#!/bin/bash
# Pin the local 'docker' group GID to match the IPA 'docker-access' group
# (GID 50010) so that IPA group membership alone grants docker socket access.
#
# On Debian, GID 50010 is already present via SSSD (the IPA group), so
# groupmod requires --non-unique to allow the local docker group to share
# it. The docker.socket + docker.service pair must be fully stopped before
# removing the stale socket so systemd recreates it with the new GID.
#
# Idempotent — exits 0 without touching anything if the GID is already 50010.
#
# Run as root after setup-ipa-sudo.sh has been applied and docker is running.
#
# Usage: sudo ./setup-docker-ipa-gid.sh
set -euo pipefail

DOCKER_ACCESS_GID=50010

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=lib/common.sh
source "${SCRIPT_DIR}/lib/common.sh"
require_root

if ! command -v docker &>/dev/null; then
    echo "ERROR: docker not found -- install Docker before running this script." >&2
    exit 1
fi

current_gid=$(getent group docker | cut -d: -f3)
if [ "$current_gid" = "$DOCKER_ACCESS_GID" ]; then
    echo "docker group is already GID ${DOCKER_ACCESS_GID} -- nothing to do."
    exit 0
fi

echo "Changing docker group GID: ${current_gid} -> ${DOCKER_ACCESS_GID}"

# SSSD exposes GID 50010 via the IPA docker-access group, so groupmod sees
# it as already in use. --non-unique lets the local docker group share it.
groupmod --non-unique -g "${DOCKER_ACCESS_GID}" docker

echo "Restarting docker to recreate socket with new GID..."
systemctl stop docker.service docker.socket
rm -f /var/run/docker.sock
systemctl start docker.socket docker.service

actual_gid=$(stat -c '%g' /var/run/docker.sock)
if [ "$actual_gid" != "$DOCKER_ACCESS_GID" ]; then
    echo "ERROR: socket GID is ${actual_gid}, expected ${DOCKER_ACCESS_GID}" >&2
    exit 1
fi

echo "Done. Docker socket is now GID ${DOCKER_ACCESS_GID} (docker / docker-access)."
echo "IPA members of the 'docker-access' group can now run docker without explicit local group membership."