feat: add SSH private key for rclone SFTP connection

This key is generated by the Ubuntu setup script and allows
Windows clients to authenticate via SFTP to the sync server.

ubuntu/setup.sh

@@ -3,7 +3,10 @@
 # JingTian rclone Server Setup Script
 # Run this on the Ubuntu VM that will receive synced files
 #
-# Usage: sudo bash setup.sh
+# Usage: sudo bash setup.sh [PUBLIC_IP]
+#
+# If PUBLIC_IP is provided, it will be shown in the connection details.
+# Otherwise, the script will try to detect it or use the first local IP.
 #
 
 set -e
@@ -13,6 +16,7 @@ DATA_DIR="/data/jingtian/BenjaminTeam"
 RCLONE_USER="rclone-sync"
 SSH_KEY_NAME="jingtian_rclone"
 SSH_KEY_DIR="/home/$RCLONE_USER/.ssh"
+PUBLIC_IP="${1:-}"
 
 echo "=========================================="
 echo "JingTian rclone Server Setup"
@@ -24,37 +28,9 @@ if [ "$EUID" -ne 0 ]; then
     exit 1
 fi
 
-# Step 1: Create data directory
+# Step 1: Create dedicated user for rclone sync (FIRST, so we can set ownership correctly)
 echo ""
-echo "[1/5] Creating data directory..."
-mkdir -p "$DATA_DIR"
-mkdir -p "$DATA_DIR/_LLM_Sync"
-
-# Create the same folder structure as client
-mkdir -p "$DATA_DIR/Admin/E-Signature"
-mkdir -p "$DATA_DIR/Admin/General Matter"
-mkdir -p "$DATA_DIR/Admin/IPD e-filing"
-mkdir -p "$DATA_DIR/Admin/JT Logo"
-mkdir -p "$DATA_DIR/Admin/Letterhead"
-mkdir -p "$DATA_DIR/Admin/Matter Open"
-mkdir -p "$DATA_DIR/Admin/Template"
-mkdir -p "$DATA_DIR/BD&M/2025 GCP"
-mkdir -p "$DATA_DIR/BD&M/HKPC"
-mkdir -p "$DATA_DIR/BD&M/WKCDA WKProcure"
-mkdir -p "$DATA_DIR/Billing/Draft Bills"
-mkdir -p "$DATA_DIR/Billing/Invoice Templates"
-mkdir -p "$DATA_DIR/Billing/Issued Bills"
-mkdir -p "$DATA_DIR/Client"
-mkdir -p "$DATA_DIR/Free Schedules/Price List"
-mkdir -p "$DATA_DIR/Free Schedules/Emails"
-mkdir -p "$DATA_DIR/IP"
-mkdir -p "$DATA_DIR/Precedent"
-
-echo "  Created: $DATA_DIR"
-
-# Step 2: Create dedicated user for rclone sync
-echo ""
-echo "[2/5] Creating dedicated sync user: $RCLONE_USER..."
+echo "[1/5] Creating dedicated sync user: $RCLONE_USER..."
 if id "$RCLONE_USER" &>/dev/null; then
     echo "  User $RCLONE_USER already exists, skipping..."
 else
@@ -62,10 +38,44 @@ else
     echo "  Created user: $RCLONE_USER"
 fi
 
