#!/bin/bash

# ==============================================================================
# Script: vaultwarden_backup.sh
# Description: This script securely backs up Vaultwarden to a designated 
#              mounted drive using rsync. It includes pre-run checks to ensure 
#              the source files and destination are valid, and sends ntfy 
#              notifications for each task.
# Usage:       sudo ./vaultwarden_backup.sh
# Notes:       This script may require sudo/root privileges to access files.
# ==============================================================================

# ==============================================================================
# Define Variables for Source and Destination
# ==============================================================================
BACKUP_MOUNT_POINT="/mnt/5TB-Disk1"
BACKUP_DESTINATION="$BACKUP_MOUNT_POINT/backup"

# Vaultwarden backup directories
VAULTWARDEN_SOURCE_DIR="/srv/docker/vaultwarden/data"
VAULTWARDEN_DESTINATION="$BACKUP_MOUNT_POINT/backup/services/vaultwarden"

# ntfy Notification Configuration
NTFY_TOPIC="Server"
NTFY_SERVER="https://ntfy.speerfam.net"
NTFY_TOKEN="tk_3xo9mejjtgemyowzckqw2souo3mux"

# ==============================================================================
# Pre-flight Checks (for the destination drive)
# ==============================================================================
if ! mountpoint -q "$BACKUP_MOUNT_POINT"; then
    echo "Error: '$BACKUP_MOUNT_POINT' is not a mount point. Please ensure the drive is mounted." >&2
    curl -H "Authorization: Bearer $NTFY_TOKEN" -d "Error: Script failed. Destination '$BACKUP_MOUNT_POINT' is not mounted." "$NTFY_SERVER/$NTFY_TOPIC" > /dev/null 2>&1
    exit 1
fi

# Check if the Vaultwarden source directory exists.
if [ ! -d "$VAULTWARDEN_SOURCE_DIR" ]; then
    echo "Error: Vaultwarden backup source directory '$VAULTWARDEN_SOURCE_DIR' not found." >&2
    curl -H "Authorization: Bearer $NTFY_TOKEN" -d "Error: Script failed. Vaultwarden backup source not found." "$NTFY_SERVER/$NTFY_TOPIC" > /dev/null 2>&1
    exit 1
fi

# ==============================================================================
# Vaultwarden backup
# ==============================================================================
echo "Starting Vaultwarden backup process..."

# Step 1: Clean up any existing database dump files before generating a new one
echo "Cleaning up old local database backup dumps..."
rm -f "$VAULTWARDEN_SOURCE_DIR"/db_*.sqlite3

# Step 2: Execute the Docker command to create the new database backup.
# Note: Removed '-it' flags so this executes properly under automated cron jobs.
echo "Running Vaultwarden backup via Docker..."
sudo docker exec vaultwarden /vaultwarden backup
if [ $? -ne 0 ]; then
    echo "Error: Docker command failed to create Vaultwarden database backup." >&2
    curl -H "Authorization: Bearer $NTFY_TOKEN" -d "Error: Docker command failed to create Vaultwarden database backup." "$NTFY_SERVER/$NTFY_TOPIC" > /dev/null 2>&1
    exit 1
fi

echo "Vaultwarden database backup created successfully."
curl -H "Authorization: Bearer $NTFY_TOKEN" -d "Vaultwarden database backup created. Starting rsync." "$NTFY_SERVER/$NTFY_TOPIC" > /dev/null 2>&1

# Step 3: Rsync the Vaultwarden directories and files to the destination.
echo "Starting rsync of Vaultwarden data to '$VAULTWARDEN_DESTINATION'..."

# Define source files/directories including the newly generated database dump file
VAULTWARDEN_SOURCES=(
    "$VAULTWARDEN_SOURCE_DIR"/db_*.sqlite3
    "$VAULTWARDEN_SOURCE_DIR/attachments"
    "$VAULTWARDEN_SOURCE_DIR/sends"
    "$VAULTWARDEN_SOURCE_DIR/rsa_key.pem"
    "$VAULTWARDEN_SOURCE_DIR/rsa_key.pub.pem"
    "$VAULTWARDEN_SOURCE_DIR/icon_cache"
)

# Ensure destination directory exists
mkdir -p "$VAULTWARDEN_DESTINATION"

# Loop through each source and rsync it.
for source in "${VAULTWARDEN_SOURCES[@]}"; do
    if [ -e "$source" ]; then
        rsync -av --no-owner --no-group "$source" "$VAULTWARDEN_DESTINATION"
        if [ $? -eq 0 ]; then
            echo "Success: '$source' copied to '$VAULTWARDEN_DESTINATION'."
        else
            echo "Error: rsync failed to copy '$source'. Please check permissions." >&2
            curl -H "Authorization: Bearer $NTFY_TOKEN" -d "Error: rsync failed to copy Vaultwarden data." "$NTFY_SERVER/$NTFY_TOPIC" > /dev/null 2>&1
            exit 1
        fi
    fi
done

# Step 4: Clean up local database backup dump file to conserve space on primary disk
echo "Cleaning up temporary database backup dump from source directory..."
rm -f "$VAULTWARDEN_SOURCE_DIR"/db_*.sqlite3

echo "Success: Vaultwarden backup has been successfully copied to '$VAULTWARDEN_DESTINATION'."
curl -H "Authorization: Bearer $NTFY_TOKEN" -d "Success: Vaultwarden backup copied to $VAULTWARDEN_DESTINATION" "$NTFY_SERVER/$NTFY_TOPIC" > /dev/null 2>&1

echo "All rsync tasks completed."
exit 0