#!/bin/bash

# Script: create_sftp_user.sh

if [ "$(id -u)" != "0" ]; then
    echo "❌ This script must be run as root." >&2
    exit 1
fi

if [ $# -ne 2 ]; then
    echo "Usage: $0 <sftp_username> <sftp_password>"
    exit 1
fi

USERNAME="$1"
PASSWORD="$2"
USERDIR="/var/www/$USERNAME"
HOMEDIR="$USERDIR/home"
WEBROOT="$HOMEDIR/public_html"

echo "👤 Creating SFTP-only user: $USERNAME"
adduser --disabled-password --gecos "" "$USERNAME"
usermod -s /usr/sbin/nologin "$USERNAME"
echo "$USERNAME:$PASSWORD" | chpasswd

echo "📁 Creating directory structure..."
mkdir -p "$WEBROOT"
chown root:root "$USERDIR"
chmod 755 "$USERDIR"

chown "$USERNAME:$USERNAME" "$HOMEDIR"
chmod 755 "$HOMEDIR"
chown -R "$USERNAME:$USERNAME" "$WEBROOT"

SSHD_CONFIG="/etc/ssh/sshd_config"
MATCH_BLOCK="Match User $USERNAME"

if ! grep -q "$MATCH_BLOCK" "$SSHD_CONFIG"; then
    echo "🔧 Adding SSH jail configuration..."
    cat <<EOL >> "$SSHD_CONFIG"

# SFTP jail for $USERNAME
Match User $USERNAME
    ChrootDirectory $USERDIR
    ForceCommand internal-sftp
    PasswordAuthentication yes
    X11Forwarding no
    AllowTcpForwarding no
EOL
    systemctl restart ssh
fi

echo "✅ SFTP user '$USERNAME' created and jailed to $WEBROOT"