#!/bin/bash
# Run INSIDE esh-nas (CT 103 on esh-pve-nas) as root, via `pct exec 103`. The same steps as
# playbooks/bootstrap-infra-ops-user.yaml, for a container infra-ops cannot log into yet (Prime 2026-10-13: "set it up").
set -euo pipefail
U=infra-ops; ID=850
KEY='ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN+1HBwfXrkfTYWdcnWCjLJ6VLAGC87gxH5h5vKaaA3c infra-ops@pfi-fleet'
if ! id "$U" >/dev/null 2>&1; then
  if ! getent passwd "$ID" >/dev/null && ! getent group "$ID" >/dev/null; then
    groupadd -g "$ID" "$U"; useradd -m -s /bin/bash -u "$ID" -g "$ID" "$U"
  else
    echo "uid/gid $ID taken; letting the OS allocate"; useradd -m -s /bin/bash "$U"
  fi
  echo "created $U"
fi
chmod 0700 /home/$U
getent group docker >/dev/null && usermod -aG docker "$U" || echo "no docker group, skipped"
install -d -m 700 -o "$U" -g "$U" /home/$U/.ssh
printf '%s\n' "$KEY" > /home/$U/.ssh/authorized_keys
chown "$U:$U" /home/$U/.ssh/authorized_keys; chmod 600 /home/$U/.ssh/authorized_keys
f=/etc/sudoers.d/$U
printf 'Defaults:%s log_output\n%s ALL=(ALL) NOPASSWD:ALL\n' "$U" "$U" > "$f.tmp"
printf '%s\n' '# Bulk data movers: keep the audit line, do not record the bytes (eshpfi playbooks/sudoers-infra-ops-bulk-no-log-output.yaml)' \
  'Cmnd_Alias BULK_DATA = /usr/bin/rsync, /usr/bin/tar, /usr/bin/cat, /usr/bin/dd, /usr/bin/zstd, /usr/bin/zcat, /usr/bin/gzip, /usr/bin/pv, /usr/bin/docker save *, /usr/bin/docker export *, /usr/bin/docker cp *' \
  'Defaults!BULK_DATA !log_output' >> "$f.tmp"
chmod 440 "$f.tmp"
if visudo -cf "$f.tmp"; then mv "$f.tmp" "$f"; else rm -f "$f.tmp"; echo "VISUDO VALIDATION FAILED"; exit 1; fi
id "$U"; stat -c '%a %U %n' /home/$U /home/$U/.ssh /home/$U/.ssh/authorized_keys "$f"