#!/bin/bash
set -euo pipefail

until lsblk -dno NAME | grep -v "$(lsblk -no PKNAME "$(findmnt -n -o SOURCE /)" 2>/dev/null || echo xvda)" | grep -q .; do
  echo "Waiting for data volume..."
  sleep 5
done
DATA_DEVICE="/dev/$(lsblk -dno NAME | grep -v "$(lsblk -no PKNAME "$(findmnt -n -o SOURCE /)" 2>/dev/null || echo xvda)" | head -1)"
if ! blkid "$DATA_DEVICE"; then
  mkfs.ext4 -L file-share-data "$DATA_DEVICE"
fi
mkdir -p /data
grep -q 'LABEL=file-share-data /data ' /etc/fstab || echo "LABEL=file-share-data /data ext4 defaults,nofail 0 2" >> /etc/fstab
mount -a
mkdir -p /data/share

dnf install -y samba samba-common

useradd --system --no-create-home --shell /sbin/nologin adam || true
chown adam:adam /data/share

SMB_PASSWORD="$(aws secretsmanager get-secret-value --secret-id file-share/smb-password --query SecretString --output text --region ${aws_region})"
(printf '%s\n' "$SMB_PASSWORD"; printf '%s\n' "$SMB_PASSWORD") | smbpasswd -s -a adam
if passwd --help 2>&1 | grep -q -- '--stdin'; then
  printf '%s\n' "$SMB_PASSWORD" | passwd --stdin adam
else
  printf 'adam:%s\n' "$SMB_PASSWORD" | chpasswd
fi
unset SMB_PASSWORD

cat > /etc/samba/smb.conf << 'SMBEOF'
[global]
workgroup = SEAHAVEN
server string = Sea Haven File Share
security = user
map to guest = never
log file = /var/log/samba/log.%m
max log size = 1000
server min protocol = SMB3

# macOS Finder optimizations
vfs objects = catia fruit streams_xattr
fruit:metadata = stream
fruit:model = MacSamba
fruit:posix_rename = yes
fruit:veto_appledouble = no
fruit:nfs_aces = no
fruit:wipe_intentionally_left_blank_rfork = yes
fruit:delete_empty_adfiles = yes

[files]
path = /data/share
browseable = yes
writable = yes
valid users = adam
create mask = 0644
directory mask = 0755
SMBEOF

systemctl enable --now smb nmb

curl -sfL "https://github.com/filebrowser/filebrowser/releases/download/${filebrowser_version}/linux-arm64-filebrowser.tar.gz" | tar xz -C /usr/local/bin filebrowser
chmod +x /usr/local/bin/filebrowser

mkdir -p /etc/filebrowser
FB_PASSWORD="$(aws secretsmanager get-secret-value --secret-id file-share/filebrowser-password --query SecretString --output text --region ${aws_region})"

cat > /etc/filebrowser/config.json << 'FBEOF'
{
  "address": "0.0.0.0",
  "port": 8080,
  "root": "/data/share",
  "database": "/etc/filebrowser/filebrowser.db",
  "log": "/var/log/filebrowser.log"
}
FBEOF

filebrowser config init --config /etc/filebrowser/config.json
filebrowser users add admin "$FB_PASSWORD" --config /etc/filebrowser/config.json --perm.admin
unset FB_PASSWORD

cat > /etc/systemd/system/filebrowser.service << 'SVCEOF'
[Unit]
Description=FileBrowser
After=network.target

[Service]
Type=simple
ExecStart=/usr/local/bin/filebrowser --config /etc/filebrowser/config.json
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
SVCEOF

systemctl daemon-reload
systemctl enable --now filebrowser

usermod -s /bin/bash -d /data/share adam
if ! grep -q 'Match User adam' /etc/ssh/sshd_config; then
  cat >> /etc/ssh/sshd_config << 'SSHEOF'

Match User adam
    ForceCommand internal-sftp
    PasswordAuthentication yes
    AllowTcpForwarding no
    X11Forwarding no
SSHEOF
fi
systemctl restart sshd