#!/bin/bash

set -e

server_name="${SERVER_NAME:?SERVER_NAME not set}"

restic_password_file="${RESTIC_PASSWORD_FILE:?RESTIC_PASSWORD_FILE not set}"

restic_host="${RESTIC_HOST:?RESTIC_HOST not set}"

backup_paths=()

# shellcheck disable=SC2153
ssh_key_file="${SSH_KEY_FILE}"
s3_key_file="${AWS_SECRET_ACCESS_KEY_FILE}"

restic_repo=
restic_extra_options=

if [ -n "$ssh_key_file" ] && [ -f "$ssh_key_file" ]; then
	restic_repo="sftp:$restic_host:/$server_name"

	# Only check server against provided SSH_HOST_KEY, if set
	if [ -n "$SSH_HOST_KEY" ]; then
		tmpfile=$(mktemp)
		echo "$SSH_HOST_KEY" >>"$tmpfile"
		echo "using host key $SSH_HOST_KEY"
		ssh_options="-o 'UserKnownHostsFile $tmpfile'"
	elif [ "$SSH_HOST_KEY_DISABLE" = "1" ]; then
		echo "disabling SSH host key checking"
		ssh_options="-o 'StrictHostKeyChecking=No'"
	else
		echo "neither SSH_HOST_KEY nor SSH_HOST_KEY_DISABLE set"
	fi
	restic_extra_options="sftp.command=ssh $ssh_options -i $ssh_key_file $restic_host -s sftp"
fi

if [ -n "$s3_key_file" ] && [ -f "$s3_key_file" ] && [ -n "$AWS_ACCESS_KEY_ID" ]; then
	AWS_SECRET_ACCESS_KEY="$(cat "${s3_key_file}")"
	export AWS_SECRET_ACCESS_KEY
	restic_repo="s3:$restic_host:/$server_name"
fi

if [ -z "$restic_repo" ]; then
	echo "you must configure either SFTP or S3 storage, see README"
	exit 1
fi

echo "restic_repo: $restic_repo"

# Pre-bake-in some default restic options
_restic() {
	if [ -z "$restic_extra_options" ]; then
		# shellcheck disable=SC2068
		restic -p "$restic_password_file" \
			--quiet -r "$restic_repo" \
			$@
	else
		# shellcheck disable=SC2068
		restic -p "$restic_password_file" \
			--quiet -r "$restic_repo" \
			-o "$restic_extra_options" \
			$@
	fi
}

if [ -n "$SERVICES_OVERRIDE" ]; then
	# this is fine because docker service names should never include spaces or
	# glob characters
	# shellcheck disable=SC2206
	services=($SERVICES_OVERRIDE)
else
	mapfile -t services < <(docker service ls --format '{{ .Name }}')
fi

post_commands=()
if [[ \ $*\  != *\ --skip-backup\ * ]]; then

	for service in "${services[@]}"; do
		echo "service: $service"
		details=$(docker service inspect "$service" --format "{{ json .Spec.Labels }}")
		if echo "$details" | jq -r '.["backupbot.backup"]' | grep -q 'true'; then
			pre=$(echo "$details" | jq -r '.["backupbot.backup.pre-hook"]')
			post=$(echo "$details" | jq -r '.["backupbot.backup.post-hook"]')
			container=$(docker container ls -f "name=$service" --format '{{ .ID }}')
			stack_name=$(echo "$details" | jq -r '.["com.docker.stack.namespace"]')

			if [ "$pre" != "null" ]; then
				# run the precommand
				echo "executing precommand $pre in container $container"
				docker exec "$container" sh -c "$pre"
			fi
			if [ "$post" != "null" ]; then
				# append post command
				post_commands+=("docker exec $container sh -c \"$post\"")
			fi

			# add volume paths to backup path
			backup_paths+=(/var/lib/docker/volumes/"${stack_name}"_*)
		fi
	done

	# check if restic repo exists, initialise if not
	if [ -z "$(_restic cat config)" ] 2>/dev/null; then
		echo "initializing restic repo"
		_restic init
	fi
fi

if [[ \ $*\  != *\ --skip-upload\ * ]]; then
	echo "${backup_paths[@]}"
	_restic backup --host "$server_name" --tag coop-cloud "${backup_paths[@]}"
fi

# run post commands
for post in "${post_commands[@]}"; do
	echo "executing postcommand $post"
	eval "$post"
done