# echo "yoursecrectpassword" | mkpasswd -m sha-512 -s
# On arch, best seems to be copy your shadow file to a temp location,
# then passwd, get out the new pass, then copy the shadow file back.
-ssh root@faiserver tee -a /srv/fai/config/class/DEFAULT.var <<EOF
-ROOTPW='$(cat /p/shadow/standard)'
+
+f=/q/root/shadow/standard
+if s test -e $f; then
+ ssh root@faiserver tee -a /srv/fai/config/class/DEFAULT.var <<EOF
+ROOTPW='$(s cat $f)'
EOF
+fi
+
+tpvar="$(s cat /q/root/shadow/traci-simple)"
ssh root@faiserver tee -a /srv/fai/config/class/tp.var <<EOF
-ROOTPW='$(cat /p/shadow/traci-simple)'
+ROOTPW='$tpvar'
EOF
scp ~/.ssh/id_rsa.pub \
root@faiserver:/srv/fai/config/files/home/ian/.ssh/authorized_keys/GRUB_PC
-s scp -r /q/root/luks /p/shadow/traci{,-simple} \
+# todo: automatically disable faiserver after a period so
+# these files are not exposed.
+s scp -r /q/root/luks /q/root/shadow/traci{,-simple} \
root@faiserver:/srv/fai/config/distro-install-common
-ssh root@faiserver chmod -R a+rX /srv/fai/config/distro-install-common
+scp /a/bin/devbyid root@faiserver:/srv/fai/nfsroot/usr/local/bin
+ssh root@faiserver bash <<'EOF'
+set -eE -o pipefail
+chmod 644 /srv/fai/config/files/home/ian/.ssh/authorized_keys/GRUB_PC
+chmod -R a+rX /srv/fai/config/distro-install-common
+EOF