#!/bin/zsh
# Sauvegarde chiffrée de la base PostgreSQL Toveli (compte applicatif, lecture) → data/backups/toveli-YYYYmmdd-HHMM.sql.gz.age
# Restauration testée : age -d -i key.txt fichier.age | gunzip | psql $DATABASE_URL
set -euo pipefail
cd "$(dirname "$0")/.."
export PATH=/opt/homebrew/opt/postgresql@17/bin:/opt/homebrew/bin:$PATH
: "${DATABASE_URL:?DATABASE_URL requise}"
mkdir -p data/backups
out="data/backups/toveli-$(date +%Y%m%d-%H%M).sql.gz"
pg_dump --no-owner --no-privileges "$DATABASE_URL" | gzip -9 > "$out"
if [[ -n "${BACKUP_AGE_RECIPIENT:-}" ]] && command -v age >/dev/null; then age -r "$BACKUP_AGE_RECIPIENT" -o "$out.age" "$out" && rm -f "$out"; out="$out.age"; fi
ls -t data/backups/toveli-* | tail -n +15 | xargs -r rm -f
echo "sauvegarde OK : $out ($(du -h "$out" | cut -f1))"