pepsi: host-net highports + ensure mon-* users

scripts/pepsi/ensure-mon-users.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# Idempotent: ensure mon-* OS users + Maildir inside koopa-pepsi.
+# Needed after every container recreate: /home is not in the image and is
+# not a volume by default → useradd state vanishes while DB login_assignment
+# survives.
+#
+# UIDs fixed 1000–1004 (match login_assignment / prior live).
+# STATUS= only; no secrets. Run on koopa as hernani (rootless podman exec).
+set -euo pipefail
+
+CTR="${PEPSI_CTR:-koopa-pepsi}"
+USERS=(
+  "mon-smtp:1000"
+  "mon-maildir:1001"
+  "mon-dkim:1002"
+  "mon-bounce:1003"
+  "mon-local:1004"
+)
+
+echo "STATUS=start CTR=$CTR HOST=$(hostname -s)"
+
+if ! podman container exists "$CTR" 2>/dev/null; then
+  echo "STATUS=missing_ctr CTR=$CTR"
+  exit 2
+fi
+if [[ "$(podman inspect -f '{{.State.Running}}' "$CTR" 2>/dev/null || echo false)" != "true" ]]; then
+  echo "STATUS=ctr_not_running CTR=$CTR"
+  exit 3
+fi
+
+created=0
+present=0
+for entry in "${USERS[@]}"; do
+  u="${entry%%:*}"
+  uid="${entry##*:}"
+  if podman exec "$CTR" getent passwd "$u" >/dev/null 2>&1; then
+    echo "USER=$u STATE=present"
+    present=$((present + 1))
+  else
+    podman exec -u root "$CTR" useradd -u "$uid" -U -m -d "/home/$u" -s /usr/sbin/nologin "$u"
+    echo "USER=$u STATE=created UID=$uid"
+    created=$((created + 1))
+  fi
+  # Maildir skeleton (cur/new/tmp) — safe if already present
+  podman exec -u root "$CTR" bash -c "
+    set -e
+    home=/home/$u
+    mkdir -p \"\$home/Maildir\"/{cur,new,tmp}
+    chown -R $u:$u \"\$home\"
+    chmod 700 \"\$home\"
+  "
+  echo "MAILDIR=$u OK=1"
+done
+
+echo "STATUS=done CREATED=$created PRESENT_BEFORE=$present EXPECT=${#USERS[@]}"
+podman exec "$CTR" getent passwd | grep '^mon-' || true
+exit 0