#!/usr/bin/env bash
set -Eeuo pipefail
umask 077
[[ $EUID -eq 0 ]] || { echo 'Run with sudo.' >&2; exit 1; }
BACKUP_DIR=/var/backups/archforge-status
mkdir -p "$BACKUP_DIR"
TMP=$(mktemp -d)
trap 'rm -rf "$TMP"' EXIT
if [[ -f /var/lib/archforge-status/status.db ]]; then
  sqlite3 /var/lib/archforge-status/status.db ".backup '$TMP/status.db'"
fi
cp /etc/archforge-status/status.env "$TMP/status.env"
if [[ -f /etc/archforge-status/msmtprc ]]; then cp /etc/archforge-status/msmtprc "$TMP/msmtprc"; fi
NAME="backup-$(date -u +%Y%m%d-%H%M%S).tar.gz"
tar -C "$TMP" -czf "$BACKUP_DIR/$NAME" .
chmod 600 "$BACKUP_DIR/$NAME"
find "$BACKUP_DIR" -maxdepth 1 -type f -name 'backup-*.tar.gz' -mtime +14 -delete
echo "Encrypted-disk recommended: backup contains secrets: $BACKUP_DIR/$NAME"