#!/usr/bin/env bash
set -Eeuo pipefail

# shellcheck source=lib.sh
source "$(dirname -- "${BASH_SOURCE[0]}")/lib.sh"

env_file="${1:-/etc/lehuo/lehuo.env}"
require_command docker
require_command gzip
require_command sha256sum
require_env_file "$env_file"

backup_dir="$(env_value "$env_file" BACKUP_DIR)"
[[ "$backup_dir" == /opt/lehuo/backups || "$backup_dir" == /opt/lehuo/backups/* ]] || {
  echo 'BACKUP_DIR 必须位于 /opt/lehuo/backups。' >&2
  exit 1
}
install -d -m 0700 "$backup_dir"

database="$(env_value "$env_file" MYSQL_DATABASE)"
timestamp="$(date -u +%Y%m%dT%H%M%SZ)"
target="$backup_dir/lehuo-${timestamp}.sql.gz"
temporary="${target}.tmp"
trap 'rm -f -- "$temporary"' EXIT

compose "$env_file" exec -T mysql sh -c \
  'MYSQL_PWD="$MYSQL_ROOT_PASSWORD" exec mysqldump --single-transaction --routines --triggers --events --set-gtid-purged=OFF -u root "$MYSQL_DATABASE"' \
  | gzip -9 > "$temporary"

gzip -t "$temporary"
mv -- "$temporary" "$target"
chmod 600 "$target"
sha256sum "$target" > "${target}.sha256"
chmod 600 "${target}.sha256"
find "$backup_dir" -maxdepth 1 -type f \( -name 'lehuo-*.sql.gz' -o -name 'lehuo-*.sql.gz.sha256' \) -mtime +30 -delete

printf '数据库备份完成：%s（数据库：%s）\n' "$target" "$database"
echo '请将备份及 SHA-256 文件同步到异地加密存储。'