#!/bin/bash
# ============================================
# Encrypted Backup Script for SIAKAD
# Run daily via cron: 0 2 * * * /var/www/siakad/scripts/security/backup-encrypted.sh
# ============================================

set -euo pipefail

# Configuration
BACKUP_DIR="/backup/siakad"
DB_NAME="siakad_db"
DB_USER="siakad_backup"
DB_PASS="${DB_BACKUP_PASSWORD:-}"
ENCRYPTION_KEY="${BACKUP_ENCRYPTION_KEY:-}"
RETENTION_DAYS=30
APP_DIR="/var/www/siakad"
DATE=$(date +%Y%m%d_%H%M%S)
HOSTNAME=$(hostname)

# Create backup directory
mkdir -p "${BACKUP_DIR}"

# Check encryption key
if [ -z "$ENCRYPTION_KEY" ]; then
    echo "ERROR: BACKUP_ENCRYPTION_KEY not set"
    exit 1
fi

# Generate backup filename
BACKUP_PREFIX="siakad_${HOSTNAME}_${DATE}"

echo "[$(date)] Starting backup: ${BACKUP_PREFIX}"

# 1. Database Backup
echo "[$(date)] Backing up database..."
mysqldump \
    --single-transaction \
    --routines \
    --triggers \
    --lock-tables=false \
    --set-gtid-purged=OFF \
    -u "${DB_USER}" \
    -p"${DB_PASS}" \
    "${DB_NAME}" | \
    gzip | \
    openssl enc -aes-256-cbc -salt -pbkdf2 -pass pass:"${ENCRYPTION_KEY}" \
    > "${BACKUP_DIR}/${BACKUP_PREFIX}_database.sql.gz.enc"

echo "[$(date)] Database backup completed"

# 2. Application Files Backup
echo "[$(date)] Backing up application files..."
tar czf - \
    --exclude='vendor' \
    --exclude='node_modules' \
    --exclude='storage/logs/*' \
    --exclude='storage/framework/cache/*' \
    --exclude='storage/framework/sessions/*' \
    --exclude='.git' \
    -C "$(dirname ${APP_DIR})" \
    "$(basename ${APP_DIR})" | \
    openssl enc -aes-256-cbc -salt -pbkdf2 -pass pass:"${ENCRYPTION_KEY}" \
    > "${BACKUP_DIR}/${BACKUP_PREFIX}_files.tar.gz.enc"

echo "[$(date)] Files backup completed"

# 3. Environment Config Backup
echo "[$(date)] Backing up environment config..."
tar czf - -C "${APP_DIR}" .env config/ | \
    openssl enc -aes-256-cbc -salt -pbkdf2 -pass pass:"${ENCRYPTION_KEY}" \
    > "${BACKUP_DIR}/${BACKUP_PREFIX}_config.tar.gz.enc"

echo "[$(date)] Config backup completed"

# 4. Generate checksums
echo "[$(date)] Generating checksums..."
cd "${BACKUP_DIR}"
sha256sum ${BACKUP_PREFIX}_* > "${BACKUP_PREFIX}_checksums.sha256"

echo "[$(date)] Backup checksums:"
cat "${BACKUP_PREFIX}_checksums.sha256"

# 5. Upload to remote (optional - configure rclone/s3cmd)
# if command -v rclone &> /dev/null; then
#     echo "[$(date)] Uploading to remote storage..."
#     rclone copy "${BACKUP_DIR}/${BACKUP_PREFIX}_*" remote:siakad-backups/
# fi

# 6. Cleanup old backups
echo "[$(date)] Cleaning up old backups (>${RETENTION_DAYS} days)..."
find "${BACKUP_DIR}" -name "siakad_*" -mtime +${RETENTION_DAYS} -delete

# 7. Verify backup
echo "[$(date)] Verifying backup..."
if openssl enc -aes-256-cbc -d -pbkdf2 -pass pass:"${ENCRYPTION_KEY}" -in "${BACKUP_DIR}/${BACKUP_PREFIX}_database.sql.gz.enc" | gzip -t; then
    echo "[$(date)] Backup verification: SUCCESS"
else
    echo "[$(date)] Backup verification: FAILED"
    exit 1
fi

# 8. Send notification (optional)
# if command -v mail &> /dev/null; then
#     echo "Backup completed: ${BACKUP_PREFIX}" | mail -s "SIAKAD Backup Success" admin@undarma.ac.id
# fi

# Log completion
BACKUP_SIZE=$(du -sh "${BACKUP_DIR}/${BACKUP_PREFIX}_*" | awk '{sum+=$1} END {print sum}')
echo "[$(date)] Backup completed: ${BACKUP_PREFIX}"
echo "[$(date)] Total size: ${BACKUP_SIZE}"
echo "[$(date)] Backup files:"
ls -lh "${BACKUP_DIR}/${BACKUP_PREFIX}_*"

# Write to system log
logger -t siakad-backup "Backup ${BACKUP_PREFIX} completed successfully"