#!/bin/sh
# Kvitt backup job (SPEC §10.9). Runs inside the backup image with /data (server data) and /backups mounted.
#  1. online, consistent snapshot of /data/kvitt.sqlite with sqlite3 .backup
#  2. PRAGMA integrity_check on the snapshot must print ok, else abort
#  3. gzip -9 the snapshot and tar the pictures, both with the same UTC stamp
#  4. Drive upload when RCLONE_FOLDER_ID is set (the Pi): rclone copy --immutable of every kvitt-*.sqlite.gz and
#     pictures-*.tar.gz in /backups (this run's pair and any left by an earlier failed upload), never sync, never
#     delete on Drive; once every file is confirmed on Drive with rclone lsf (name and size) the local copies are
#     deleted (D-002). Skipped with a log line when RCLONE_FOLDER_ID is empty (the development stack, D-001): files kept.
#  5. write /backups/last-success with the stamp (only after this run's pair is confirmed on Drive, when uploading)
# Logs carry file names and sizes only, never database content (SPEC §8.7).
set -eu

DATA_DIR=${KVITT_DATA_DIR:-/data}
BACKUP_DIR=${BACKUP_DIR:-/backups}
DB="$DATA_DIR/kvitt.sqlite"
STAGING="$BACKUP_DIR/staging"

db_out=""; pics_out=""
log() { echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) backup: $*"; }
# Removes the snapshot and any half-written archive of this run; finished archives stay for the next upload.
fail() { log "FAILED: $*"; rm -f "$STAGING/kvitt.sqlite" ${db_out:+"$db_out.tmp"} ${pics_out:+"$pics_out.tmp"}; exit 1; }

[ -f "$DB" ] || fail "no database at $DB"
mkdir -p "$STAGING"
rm -f "$STAGING/kvitt.sqlite"

# 1. Snapshot
sqlite3 -batch "$DB" ".backup '$STAGING/kvitt.sqlite'" || fail "sqlite3 .backup returned an error"

# 2. Integrity check
result=$(sqlite3 -batch -noheader -list "$STAGING/kvitt.sqlite" "PRAGMA integrity_check") || fail "integrity_check could not run"
[ "$result" = "ok" ] || fail "integrity_check did not print ok"

# 3. Compress with one UTC stamp
stamp=$(date -u +%Y%m%dT%H%M%SZ)
db_out="$BACKUP_DIR/kvitt-$stamp.sqlite.gz"
pics_out="$BACKUP_DIR/pictures-$stamp.tar.gz"
gzip -9 -c "$STAGING/kvitt.sqlite" > "$db_out.tmp" || fail "gzip failed"
mv "$db_out.tmp" "$db_out"
rm -f "$STAGING/kvitt.sqlite"
if [ -d "$DATA_DIR/pictures" ]; then
  tar -czf "$pics_out.tmp" -C "$DATA_DIR" pictures || fail "tar of pictures failed"
else
  log "no pictures directory yet; writing an empty pictures archive"
  tar -czf "$pics_out.tmp" -T /dev/null || fail "tar of empty pictures archive failed"
fi
mv "$pics_out.tmp" "$pics_out"
log "wrote $(basename "$db_out") ($(wc -c < "$db_out") bytes) and $(basename "$pics_out") ($(wc -c < "$pics_out") bytes)"

# 4. Drive upload (D-002)
if [ -z "${RCLONE_FOLDER_ID:-}" ]; then
  log "RCLONE_FOLDER_ID is empty: Drive upload skipped, local files kept"
else
  remote=${RCLONE_REMOTE:-gdrive:}
  conf_src=${RCLONE_CONFIG_SOURCE:-/config/rclone/rclone.conf}
  [ -r "$conf_src" ] || fail "no readable rclone config at $conf_src; local files kept"
  # rclone writes refreshed access tokens back to its config; the mounted one is read-only, so use a private copy.
  conf=$(mktemp)
  cp "$conf_src" "$conf"
  export RCLONE_CONFIG="$conf"
  trap 'rm -f "$conf"' EXIT
  confirmed=""
  for f in "$BACKUP_DIR"/kvitt-*.sqlite.gz "$BACKUP_DIR"/pictures-*.tar.gz; do
    [ -f "$f" ] || continue
    name=$(basename "$f")
    size=$(wc -c < "$f" | tr -d ' ')
    rclone copy "$f" "$remote" --drive-root-folder-id "$RCLONE_FOLDER_ID" --immutable --retries 3 --stats 0 --log-level ERROR \
      || fail "rclone copy of $name failed; local files kept"
    listed=$(rclone lsf "$remote" --drive-root-folder-id "$RCLONE_FOLDER_ID" --files-only --format sp --separator ' ' \
      --include "/$name" --log-level ERROR) || fail "rclone lsf could not confirm $name; local files kept"
    [ "$listed" = "$size $name" ] || fail "$name is not on Drive with $size bytes; local file kept"
    log "uploaded and confirmed on Drive: $name ($size bytes)"
    confirmed="$confirmed $f"
  done
  # Every file is confirmed on Drive: delete the local copies (D-002). Nothing on Drive is ever deleted.
  for f in $confirmed; do rm -f "$f"; done
  log "local copies deleted after Drive confirmation"
  rm -f "$conf"
  trap - EXIT
fi

# 5. Success marker
echo "$stamp" > "$BACKUP_DIR/last-success.tmp"
mv "$BACKUP_DIR/last-success.tmp" "$BACKUP_DIR/last-success"
log "ok $stamp"