#!/usr/bin/env bash
# heleos per-database dumps — automysqlbackup-style rotation, adapted for the
# containerized shared MariaDB. Managed by Ansible. Iterates the deployments dir
# (source of truth) and dumps each DB-backed site into
# db-backups/<customer>/<site>/{daily,weekly,monthly}.
set -euo pipefail

CONTAINER="{{ mariadb_container }}"
BASE="{{ db_backup_dir }}"
DEPLOYMENTS="{{ deployments_dir }}"
KEEP_DAILY={{ db_backup_keep_daily }}
KEEP_WEEKLY={{ db_backup_keep_weekly }}
KEEP_MONTHLY={{ db_backup_keep_monthly }}

# Root password: env var wins, else read from the mariadb stack .env.
ROOTPW="${MARIADB_ROOT_PASSWORD:-}"
if [ -z "$ROOTPW" ] && [ -f "{{ mariadb_env_file }}" ]; then
    ROOTPW="$(grep -E '^MARIADB_ROOT_PASSWORD=' "{{ mariadb_env_file }}" | cut -d= -f2-)"
fi
if [ -z "$ROOTPW" ]; then
    echo "no MariaDB root password (env or {{ mariadb_env_file }})" >&2
    exit 1
fi

dow="$(date +%u)"      # 7 = Sunday
dom="$(date +%d)"      # 01 = first of month
ts="$(date +%Y%m%d-%H%M%S)"

shopt -s nullglob
for meta in "$DEPLOYMENTS"/*/*/site.yaml; do
    d="$(dirname "$meta")"
    site="$(basename "$d")"
    customer="$(basename "$(dirname "$d")")"
    grep -qiE '^database:[[:space:]]*true' "$meta" || continue

    db="db_${customer//-/_}_${site//-/_}"
    dest="$BASE/$customer/$site"
    mkdir -p "$dest/daily" "$dest/weekly" "$dest/monthly"

    out="$dest/daily/${db}-${ts}.sql.gz"
    # MYSQL_PWD keeps the password out of the container's process list.
    docker exec -e MYSQL_PWD="$ROOTPW" "$CONTAINER" \
        mariadb-dump --single-transaction --databases "$db" -uroot | gzip > "$out"

    [ "$dow" = "7" ]  && cp -f "$out" "$dest/weekly/"
    [ "$dom" = "01" ] && cp -f "$out" "$dest/monthly/"

    find "$dest/daily"   -name '*.sql.gz' -type f -mtime +"$KEEP_DAILY"            -delete
    find "$dest/weekly"  -name '*.sql.gz' -type f -mtime +"$(( KEEP_WEEKLY * 7 ))"  -delete
    find "$dest/monthly" -name '*.sql.gz' -type f -mtime +"$(( KEEP_MONTHLY * 31 ))" -delete
done