[ -z "${TARGET_IP}" ]]; then
     exit 1
 fi
 
+SSH_CONFIG="${HOME}/.ssh/config"
+
 if [[ -z "${ALIAS}" ]]; then
-    LAST_OCTET="${TARGET_IP##*.}"
-    ALIAS="n${LAST_OCTET}.srv"
+    CURRENT_MAX=$(grep -oP 'Host\s+n\K[0-9]+(?=\.srv)' "${SSH_CONFIG}" 2>/dev/null | sort -n | tail -n1 || true)
+    CURRENT_MAX="${CURRENT_MAX:-0}"
+    NEXT_NUM=$(( CURRENT_MAX + 1 ))
+    ALIAS="n${NEXT_NUM}.srv"
 fi
 
+if [[ ! -f "${RAM_KEY}" ]] || [[ ! -s "${RAM_KEY}" ]]; then
+    log_err "Аппаратный ключ в RAM отсутствует (${RAM_KEY}). Выполните 'z login'."
+    exit 1
+fi
+
+PUBKEY_B64=$(ssh-keygen -y -f "${RAM_KEY}" | base64 -w0)
+
 log_info "Инициализация ноды ${ALIAS} (${TARGET_IP}:${PORT})..."
 
 ssh -o StrictHostKeyChecking=accept-new -p 22 "root@${TARGET_IP}" \
     "env BOOTSTRAP_USER='${USER_NAME}' \
          BOOTSTRAP_PORT='${PORT}' \
-         BOOTSTRAP_PUBKEY='${PUBKEY}' \
+         BOOTSTRAP_PUBKEY_B64='${PUBKEY_B64}' \
          BOOTSTRAP_TCP_PORTS='${TCP_PORTS}' \
          BOOTSTRAP_UDP_PORTS='${UDP_PORTS}' \
          BOOTSTRAP_UFW_IN='${UFW_IN}' \
@@ -119,5 +128,11 @@ if [[ "${VERIFY_GATE}" == "true" ]]; then
 fi
 
 log_info "Автоматическая валидация ноды ${ALIAS}..."
-ssh -o ConnectTimeout=5 "${ALIAS}" "hostname"
-log_ok "Сервер ${ALIAS} успешно инициализирован и верифицирован."
+if ! ssh -o ConnectTimeout=5 -o BatchMode=yes "${ALIAS}" "hostname" >/dev/null 2>&1; then
+    log_err "Валидация FIDO2-ключа для ${ALIAS} провалена."
+    echo "Диагностика SSH-соединения:"
+    ssh -v -o ConnectTimeout=5 -o BatchMode=yes "${ALIAS}" 2>&1 | grep -E 'Offering|Authenticat|Denied|Connection' || true
+    exit 1
+fi
+
+log_ok "Сервер ${ALIAS} (${TARGET_IP}:${PORT}) успешно инициализирован и подтвержден."

templates/vps-bootstrap.sh

@@ -3,7 +3,6 @@ set -euo pipefail
 
 USER_NAME="${BOOTSTRAP_USER:-atlas}"
 PORT="${BOOTSTRAP_PORT:-1488}"
-PUBKEY="${BOOTSTRAP_PUBKEY}"
 TCP_PORTS="${BOOTSTRAP_TCP_PORTS:-1488 80 443}"
 UDP_PORTS="${BOOTSTRAP_UDP_PORTS:-51820}"
 UFW_IN="${BOOTSTRAP_UFW_IN:-deny}"
@@ -15,8 +14,11 @@ DISABLE_IPV6="${BOOTSTRAP_DISABLE_IPV6:-true}"
 DISABLE_ICMP="${BOOTSTRAP_DISABLE_ICMP:-false}"
 
 id -u "${USER_NAME}" &>/dev/null || useradd -m -s /bin/bash -G sudo "${USER_NAME}"
+usermod -p '*' "${USER_NAME}"
+
 mkdir -p "/home/${USER_NAME}/.ssh"
-echo "${PUBKEY}" > "/home/${USER_NAME}/.ssh/authorized_keys"
+echo "${BOOTSTRAP_PUBKEY_B64}" | base64 -d > "/home/${USER_NAME}/.ssh/authorized_keys"
+chmod 700 "/home/${USER_NAME}"
 chmod 700 "/home/${USER_NAME}/.ssh"
 chmod 600 "/home/${USER_NAME}/.ssh/authorized_keys"
 chown -R "${USER_NAME}:${USER_NAME}" "/home/${USER_NAME}/.ssh"
@@ -35,11 +37,14 @@ PasswordAuthentication no
 KbdInteractiveAuthentication no
 PermitRootLogin prohibit-password
 PubkeyAuthentication yes
+AuthorizedKeysFile .ssh/authorized_keys
+UsePAM yes
 X11Forwarding no
 AcceptEnv LANG LC_*
 Subsystem sftp /usr/lib/openssh/sftp-server
 SSHEOF
 
+systemctl daemon-reload
 systemctl enable --now ssh.service
 systemctl restart ssh.service