#!/usr/bin/env bash
set -euo pipefail

ENV_FILE=".env"
SERVICE_ACCOUNT_NAME="FileShare_ServiceAccount"

BOOTSTRAP_ENV_FILE=""
ORIGINAL_ENV_BACKUP=""
BOOTSTRAP_ENV_WRITTEN=0
FINAL_ENV_WRITTEN=0
ENV_PREEXISTED=0

cleanup() {
  if [[ -n "$BOOTSTRAP_ENV_FILE" && -f "$BOOTSTRAP_ENV_FILE" ]]; then
    rm -f "$BOOTSTRAP_ENV_FILE"
  fi

  if [[ "$BOOTSTRAP_ENV_WRITTEN" -eq 1 && "$FINAL_ENV_WRITTEN" -eq 0 ]]; then
    if [[ "$ENV_PREEXISTED" -eq 1 && -n "$ORIGINAL_ENV_BACKUP" && -f "$ORIGINAL_ENV_BACKUP" ]]; then
      cp "$ORIGINAL_ENV_BACKUP" "$ENV_FILE"
      chmod 600 "$ENV_FILE"
      printf "Restored original %s after setup failure.\n" "$ENV_FILE" >&2
    else
      rm -f "$ENV_FILE"
      printf "Removed temporary %s after setup failure.\n" "$ENV_FILE" >&2
    fi
  fi

  if [[ -n "$ORIGINAL_ENV_BACKUP" && -f "$ORIGINAL_ENV_BACKUP" ]]; then
    rm -f "$ORIGINAL_ENV_BACKUP"
  fi
}
trap cleanup EXIT

sanitize_netbios_name() {
  local raw_name="$1"
  local upper_name="${raw_name^^}"
  local cleaned_name
  cleaned_name="$(printf '%s' "$upper_name" | tr -cd 'A-Z0-9')"
  if [[ -z "$cleaned_name" ]]; then
    cleaned_name="ADSAMBAFSRV"
  fi
  printf '%s' "${cleaned_name:0:15}"
}

sanitize_sam_account_name() {
  local raw_name="$1"
  local cleaned_name
  cleaned_name="$(printf '%s' "$raw_name" | tr -cd 'A-Za-z0-9._-')"
  if [[ "$cleaned_name" == "FileShare_ServiceAccount" ]]; then
    printf '%s' "FileShare_ServiceAcc"
    return
  fi
  if [[ -z "$cleaned_name" ]]; then
    cleaned_name="FileShareSvc"
  fi
  printf '%s' "${cleaned_name:0:20}"
}

parse_route_source_ip() {
  local route="$1"
  local previous=""
  local token

  for token in $route; do
    if [[ "$previous" == "src" ]]; then
      printf '%s\n' "$token"
      return 0
    fi
    previous="$token"
  done

  return 1
}

detect_ad_dns_ip() {
  local lookup_name="$1"
  local target_ip=""
  local route=""

  if ! command -v ip >/dev/null 2>&1; then
    return 1
  fi

  if [[ -n "$lookup_name" ]] && command -v getent >/dev/null 2>&1; then
    while read -r target_ip _; do
      if [[ ! "$target_ip" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]]; then
        continue
      fi
      route="$(ip -o -4 route get "$target_ip" 2>/dev/null || true)"
      parse_route_source_ip "$route" && return 0
    done < <(getent ahostsv4 "$lookup_name" 2>/dev/null)
  fi

  route="$(ip -o -4 route get 1.1.1.1 2>/dev/null || true)"
  parse_route_source_ip "$route"
}

prompt_value() {
  local var_name="$1"
  local prompt_text="$2"
  local is_secret="${3:-false}"
  local value=""

  while [[ -z "$value" ]]; do
    if [[ "$is_secret" == "true" ]]; then
      read -r -s -p "$prompt_text: " value
      printf "\n"
    else
      read -r -p "$prompt_text: " value
    fi
  done

  printf -v "$var_name" '%s' "$value"
}

write_env_file() {
  local realm=""
  local workgroup=""
  local domain=""
  local admin_user=""
  local admin_password=""
  local domain_users_sid=""
  local domain_admins_sid=""
  local fslogix_group_sid=""
  local backup_destination=""
  local backup_start_hour="2"
  local backup_retention_daily="3"
  local backup_retention_weekly="2"
  local backup_retention_monthly="2"
  local backup_retention_yearly="1"
  local samba_hostname="adsambafsrv"
  local netbios_name="ADSAMBAFSRV"
  local ad_dns_ip=""
  local ad_dns_name=""
  local ad_dns_ip_auto="0"
  local service_password=""
  local service_account_sam=""
  local fslogix_group_prompt=""
  local samba_hostname_input=""
  local netbios_name_input=""
  local ad_dns_ip_input=""
  local ad_dns_name_input=""
  local detected_ad_dns_ip=""
  local sanitized_netbios_name=""

