From 4e8abf82c311bdf466b2fffc6d652f93744c640a Mon Sep 17 00:00:00 2001
From: Ochenstarik <ochenstarik@inbox.ru>
Date: Fri, 17 Jul 2026 09:22:14 +0700
Subject: [PATCH] Fix installer SSH context and mesh setup order

---
 ochenstarik-server-monitor-manager.sh                | 9 ++++++---
 tests/e2e/test-monitor-manager-wireguard-nftables.sh | 4 ++--
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/ochenstarik-server-monitor-manager.sh b/ochenstarik-server-monitor-manager.sh
index d76a225..b0626df 100644
--- a/ochenstarik-server-monitor-manager.sh
+++ b/ochenstarik-server-monitor-manager.sh
@@ -196,8 +196,10 @@ create_monitor_user() {
 
   install -d -m 0755 -o root -g root /etc/ssh/sshd_config.d
   cat > "$MONITOR_SSH_CONFIG" <<'EOF'
-# Required by the restricted Server Monitor Manager identity.
-PubkeyAuthentication yes
+# Required by the restricted Server Monitor Manager identity only.
+Match User ochenstarik-monitor
+    PubkeyAuthentication yes
+Match all
 EOF
   chown root:root "$MONITOR_SSH_CONFIG"
   chmod 0644 "$MONITOR_SSH_CONFIG"
@@ -205,7 +207,8 @@ EOF
 
 verify_sshd() {
   sshd -t
-  sshd -T | grep -qi '^pubkeyauthentication yes$' \
+  sshd -T -C "user=${MONITOR_USER},host=localhost,addr=127.0.0.1" \
+    | grep -qi '^pubkeyauthentication yes$' \
     || die "В sshd отключена аутентификация по публичному ключу"
 }
 
diff --git a/tests/e2e/test-monitor-manager-wireguard-nftables.sh b/tests/e2e/test-monitor-manager-wireguard-nftables.sh
index d21d7f4..d0f38d8 100644
--- a/tests/e2e/test-monitor-manager-wireguard-nftables.sh
+++ b/tests/e2e/test-monitor-manager-wireguard-nftables.sh
@@ -70,11 +70,11 @@ ip netns exec "$target" wg set smm0 \
 ip -n "$hub" address add 10.77.0.1/24 dev smm0
 ip -n "$source" address add 10.77.0.2/32 dev smm0
 ip -n "$target" address add 10.77.0.3/32 dev smm0
-ip -n "$source" route add 10.77.0.0/24 dev smm0
-ip -n "$target" route add 10.77.0.0/24 dev smm0
 for namespace in "$hub" "$source" "$target"; do
   ip -n "$namespace" link set smm0 up
 done
+ip -n "$source" route add 10.77.0.0/24 dev smm0
+ip -n "$target" route add 10.77.0.0/24 dev smm0
 ip netns exec "$hub" sysctl -q -w net.ipv4.ip_forward=1
 
 helper="$temporary/ochenstarik-smm-hub"