#!/bin/sh
# Generate SSH host keys if missing, then exec the real sshd
fips_enabled=$(grep -qw fips=1 /proc/cmdline && echo 1 || echo 0)

for algo in rsa ecdsa ed25519; do
    # ed25519 is not FIPS 140-3 approved
    [ "$algo" = "ed25519" ] && [ "$fips_enabled" = "1" ] && continue
    keyfile="/etc/ssh_host_${algo}_key"
    if [ ! -f "$keyfile" ]; then
        /bin/ssh-keygen -t "$algo" -f "$keyfile" -N '' >/dev/null 2>&1
    fi
done
exec /bin/sshd.bin "$@"
