Samba shares, host file updates

helpers/gen-wpcontent-shares

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+wwwRoot="/var/www"
+outFile="/etc/samba/wordops-wpcontent-shares.conf"
+tmpFile="$(mktemp)"
+
+# Change these to match your world:
+sambaGroup="dev" # group allowed to access shares
+forceGroup="dev" # group to force on created files (optional)
+
+{
+  echo "; AUTO-GENERATED FILE - DO NOT EDIT"
+  echo "; Generated: $(date -Is)"
+  echo
+
+  shopt -s nullglob
+  for siteDir in "${wwwRoot}"/*; do
+    site="$(basename "${siteDir}")"
+    wpContent="${wwwRoot}/${site}/htdocs/wp-content"
+
+    # Only create shares for sites that look like WP installs
+    if [[ -d "${wpContent}" ]]; then
+      cat <<SHARE
+
+[${site}]
+  comment = WordPress wp-content for ${site}
+  path = ${wpContent}
+  browseable = yes
+  writable = yes
+  read only = no
+  guest ok = no
+
+  ; Lock access down to a group
+  valid users = @${sambaGroup}
+
+  ; Keep permissions sane for webserver + devs
+  force group = ${forceGroup}
+  create mask = 0664
+  directory mask = 2775
+
+  ; Optional: reduce Finder/Windows junk
+  veto files = /Thumbs.db/.DS_Store/._.DS_Store/
+SHARE
+    fi
+  done
+} > "${tmpFile}"
+
+# Basic sanity check: refuse to install a broken file
+testparm -s "${tmpFile}" >/dev/null
+
+sudo mv "${tmpFile}" "${outFile}"
+sudo chmod 0644 "${outFile}"
+
+# Reload Samba to pick up new shares (no disconnect like restart)
+sudo systemctl reload smbd || sudo systemctl reload samba