#!/bin/bash
# Usage: echo '<crypt hash>' | mirrordash-pi-password
# Sets the password of the pi user, and only of pi, from a crypt hash (openssl passwd -6) on stdin.
# The sudo rule allows this with no arguments: a plain `chpasswd` would let the app set root's password.
set -euo pipefail

IFS= read -r hash || true
[[ "$hash" =~ ^\$[0-9a-z]+\$[^:[:space:]]+$ ]] || { echo "not a crypt hash" >&2; exit 2; }
printf 'pi:%s\n' "$hash" | chpasswd -e