-# Set ownership of data directory
-chown -R "$RCLONE_USER:$RCLONE_USER" "$DATA_DIR"
-chmod -R 755 "$DATA_DIR"
-echo "  Set ownership of $DATA_DIR to $RCLONE_USER"
+# Step 2: Create data directory structure with correct ownership from the start
+echo ""
+echo "[2/5] Creating data directory..."
+
+# Create parent directories with root, then hand off to rclone-sync
+mkdir -p /data/jingtian
+chown root:root /data
+chown -R "$RCLONE_USER:$RCLONE_USER" /data/jingtian
+
+# Create BenjaminTeam structure as rclone-sync user
+sudo -u "$RCLONE_USER" mkdir -p "$DATA_DIR"
+sudo -u "$RCLONE_USER" mkdir -p "$DATA_DIR/_LLM_Sync"
+
+# Create the same folder structure as client
+sudo -u "$RCLONE_USER" mkdir -p "$DATA_DIR/Admin/E-Signature"
+sudo -u "$RCLONE_USER" mkdir -p "$DATA_DIR/Admin/General Matter"
+sudo -u "$RCLONE_USER" mkdir -p "$DATA_DIR/Admin/IPD e-filing"
+sudo -u "$RCLONE_USER" mkdir -p "$DATA_DIR/Admin/JT Logo"
+sudo -u "$RCLONE_USER" mkdir -p "$DATA_DIR/Admin/Letterhead"
+sudo -u "$RCLONE_USER" mkdir -p "$DATA_DIR/Admin/Matter Open"
+sudo -u "$RCLONE_USER" mkdir -p "$DATA_DIR/Admin/Template"
+sudo -u "$RCLONE_USER" mkdir -p "$DATA_DIR/BD&M/2025 GCP"
+sudo -u "$RCLONE_USER" mkdir -p "$DATA_DIR/BD&M/HKPC"
+sudo -u "$RCLONE_USER" mkdir -p "$DATA_DIR/BD&M/WKCDA WKProcure"
+sudo -u "$RCLONE_USER" mkdir -p "$DATA_DIR/Billing/Draft Bills"
+sudo -u "$RCLONE_USER" mkdir -p "$DATA_DIR/Billing/Invoice Templates"
+sudo -u "$RCLONE_USER" mkdir -p "$DATA_DIR/Billing/Issued Bills"
+sudo -u "$RCLONE_USER" mkdir -p "$DATA_DIR/Client"
+sudo -u "$RCLONE_USER" mkdir -p "$DATA_DIR/Free Schedules/Price List"
+sudo -u "$RCLONE_USER" mkdir -p "$DATA_DIR/Free Schedules/Emails"
+sudo -u "$RCLONE_USER" mkdir -p "$DATA_DIR/IP"
+sudo -u "$RCLONE_USER" mkdir -p "$DATA_DIR/Precedent"
+
+echo "  Created: $DATA_DIR"
+
+# Verify ownership
+echo "  Verifying ownership..."
+ls -la /data/jingtian/ | head -5
 
 # Step 3: Generate SSH key pair for rclone
 echo ""
@@ -111,6 +121,12 @@ else
     echo "  Installed: $(rclone version | head -1)"
 fi
 
+# Determine the IP to show
+if [ -z "$PUBLIC_IP" ]; then
+    # Try to get public IP, fall back to first local IP
+    PUBLIC_IP=$(curl -s --max-time 5 ifconfig.me 2>/dev/null || hostname -I | awk '{print $1}')
+fi
+
 # Print summary
 echo ""
 echo "=========================================="
@@ -134,7 +150,7 @@ echo "Save this key to: windows/rclone-key"
 echo "It will be used by Windows clients to connect."
 echo ""
 echo "Connection details for Windows rclone config:"
-echo "  Host: $(hostname -I | awk '{print $1}')"
+echo "  Host: $PUBLIC_IP"
 echo "  User: $RCLONE_USER"
 echo "  Path: $DATA_DIR"
 echo ""

windows/rclone-key

@@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACBhGez4Yaqdq5kS2nLWDMje+Ay48G9pkTUgVHByrVrHOAAAAJjg45Xm4OOV
+5gAAAAtzc2gtZWQyNTUxOQAAACBhGez4Yaqdq5kS2nLWDMje+Ay48G9pkTUgVHByrVrHOA
+AAAEAw5C+98JLaNZakWuw88val82lV8ZgLzNLXcbh35aAVCWEZ7Phhqp2rmRLactYMyN74
+DLjwb2mRNSBUcHKtWsc4AAAAFGppbmd0aWFuLXJjbG9uZS1zeW5jAQ==
+-----END OPENSSH PRIVATE KEY-----