  prompt_value realm "REALM (e.g. EXAMPLE.COM)"
  prompt_value workgroup "WORKGROUP (NetBIOS, e.g. EXAMPLE)"
  prompt_value domain "DOMAIN (AD DNS name or reachable DC FQDN)"
  prompt_value admin_user "Initial admin user (for provisioning service account)"
  prompt_value admin_password "Initial admin password" true
  prompt_value domain_users_sid "DOMAIN_USERS_SID (e.g. ...-513)"
  prompt_value domain_admins_sid "DOMAIN_ADMINS_SID (e.g. ...-512)"

  fslogix_group_prompt="FSLOGIX_GROUP_SID (press Enter to reuse DOMAIN_USERS_SID)"
  read -r -p "${fslogix_group_prompt}: " fslogix_group_sid
  if [[ -z "$fslogix_group_sid" ]]; then
    fslogix_group_sid="$domain_users_sid"
  fi

  read -r -p "SAMBA_HOSTNAME [adsambafsrv]: " samba_hostname_input
  if [[ -n "${samba_hostname_input:-}" ]]; then
    samba_hostname="$samba_hostname_input"
  fi

  read -r -p "NETBIOS_NAME [ADSAMBAFSRV]: " netbios_name_input
  if [[ -n "${netbios_name_input:-}" ]]; then
    netbios_name="$netbios_name_input"
  fi
  sanitized_netbios_name="$(sanitize_netbios_name "$netbios_name")"
  if [[ "$sanitized_netbios_name" != "$netbios_name" ]]; then
    printf "Using sanitized NETBIOS_NAME: %s\n" "$sanitized_netbios_name"
  fi
  netbios_name="$sanitized_netbios_name"

  detected_ad_dns_ip="$(detect_ad_dns_ip "$domain" || true)"
  if [[ -n "$detected_ad_dns_ip" ]]; then
    read -r -p "AD_DNS_IP (host LAN IP to publish in AD DNS) [${detected_ad_dns_ip}]: " ad_dns_ip_input
    if [[ -n "$ad_dns_ip_input" ]]; then
      ad_dns_ip="$ad_dns_ip_input"
    else
      ad_dns_ip="$detected_ad_dns_ip"
      ad_dns_ip_auto="1"
    fi
  else
    prompt_value ad_dns_ip "AD_DNS_IP (host LAN IP to publish in AD DNS)"
  fi

  ad_dns_name="${samba_hostname}.${domain}"
  read -r -p "AD_DNS_NAME [${ad_dns_name}]: " ad_dns_name_input
  if [[ -n "$ad_dns_name_input" ]]; then
    ad_dns_name="$ad_dns_name_input"
  fi

  read -r -p "BACKUP_DESTINATION (optional URL, press Enter to disable): " backup_destination
  read -r -p "BACKUP_START_HOUR [2]: " backup_start_hour
  backup_start_hour="${backup_start_hour:-2}"
  read -r -p "BACKUP_RETENTION_DAILY [3]: " backup_retention_daily
  backup_retention_daily="${backup_retention_daily:-3}"
  read -r -p "BACKUP_RETENTION_WEEKLY [2]: " backup_retention_weekly
  backup_retention_weekly="${backup_retention_weekly:-2}"
  read -r -p "BACKUP_RETENTION_MONTHLY [2]: " backup_retention_monthly
  backup_retention_monthly="${backup_retention_monthly:-2}"
  read -r -p "BACKUP_RETENTION_YEARLY [1]: " backup_retention_yearly
  backup_retention_yearly="${backup_retention_yearly:-1}"

  service_account_sam="$(sanitize_sam_account_name "$SERVICE_ACCOUNT_NAME")"
  if [[ "$service_account_sam" != "$SERVICE_ACCOUNT_NAME" ]]; then
    printf "Using sAMAccountName '%s' (AD limit is 20 chars; requested '%s').\n" "$service_account_sam" "$SERVICE_ACCOUNT_NAME"
  fi

  service_password="$(python3 - <<'PY'
import secrets
import string

alphabet = string.ascii_letters + string.digits + '@#%+=:_-'
print(''.join(secrets.choice(alphabet) for _ in range(48)))
PY
)"

  if [[ -f "$ENV_FILE" ]]; then
    ENV_PREEXISTED=1
    ORIGINAL_ENV_BACKUP="$(mktemp)"
    cp "$ENV_FILE" "$ORIGINAL_ENV_BACKUP"
    chmod 600 "$ORIGINAL_ENV_BACKUP"
  fi

  BOOTSTRAP_ENV_FILE="$(mktemp)"
  chmod 600 "$BOOTSTRAP_ENV_FILE"

