#!/bin/bash

# ==============================================================================
# Script: vaultwarden_backup.sh
# Description: Backs up Vaultwarden to timestamped directories on a mounted 
#              drive using Docker exec and rsync. Compatible with non-POSIX 
#              filesystems (exFAT, NTFS, FAT32) and automatically prunes 
#              backups older than RETENTION_DAYS.
# Usage:       sudo ./vaultwarden_backup.sh
# Notes:       Must be run with root/sudo privileges.
# ==============================================================================

# ==============================================================================
# Define Variables for Source, Destination, and Retention
# ==============================================================================
BACKUP_MOUNT_POINT="/mnt/5TB-Disk1"
VAULTWARDEN_DATA_DIR="/srv/docker/vaultwarden/data"
VAULTWARDEN_DESTINATION="$BACKUP_MOUNT_POINT/backup/services/vaultwarden"

CONTAINER_NAME="vaultwarden"
RETENTION_DAYS=30

# Timestamp and Folder Setup
TIMESTAMP=$(date +"%Y-%m-%d_%H%M%S")
CURRENT_BACKUP_DIR="$VAULTWARDEN_DESTINATION/backup_$TIMESTAMP"
LATEST_TXT_FILE="$VAULTWARDEN_DESTINATION/latest.txt"

# ntfy Notification Configuration
NTFY_TOPIC="Server"
NTFY_SERVER="https://ntfy.speerfam.net"
NTFY_TOKEN="tk_3xo9mejjtgemyowzckqw2souo3mux"

# ==============================================================================
# Pre-flight Checks
# ==============================================================================

# Check if the mount point directory exists and is a mounted filesystem.
if ! mountpoint -q "$BACKUP_MOUNT_POINT"; then
    echo "Error: '$BACKUP_MOUNT_POINT' is not a mount point. Please ensure the drive is mounted." >&2
    curl -H "Authorization: Bearer $NTFY_TOKEN" -d "Error: Script failed. Destination '$BACKUP_MOUNT_POINT' is not mounted." "$NTFY_SERVER/$NTFY_TOPIC" > /dev/null 2>&1
    exit 1
fi

# Check if the Vaultwarden source directory exists on the host.
if [ ! -d "$VAULTWARDEN_DATA_DIR" ]; then
    echo "Error: Vaultwarden source directory '$VAULTWARDEN_DATA_DIR' not found." >&2
    curl -H "Authorization: Bearer $NTFY_TOKEN" -d "Error: Script failed. Vaultwarden data directory '$VAULTWARDEN_DATA_DIR' not found." "$NTFY_SERVER/$NTFY_TOPIC" > /dev/null 2>&1
    exit 1
fi

# Check if the Docker container is running.
if ! docker ps --format '{{.Names}}' | grep -q "^${CONTAINER_NAME}$"; then
    echo "Error: Docker container '$CONTAINER_NAME' is not running." >&2
    curl -H "Authorization: Bearer $NTFY_TOKEN" -d "Error: Script failed. Docker container '$CONTAINER_NAME' is not running." "$NTFY_SERVER/$NTFY_TOPIC" > /dev/null 2>&1
    exit 1
fi

# Create target directory for current run
mkdir -p "$CURRENT_BACKUP_DIR"

# ==============================================================================
# Vaultwarden Backup Execution
# ==============================================================================
echo "Starting Vaultwarden backup ($TIMESTAMP)..."

