#!/bin/bash
# Nightly logical backup of the webmail database.
#
# Runs as a long-lived sidecar: sleeps until BACKUP_AT, dumps, verifies, prunes,
# repeats. `docker compose run --rm backup once` takes a single backup now (this
# is what `deploy/webmail.sh backup` does, e.g. immediately before an update).
#
# Why logical dumps and not just a NAS snapshot: a btrfs/Hyper Backup snapshot of
# a *running* Postgres data directory is crash-consistent, which usually replays
# fine but is not guaranteed and cannot be restored into a different Postgres
# version. A pg_dump is version-portable and verifiable. Keep both.
set -euo pipefail

BACKUP_DIR="${BACKUP_DIR:-/backups}"
BACKUP_AT="${BACKUP_AT:-03:30}"
BACKUP_KEEP_DAYS="${BACKUP_KEEP_DAYS:-14}"
DB="${PGDATABASE:-webmail}"

log() { echo "[backup $(date -Is)] $*"; }

take_backup() {
    local stamp out globals
    stamp="$(date +%Y%m%d-%H%M%S)"
    out="${BACKUP_DIR}/${DB}-${stamp}.dump"
    globals="${BACKUP_DIR}/globals-${stamp}.sql"

    log "dumping ${DB} -> $(basename "$out")"
    # -Fc: compressed custom format, restorable selectively with pg_restore.
    if ! pg_dump --format=custom --compress=6 --file="${out}.partial" "$DB"; then
        log "ERROR: pg_dump failed; leaving no partial file"
        rm -f "${out}.partial"
        return 1
    fi

    # Verify the archive is readable before it counts as a backup.
    if ! pg_restore --list "${out}.partial" >/dev/null 2>&1; then
        log "ERROR: dump failed verification (pg_restore --list); discarding"
        rm -f "${out}.partial"
        return 1
    fi

    mv "${out}.partial" "$out"
    chmod 600 "$out"

    # Roles/passwords live outside the database; tiny, and makes a restore onto a
    # bare Postgres one step shorter.
    pg_dumpall --globals-only --file="$globals" 2>/dev/null || true
    [ -f "$globals" ] && chmod 600 "$globals"

    ln -sfn "$(basename "$out")" "${BACKUP_DIR}/latest.dump"
    log "ok: $(du -h "$out" | cut -f1) $(basename "$out")"

    log "pruning dumps older than ${BACKUP_KEEP_DAYS} days"
    find "$BACKUP_DIR" -maxdepth 1 -name "${DB}-*.dump" -mtime "+${BACKUP_KEEP_DAYS}" -print -delete || true
    find "$BACKUP_DIR" -maxdepth 1 -name "globals-*.sql" -mtime "+${BACKUP_KEEP_DAYS}" -print -delete || true
}

seconds_until() {
    local target now next
    target="$1"
    now=$(date +%s)
    next=$(date -d "today ${target}" +%s 2>/dev/null || echo 0)
    if [ "$next" -le "$now" ]; then
        next=$(date -d "tomorrow ${target}" +%s)
    fi
    echo $(( next - now ))
}

if [ "${1:-}" = "once" ]; then
    take_backup
    exit $?
fi

log "backup sidecar started; schedule ${BACKUP_AT} daily, retention ${BACKUP_KEEP_DAYS} days"

# Baseline on first start: if there is no dump from the last 24 h, take one now
# rather than leaving a fresh install unprotected until the first scheduled run.
if ! find "$BACKUP_DIR" -maxdepth 1 -name "${DB}-*.dump" -mtime -1 | grep -q .; then
    log "no recent dump found; taking a baseline backup"
    take_backup || log "baseline backup failed; will retry on schedule"
fi

while true; do
    wait_s="$(seconds_until "$BACKUP_AT")"
    log "next backup in ${wait_s}s (at ${BACKUP_AT})"
    sleep "$wait_s"
    take_backup || log "scheduled backup failed; continuing"
done