#!/usr/bin/env bash
# Off-host database + uploads backup (design doc §01, launch gate: "A full
# backup has been restored successfully into staging" — see restore.sh).
set -euo pipefail

ENVIRONMENT="${1:?Usage: backup.sh <staging|production>}"
export ENVIRONMENT
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$REPO_ROOT"

ENV_FILE=".env.${ENVIRONMENT}"
# shellcheck source=lib/env.sh
source "$REPO_ROOT/deploy/lib/env.sh"

TIMESTAMP="$(date +%Y%m%d-%H%M%S)"
BACKUP_DIR="$(env_get "$ENV_FILE" BACKUP_DIR)"
BACKUP_REMOTE="$(env_get "$ENV_FILE" BACKUP_REMOTE)"
BACKUP_RETENTION_DAYS="$(env_get "$ENV_FILE" BACKUP_RETENTION_DAYS)"
BACKUP_DIR="${BACKUP_DIR:-./backups}/${ENVIRONMENT}"
mkdir -p "$BACKUP_DIR"

# See deploy.sh for why: Compose warns on any $-shaped value in --env-file
# even when unused, so DB_PASSWORD/DB_ROOT_PASSWORD are filtered out of the
# copy Compose actually sees.
COMPOSE_ENV_FILE="$(mktemp)"
trap 'rm -f "$COMPOSE_ENV_FILE"' EXIT
grep -Ev '^(DB_PASSWORD|DB_ROOT_PASSWORD)=' "$ENV_FILE" > "$COMPOSE_ENV_FILE"

COMPOSE="docker compose -p bookstore-${ENVIRONMENT} -f docker-compose.yml -f docker-compose.${ENVIRONMENT}.yml --env-file ${COMPOSE_ENV_FILE}"

echo "==> dumping database"
# --single-transaction: without it, a dump against a live site either
# table-locks for its duration (blocking writes) or, if MARIADB_USER lacks
# LOCK TABLES privilege, produces a non-atomic dump — rows written after the
# dump starts but before it reaches their table can be captured
# inconsistently with rows it already passed. InnoDB (this project's engine
# throughout) supports a consistent snapshot via a single transaction instead.
$COMPOSE exec -T db sh -c "exec mariadb-dump --single-transaction -u\"\$MARIADB_USER\" -p\"\$(cat /run/secrets/db_password)\" \"\$MARIADB_DATABASE\"" \
  | gzip > "$BACKUP_DIR/db-${TIMESTAMP}.sql.gz"

echo "==> archiving uploads"
$COMPOSE run --rm -T -u www-data wordpress tar -czf - -C /var/www/html/wp-content uploads \
  > "$BACKUP_DIR/uploads-${TIMESTAMP}.tar.gz"

echo "==> archiving environment config"
# Every API key (Booksrun/Ingram/Helcim/MailerLite/Hardcover), the WP admin
# bootstrap credentials, and both DB passwords live ONLY in this one
# gitignored host file — losing the host without this backed up loses all of
# it, even with the DB dump and uploads intact. Same trust model as the DB
# dump above (also plaintext, also only as protected as $BACKUP_DIR/
# $BACKUP_REMOTE are) — chmod 600 since, unlike the DB/uploads archives, this
# one is directly the credentials themselves, not data that merely contains some.
cp "$ENV_FILE" "$BACKUP_DIR/env-${TIMESTAMP}"
chmod 600 "$BACKUP_DIR/env-${TIMESTAMP}"

if [[ -n "${BACKUP_REMOTE:-}" ]]; then
  echo "==> syncing to off-host storage ($BACKUP_REMOTE)"
  rclone copy "$BACKUP_DIR/db-${TIMESTAMP}.sql.gz" "$BACKUP_REMOTE/${ENVIRONMENT}/"
  rclone copy "$BACKUP_DIR/uploads-${TIMESTAMP}.tar.gz" "$BACKUP_REMOTE/${ENVIRONMENT}/"
  rclone copy "$BACKUP_DIR/env-${TIMESTAMP}" "$BACKUP_REMOTE/${ENVIRONMENT}/"
else
  echo "==> BACKUP_REMOTE not set — backup stayed local only; configure rclone before launch"
fi

echo "==> pruning local backups older than ${BACKUP_RETENTION_DAYS:-14} days"
find "$BACKUP_DIR" -type f -mtime "+${BACKUP_RETENTION_DAYS:-14}" -delete

echo "==> backup complete: $BACKUP_DIR"