fixes

cookbooks/fb_ssh/README.md

@@ -142,6 +142,15 @@ These work similarly to Authorized Principals. If you set
 There should be one item for each user, as many keys as you'd like may
 be in that item.
 
+Alternatively you can populate `node['fb_ssh']['authorized_keys'][$USER]`.
+Doing so should be done similarly to the databags and each key given a name:
+
+```ruby
+node.default['fb_ssh']['authorized_keys']['john']['key1'] = '...'
+```
+
+Anything in the node overrides databags.
+
 ### Client config (ssh_config)
 The client config works the same as the server config, except the special-case
 is `Host` keys instead of `Match` keys. As an example:

cookbooks/fb_ssh/recipes/default.rb

@@ -63,7 +63,10 @@
   mode '0644'
   variables({ :type => 'sshd_config' })
   verify '/usr/sbin/sshd -t -f %{path}'
-  notifies :restart, 'service[ssh]'
+  # in firstboot we may not be able to get in until ssh is restarted
+  # on the desired config, so restart immediately. Otherwise, delay
+  ntype = node.firstboot_any_phase? ? :immediately : :delayed
+  notifies :restart, 'service[ssh]', ntype
 end
 
 template '/etc/ssh/ssh_config' do

cookbooks/fb_ssh/resources/authorization.rb

@@ -32,6 +32,7 @@ def manage(type)
       auth_map = Hash[
         data_bag('fb_ssh_authorized_keys').map { |x| [x, nil] }
       ]
+      auth_map.merge!(node['fb_ssh']['authorized_keys'])
     else
       auth_map = node['fb_ssh']["authorized_#{type}"]
     end
@@ -44,7 +45,7 @@ def manage(type)
         owner 'root'
         group 'root'
         mode '0644'
-        if type == 'keys'
+        if type == 'keys' && !auth_map[user]
           d = data_bag_item('fb_ssh_authorized_keys', user)
           d.delete('id')
           variables({ :data => d })