#!/usr/bin/env bash
set -euo pipefail

wwwRoot="/var/www"
outFile="/etc/samba/wordops-wpcontent-shares.conf"
tmpFile="$(mktemp)"

# Change these to match your world:
sambaGroup="dev" # group allowed to access shares
forceGroup="dev" # group to force on created files (optional)

{
  echo "; AUTO-GENERATED FILE - DO NOT EDIT"
  echo "; Generated: $(date -Is)"
  echo

  shopt -s nullglob
  for siteDir in "${wwwRoot}"/*; do
    site="$(basename "${siteDir}")"
    wpContent="${wwwRoot}/${site}/htdocs/wp-content"

    # Only create shares for sites that look like WP installs
    if [[ -d "${wpContent}" ]]; then
      cat <<SHARE

[${site}]
  comment = WordPress wp-content for ${site}
  path = ${wpContent}
  browseable = yes
  writable = yes
  read only = no
  guest ok = no

  ; Lock access down to a group
  valid users = @${sambaGroup}

  ; Keep permissions sane for webserver + devs
  force group = ${forceGroup}
  create mask = 0664
  directory mask = 2775

  ; Optional: reduce Finder/Windows junk
  veto files = /Thumbs.db/.DS_Store/._.DS_Store/
SHARE
    fi
  done
} > "${tmpFile}"

# Basic sanity check: refuse to install a broken file
testparm -s "${tmpFile}" >/dev/null

sudo mv "${tmpFile}" "${outFile}"
sudo chmod 0644 "${outFile}"

# Reload Samba to pick up new shares (no disconnect like restart)
sudo systemctl reload smbd || sudo systemctl reload samba