#!/bin/sh
# Full-instance backups for a Docker Compose install of Sure.
#
# Runs as the `backup` service, from the same Sure image as web/worker (see
# compose.example.yml). A backup bundle holds everything needed to bring the
# same version back up elsewhere:
#
#   $BACKUP_DIR/<version>/<YYYY-MM-DD_HHMMSS>-<manual|scheduled>/
#     manifest.json    version, commit, image tags, schema version, ...
#     db.dump          pg_dump custom format
#     storage.tar.gz   the app-storage volume (uploaded files)
#     config/          the host's .env (contains secrets), compose file(s) and
#                      bin/sure-backup
#     restore.sh       restores the bundle into a new folder (see `recover`)
#     SHA256SUMS
#
# Usage (from the compose directory):
#   docker compose run --rm backup create [--version X] [--commit SHA]
#   docker compose run --rm backup list
#   docker compose run --rm backup restore <version/name | path | latest> [--yes] [--force]
#   docker compose run --rm backup prune
#
# With no arguments it runs `scheduled` (create + prune) every day at the time
# in BACKUP_SCHEDULE ("M H * * *", UTC). Off-site copies are made by the
# separate `backup-offsite` service.
#
# Or on the host, from the folder with compose.yml, without a backup service
# (works for any Sure version, including 0.7.5 and older):
#   sh sure-backup create | list | restore <backup> | prune
#
# On the host, a bundle restores itself into a new project folder:
#   sh <bundle>/restore.sh [--target DIR] [--port N] [--with-worker | --without-worker] [--yes]
# which runs `sure-backup recover <bundle> ...`. It needs Docker with Compose.
set -e

# shellcheck disable=SC3040
if (set -o pipefail 2>/dev/null); then
  set -o pipefail
fi

BACKUP_DIR=${BACKUP_DIR_IN_CONTAINER:-/backups}
STORAGE_DIR=${SURE_STORAGE_DIR:-/rails/storage}
CONFIG_DIR=${SURE_CONFIG_DIR:-/config}
STAMP_FILE="${STORAGE_DIR}/.sure-runtime"
IMAGE_REPO=${SURE_IMAGE_REPO:-ghcr.io/we-promise/sure}

BACKUP_SCHEDULE=${BACKUP_SCHEDULE:-0 2 * * *}
BACKUP_KEEP_DAYS=${BACKUP_KEEP_DAYS:-7}
INSTANCE_ID=${INSTANCE_ID:-default}
POSTGRES_PORT=${POSTGRES_PORT:-5432}

log() { echo "[sure-backup] $*"; }
warn() { echo "[sure-backup] WARNING: $*" >&2; }
die() { echo "[sure-backup] ERROR: $*" >&2; exit 1; }

usage() {
  awk 'NR > 1 && /^#/ { sub(/^# ?/, ""); print; next } NR > 1 { exit }' "$0"
}

# --- setup -------------------------------------------------------------------

ensure_deps() {
  # The Sure image has all of these. The apk fallback keeps Alpine-based
  # backup services from v0.7.5 working.
  missing=""
  if ! command -v pg_dump >/dev/null 2>&1; then
    # Prefer the client the Sure image ships (17); dumps it makes need a
    # pg_restore at least that new. Older Alpine releases only have 16.
    if apk search -q postgresql17-client 2>/dev/null | grep -qx postgresql17-client; then
      missing="$missing postgresql17-client"
    else
      missing="$missing postgresql16-client~=16"
    fi
  fi
  # BusyBox tar lacks --numeric-owner/--exclude semantics we rely on.
  tar --version 2>/dev/null | grep -q "GNU tar" || missing="$missing tar~=1"
  [ -z "$missing" ] && return 0

  command -v apk >/dev/null 2>&1 || die "missing tools (${missing# }) and no apk to install them"
  log "Installing:${missing}"
  # shellcheck disable=SC2086
  if ! apk_out=$(apk add --no-cache --quiet $missing 2>&1); then
    echo "$apk_out" >&2
    die "could not install required packages"
  fi
}

check_db_env() {
  if [ -z "$POSTGRES_DB" ] || [ -z "$POSTGRES_USER" ] || [ -z "$POSTGRES_PASSWORD" ] || [ -z "$POSTGRES_HOST" ]; then
    die "database connection variables are not fully set"
  fi

  case "${POSTGRES_HOST}${POSTGRES_PORT}${POSTGRES_DB}${POSTGRES_USER}${POSTGRES_PASSWORD}" in
    *"
"*)
      die "database connection parameters must not contain newlines"
      ;;
  esac
}

check_keep_days() {
  if ! [ "$BACKUP_KEEP_DAYS" -gt 0 ] 2>/dev/null; then
    die "BACKUP_KEEP_DAYS must be a positive integer (got: ${BACKUP_KEEP_DAYS})"
  fi
}

