#!/bin/bash
set -e

echo "=== Creating dedicated media user (UID 1001) and group (GID 1001) ==="

# Create the media group
sudo groupadd -g 1001 media

# Create the media user (no home dir, no login shell)
sudo useradd -u 1001 -g media -s /usr/sbin/nologin -M media

# Add tyler to media group so tyler can access files created by the media user
sudo usermod -aG media tyler

# Add media user to video and render groups for hardware transcoding access
sudo usermod -aG video,render media

echo "=== Fixing Jellyfin config/cache ownership ==="
sudo chown -R 1001:1001 /home/tyler/docker/jellyfin/config
sudo chown -R 1001:1001 /home/tyler/docker/jellyfin/cache

echo "=== Creating config directories for Sonarr and Radarr ==="
sudo mkdir -p /home/tyler/docker/jellyfin/sonarr-config
sudo mkdir -p /home/tyler/docker/jellyfin/radarr-config
sudo chown -R 1001:1001 /home/tyler/docker/jellyfin/sonarr-config
sudo chown -R 1001:1001 /home/tyler/docker/jellyfin/radarr-config

echo "=== Setting media group ownership on /srv/ directories ==="
# Change group to media on all media directories
sudo chown -R :media /srv/vids /srv/mus /srv/books /srv/photos /srv/roms /srv/torrents

echo "=== Clearing conflicting POSIX ACLs (if any) ==="
# ACLs from NAS/Samba can override Unix group permissions.
# Strip them so our chmod/chown rules actually take effect.
if command -v setfacl &>/dev/null; then
  sudo setfacl -R -b /srv/vids /srv/mus /srv/books /srv/photos /srv/roms /srv/torrents 2>/dev/null || true
else
  echo "Warning: setfacl not found. Install the 'acl' package if you have ACL issues."
fi

echo "=== Setting directory sticky bit (g+s) so new files inherit media group ==="
sudo find /srv/vids /srv/mus /srv/books /srv/photos /srv/roms /srv/torrents -type d -exec chmod g+s {} +

echo "=== Setting base permissions ==="
# Group read+execute on all directories
sudo find /srv/vids /srv/mus /srv/books /srv/photos /srv/roms /srv/torrents -type d -exec chmod g+rx {} +

# Group read on all files
sudo find /srv/vids /srv/mus /srv/books /srv/photos /srv/roms /srv/torrents -type f -exec chmod g+r {} +

echo "=== Setting write permissions for Sonarr/Radarr managed directories ==="
# Allow group write on top-level dirs and recursively within them
sudo chmod g+w /srv/vids/movies /srv/vids/shows /srv/torrents
sudo find /srv/vids/movies /srv/vids/shows /srv/torrents -type d -exec chmod g+w {} +
sudo find /srv/vids/movies /srv/vids/shows /srv/torrents -type f -exec chmod g+w {} +

echo "=== Done! ==="
echo ""
echo "You will need to log out and back in (or run 'newgrp media') for the"
echo "group changes to take effect in your current shell."
echo ""
echo "Start the stack with: docker compose up -d"
echo ""
echo "=== Web UI Configuration ==="
echo "Sonarr (http://<host>:8989):"
echo "  - Root folder: /data/vids/shows"
echo "  - Download client path: /data/torrents"
echo ""
echo "Radarr (http://<host>:7878):"
echo "  - Root folder: /data/vids/movies"
echo "  - Download client path: /data/torrents"
echo ""
echo "If you add a download client later, mount it with /srv:/data too"
echo "and set its download directory to /data/torrents."
echo "This ensures paths match and hard links / fast moves work correctly."