#!/usr/bin/env bash
# FortDice MySQL backup with rotation.
# cPanel → Cron Jobs (daily 02:30):
#   30 2 * * * /bin/bash $HOME/fort-api/scripts/backup-db.sh >> $HOME/fort-backups/backup.log 2>&1
set -euo pipefail

APP_DIR="$(cd "$(dirname "$0")/.." && pwd)"
# Load DB_* variables from the API's .env (cPanel env vars are not visible to cron)
if [ -f "$APP_DIR/.env" ]; then
  set -a
  # shellcheck disable=SC1091
  . <(grep -E '^(DB_HOST|DB_PORT|DB_USER|DB_PASSWORD|DB_NAME)=' "$APP_DIR/.env")
  set +a
fi

BACKUP_DIR="${BACKUP_DIR:-$HOME/fort-backups}"
KEEP_DAYS="${KEEP_DAYS:-14}"
STAMP="$(date +%Y%m%d-%H%M%S)"
mkdir -p "$BACKUP_DIR"
chmod 700 "$BACKUP_DIR"

# Credentials via a temp option file so the password never appears in `ps`
CNF="$(mktemp)"
trap 'rm -f "$CNF"' EXIT
printf '[client]\nuser=%s\npassword=%s\nhost=%s\nport=%s\n' "$DB_USER" "$DB_PASSWORD" "${DB_HOST:-localhost}" "${DB_PORT:-3306}" > "$CNF"

OUT="$BACKUP_DIR/${DB_NAME}-${STAMP}.sql.gz"
mysqldump --defaults-extra-file="$CNF" --single-transaction --quick --routines --triggers --no-tablespaces "$DB_NAME" | gzip -9 > "$OUT"
chmod 600 "$OUT"

# Also archive private uploads (CVs, attachments) weekly on Sundays
if [ "$(date +%u)" = "7" ] && [ -d "$APP_DIR/uploads" ]; then
  tar -czf "$BACKUP_DIR/uploads-${STAMP}.tar.gz" -C "$APP_DIR" uploads
fi

find "$BACKUP_DIR" -name "*.gz" -type f -mtime +"$KEEP_DAYS" -delete
echo "[$(date -Iseconds)] backup ok → $OUT ($(du -h "$OUT" | cut -f1))"