#!/opt/homebrew/bin/bash
# tank-automount.sh — run ON the Mac as seth. From steel141:
#   printf '%s\n' "$HOMELAB_PASSWORD" | ssh mac 'bash ~/mac/scripts/tank-automount.sh'
# tank at /Volumes/tank via autofs + SMB, as Administrator (= root on tank, same as steel141's
# /mnt/Z). autofs mounts on first access and unmounts when idle, so a laptop that leaves the LAN
# gets no login-time "server not found" dialogs and no hung Finder. Password lives ONLY in
# root-owned /etc/auto_smb (0600); it is also seth's sudo password here, so stdin serves both.
# Known limit: automounted fs are always `nobrowse` -> not a drive in Finder's Locations sidebar.
# It's a folder: drag /Volumes/tank to Finder Favorites once (docs/manual-checklist.md).
set -euo pipefail
IFS= read -r PW; [[ -n $PW ]] || { echo "password expected on stdin"; exit 1; }
BK="$HOME/.mac-setup-backup"; TS=$(date +%s); mkdir -p "$BK"
log(){ printf '\033[1;33m[%s]\033[0m %s\n' "$1" "$2"; }
printf '%s\n' "$PW" | sudo -S -p '' -v            # one ticket for the run; -K at the end
trap 'sudo -K' EXIT

if grep -qE '^/-[[:space:]]+auto_smb' /etc/auto_master; then log skip "auto_master direct map"; else
  sudo cp /etc/auto_master "$BK/auto_master-$TS"
  printf '/-\t\t\tauto_smb\t-nosuid\n' | sudo tee -a /etc/auto_master >/dev/null; log set "auto_master += auto_smb"
fi

# password via stdin (never argv) -> %-encoded for the URL
ENC=$(printf '%s' "$PW" | python3 -c 'import sys,urllib.parse;print(urllib.parse.quote(sys.stdin.read(),safe=""))')
MAP="/Volumes/tank	-fstype=smbfs,soft	://Administrator:${ENC}@192.168.0.173/tank"
# pipeline, not $(sudo cat): the no-tty sudo ticket is per parent pid and a subshell breaks it
if printf '%s\n' "$MAP" | sudo cmp -s - /etc/auto_smb 2>/dev/null; then log skip "/etc/auto_smb"; else
  printf '%s\n' "$MAP" | sudo tee /etc/auto_smb >/dev/null   # no backup: it's ours and holds the password
  sudo chmod 600 /etc/auto_smb; sudo chown root:wheel /etc/auto_smb; log set "/etc/auto_smb"
fi

sudo mkdir -p /Volumes/tank   # automount won't create direct-map triggers ("mountpoint unavailable"); a plain dir here persists
sudo automount -vc >/dev/null
if ls /Volumes/tank >/dev/null 2>&1 && mount | grep -q ' /Volumes/tank (smbfs'; then log ok "tank mounted: $(mount | grep ' /Volumes/tank (smbfs' | cut -d' ' -f1)"
else log warn "trigger present but mount failed — off the LAN, or bad SMB credentials? (check: log show --last 2m --predicate 'process == \"automountd\"')"; fi