#!/usr/bin/env bash
# Phase 1 logical backup for apps-pg consumer databases (Option A lane).
# Encrypts locally with age; Nextcloud upload requires OpenBao offsite-lane creds.
set -euo pipefail

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
PLATFORM_REPO="${PLATFORM_REPO:-$HOME/railiance-platform}"
COMMON_SH="${PLATFORM_REPO}/lib/railiance-backup-common.sh"

APPS_PG_NAMESPACE="${APPS_PG_NAMESPACE:-databases}"
APPS_PG_CLUSTER="${APPS_PG_CLUSTER:-apps-pg}"
APPS_PG_POD="${APPS_PG_POD:-}"
APPS_PG_DATABASE="${APPS_PG_DATABASE:-vergabe_db}"
BACKUP_DIR="${BACKUP_DIR:-$HOME/.cache/railiance/backups/apps-pg}"
DRY_RUN="${RAILIANCE_BACKUP_DRY_RUN:-1}"

if [[ ! -f "$COMMON_SH" ]]; then
  echo "ERROR: missing ${COMMON_SH}" >&2
  exit 1
fi
# shellcheck source=/dev/null
source "$COMMON_SH"

railiance_backup_require_tools
mkdir -p "$BACKUP_DIR"

if [[ -z "$APPS_PG_POD" ]]; then
  APPS_PG_POD="$(
    kubectl get pods -n "$APPS_PG_NAMESPACE" \
      -l "cnpg.io/cluster=${APPS_PG_CLUSTER},role=primary" \
      -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true
  )"
fi
if [[ -z "$APPS_PG_POD" ]]; then
  echo "ERROR: primary pod for ${APPS_PG_CLUSTER} not found in ${APPS_PG_NAMESPACE}" >&2
  exit 1
fi

TS="$(date -u +%Y%m%dT%H%M%SZ)"
DB_PLAIN="${BACKUP_DIR}/apps-pg-${APPS_PG_DATABASE}-${TS}.dump"
DB_AGE="${DB_PLAIN}.age"

echo "apps-pg backup dry-run"
echo "  cluster: ${APPS_PG_CLUSTER}"
echo "  pod:     ${APPS_PG_POD}"
echo "  database:${APPS_PG_DATABASE}"
echo

kubectl exec -n "$APPS_PG_NAMESPACE" "$APPS_PG_POD" -c postgres -- \
  pg_dump -U postgres -d "$APPS_PG_DATABASE" -Fc --no-owner --no-acl > "$DB_PLAIN"
echo "ok: pg_dump $(du -h "$DB_PLAIN" | awk '{print $1}')"

railiance_backup_encrypt "$DB_PLAIN" "$DB_AGE"
echo "ok: age encrypted $(basename "$DB_AGE")"

if [[ "$DRY_RUN" == "1" ]]; then
  echo "ok: dry-run — skipping Nextcloud upload (OpenBao offsite-lane required)"
  echo "     Decrypt with ~/.config/age/railiance-backup.key"
  exit 0
fi

railiance_backup_require_openbao_lane
RAILIANCE_BACKUP_NC_PREFIX="${RAILIANCE_BACKUP_NC_PREFIX:-apps-pg}"
railiance_backup_nc_upload "$DB_AGE" "apps-pg-${APPS_PG_DATABASE}-${TS}.dump.age"
railiance_backup_record_success "$BACKUP_DIR" "$TS"
echo "ok: uploaded apps-pg-${APPS_PG_DATABASE}-${TS}.dump.age"