#!/usr/bin/env bash
set -euo pipefail

# ============================================================
# 🟢 HIER EINTRAGEN / ANPASSEN
# ============================================================

WORKGROUP="WORKGROUP"
SERVER_STRING="Raspberry Pi 5 Samba Server"

# Format:
# "benutzername:home-verzeichnis:shell:beschreibung:gruppe:samba-passwort"
USERS=(
  "mueller:/home/mueller:/bin/bash:Mitarbeiter IT:it-abteilung:Passwort123!"
  "weber:/home/weber:/bin/bash:Mitarbeiter IT:it-abteilung:Passwort123!"
  "schmidt:/home/schmidt:/bin/bash:Mitarbeiter Buchhaltung:buchhaltung:Passwort123!"
  "fischer:/home/fischer:/bin/bash:Mitarbeiter Buchhaltung:buchhaltung:Passwort123!"
)

# Format:
# "freigabename:pfad:gruppe:read_only"
SHARES=(
  "it-freigabe:/srv/samba/it-share:it-abteilung:no"
  "buchhaltung-freigabe:/srv/samba/buchhaltung-share:buchhaltung:no"
  "oeffentlich:/srv/samba/public:sambashare:yes"
)

# Öffentliche Freigabe:
# yes = alle Samba-Benutzer dürfen lesen
PUBLIC_SHARE_NAME="oeffentlich"

# ============================================================
# Ab hier nichts mehr ändern
# ============================================================

if [[ "$EUID" -ne 0 ]]; then
  echo "Bitte mit sudo starten."
  exit 1
fi

echo "Installiere Samba..."
apt update
apt install -y samba samba-common-bin

echo "Erstelle Benutzer, Gruppen und Samba-Konten..."

for entry in "${USERS[@]}"; do
  IFS=":" read -r USER HOME_DIR SHELL DESC GROUP SMBPASS <<< "$entry"

  getent group "$GROUP" >/dev/null || groupadd "$GROUP"

  if ! id "$USER" >/dev/null 2>&1; then
    useradd -m -d "$HOME_DIR" -s "$SHELL" -c "$DESC" "$USER"
  else
    usermod -d "$HOME_DIR" -s "$SHELL" -c "$DESC" "$USER"
  fi

  usermod -aG "$GROUP" "$USER"

  echo -e "${SMBPASS}\n${SMBPASS}" | smbpasswd -a -s "$USER"
  smbpasswd -e "$USER"
done

echo "Erstelle Standardgruppe für öffentliche Freigabe..."
getent group sambashare >/dev/null || groupadd sambashare

for entry in "${USERS[@]}"; do
  IFS=":" read -r USER HOME_DIR SHELL DESC GROUP SMBPASS <<< "$entry"
  usermod -aG sambashare "$USER"
done

echo "Erstelle Freigabe-Ordner und Berechtigungen..."

for entry in "${SHARES[@]}"; do
  IFS=":" read -r SHARE_NAME SHARE_PATH GROUP READ_ONLY <<< "$entry"

  getent group "$GROUP" >/dev/null || groupadd "$GROUP"

  mkdir -p "$SHARE_PATH"

  if [[ "$SHARE_NAME" == "$PUBLIC_SHARE_NAME" ]]; then
    chown -R root:sambashare "$SHARE_PATH"
    chmod -R 2755 "$SHARE_PATH"
  else
    chown -R root:"$GROUP" "$SHARE_PATH"
    chmod -R 2770 "$SHARE_PATH"
  fi
done

SMB_CONF="/etc/samba/smb.conf"
BACKUP="/etc/samba/smb.conf.backup.$(date +%Y%m%d-%H%M%S)"

echo "Sichere alte smb.conf nach $BACKUP"
cp "$SMB_CONF" "$BACKUP"

sed -i '/# BEGIN AUTO-SAMBA-SETUP/,/# END AUTO-SAMBA-SETUP/d' "$SMB_CONF"

cat >> "$SMB_CONF" <<EOF

# BEGIN AUTO-SAMBA-SETUP

[global]
   workgroup = ${WORKGROUP}
   server string = ${SERVER_STRING}
   security = user
   map to guest = Bad User
   dns proxy = no

EOF

for entry in "${SHARES[@]}"; do
  IFS=":" read -r SHARE_NAME SHARE_PATH GROUP READ_ONLY <<< "$entry"

  if [[ "$SHARE_NAME" == "$PUBLIC_SHARE_NAME" ]]; then
    cat >> "$SMB_CONF" <<EOF
[${SHARE_NAME}]
   path = ${SHARE_PATH}
   valid users = @sambashare
   read only = yes
   browseable = yes
   guest ok = no

EOF
  else
    cat >> "$SMB_CONF" <<EOF
[${SHARE_NAME}]
   path = ${SHARE_PATH}
   valid users = @${GROUP}
   force group = ${GROUP}
   read only = ${READ_ONLY}
   browseable = yes
   guest ok = no
   create mask = 0660
   directory mask = 2770
   inherit permissions = yes

EOF
  fi
done

cat >> "$SMB_CONF" <<EOF
# END AUTO-SAMBA-SETUP
EOF

echo "Prüfe Samba-Konfiguration..."
testparm -s

echo "Starte Samba neu..."
systemctl enable smbd nmbd
systemctl restart smbd nmbd

IP_ADDR="$(hostname -I | awk '{print $1}')"

echo
echo "Fertig. Zugriff:"
echo "  \\\\$IP_ADDR\\it-freigabe"
echo "  \\\\$IP_ADDR\\buchhaltung-freigabe"
echo "  \\\\$IP_ADDR\\oeffentlich"