# Step 1: Trigger in-container database backup
docker exec "$CONTAINER_NAME" /vaultwarden backup
DB_STATUS=$?

if [ $DB_STATUS -ne 0 ]; then
    echo "Error: Vaultwarden docker exec backup failed with exit code $DB_STATUS." >&2
    curl -H "Authorization: Bearer $NTFY_TOKEN" -d "Error: Vaultwarden internal DB backup command failed." "$NTFY_SERVER/$NTFY_TOPIC" > /dev/null 2>&1
    rm -rf "$CURRENT_BACKUP_DIR"
    exit 1
fi

# Step 2: Locate the newly generated database snapshot in the host data dir
LATEST_DB_BACKUP=$(ls -t "$VAULTWARDEN_DATA_DIR"/db_*.sqlite3 2>/dev/null | head -n 1)

if [ -z "$LATEST_DB_BACKUP" ]; then
    echo "Error: Could not locate generated db_*.sqlite3 backup file in '$VAULTWARDEN_DATA_DIR'." >&2
    curl -H "Authorization: Bearer $NTFY_TOKEN" -d "Error: Vaultwarden backup snapshot file missing after exec." "$NTFY_SERVER/$NTFY_TOPIC" > /dev/null 2>&1
    rm -rf "$CURRENT_BACKUP_DIR"
    exit 1
fi

# Rsync the snapshot file into the timestamped directory as db.sqlite3
echo "Rsyncing database snapshot to '$CURRENT_BACKUP_DIR/db.sqlite3'..."
rsync -av --no-owner --no-group "$LATEST_DB_BACKUP" "$CURRENT_BACKUP_DIR/db.sqlite3"
RSYNC_DB_STATUS=$?

# Cleanup local temporary snapshot file
rm -f "$LATEST_DB_BACKUP"

if [ $RSYNC_DB_STATUS -ne 0 ]; then
    echo "Error: rsync failed to copy database snapshot file." >&2
    curl -H "Authorization: Bearer $NTFY_TOKEN" -d "Error: rsync failed during Vaultwarden DB snapshot sync." "$NTFY_SERVER/$NTFY_TOPIC" > /dev/null 2>&1
    exit 1
fi

# Step 3: Find previous backup directory for --link-dest (if filesystem supports it)
PREVIOUS_BACKUP_DIR=$(ls -td "$VAULTWARDEN_DESTINATION"/backup_* 2>/dev/null | grep -v "$CURRENT_BACKUP_DIR" | head -n 1)

LINK_DEST_PARAM=""
if [ -n "$PREVIOUS_BACKUP_DIR" ] && [ -d "$PREVIOUS_BACKUP_DIR" ]; then
    LINK_DEST_PARAM="--link-dest=$PREVIOUS_BACKUP_DIR"
fi

echo "Rsyncing attachments, RSA keys, and configuration files..."
rsync -av --no-owner --no-group $LINK_DEST_PARAM --exclude='db.sqlite3*' "$VAULTWARDEN_DATA_DIR/" "$CURRENT_BACKUP_DIR/"
RSYNC_DATA_STATUS=$?

if [ $RSYNC_DATA_STATUS -ne 0 ]; then
    echo "Error: rsync failed during remaining files sync." >&2
    curl -H "Authorization: Bearer $NTFY_TOKEN" -d "Error: rsync failed during Vaultwarden data backup." "$NTFY_SERVER/$NTFY_TOPIC" > /dev/null 2>&1
    exit 1
fi

# Step 4: Record current backup path to latest.txt
echo "$CURRENT_BACKUP_DIR" > "$LATEST_TXT_FILE"

# ==============================================================================
# Retention Cleanup (Prune Backups Older than RETENTION_DAYS)
# ==============================================================================
echo "Checking for backups older than $RETENTION_DAYS days..."
find "$VAULTWARDEN_DESTINATION" -maxdepth 1 -type d -name "backup_*" -mtime +$RETENTION_DAYS -exec rm -rf {} +

# ==============================================================================
# Completion and Notification
# ==============================================================================
echo "Success: Vaultwarden backup completed at '$CURRENT_BACKUP_DIR'."
curl -H "Authorization: Bearer $NTFY_TOKEN" -d "Success: Vaultwarden backup completed ($TIMESTAMP). Retaining $RETENTION_DAYS days." "$NTFY_SERVER/$NTFY_TOPIC" > /dev/null 2>&1