  cat > "$BOOTSTRAP_ENV_FILE" <<EOF
REALM=${realm}
WORKGROUP=${workgroup}
DOMAIN=${domain}
JOIN_USER=${admin_user}
JOIN_PASSWORD=${admin_password}
SERVICE_ACCOUNT_NAME=${SERVICE_ACCOUNT_NAME}
SERVICE_ACCOUNT_SAM=${service_account_sam}
SERVICE_ACCOUNT_PASSWORD=${service_password}
DOMAIN_USERS_SID=${domain_users_sid}
DOMAIN_ADMINS_SID=${domain_admins_sid}
FSLOGIX_GROUP_SID=${fslogix_group_sid}
AD_DNS_IP=${ad_dns_ip}
AD_DNS_NAME=${ad_dns_name}
AD_DNS_IP_AUTO=${ad_dns_ip_auto}
BACKUP_DESTINATION=${backup_destination}
BACKUP_START_HOUR=${backup_start_hour}
BACKUP_RETENTION_DAILY=${backup_retention_daily}
BACKUP_RETENTION_WEEKLY=${backup_retention_weekly}
BACKUP_RETENTION_MONTHLY=${backup_retention_monthly}
BACKUP_RETENTION_YEARLY=${backup_retention_yearly}
SAMBA_HOSTNAME=${samba_hostname}
NETBIOS_NAME=${netbios_name}
EOF

  cp "$BOOTSTRAP_ENV_FILE" "$ENV_FILE"
  chmod 600 "$ENV_FILE"
  BOOTSTRAP_ENV_WRITTEN=1

  printf "Building image...\n"
  docker compose build samba

  printf "Provisioning service account %s...\n" "$SERVICE_ACCOUNT_NAME"
  docker compose run --rm --entrypoint /bin/bash samba -lc '
set -euo pipefail

cat > /tmp/bootstrap-smb.conf <<EOF
[global]
   security = ADS
   kerberos method = secrets and keytab
   realm = ${REALM}
   workgroup = ${WORKGROUP}
   netbios name = ${NETBIOS_NAME}
EOF

run_net() {
  net -s /tmp/bootstrap-smb.conf -A /tmp/bootstrap.auth -S "$DOMAIN" "$@"
}

cat > /tmp/bootstrap.auth <<EOF
username = ${JOIN_USER}
password = ${JOIN_PASSWORD}
domain = ${WORKGROUP}
EOF
chmod 600 /tmp/bootstrap.auth

if run_net ads search "(&(objectClass=user)(sAMAccountName=${SERVICE_ACCOUNT_SAM}))" sAMAccountName | grep -q "^sAMAccountName: ${SERVICE_ACCOUNT_SAM}$"; then
  run_net ads password "${SERVICE_ACCOUNT_SAM}" "${SERVICE_ACCOUNT_PASSWORD}"
else
  run_net ads user add "${SERVICE_ACCOUNT_SAM}" "${SERVICE_ACCOUNT_PASSWORD}"
fi
'

  cat > "$ENV_FILE" <<EOF
REALM=${realm}
WORKGROUP=${workgroup}
DOMAIN=${domain}
JOIN_USER=${service_account_sam}
JOIN_PASSWORD=${service_password}
DOMAIN_USERS_SID=${domain_users_sid}
DOMAIN_ADMINS_SID=${domain_admins_sid}
FSLOGIX_GROUP_SID=${fslogix_group_sid}
AD_DNS_IP=${ad_dns_ip}
AD_DNS_NAME=${ad_dns_name}
AD_DNS_IP_AUTO=${ad_dns_ip_auto}
BACKUP_DESTINATION=${backup_destination}
BACKUP_START_HOUR=${backup_start_hour}
BACKUP_RETENTION_DAILY=${backup_retention_daily}
BACKUP_RETENTION_WEEKLY=${backup_retention_weekly}
BACKUP_RETENTION_MONTHLY=${backup_retention_monthly}
BACKUP_RETENTION_YEARLY=${backup_retention_yearly}
SAMBA_HOSTNAME=${samba_hostname}
NETBIOS_NAME=${netbios_name}
# Optional overrides:
# LDAP_URI=ldaps://${domain}
# LDAP_BASE_DN=DC=example,DC=com
# PRIVATE_SKIP_USERS=svc_backup,svc_sql
# PRIVATE_SKIP_PREFIXES=svc_,sql_
# BACKUP_DESTINATION=rsync://user:pass@backup.example.com/samba-backups
# BACKUP_DESTINATION=smb://DOMAIN%5Cuser:pass@backup.example.com/Backups/samba
# BACKUP_DESTINATION=davfs://user:pass@webdav.example.com/remote.php/dav/files/backup
# BACKUP_DESTINATION=sftp://user:pass@sftp.example.com/exports/samba
# BACKUP_START_HOUR=2
# BACKUP_RETENTION_DAILY=3
# BACKUP_RETENTION_WEEKLY=2
# BACKUP_RETENTION_MONTHLY=2
# BACKUP_RETENTION_YEARLY=1
# BACKUP_LOG_FILE=/var/log/backup.log
# BACKUP_PROGRESS=auto
# BACKUP_PROGRESS_INTERVAL_SECONDS=10
EOF

  chmod 600 "$ENV_FILE"
  FINAL_ENV_WRITTEN=1
  printf "Created %s\n" "$ENV_FILE"
}

if [[ -f "$ENV_FILE" ]]; then
  read -r -p ".env already exists. Overwrite? [y/N]: " overwrite
  case "$overwrite" in
    y|Y|yes|YES)
      write_env_file
      ;;
    *)
      printf "Keeping existing .env\n"
      ;;
  esac
else
  write_env_file
fi

docker compose up -d
printf "Samba service started.\n"