#!/usr/bin/env bash
set -euo pipefail

VERSION="1.0.0"

# UPDATE THESE FOR YOUR REPO
BASE_URL="${BASE_URL:-https://raw.githubusercontent.com/<user>/<project>/main}"

CONFIG_DIR="/etc/restic-backup"
CONFIG_FILE="$CONFIG_DIR/config"
EXCLUDES_FILE="$CONFIG_DIR/excludes"
PRE_HOOKS_DIR="$CONFIG_DIR/pre-backup.d"
STATE_DIR="/var/lib/restic-backup"
MOTD_SCRIPT="/etc/update-motd.d/90-restic-backup-status"
SERVICE_FILE="/etc/systemd/system/restic-backup.service"
TIMER_FILE="/etc/systemd/system/restic-backup.timer"
README_ETC="$CONFIG_DIR/README.md"

FORCE_CONFIG="${1:-}"

echo "Restic backup installer v${VERSION}"

if [[ "$EUID" -ne 0 ]]; then
  echo "This installer must be run as root (use sudo)." >&2
  exit 1
fi

if ! command -v systemctl >/dev/null 2>&1; then
  echo "systemd is required." >&2
  exit 1
fi

if ! command -v apt-get >/dev/null 2>&1; then
  echo "This installer expects an apt-based system (Ubuntu/Debian)." >&2
  exit 1
fi

echo "Installing dependencies (restic, curl)..."
apt-get update -y >/dev/null
apt-get install -y restic curl >/dev/null

echo "Creating directories..."
mkdir -p "$CONFIG_DIR" "$PRE_HOOKS_DIR" "$STATE_DIR"
chmod 750 "$CONFIG_DIR" "$PRE_HOOKS_DIR" "$STATE_DIR"

# ------------------
# CONFIG FILE
# ------------------
if [[ -f "$CONFIG_FILE" && "$FORCE_CONFIG" != "--force-config" ]]; then
  echo "Config file already exists at $CONFIG_FILE"
  echo "Leaving it unchanged. To reconfigure, rerun with: --force-config"
else
  if [[ -f "$CONFIG_FILE" && "$FORCE_CONFIG" == "--force-config" ]]; then
    echo "Reconfiguring existing $CONFIG_FILE"
  else
    echo "Creating new config at $CONFIG_FILE"
  fi

  read -rp "Restic repository name (will be created in Backblaze B2): " RESTIC_REPO
  read -rp "Backblaze B2 Account ID: " B2_ACCOUNT_ID
  read -rp "Backblaze B2 Application Key: " B2_ACCOUNT_KEY
  read -srp "Restic repository password: " RESTIC_PASSWORD
  echo
  read -rp "ntfy URL (e.g. https://ntfy.example.com/topic): " NTFY_URL
  read -srp "ntfy auth key (Bearer token): " NTFY_AUTH_KEY
  echo
  read -rp "Heartbeat URL (optional, press Enter to skip): " HEARTBEAT_URL

  cat >"$CONFIG_FILE" <<EOF
# Restic backup configuration
# Generated by install.sh v${VERSION} on $(date -u +"%Y-%m-%d %H:%M:%S UTC")

# Backblaze B2
B2_ACCOUNT_ID="${B2_ACCOUNT_ID}"
B2_ACCOUNT_KEY="${B2_ACCOUNT_KEY}"

# Restic repository & password
RESTIC_REPOSITORY="b2:${RESTIC_REPO}:/restic/\$HOSTNAME"
RESTIC_PASSWORD="${RESTIC_PASSWORD}"

