#!/usr/bin/env bash
# UKRRS: create one account lane = cgroup slice + matching user-slice drop-in.
# usage: mkacct.sh <account> <uid> [mem_high] [mem_max] [allowed_cpus] [tier]
#
#   tier=agent (default): CPUWeight=75, pinned to a CPU pool — the 9 PMO/worker
#     lanes. interim rec: 3G 4.5G 0-5   post-upgrade: 10G 12G 0-15
#   tier=human: CPUWeight=600, NO cpu restriction, generous memory — the two
#     human interactive accounts (KDE/CAD/EDA/video via xrdp live in these).
#     interim rec: 12G 16G all   post-upgrade: 32G 40G all
#
# Examples (uids verified 2026-08-31):
#   sudo RUN=1 ./mkacct.sh reachableceo 1001 12G 16G all human
#   sudo RUN=1 ./mkacct.sh reachableceo-offstage 1010 12G 16G all human
#   sudo RUN=1 ./mkacct.sh TSGBOD <uid> 3G 4.5G 0-5 agent
#
# RUN=1 installs (needs root); default prints the plan + snippets only.
set -euo pipefail
acct=${1:?account}; uid=${2:?uid}
high=${3:-3G}; max=${4:-4.5G}; cpus=${5:-0-5}; tier=${6:-agent}
RUN=${RUN:-0}

case "$tier" in
  human) weight=600; cpuline="" ;;
  agent) weight=75;  cpuline="AllowedCPUs=$cpus" ;;
  *) echo "tier must be human or agent" >&2; exit 2 ;;
esac

slice="/etc/systemd/system/ukrrs-acct-$acct.slice"
userdrop="/etc/systemd/system/user-$uid.slice.d/50-ukrrs.conf"

cat <<EOF
plan ($tier tier):
  $slice
      CPUWeight=$weight ${cpuline:+$cpuline }MemoryHigh=$high MemoryMax=$max TasksMax=4096
  $userdrop
      CPUWeight=$weight MemoryHigh=$high

compose snippet (this account's agent projects):
  x-ukrrs-acct: &ukrrs_acct
    cgroup_parent: ukrrs-acct-$acct.slice
  services:
    anything: { <<: *ukrrs_acct }

dev.sh one-shot builders belong in the batch pool, not the account slice:
  docker run --rm --cgroup-parent ukrrs-batch.slice --cpus 4 --memory 4g ...
EOF

if [ "$RUN" = 1 ]; then
  [ "$(id -u)" = 0 ] || { echo "RUN=1 needs root" >&2; exit 1; }
  cat > "$slice" <<EOF
[Unit]
Description=UKRRS account lane ($tier): $acct
Documentation=file:///home/reachableceo/projects/ultix/REPORT.md

[Slice]
CPUWeight=$weight
${cpuline}
MemoryHigh=$high
MemoryMax=$max
TasksMax=4096
EOF
  mkdir -p "$(dirname "$userdrop")"
  cat > "$userdrop" <<EOF
[Slice]
CPUWeight=$weight
MemoryHigh=$high
EOF
  systemctl daemon-reload
  # push live: drop-ins alone don't re-apply to already-existing user slices
  systemctl set-property "user-$uid.slice" CPUWeight="$weight" MemoryHigh="$high"
  echo "installed + daemon-reload + live-applied ok: $acct ($tier)"
fi