#!/bin/bash
# uhhm-home-provision: ensure every member of the kanidm `corp` group has
# a ZFS-backed home dataset under the `home` pool, owned by their kanidm
# POSIX uid/gid. Runs on ergo (the NFS home server) from a systemd timer.
#
# Membership and uid/gid both resolve through NSS via kanidm-unixd
# (uid_attr_map = "name"), so no API token is needed.
set -euo pipefail

POOL=home
PREFIX=/home

members=$(getent group corp | cut -d: -f4 | tr ',' ' ')
[ -n "$members" ] || { echo "corp group empty or unresolved" >&2; exit 1; }

for user in $members; do
    if ! ent=$(getent passwd "$user"); then
        echo "skip $user: no passwd entry (posix not enabled?)" >&2
        continue
    fi
    uid=$(cut -d: -f3 <<<"$ent"); gid=$(cut -d: -f4 <<<"$ent")

    if ! zfs list "$POOL/$user" >/dev/null 2>&1; then
        echo "provision $POOL/$user (uid=$uid gid=$gid)"
        zfs create "$POOL/$user"
        chown "$uid:$gid" "$PREFIX/$user"
        chmod 700 "$PREFIX/$user"
    fi
done