# Backup scope
INCLUDE_PATHS="/home /root /etc /opt /var/www"
EXCLUDES_FILE="${EXCLUDES_FILE}"

# Prune policy
PRUNE_ARGS="--keep-last 5 --keep-weekly 4 --keep-monthly 3"

# ntfy (self-hosted)
NTFY_URL="${NTFY_URL}"
NTFY_AUTH_KEY="${NTFY_AUTH_KEY}"

# Optional heartbeat URL (leave empty to disable)
HEARTBEAT_URL="${HEARTBEAT_URL}"
EOF

  chmod 600 "$CONFIG_FILE"
fi

# ------------------
# EXCLUDES FILE
# ------------------
if [[ ! -f "$EXCLUDES_FILE" ]]; then
  echo "Creating default excludes file at $EXCLUDES_FILE"
  cat >"$EXCLUDES_FILE" <<EOF
# Default restic excludes
# Add any noisy/problematic paths here.
/proc
/sys
/dev
/run
/tmp
/var/tmp
.vscode-server

# Restic cache (safe to exclude)
/root/.cache/restic

# You can add more below, e.g.:
# /var/log
# /var/cache
EOF
  chmod 644 "$EXCLUDES_FILE"
else
  echo "Excludes file already exists at $EXCLUDES_FILE (leaving as-is)"
fi

# ------------------
# FETCH SCRIPTS
# ------------------
echo "Fetching backup script..."
curl -sSL "$BASE_URL/backup.sh" -o /usr/local/bin/restic-backup.sh
chmod 750 /usr/local/bin/restic-backup.sh
ln -sf /usr/local/bin/restic-backup.sh "$CONFIG_DIR/restic-backup.sh"

echo "Fetching systemd service and timer..."
curl -sSL "$BASE_URL/systemd/restic-backup.service" -o "$SERVICE_FILE"
curl -sSL "$BASE_URL/systemd/restic-backup.timer" -o "$TIMER_FILE"

echo "Fetching timer management helper script..."
curl -sSL "$BASE_URL/systemd/manage-timer.sh" -o "$CONFIG_DIR/manage-timer.sh"
chmod 750 "$CONFIG_DIR/manage-timer.sh"

echo "Fetching MOTD script..."
curl -sSL "$BASE_URL/motd/90-restic-backup-status" -o "$MOTD_SCRIPT"
chmod 755 "$MOTD_SCRIPT"

echo "Fetching example MySQL pre-backup script..."
curl -sSL "$BASE_URL/examples/10-mysql-dump-example.sh" -o "$PRE_HOOKS_DIR/10-mysql-dump-example.sh"
chmod 640 "$PRE_HOOKS_DIR/10-mysql-dump-example.sh"

echo "Fetching init helper script..."
curl -sSL "$BASE_URL/init.sh" -o "$CONFIG_DIR/init.sh"
chmod 750 "$CONFIG_DIR/init.sh"

echo "Fetching restic shell helper script..."
curl -sSL "$BASE_URL/restic-shell.sh" -o "$CONFIG_DIR/restic-shell.sh"
chmod 750 "$CONFIG_DIR/restic-shell.sh"

# ------------------
# README IN /etc/restic-backup
# ------------------
echo "Writing $README_ETC..."
cat >"$README_ETC" <<EOF
# Restic Backup System

Version: ${VERSION}  
Installed on: $(date -u +"%Y-%m-%d %H:%M:%S UTC")

This system provides automated Restic backups to Backblaze B2, with:

- Self-hosted ntfy notifications
- Optional heartbeat monitoring
- Pre-backup hook support
- MOTD warnings for backup issues
- Systemd-based scheduling

Configuration: $CONFIG_FILE  
Excludes: $EXCLUDES_FILE  
Pre-backup hooks: $PRE_HOOKS_DIR  
Status state: $STATE_DIR

To run a backup manually:

  systemctl start restic-backup.service

To see logs:

  journalctl -u restic-backup.service

See this file and comments in the config for more details.
EOF

# ------------------
# SYSTEMD SETUP
# ------------------
echo "Reloading systemd units..."
systemctl daemon-reload

echo
echo "Installation complete."
echo
echo "Next steps:"
echo "  1) Review and customize the config file if needed: $CONFIG_FILE"
echo "  2) Initialize the restic repository and enable the timer by running:"
echo "       sudo /etc/restic-backup/init.sh"
echo
echo "After that, you can run a backup manually with:"
echo "  sudo systemctl start restic-backup.service"
echo "Check logs with:"
echo "  journalctl -u restic-backup.service"