slight addition to pre key verification section

hub/onboard-spoke.sh

@@ -13,8 +13,15 @@ NC='\033[0m'
 
 info() { echo -e "${GREEN}[+]${NC} $*"; }
 warn() { echo -e "${YELLOW}[!]${NC} $*"; }
-die()    { echo -e "${RED}[ERROR]${NC} $*" >&2; exit 1; }
+die() {
-header() { echo -e "\n${CYAN}══════════════════════════════════════════${NC}"; echo -e "${CYAN}  $*${NC}"; echo -e "${CYAN}══════════════════════════════════════════${NC}"; }
+  echo -e "${RED}[ERROR]${NC} $*" >&2
+  exit 1
+}
+header() {
+  echo -e "\n${CYAN}══════════════════════════════════════════${NC}"
+  echo -e "${CYAN}  $*${NC}"
+  echo -e "${CYAN}══════════════════════════════════════════${NC}"
+}
 
 check_deps() {
   local missing=()
@@ -73,48 +80,27 @@ KEY_PATH="$SSH_DIR/$KEY_NAME"
 
 mkdir -p "$(dirname "$RCLONE_CONF")"
 
-header "Select Tunnel Key"
-AVAILABLE_KEYS=()
-while IFS= read -r keyfile; do
-    AVAILABLE_KEYS+=("$keyfile")
-done < <(find "$SSH_DIR" -maxdepth 1 -type f ! -name "*.pub" ! -name "known_hosts" ! -name "authorized_keys" ! -name "config" | sort)
-
-if [ ${#AVAILABLE_KEYS[@]} -eq 0 ]; then
-    die "No private keys found in $SSH_DIR."
-fi
-
-echo "Available keys:"
-for i in "${!AVAILABLE_KEYS[@]}"; do
-    echo "  $i) ${AVAILABLE_KEYS[$i]}"
-done
-echo ""
-read -rp "Choose key to use for tunnel access [0]: " KEY_CHOICE
-KEY_CHOICE="${KEY_CHOICE:-0}"
-[[ "$KEY_CHOICE" =~ ^[0-9]+$ ]] && [ "$KEY_CHOICE" -lt "${#AVAILABLE_KEYS[@]}" ] || die "Invalid choice."
-TUNNEL_KEY="${AVAILABLE_KEYS[$KEY_CHOICE]}"
-info "Using key: $TUNNEL_KEY"
-
 header "Checking Tunnel"
+info "Verifying spoke SSH service is reachable on port $TUNNEL_PORT..."
+# Test TCP connectivity first
+if ! timeout 5 bash -c "cat < /dev/null > /dev/tcp/localhost/$TUNNEL_PORT" 2>/dev/null; then
+  die "Cannot connect to port $TUNNEL_PORT on localhost — is the tunnel up?"
+fi
 info "Scanning spoke host key..."
 KEYSCAN=$(ssh-keyscan -p "$TUNNEL_PORT" -H localhost 2>/dev/null)
 [ -n "$KEYSCAN" ] || die "Spoke not reachable on port $TUNNEL_PORT — is the tunnel up?"
 while IFS= read -r KEYSCAN_LINE; do
   KEYSCAN_KEY=$(echo "$KEYSCAN_LINE" | awk '{print $2, $3}')
   if ! grep -qF "$KEYSCAN_KEY" "$SSH_DIR/known_hosts" 2>/dev/null; then
-        echo "$KEYSCAN_LINE" >> "$SSH_DIR/known_hosts"
+    echo "$KEYSCAN_LINE" >>"$SSH_DIR/known_hosts"
   fi
-done <<< "$KEYSCAN"
+done <<<"$KEYSCAN"
-
-info "Verifying spoke is reachable on port $TUNNEL_PORT..."
-retry_or_abort \
-    "ssh -i \"$TUNNEL_KEY\" -o BatchMode=yes -o ConnectTimeout=10 -p \"$TUNNEL_PORT\" \"$SPOKE_USER\"@localhost exit" \
-    "Spoke not reachable on port $TUNNEL_PORT. Make sure the tunnel is up."
 
 header "Generating Hub SSH Key"
 if [ -f "$KEY_PATH" ]; then
   warn "Key $KEY_PATH already exists, skipping generation."
 else
-    ssh-keygen -t ed25519 -f "$KEY_PATH" -N ""
+  ssh-keygen -t ed25519 -f "$KEY_PATH" -N "" -C "$KEY_NAME"
   info "Key generated: $KEY_PATH"
 fi
 chmod 600 "$KEY_PATH"
@@ -123,7 +109,7 @@ info "Permissions set: $KEY_PATH is 600"
 header "Installing Hub Access Key on Spoke"
 info "Copying hub public key to spoke's authorized_keys so the hub can SSH in for rclone..."
 info "(You will be prompted for the $SPOKE_USER password on the spoke)"
-if ssh-copy-id -i "$KEY_PATH.pub" -o "IdentityFile=$TUNNEL_KEY" -p "$TUNNEL_PORT" "$SPOKE_USER"@localhost; then
+if ssh-copy-id -i "$KEY_PATH.pub" -p "$TUNNEL_PORT" "$SPOKE_USER"@localhost; then
   info "Key copied."
 else
   warn "ssh-copy-id failed — password auth may be disabled on the spoke."
@@ -146,8 +132,8 @@ header "Adding rclone Remote"
 if grep -q "\[${SPOKE_NAME}-remote\]" "$RCLONE_CONF" 2>/dev/null; then
   warn "Remote [${SPOKE_NAME}-remote] already exists in $RCLONE_CONF, skipping."
 else
-    [ -s "$RCLONE_CONF" ] && tail -c1 "$RCLONE_CONF" | grep -qv $'\n' && echo "" >> "$RCLONE_CONF"
+  [ -s "$RCLONE_CONF" ] && tail -c1 "$RCLONE_CONF" | grep -qv $'\n' && echo "" >>"$RCLONE_CONF"
-    cat >> "$RCLONE_CONF" <<EOF
+  cat >>"$RCLONE_CONF" <<EOF
 
