#!/bin/bash
# Encrypted nightly backup of Chat SPBoucher AI (Postgres dump + uploads), kept 14 days.
# Usage: scripts/backup.sh [dest-dir]   — requires BACKUP_PASSPHRASE_FILE (mode 600) and DATABASE_URL in .env.production
set -euo pipefail
cd "$(dirname "$0")/.."
set -a; [ -f .env.production ] && . ./.env.production; set +a
DEST="${1:-$HOME/backups/chat-spboucher-ai}"; mkdir -p "$DEST"
STAMP=$(date +%Y%m%d-%H%M%S)
PASS_FILE="${BACKUP_PASSPHRASE_FILE:-$HOME/.config/chat-spboucher-ai/backup.pass}"
if [ ! -f "$PASS_FILE" ]; then mkdir -p "$(dirname "$PASS_FILE")"; openssl rand -base64 48 > "$PASS_FILE"; chmod 600 "$PASS_FILE"; echo "Nouvelle phrase de passe de sauvegarde créée dans $PASS_FILE — copie-la dans ~/Desktop/Cluster/secrets/ (sans elle, les sauvegardes sont illisibles)."; fi
export PATH="/opt/homebrew/opt/postgresql@17/bin:/opt/homebrew/bin:$PATH"
TMP=$(mktemp -d); trap 'rm -rf "$TMP"' EXIT
pg_dump --no-owner --format=custom "$DATABASE_URL" > "$TMP/db.dump"
tar -C "${DATA_DIR:-./data}" -czf "$TMP/uploads.tgz" uploads 2>/dev/null || tar -czf "$TMP/uploads.tgz" --files-from /dev/null
tar -C "$TMP" -cf - db.dump uploads.tgz | openssl enc -aes-256-cbc -pbkdf2 -iter 200000 -salt -pass "file:$PASS_FILE" -out "$DEST/csa-$STAMP.tar.enc"
find "$DEST" -name 'csa-*.tar.enc' -mtime +14 -delete
echo "backup ok: $DEST/csa-$STAMP.tar.enc ($(du -h "$DEST/csa-$STAMP.tar.enc" | cut -f1))"