railiance-platform/lib/railiance-backup-common.sh

#!/usr/bin/env bash
# lib/railiance-backup-common.sh — age encrypt + Nextcloud upload helpers (Option A)
set -euo pipefail

: "${RAILIANCE_BACKUP_AGE_PUBLIC_KEY:=age1zvryunvjhvpkmasskauga2heeg0ztnte9ymgppvjge36ekumk50syr3tsz}"
: "${RAILIANCE_BACKUP_BAO_PATH:=platform/workloads/railiance/backup/offsite-lane}"
: "${RAILIANCE_BACKUP_NC_PREFIX:=forgejo}"

railiance_backup_load_openbao_lane() {
  if [[ -n "${RAILIANCE_BACKUP_NC_TOKEN:-}" && -n "${RAILIANCE_BACKUP_NC_WEBDAV_URL:-}" ]]; then
    return 0
  fi
  command -v bao >/dev/null 2>&1 || return 0
  bao kv metadata get "${RAILIANCE_BACKUP_BAO_PATH}" >/dev/null 2>&1 || return 0
  : "${RAILIANCE_BACKUP_NC_TOKEN:=$(bao kv get -field=NC_WEBDAV_TOKEN "${RAILIANCE_BACKUP_BAO_PATH}")}"
  : "${RAILIANCE_BACKUP_NC_WEBDAV_URL:=$(bao kv get -field=NC_WEBDAV_URL "${RAILIANCE_BACKUP_BAO_PATH}")}"
}

railiance_backup_require_openbao_lane() {
  railiance_backup_load_openbao_lane
  # Nextcloud *file drop* shares use /public.php/dav/filesdrop/<token>/ — not /public.php/webdav
  : "${RAILIANCE_BACKUP_NC_WEBDAV_URL:=https://nx4069.your-storageshare.de/public.php/dav/filesdrop/${RAILIANCE_BACKUP_NC_TOKEN}}"
  if [[ -z "${RAILIANCE_BACKUP_NC_TOKEN:-}" ]]; then
    echo "ERROR: set RAILIANCE_BACKUP_NC_TOKEN or run: bao login -method=oidc -path=netkingdom role=railiance-backup-workload-kv-read" >&2
    exit 1
  fi
}

railiance_backup_require_tools() {
  local t
  for t in age curl kubectl; do
    command -v "$t" >/dev/null 2>&1 || { echo "ERROR: missing required tool: $t" >&2; exit 1; }
  done
}

railiance_backup_nc_upload() {
  local file="$1" remote_name="$2"
  local dest="${RAILIANCE_BACKUP_NC_WEBDAV_URL}/${RAILIANCE_BACKUP_NC_PREFIX}/${remote_name}"
  curl -sf -u "${RAILIANCE_BACKUP_NC_TOKEN}:" -T "$file" "$dest" \
    || { echo "ERROR: Nextcloud upload failed: ${remote_name}" >&2; return 1; }
}

railiance_backup_encrypt() {
  local src="$1" dest="$2"
  age -r "${RAILIANCE_BACKUP_AGE_PUBLIC_KEY}" -o "$dest" "$src"
}

railiance_backup_prune_local() {
  local dir="$1" pattern="$2" keep="${3:-7}"
  find "$dir" -maxdepth 1 -name "$pattern" -type f 2>/dev/null \
    | sort -r | tail -n +"$((keep + 1))" | xargs -r rm -f
}

railiance_backup_record_success() {
  local stamp_dir="$1" ts="$2"
  mkdir -p "$stamp_dir"
  echo "$ts" > "${stamp_dir}/.last-success"
  echo "$ts" >> "${stamp_dir}/success-log"
}