#!/bin/sh
# Encrypted nightly Postgres backup for Offerlyst. Run from the app folder on the VPS.
# Setup once:  openssl rand -hex 32 > /root/.offerlyst-backup-key && chmod 600 /root/.offerlyst-backup-key
# Cron (3 am): 0 3 * * * /opt/bundle-offers-app/scripts/backup.sh >> /var/log/offerlyst-backup.log 2>&1
# Restore:     openssl enc -d -aes-256-cbc -pbkdf2 -pass file:/root/.offerlyst-backup-key -in FILE | gunzip | \
#              docker compose exec -T db psql -U bundle_offers bundle_offers
set -eu
cd "$(dirname "$0")/.."
KEY=/root/.offerlyst-backup-key
DIR=/root/backups
mkdir -p "$DIR"
chmod 700 "$DIR"
OUT="$DIR/offerlyst-$(date +%F).sql.gz.enc"
docker compose exec -T db pg_dump -U bundle_offers bundle_offers | gzip | \
  openssl enc -aes-256-cbc -pbkdf2 -salt -pass "file:$KEY" -out "$OUT"
chmod 600 "$OUT"
# keep 14 days
find "$DIR" -name 'offerlyst-*.sql.gz.enc' -mtime +14 -delete
echo "$(date -Is) backup ok: $OUT"