#!/usr/bin/env bash
# Idempotent: ensure mon-* OS users + Maildir inside koopa-pepsi.
# Needed after every container recreate: /home is not in the image and is
# not a volume by default → useradd state vanishes while DB login_assignment
# survives.
#
# UIDs fixed 1000–1004 (match login_assignment / prior live).
# STATUS= only; no secrets. Run on koopa as hernani (rootless podman exec).
set -euo pipefail

CTR="${PEPSI_CTR:-koopa-pepsi}"
USERS=(
  "mon-smtp:1000"
  "mon-maildir:1001"
  "mon-dkim:1002"
  "mon-bounce:1003"
  "mon-local:1004"
)

echo "STATUS=start CTR=$CTR HOST=$(hostname -s)"

if ! podman container exists "$CTR" 2>/dev/null; then
  echo "STATUS=missing_ctr CTR=$CTR"
  exit 2
fi
if [[ "$(podman inspect -f '{{.State.Running}}' "$CTR" 2>/dev/null || echo false)" != "true" ]]; then
  echo "STATUS=ctr_not_running CTR=$CTR"
  exit 3
fi

created=0
present=0
for entry in "${USERS[@]}"; do
  u="${entry%%:*}"
  uid="${entry##*:}"
  if podman exec "$CTR" getent passwd "$u" >/dev/null 2>&1; then
    echo "USER=$u STATE=present"
    present=$((present + 1))
  else
    podman exec -u root "$CTR" useradd -u "$uid" -U -m -d "/home/$u" -s /usr/sbin/nologin "$u"
    echo "USER=$u STATE=created UID=$uid"
    created=$((created + 1))
  fi
  # Maildir skeleton (cur/new/tmp) — safe if already present
  podman exec -u root "$CTR" bash -c "
    set -e
    home=/home/$u
    mkdir -p \"\$home/Maildir\"/{cur,new,tmp}
    chown -R $u:$u \"\$home\"
    chmod 700 \"\$home\"
  "
  echo "MAILDIR=$u OK=1"
done

echo "STATUS=done CREATED=$created PRESENT_BEFORE=$present EXPECT=${#USERS[@]}"
podman exec "$CTR" getent passwd | grep '^mon-' || true
exit 0