From 07a6d443323fc6f6d9dc423b4d281df7714b78c5 Mon Sep 17 00:00:00 2001
From: Markus Zolliker <markus.zolliker@psi.ch>
Date: Fri, 21 Aug 2026 09:36:53 +0200
Subject: [PATCH] save previous ssh host keys

---
 cfg/linse-rpi13.cfg |  3 ---
 install.py          | 56 +++++++++++++++++++++++++++++++--------------
 2 files changed, 39 insertions(+), 20 deletions(-)

diff --git a/cfg/linse-rpi13.cfg b/cfg/linse-rpi13.cfg
index bcf9f6a..2af591e 100644
--- a/cfg/linse-rpi13.cfg
+++ b/cfg/linse-rpi13.cfg
@@ -8,6 +8,3 @@ version=1
 [NETWORK]
 end0=wan
 enx00e04c6801c7=192.168.2.2
-
-[BOXWEB]
-page=dil5
diff --git a/install.py b/install.py
index d3f385a..8faf20f 100755
--- a/install.py
+++ b/install.py
@@ -283,24 +283,44 @@ SERVICES = dict(router=router, display=display, frappy=frappy, boxweb=boxweb)
 AS_ROOT = {'router', 'display'}
 
 
-def update_host_key():
-    hostname = Path('/etc/hostname').read_text().strip().split('.')[0]
+def update_host_key(hostname):
+    oldkeysdir = None
+    keys_changed = False
+    pubpat = re.compile(r'(.*)@([^@]*)\n')
     try:
-        for pubkey in Path('/etc/ssh').glob('ssh_host*key.pub'):
-            pubhost = pubkey.read_text().split('\n')[0].rsplit('@')[-1]
+        found = False
+        for pubfile in Path('/etc/ssh').glob('ssh_host*key.pub'):
+            found = True
+            pubhost = pubpat.match(pubfile.read_text()).group(2)
             if pubhost == hostname:
                 continue  # no need to change keys
-            print('-- need new ssh host key:', pubhost, '!=', hostname)
-            break
-        else:
-            return  # no changed hostname found
-        do_cmd('mkdir -p /etc/ssh/host_key_backup')
-        for file in Path('/etc/ssh').glob('ssh_host*key*'):
-            do_cmd('mv', file, '/etc/ssh/host_key_backup/')
-        do_cmd(f'ssh-keygen -A')
-    except BaseException:
-        for file in Path('/etc/ssh/host_key_backup').glob('*'):
-            do_cmd('mv', file, '/etc/ssh/')
+            else:
+                keys_changed = True
+                prvfile = str(pubfile)[:-4]  # strip '.pub'
+                keysdir = f'/etc/ssh/old_keys_{pubhost}/'
+                if keysdir != oldkeysdir:
+                    oldkeysdir = keysdir
+                    do_cmd('mkdir', '-p', keysdir)
+                do_cmd('mv', pubfile, keysdir)
+                do_cmd('mv', prvfile, keysdir)
+        if keys_changed or not found:
+            for file in Path(f'/etc/ssh/old_keys_{hostname}/').glob('*'):
+                do_cmd('mv', file, '/etc/ssh/')
+            print('creating new ssh keys - this takes quite some time ...')
+            do_cmd(f'ssh-keygen -A')  # create missing keys
+        for pubfile in Path('/etc/ssh').glob('ssh_host*key.pub'):
+            head, name = pubpat.match(pubfile.read_text()).groups()
+            if name != hostname and doit:
+                do_cmd(f'chmod o+w {pubfile}')
+                pubfile.write_text(f'{head}@{hostname}\n')
+                do_cmd(f'chmod o-w {pubfile}')
+        if keys_changed and doit:
+            print('--- reboot needed ---')
+    except BaseException as e:
+        print(e)
+        if oldkeysdir:
+            for file in Path(oldkeysdir).glob('*'):
+                do_cmd('mv', file, '/etc/ssh/')
 
 
 def write_when_new(filename, content, as_root=False, ignore_reduction=False):
@@ -549,6 +569,7 @@ def handle_config():
     dhcp_server_cfg.clear()
     try:
         config = box.read_config()
+        print(f'{box.cfgfile} read')
     except UndefinedConfigFile as e:
         print(f'{box.cfgfile} not found', e)
 
@@ -560,7 +581,7 @@ def handle_config():
 
     cfgfile = box.cfgfile
     unix_cmd('scp', str(cfgfile), f'{CENTRAL_BOXTOOLS_REPO}/cfg/', sudo=False)
-    newhostname = box.hostname
+    newhostname = box.cfgfile.stem
     if cfgfile:
         if box.hwtype != 'apu':
             typ = config.get('BOX', {}).get('type')
@@ -633,8 +654,9 @@ def handle_config():
                 print('replace host name %r by %r' % (box.hostname, newhostname))
                 show.dirty = True
         config = box.read_config()
+    print(box.hostname_changed, box.hostname, newhostname)
     box.hostname = newhostname
-    update_host_key()
+    update_host_key(newhostname)
     if cfgfile is None:
         return False
     to_start = {}  # dict <service> of <action>, <as_root>