#!/bin/sh
set -eu

share_name="${SMB_SHARE_NAME:-files}"
user_name="${SMB_USER:-govoplan}"
smb_port="${SMB_PORT:-1445}"
runtime_user="$(id -un)"
runtime_group="$(id -gn)"

case "$share_name" in
  "" | *[!A-Za-z0-9_.-]*)
    printf 'SMB_SHARE_NAME must contain only letters, numbers, dot, dash, or underscore.\n' >&2
    exit 1
    ;;
esac

case "$user_name" in
  "" | *[!A-Za-z0-9_.-]*)
    printf 'SMB_USER must contain only letters, numbers, dot, dash, or underscore.\n' >&2
    exit 1
    ;;
esac

case "$smb_port" in
  "" | *[!0-9]*)
    printf 'SMB_PORT must be numeric.\n' >&2
    exit 1
    ;;
esac

if [ "$smb_port" -lt 1024 ]; then
  printf 'SMB_PORT must be >= 1024 because the dev Samba container runs as a non-root user.\n' >&2
  exit 1
fi

if [ "$user_name" != "$runtime_user" ]; then
  printf 'SMB_USER=%s is not supported by the non-root dev image; use %s or rebuild the image with a matching user.\n' "$user_name" "$runtime_user" >&2
  exit 1
fi

mkdir -p /storage /var/lib/samba/private /var/cache/samba /run/samba /etc/samba

cat > /etc/samba/smb.conf <<EOF
[global]
   server role = standalone server
   workgroup = WORKGROUP
   security = user
   map to guest = Never
   guest account = $runtime_user
   server min protocol = SMB2
   server signing = mandatory
   smb ports = $smb_port
   load printers = no
   printing = bsd
   disable spoolss = yes
   log level = 1
   passdb backend = tdbsam
   private dir = /var/lib/samba/private
   lock directory = /run/samba
   state directory = /var/lib/samba
   cache directory = /var/cache/samba
   pid directory = /run/samba

[$share_name]
   path = /storage
   browseable = yes
   read only = no
   guest ok = no
   valid users = $user_name
   force user = $runtime_user
   force group = $runtime_group
   create mask = 0664
   directory mask = 0775
EOF

if ! pdbedit -L -u "$user_name" >/dev/null 2>&1; then
  printf 'Samba user %s is missing from passdb. Rebuild the smb image so the non-root passdb is seeded.\n' "$user_name" >&2
  printf 'Run: docker compose build --no-cache smb && docker compose up -d smb\n' >&2
  exit 1
fi

exec smbd --foreground --no-process-group --debug-stdout -p "$smb_port"