#!/bin/bash
# root-create-accounts.sh — run AS ROOT on each host. Creates the MOPAC Linux
# accounts (SPEC-20260829) with docker-group membership so each account's
# container service can reach the host docker daemon. Idempotent.
#   ultix-streaming: bash root-create-accounts.sh streaming
#   ultix-offstage:  bash root-create-accounts.sh offstage
set -eu
HOST="${1:?usage: root-create-accounts.sh ultix}"
case "$HOST" in
  ultix) USERS="reachableceo TSGBOD TSGCOO TSGCTO TSGCCO reachableceo-offstage COSRCEO-Personal COSRCEO-Biz COSWFO" ;;
  *) echo "unknown host $HOST" >&2; exit 1 ;;
esac
DOCKER_GID="$(stat -c %g /var/run/docker.sock)"
for u in $USERS; do
  if id "$u" >/dev/null 2>&1; then
    echo "exists: $u"
  else
    useradd -m -s /bin/bash -G docker "$u"
    echo "created: $u (docker group $DOCKER_GID)"
  fi
  usermod -aG docker "$u" 2>/dev/null || true
done
echo "NOTE: reachableceo already exists — group membership updated only."
echo "Next (as each account or via sudo -u): ~/mopac/bootstrap-account.sh"