 [${SPOKE_NAME}-remote]
 type = sftp
@@ -182,7 +168,10 @@ if [[ "${ADD_UNION,,}" == "y" ]]; then
   1) UPSTREAM_TAG=":ro" ;;
   2) UPSTREAM_TAG=":nc" ;;
   3) UPSTREAM_TAG=":writeback" ;;
-        *) warn "Invalid choice, defaulting to full read/write."; UPSTREAM_TAG="" ;;
+  *)
+    warn "Invalid choice, defaulting to full read/write."
+    UPSTREAM_TAG=""
+    ;;
   esac
   if [ -n "$UNION_PATH" ]; then
     UPSTREAM="${SPOKE_NAME}-remote:${UNION_PATH}${UPSTREAM_TAG}"
@@ -190,7 +179,8 @@ if [[ "${ADD_UNION,,}" == "y" ]]; then
     UPSTREAM="${SPOKE_NAME}-remote:${UPSTREAM_TAG}"
   fi
   if grep -q "^\[${UNION_NAME}\]" "$RCLONE_CONF" 2>/dev/null; then
-        ALREADY=$(python3 - "$RCLONE_CONF" "$UNION_NAME" "${SPOKE_NAME}-remote:" <<'PYEOF'
+    ALREADY=$(
+      python3 - "$RCLONE_CONF" "$UNION_NAME" "${SPOKE_NAME}-remote:" <<'PYEOF'
 import sys
 path, section, prefix = sys.argv[1], sys.argv[2], sys.argv[3]
 with open(path) as f:
@@ -206,7 +196,7 @@ for line in lines:
         sys.exit(0)
 print("no")
 PYEOF
-)
+    )
     if [ "$ALREADY" = "yes" ]; then
       warn "Upstream for ${SPOKE_NAME}-remote already in union remote [${UNION_NAME}], skipping."
     else
@@ -231,8 +221,8 @@ PYEOF
       info "Added '$UPSTREAM' to union remote [${UNION_NAME}]."
     fi
   else
-        [ -s "$RCLONE_CONF" ] && tail -c1 "$RCLONE_CONF" | grep -qv $'\n' && echo "" >> "$RCLONE_CONF"
+    [ -s "$RCLONE_CONF" ] && tail -c1 "$RCLONE_CONF" | grep -qv $'\n' && echo "" >>"$RCLONE_CONF"
-        printf '\n[%s]\ntype = union\nupstreams = %s\n' "$UNION_NAME" "$UPSTREAM" >> "$RCLONE_CONF"
+    printf '\n[%s]\ntype = union\nupstreams = %s\n' "$UNION_NAME" "$UPSTREAM" >>"$RCLONE_CONF"
     info "Union remote [${UNION_NAME}] created with upstream '$UPSTREAM'."
   fi
 fi
@@ -250,10 +240,10 @@ MOUNT_POINT="${HOME}/mnt/${SPOKE_NAME}"
 mkdir -p "$MOUNT_POINT"
 if grep -q "^${SPOKE_NAME} " "$REGISTRY" 2>/dev/null; then
   warn "$SPOKE_NAME already in registry, updating."
-    grep -v "^${SPOKE_NAME} " "$REGISTRY" > "${REGISTRY}.tmp" 2>/dev/null || true
+  grep -v "^${SPOKE_NAME} " "$REGISTRY" >"${REGISTRY}.tmp" 2>/dev/null || true
   mv "${REGISTRY}.tmp" "$REGISTRY"
 fi
-echo "${SPOKE_NAME} ${TUNNEL_PORT} ${KEY_PATH} ${MOUNT_POINT}" >> "$REGISTRY"
+echo "${SPOKE_NAME} ${TUNNEL_PORT} ${KEY_PATH} ${MOUNT_POINT}" >>"$REGISTRY"
 info "$SPOKE_NAME registered."
 
 header "Setting Up Auto-Mount"
@@ -265,9 +255,12 @@ if echo "$EXISTING" | grep -qF "${SPOKE_NAME}-remote:"; then
 else
   CRONTAB_BACKUP="${HOME}/.config/tinyboard/crontab.$(date +%Y%m%d%H%M%S)"
   mkdir -p "$(dirname "$CRONTAB_BACKUP")"
-    echo "$EXISTING" > "$CRONTAB_BACKUP"
+  echo "$EXISTING" >"$CRONTAB_BACKUP"
   info "Crontab backed up to $CRONTAB_BACKUP"
-    { echo "$EXISTING"; echo "$CRON_ENTRY"; } | crontab -
+  {
+    echo "$EXISTING"
+    echo "$CRON_ENTRY"
+  } | crontab -
   info "Auto-mount crontab entry added for ${SPOKE_NAME}."
 fi
 info "Starting mount now..."