spb/chat-spboucher-ai

1#!/bin/bash2# Encrypted nightly backup of Chat SPBoucher AI (Postgres dump + uploads), kept 14 days.3# Usage: scripts/backup.sh [dest-dir]   — requires BACKUP_PASSPHRASE_FILE (mode 600) and DATABASE_URL in .env.production4set -euo pipefail5cd "$(dirname "$0")/.."6set -a; [ -f .env.production ] && . ./.env.production; set +a7DEST="${1:-$HOME/backups/chat-spboucher-ai}"; mkdir -p "$DEST"8STAMP=$(date +%Y%m%d-%H%M%S)9PASS_FILE="${BACKUP_PASSPHRASE_FILE:-$HOME/.config/chat-spboucher-ai/backup.pass}"10if [ ! -f "$PASS_FILE" ]; then mkdir -p "$(dirname "$PASS_FILE")"; openssl rand -base64 48 > "$PASS_FILE"; chmod 600 "$PASS_FILE"; echo "Nouvelle phrase de passe de sauvegarde créée dans $PASS_FILE — copie-la dans ~/Desktop/Cluster/secrets/ (sans elle, les sauvegardes sont illisibles)."; fi11export PATH="/opt/homebrew/opt/postgresql@17/bin:/opt/homebrew/bin:$PATH"12TMP=$(mktemp -d); trap 'rm -rf "$TMP"' EXIT13pg_dump --no-owner --format=custom "$DATABASE_URL" > "$TMP/db.dump"14tar -C "${DATA_DIR:-./data}" -czf "$TMP/uploads.tgz" uploads 2>/dev/null || tar -czf "$TMP/uploads.tgz" --files-from /dev/null15tar -C "$TMP" -cf - db.dump uploads.tgz | openssl enc -aes-256-cbc -pbkdf2 -iter 200000 -salt -pass "file:$PASS_FILE" -out "$DEST/csa-$STAMP.tar.enc"16find "$DEST" -name 'csa-*.tar.enc' -mtime +14 -delete17echo "backup ok: $DEST/csa-$STAMP.tar.enc ($(du -h "$DEST/csa-$STAMP.tar.enc" | cut -f1))"18