#!/bin/sh
# One-time DSM administrator action, run with sudo; does not restart any service.
set -eu
test "$(id -u)" = 0 || { echo 'Run this setup with sudo' >&2; exit 1; }
account=agiledancers-deploy
docker=/usr/local/bin/docker
target=/etc/sudoers.d/agiledancers-deploy
rule="$account ALL=(root) NOPASSWD: $docker"
test -x "$docker" && id "$account" >/dev/null
test -d /etc/sudoers.d || { echo 'Missing sudoers.d; no changes made' >&2; exit 1; }
if [ -e "$target" ]; then
    test "$(cat "$target")" = "$rule" || { echo 'Existing sudoers entry differs; no changes made' >&2; exit 1; }
else
    umask 077
    temporary=$(mktemp /etc/sudoers.d/agiledancers-deploy.XXXXXX)
    trap 'rm -f "$temporary"' EXIT
    printf '%s\n' "$rule" > "$temporary"
    chmod 440 "$temporary"
    if command -v visudo >/dev/null 2>&1; then visudo -cf "$temporary"; fi
    # A dot in the temporary name keeps sudo from loading the uncommitted file.
    mv "$temporary" "$target"
    if ! sudo -n -u "$account" sudo -n "$docker" info --format '{{.OSType}}/{{.Architecture}}'; then
        rm "$target"
        echo 'Docker permission check failed; new sudoers entry removed' >&2
        exit 1
    fi
fi
echo 'Dedicated Docker sudo permission is configured; no services were restarted.'