#!/usr/bin/env bash
set -euo pipefail

BACKUP_ROOT="${BAYLINE_BACKUP_ROOT:-/var/backups/bayline}"
RETAIN_DAYS="${BAYLINE_BACKUP_RETAIN_DAYS:-14}"
ENV_FILE="${BAYLINE_ENV_FILE:-/var/www/bayline/api/.env}"
STAMP="$(date -u +%Y%m%dT%H%M%SZ)"
TARGET="${BACKUP_ROOT}/${STAMP}"

if [[ ! -f "$ENV_FILE" ]]; then
  echo "Environment file not found at $ENV_FILE" >&2
  exit 1
fi

read_env() {
  grep -E "^${1}=" "$ENV_FILE" | tail -n1 | cut -d= -f2- | tr -d '"'
}

DB_DATABASE="$(read_env DB_DATABASE)"
DB_USERNAME="$(read_env DB_USERNAME)"
DB_PASSWORD="$(read_env DB_PASSWORD)"
DB_HOST="$(read_env DB_HOST)"

if [[ -z "${BAYLINE_BACKUP_PASSPHRASE:-}" ]]; then
  echo "BAYLINE_BACKUP_PASSPHRASE is not set. Refusing to write an unencrypted backup." >&2
  exit 1
fi

mkdir -p "$TARGET"

mysqldump \
  --host="$DB_HOST" \
  --user="$DB_USERNAME" \
  --password="$DB_PASSWORD" \
  --single-transaction \
  --quick \
  --routines \
  --triggers \
  --default-character-set=utf8mb4 \
  "$DB_DATABASE" \
  | gzip -9 \
  | openssl enc -aes-256-cbc -pbkdf2 -salt -pass env:BAYLINE_BACKUP_PASSPHRASE \
  > "${TARGET}/${DB_DATABASE}.sql.gz.enc"

sha256sum "${TARGET}/${DB_DATABASE}.sql.gz.enc" > "${TARGET}/checksums.txt"

if ! openssl enc -d -aes-256-cbc -pbkdf2 -pass env:BAYLINE_BACKUP_PASSPHRASE \
     -in "${TARGET}/${DB_DATABASE}.sql.gz.enc" | gzip -t; then
  echo "Backup verification FAILED for ${TARGET}" >&2
  exit 1
fi

echo "Backup verified: ${TARGET}"

find "$BACKUP_ROOT" -mindepth 1 -maxdepth 1 -type d -mtime "+${RETAIN_DAYS}" -exec rm -rf {} +

if [[ -n "${BAYLINE_BACKUP_REMOTE:-}" ]]; then
  rsync -a --delete "${BACKUP_ROOT}/" "${BAYLINE_BACKUP_REMOTE}/"
  echo "Mirrored to ${BAYLINE_BACKUP_REMOTE}"
fi