#!/bin/sh
set -eu

[ "$(id -u)" = "0" ] || { echo "FAIL must_run_as_root"; exit 1; }
umask 077

rclone_image='rclone/rclone@sha256:623378ad0ff3ebd5cebf77720843c0e02edfe46e2d5b5ac6bed54c6371780dfb'
restic_image='restic/restic@sha256:424a4e1fcc6fe2557b5614239dc71a2c793acb33a83ea217171bd7edc1862dcb'
base=/volume1/xtao-data/backup-controller
ssd=/volume2/xtao-backup/backup-controller
bin="$base/bin"
tmp=$(mktemp -d /tmp/xtao-backup-controller.XXXXXX)
trap 'rm -rf "$tmp"' EXIT HUP INT TERM

mkdir -p "$bin" "$base/canary-source" "$ssd/restores" "$ssd/logs"
chmod 700 "$base" "$bin" "$base/canary-source" "$ssd" "$ssd/restores" "$ssd/logs"

/usr/local/bin/xtao-secret-agent raw-field --entry external/google-drive/offsite-backup --field rclone_token_json > "$tmp/token.json"
/usr/local/bin/xtao-secret-agent raw-field --entry external/google-drive/offsite-backup --field root_folder_id > "$tmp/root_folder_id"
/usr/local/bin/xtao-secret-agent raw-field --entry external/google-drive/offsite-backup --field oauth_client_id > "$tmp/oauth_client_id"
/usr/local/bin/xtao-secret-agent raw-field --entry external/google-drive/offsite-backup --field oauth_client_secret > "$tmp/oauth_client_secret"
/usr/local/bin/xtao-secret-agent raw-field --entry backup/google-drive/restic-repository --field password > "$tmp/restic.pass"
chmod 600 "$tmp/token.json" "$tmp/root_folder_id" "$tmp/oauth_client_id" "$tmp/oauth_client_secret" "$tmp/restic.pass"

python3 - "$tmp/token.json" "$tmp/root_folder_id" "$tmp/oauth_client_id" "$tmp/oauth_client_secret" "$tmp/rclone.conf" <<'PY'
import json, pathlib, sys
token_path, root_path, client_id_path, client_secret_path, config_path = map(pathlib.Path, sys.argv[1:])
token = token_path.read_text(encoding="utf-8").strip()
json.loads(token)
root = root_path.read_text(encoding="utf-8").strip()
if not root or root == "CODEX_GENERATE":
    raise SystemExit("FAIL invalid_root_folder_id")
client_id = client_id_path.read_text(encoding="utf-8").strip()
client_secret = client_secret_path.read_text(encoding="utf-8").strip()
client_lines = ""
if client_id and client_id != "NONE":
    client_lines += f"client_id = {client_id}\n"
if client_secret:
    client_lines += f"client_secret = {client_secret}\n"
config_path.write_text(
    "[xtao-gdrive]\n"
    "type = drive\n"
    "scope = drive.file\n"
    f"{client_lines}"
    f"root_folder_id = {root}\n"
    f"token = {token}\n",
    encoding="utf-8",
)
PY
chmod 600 "$tmp/rclone.conf"

if [ ! -x "$bin/rclone" ]; then
  cid=$(/usr/local/bin/docker create --entrypoint /bin/sh "$rclone_image" -c true)
  /usr/local/bin/docker cp "$cid:/usr/local/bin/rclone" "$tmp/rclone"
  /usr/local/bin/docker rm "$cid" >/dev/null
  install -m 700 "$tmp/rclone" "$bin/rclone"
fi

canary_name="phase02-canary-$(date -u +%Y%m%dT%H%M%SZ).txt"
printf 'xtao backup controller canary %s\n' "$canary_name" > "$tmp/canary.txt"
sha256sum "$tmp/canary.txt" | awk '{print $1}' > "$tmp/canary.sha256"

/usr/local/bin/docker run --rm --network bridge \
  -v "$tmp:/config/rclone" \
  -v "$tmp:/work" \
  "$rclone_image" copyto /work/canary.txt "xtao-gdrive:phase02-canary/$canary_name" >/dev/null
/usr/local/bin/docker run --rm --network bridge \
  -v "$tmp:/config/rclone" \
  -v "$tmp:/work" \
  "$rclone_image" copyto "xtao-gdrive:phase02-canary/$canary_name" /work/canary.download >/dev/null
sha256sum "$tmp/canary.download" | awk '{print $1}' > "$tmp/canary.download.sha256"
cmp "$tmp/canary.sha256" "$tmp/canary.download.sha256"
/usr/local/bin/docker run --rm --network bridge \
  -v "$tmp:/config/rclone" \
  "$rclone_image" deletefile "xtao-gdrive:phase02-canary/$canary_name" >/dev/null

sample="$base/canary-source/sample.txt"
printf 'xtao restic restore sample %s\n' "$canary_name" > "$sample"
sha256sum "$sample" | awk '{print $1}' > "$tmp/sample.sha256"

restic_env="-e RCLONE_CONFIG=/config/rclone/rclone.conf -e RESTIC_PASSWORD_FILE=/secrets/restic.pass -e RESTIC_REPOSITORY=rclone:xtao-gdrive:restic/nas"
set +e
/usr/local/bin/docker run --rm --network bridge \
  -v "$tmp:/config/rclone" \
  -v "$tmp/restic.pass:/secrets/restic.pass:ro" \
  -v "$bin/rclone:/usr/local/bin/rclone:ro" \
  $restic_env \
  "$restic_image" init >/tmp/xtao-restic-init.out 2>&1
rc=$?
set -e
if [ "$rc" -ne 0 ] && ! grep -Eq 'already initialized|config file already exists' /tmp/xtao-restic-init.out; then
  cat /tmp/xtao-restic-init.out
  echo "FAIL restic_init"
  exit 2
fi
/usr/local/bin/docker run --rm --network bridge \
  -v "$tmp:/config/rclone" \
  -v "$tmp/restic.pass:/secrets/restic.pass:ro" \
  -v "$bin/rclone:/usr/local/bin/rclone:ro" \
  -v "$base/canary-source:/data/canary-source:ro" \
  $restic_env \
  "$restic_image" backup /data/canary-source >/tmp/xtao-restic-backup.out
restore="$tmp/restore"
mkdir -p "$restore"
/usr/local/bin/docker run --rm --network bridge \
  -v "$tmp:/config/rclone" \
  -v "$tmp/restic.pass:/secrets/restic.pass:ro" \
  -v "$bin/rclone:/usr/local/bin/rclone:ro" \
  -v "$restore:/restore" \
  $restic_env \
  "$restic_image" restore latest --target /restore >/tmp/xtao-restic-restore.out
sha256sum "$restore/data/canary-source/sample.txt" | awk '{print $1}' > "$tmp/restore.sha256"
cmp "$tmp/sample.sha256" "$tmp/restore.sha256"
cp "$tmp/restore.sha256" "$ssd/logs/last-restore.sha256"
echo "PASS backup_controller gdrive_canary=PASS restic_backup_restore=PASS values=redacted"