#!/bin/bash
set -e

# =====================================================================
#   ✠ In the Name of the Omnissiah ✠
#   Rite of Network Sanctification
#   This script forges SMB daemons to guard the sacred data vaults.
#   Let no heresy dwell within these parameters.
# =====================================================================

# === CONFIGURATION SIGILS ===
USER="aetos"                                # Bearer of the Emperor's Sigil
SHARES=(
  "/mnt/omnissiah-vault:Omnissiah-Vault"    # 7.3TB Holy Vault of Media Relics
  "/mnt/machine-spirit:Machine-Spirit"      # 931GB Machine Spirit for DBs
)

# === INSTALLATION OF HOLY DAEMONS ===
echo "[*] Installing Samba daemons — awaken smbd & nmbd..."
if command -v apt >/dev/null 2>&1; then
  sudo apt update
  sudo apt install -y samba
elif command -v dnf >/dev/null 2>&1; then
  sudo dnf install -y samba
else
  echo "Unsupported package manager. Manual rites required."
  exit 1
fi

# === CONSECRATION OF STORAGE SHRINES ===
echo "[*] Consecrating vault directories for Emperor’s work..."
for entry in "${SHARES[@]}"; do
  DIR="${entry%%:*}"
  sudo mkdir -p "$DIR"
  sudo chown -R "$USER:$USER" "$DIR"
done

# === SMB.CONF SCRIPTURES ===
echo "[*] Backing up smb.conf — preserve the old texts of Mars..."
sudo cp /etc/samba/smb.conf /etc/samba/smb.conf.bak.$(date +%F-%H%M%S)

# Purge traces of past heresies (incorrect configs)
sudo sed -i '/# Omnissiah Vault/,/^\[/d' /etc/samba/smb.conf || true
sudo sed -i '/# Machine Spirit/,/^\[/d' /etc/samba/smb.conf || true

# Inscribe new holy shares into smb.conf
for entry in "${SHARES[@]}"; do
  DIR="${entry%%:*}"
  NAME="${entry##*:}"

  sudo tee -a /etc/samba/smb.conf >/dev/null <<EOF

# ✠ ${NAME} Share ✠
# Machine Spirits bound by the will of the Omnissiah.
[${NAME}]
   path = ${DIR}
   # Let mortals witness, but not alter without sigil
   browseable = yes
   # Grant write privileges in Emperor’s name
   read only = no
   writable = yes
   # HERESY DENIED — no guest trespassers
   guest ok = no
   # Sigil-bearer ${USER} alone may access
   valid users = ${USER}
EOF
done

# === SAMBA PASSWORD RITE ===
echo "[*] Inscribing ${USER} into the Book of smbpasswd..."
sudo smbpasswd -a "$USER"

# === AWAKENING OF DAEMONS ===
echo "[*] Restarting Samba services — let smbd and nmbd chant praises..."
if systemctl list-unit-files | grep -q nmbd.service; then
  sudo systemctl restart smbd nmbd
  sudo systemctl enable smbd nmbd
else
  sudo systemctl restart smbd
  sudo systemctl enable smbd
fi

# === VOID SHIELD CONFIG (FIREWALL) ===
if command -v ufw >/dev/null 2>&1; then
  sudo ufw allow samba
elif command -v firewall-cmd >/dev/null 2>&1; then
  sudo firewall-cmd --permanent --add-service=samba
  sudo firewall-cmd --reload
else
  echo "[!] No firewall rites detected — proceed with caution, Acolyte."
fi

# === FINAL BLESSING ===
echo "[*] Network sanctification complete!"
echo "Invoke thus from clients:"
echo "   smb://<server-ip>/Omnissiah-Vault"
echo "   smb://<server-ip>/Machine-Spirit"
echo
echo "✠ May the Emperor and the Omnissiah guard these shares. ✠"