#!/usr/bin/env bash
# Nightly backup for the dual IDE stacks (cdsr = code-server, code = Coder v2).
#
# Deliberately NOT backed up: /home/loca/dev/coder/.env and
# /home/loca/dev/coder/.admin-credentials, and
# /home/loca/dev/code-server/.ai-credentials. Those are keys, not data. Losing
# them is recoverable (re-bootstrap the Coder owner via container exec, re-mint
# the LiteLLM virtual key); copying them in plaintext into a nightly archive
# only widens the exposure surface.
#
# Runs as root from stacks-backup.service, so no sudo prefixes here.
set -euo pipefail

DEST="/home/loca/backups/stacks/$(date +%F)"
mkdir -p "$DEST"

# (a) Coder control-plane database
docker compose -f /home/loca/dev/coder/docker-compose.yml exec -T database \
  pg_dump -U coder coder | gzip > "$DEST/coder-db.sql.gz"

# (b) Continue's real state (config + chat sessions live outside the project)
tar czf "$DEST/continue-config.tgz" -C /home/loca .continue

# (c) Stack configuration (source of truth for both deployments)
tar czf "$DEST/stack-configs.tgz" --exclude .git -C /home/loca/dev \
  code-server/config code-server/scripts code-server/deploy \
  coder/docker-compose.yml coder/deploy coder/templates coder/config

# (d) Retention: keep 14 days of dated directories
find /home/loca/backups/stacks -maxdepth 1 -mindepth 1 -type d -mtime +14 \
  -exec rm -rf {} +

printf 'backup complete: %s\n' "$DEST"
ls -l "$DEST"