Manage dropbear via a systemd path unit watching authorized_keys

buildroot-external/rootfs-overlay/usr/lib/systemd/system/dropbear-lifecycle.service

@@ -0,0 +1,10 @@
+[Unit]
+Description=Start or stop dropbear based on SSH authorized_keys
+RequiresMountsFor=/root/.ssh
+
+[Service]
+# Idempotent on purpose: the path unit may fire for any change in the watched
+# directory (e.g. temporary files from atomic writes), so this must converge
+# rather than toggle.
+Type=oneshot
+ExecStart=/bin/sh -c 'if [ -s /root/.ssh/authorized_keys ]; then systemctl start dropbear.service; else systemctl stop dropbear.service; fi'

buildroot-external/rootfs-overlay/usr/lib/systemd/system/dropbear.path

@@ -0,0 +1,17 @@
+[Unit]
+Description=Watch SSH authorized_keys for debug SSH access
+# The watch must be armed on the bind-mounted directory (inotify events do
+# not cross mount points), and before haos-config potentially imports keys.
+RequiresMountsFor=/root/.ssh
+Before=haos-config.service
+
+[Path]
+# Edge-triggered on purpose: PathExists= pointed at a oneshot unit that does
+# not consume the file would re-trigger until the start rate limit is hit.
+# Presence of keys at boot is instead handled by dropbear.service itself,
+# which is enabled and gated by ConditionFileNotEmpty.
+PathChanged=/root/.ssh/authorized_keys
+Unit=dropbear-lifecycle.service
+
+[Install]
+WantedBy=multi-user.target

buildroot-external/rootfs-overlay/usr/sbin/haos-config

@@ -76,13 +76,10 @@ if [ -f "${CONFIG_DIR}/authorized_keys" ]; then
 
     cp -f ${CONFIG_DIR}/authorized_keys /root/.ssh/authorized_keys
     chmod 600 /root/.ssh/authorized_keys
-
-    systemctl start dropbear > /dev/null 2>&1
 else
     echo "[Info] Stop SSH debug access"
 
     rm -f /root/.ssh/authorized_keys
-    systemctl stop dropbear > /dev/null 2>&1
 fi
 
 ##