#!/usr/bin/env bash
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

#export RESTIC_REPOSITORY="sftp:glen@thalassa.local:/Users/glen/backups/restic-starbak"
export RESTIC_REPOSITORY="sftp:glen@192.168.0.247:/Users/glen/backups/restic-starbak"
export RESTIC_PASSWORD_FILE="${SCRIPT_DIR}/.password"

EXCLUDE_FILE="${SCRIPT_DIR}/excludes.txt"

# Force macOS system ssh — the nix restic wrapper prepends nix openssh to PATH,
# which lacks macOS network entitlements and fails inside tmux
SFTP_OPTS=(-o "sftp.command=/usr/bin/ssh glen@192.168.0.247 -s sftp")

if [ ! -f "$RESTIC_PASSWORD_FILE" ]; then
  echo "Error: Password file not found at $RESTIC_PASSWORD_FILE"
  echo "Create it with: head -c 32 /dev/urandom | base64 > ${RESTIC_PASSWORD_FILE}"
  echo "Then: chmod 600 ${RESTIC_PASSWORD_FILE}"
  exit 1
fi

case "${1:-backup}" in
  init)
    restic "${SFTP_OPTS[@]}" init
    ;;
  backup)
    restic "${SFTP_OPTS[@]}" backup \
      /Users/glen \
      --exclude-file="$EXCLUDE_FILE" \
      --exclude-caches \
      --one-file-system \
      --verbose
    ;;
  snapshots)
    restic "${SFTP_OPTS[@]}" snapshots
    ;;
  prune)
    restic "${SFTP_OPTS[@]}" forget \
      --keep-hourly 24 \
      --keep-daily 7 \
      --keep-weekly 4 \
      --keep-monthly 12 \
      --keep-yearly 3 \
      --prune
    ;;
  check)
    restic "${SFTP_OPTS[@]}" check
    ;;
  stats)
    # per-snapshot sizes; pass snapshot ID for a specific one
    restic "${SFTP_OPTS[@]}" stats "${2:-latest}"
    ;;
  diff)
    # diff two snapshots: ./backup.sh diff <id1> <id2>
    restic "${SFTP_OPTS[@]}" diff "${2:?snapshot1 ID required}" "${3:?snapshot2 ID required}"
    ;;
  mount)
    MOUNT_POINT="${2:-/tmp/restic-mount}"
    mkdir -p "$MOUNT_POINT"
    restic "${SFTP_OPTS[@]}" mount "$MOUNT_POINT"
    ;;
  *)
    echo "Usage: $0 {init|backup|snapshots|prune|check|stats [id]|diff <id1> <id2>|mount [path]}"
    exit 1
    ;;
esac