#!/usr/bin/env bash
# Konsistentes, verschluesseltes SQLite-Backup (Konzept 6.8).
# KEK-Backup erfolgt bewusst GETRENNT (siehe Konzept 6.8) -- dieses Skript
# sichert ausschliesslich die Datenbank, kein Schluesselmaterial.
set -euo pipefail

DB_PATH="{{ jumphost_data_dir }}/jumphost.db"
BACKUP_DIR="{{ backup_dir }}"
TS="$(date -u +%Y%m%dT%H%M%SZ)"
OUT_PLAIN="${BACKUP_DIR}/jumphost_${TS}.db"
OUT_ENC="${OUT_PLAIN}.age"

sqlite3 "$DB_PATH" "VACUUM INTO '${OUT_PLAIN}'"
age -r "{{ backup_age_public_key | default('AGE_PUBLIC_KEY_PLACEHOLDER') }}" -o "${OUT_ENC}" "${OUT_PLAIN}"
shred -u "${OUT_PLAIN}"

find "$BACKUP_DIR" -name 'jumphost_*.db.age' -mtime +{{ backup_retention_days }} -delete