1 files changed, 73 insertions, 0 deletions
diff --git a/fix-sanctum.sh b/fix-sanctum.sh
new file mode 100755
index 0000000..070fb07
--- /dev/null
+++ b/fix-sanctum.sh
@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# ================= CONFIG =================
+WG_CON="wg-sanctum"
+SERVER_WG_IP="10.50.0.1"
+SERVER_USER="lukasz"
+SSH_PORT="57385"
+SSH_KEY="$HOME/.ssh/sacrum.key"
+
+# ================= HELPERS =================
+log() { printf "\n==> %s\n" "$*"; }
+die() { printf "\nERROR: %s\n" "$*" >&2; exit 1; }
+
+# ================= 1) RESTART WG =================
+log "Restarting WireGuard connection: $WG_CON"
+
+nmcli -t -f NAME con show | grep -Fxq "$WG_CON" \
+  || die "NetworkManager connection '$WG_CON' not found"
+
+nmcli con down "$WG_CON" >/dev/null 2>&1 || true
+nmcli con up "$WG_CON"   >/dev/null
+
+sleep 2
+
+log "WireGuard status (host)"
+sudo wg show "$WG_CON" || die "wg show failed"
+
+# ================= 2) TEST WG =================
+log "Testing WG reachability to server ($SERVER_WG_IP)"
+
+if ! ping -c 2 -W 2 "$SERVER_WG_IP" >/dev/null; then
+  die "WG ping failed (likely VPN/killswitch or routing issue)"
+fi
+
+log "WG ping OK"
+
+# ================= 3) FIX SSH ON SERVER =================
+log "Fixing SSH permissions on server (interactive, safe)"
+
+ssh -tt -i "$SSH_KEY" -p "$SSH_PORT" \
+  -o IdentitiesOnly=yes \
+  "$SERVER_USER@$SERVER_WG_IP" \
+  "set -e;
+   USER_NAME='lukasz';
+   HOME_DIR=\"/home/\$USER_NAME\";
+   SSH_DIR=\"\$HOME_DIR/.ssh\";
+   AUTH_KEYS=\"\$SSH_DIR/authorized_keys\";
+
+   echo '-> Enforcing SSH directory invariants';
+   sudo mkdir -p \"\$SSH_DIR\";
+   sudo chown -R \"\$USER_NAME:\$USER_NAME\" \"\$SSH_DIR\";
+   sudo chmod 700 \"\$SSH_DIR\";
+
+   if [ -f \"\$AUTH_KEYS\" ]; then
+     sudo chown \"\$USER_NAME:\$USER_NAME\" \"\$AUTH_KEYS\";
+     sudo chmod 600 \"\$AUTH_KEYS\";
+   fi;
+
+   echo '-> Restarting sshd';
+   sudo systemctl restart ssh;
+  "
+
+# ================= 4) FINAL VERIFICATION =================
+log "Final SSH verification over WireGuard"
+
+ssh -i "$SSH_KEY" -p "$SSH_PORT" \
+  -o IdentitiesOnly=yes \
+  "$SERVER_USER@$SERVER_WG_IP" \
+  'echo "SSH OK via WireGuard"'
+
+log "ALL FIXES APPLIED SUCCESSFULLY"
+