#!/usr/bin/env bash
set -euo pipefail
requested="${1:-}"
case "$requested" in /home/*|/mnt/*|/media/*|/srv/*) ;; *) exit 10 ;; esac
target="$(realpath -e -- "$requested")"
[ -d "$target" ] && [ ! -L "$target" ] || exit 11
case "$target" in /var/www/*|/var/lib/gesundheitsbelege|/var/lib/gesundheitsbelege/*) exit 12 ;; esac
parent="$(dirname -- "$target")"
while [ "$parent" != "/" ]; do setfacl -m u:www-data:--x -- "$parent"; parent="$(dirname -- "$parent")"; done
find "$target" -xdev -type d -exec setfacl -m u:www-data:r-x -- {} +
find "$target" -xdev -type f -exec setfacl -m u:www-data:r-- -- {} +