#!/usr/bin/env bash
#
# Cavendral Beta — backup diário
# Executa: mariabackup (full DB) + redis BGSAVE + rsync filesystem
# Sync offsite opcional (rsync para srv2).
#
# Cron root: 0 2 * * * /usr/local/bin/backup-cavendral.sh >> /var/log/cavendral/backup.log 2>&1
#
set -euo pipefail

APP_DIR="/opt/cavendral/current"
BACKUP_DIR="/opt/cavendral/backups"
OFFSITE_HOST="${BACKUP_OFFSITE_HOST:-srv2}"
OFFSITE_USER="${BACKUP_OFFSITE_USER:-backup}"
KEEP_DAYS="${BACKUP_KEEP_DAYS:-30}"

TS=$(date +%Y%m%d_%H%M%S)
DEST="${BACKUP_DIR}/${TS}"

mkdir -p "${DEST}"

echo "==> [$(date)] Backup Cavendral -> ${DEST}"

# 1. MariaDB backup (mariabackup full + compress)
echo "  -> mariabackup..."
mariabackup --backup --target-dir="${DEST}/db" \
  --user="${DB_USERNAME:-cavendral_app}" \
  --password="${DB_PASSWORD:-}" \
  --compress \
  --parallel=4

# 2. Redis BGSAVE + cópia dump.rdb
echo "  -> redis BGSAVE..."
redis-cli -h "${REDIS_HOST:-127.0.0.1}" -p "${REDIS_PORT:-6379}" -a "${REDIS_PASSWORD:-}" BGSAVE
sleep 5
cp /var/lib/redis/dump.rdb "${DEST}/redis-dump.rdb" || echo "WARN: dump.rdb não copiado."

# 3. Storage (uploads de feedback, exports, settings)
echo "  -> storage..."
rsync -a "${APP_DIR}/storage/app/feedback/" "${DEST}/feedback/"
rsync -a "${APP_DIR}/storage/app/exports/" "${DEST}/exports/" || true

# 4. .env (sem senhas), MFA secrets cifrados
cp /opt/cavendral/.env "${DEST}/env.txt"

# 5. Audit logs (export adicional)
php "${APP_DIR}/artisan" admin:audit-export --tenant=all > "${DEST}/audit-logs-${TS}.csv" || true

# 6. Integrity verify
echo "  -> verifying mariabackup..."
mariabackup --prepare --target-dir="${DEST}/db" --password="${DB_PASSWORD:-}" >/dev/null

# 7. Compress
echo "  -> compressing..."
tar -czf "${DEST}.tar.gz" -C "${BACKUP_DIR}" "${TS}"
rm -rf "${DEST}"

# 8. Offsite sync (rsync to srv2)
if [[ -n "${OFFSITE_HOST}" ]]; then
    echo "  -> offsite sync to ${OFFSITE_USER}@${OFFSITE_HOST}..."
    rsync -az --delete-after "${BACKUP_DIR}/" "${OFFSITE_USER}@${OFFSITE_HOST}:/backups/cavendral/"
fi

# 9. Prune locais
echo "  -> pruning..."
find "${BACKUP_DIR}" -name "*.tar.gz" -mtime +${KEEP_DAYS} -delete

echo "==> [$(date)] Backup completo: ${DEST}.tar.gz"
echo "Tamanho: $(du -h ${DEST}.tar.gz | cut -f1)"

# Dispara evento para auditoria
php "${APP_DIR}/artisan" tinker -e "event(new \App\Domains\System\Events\BackupCompleted('${DEST}.tar.gz'));" 2>/dev/null || true