# Write a .pgpass with escaped fields so the password never hits argv.
setup_pgpass() {
  WORK_DIR=$(umask 077 && mktemp -d)
  trap 'rm -rf "${WORK_DIR}"' EXIT INT TERM

  pg_esc() { printf '%s' "$1" | sed -e 's/\\/\\\\/g' -e 's/:/\\:/g'; }

  # "*" for the database so dropdb/createdb can use the maintenance database.
  (umask 077 && printf '%s:%s:*:%s:%s\n' \
    "$(pg_esc "$POSTGRES_HOST")" "$(pg_esc "$POSTGRES_PORT")" \
    "$(pg_esc "$POSTGRES_USER")" "$(pg_esc "$POSTGRES_PASSWORD")" > "${WORK_DIR}/.pgpass")
  export PGPASSFILE="${WORK_DIR}/.pgpass"
  export PGHOST="$POSTGRES_HOST" PGPORT="$POSTGRES_PORT" PGUSER="$POSTGRES_USER"
}

psql_value() {
  psql -X -q -t -A -v ON_ERROR_STOP=1 -d "${2:-$POSTGRES_DB}" -c "$1"
}

json_str() {
  printf '"%s"' "$(printf '%s' "$1" | sed -e 's/\\/\\\\/g' -e 's/"/\\"/g')"
}

manifest_value() {
  sed -n "s/^[[:space:]]*\"$2\": \"\([^\"]*\)\".*/\1/p" "$1/manifest.json" | head -n 1
}

# The Sure image ships an empty /rails/storage, so "is a directory" is not
# enough: the uploaded-files volume must actually be mounted there.
storage_mounted() {
  [ -d "$STORAGE_DIR" ] && awk -v d="$STORAGE_DIR" '$2 == d { found = 1 } END { exit !found }' /proc/mounts 2>/dev/null
}

stamp_value() {
  sed -n "s/^$1=//p" "$STAMP_FILE" 2>/dev/null | head -n 1
}

# --- create ------------------------------------------------------------------

cmd_create() {
  trigger=manual
  version=""
  commit=""
  while [ $# -gt 0 ]; do
    case "$1" in
      --version) version=$2; shift 2 ;;
      --commit) commit=$2; shift 2 ;;
      --scheduled) trigger=scheduled; shift ;;
      *) die "unknown option for create: $1" ;;
    esac
  done

  check_db_env
  ensure_deps
  setup_pgpass

  db_schema=$(psql_value "SELECT max(version) FROM schema_migrations" 2>/dev/null) \
    || die "cannot read schema_migrations from ${POSTGRES_DB}; is the database initialized?"

  # The web container stamps the version that migrated the database. Trust it
  # only if the database is still at that schema, otherwise the stamp is stale
  # (e.g. the image was swapped but web has not booted the new one yet).
  if [ -f "$STAMP_FILE" ]; then
    stamp_version=$(stamp_value SURE_VERSION)
    stamp_schema=$(stamp_value SURE_SCHEMA_VERSION)
    if [ -n "$version" ] && [ "$version" != "$stamp_version" ]; then
      die "--version ${version} disagrees with the running app (${stamp_version}); drop --version"
    fi
    if [ "$stamp_schema" != "$db_schema" ]; then
      die "database schema ${db_schema} does not match the app's stamped schema ${stamp_schema} (version ${stamp_version}). Start the web service so it re-stamps, then retry."
    fi
    version=$stamp_version
    commit=${commit:-$(stamp_value SURE_COMMIT)}
  elif [ -z "$version" ] && [ -f /rails/.sure-version ] && [ -f /rails/db/schema.rb ]; then
    # Running in a Sure image that predates stamping: use the image's own
    # version, but only if the database is at that version's schema.
    image_version=$(tr -d '[:space:]' < /rails/.sure-version)
    image_schema=$(sed -n 's/.*define(version: \([0-9_]*\)).*/\1/p' /rails/db/schema.rb | tr -d _)
    if [ "$image_schema" != "$db_schema" ]; then
      die "database schema ${db_schema} does not match this image (Sure ${image_version}, schema ${image_schema}). Run the backup with the image the app runs on, or pass --version."
    fi
    version=$image_version
    commit=${commit:-${BUILD_COMMIT_SHA:-}}
    log "No version stamp; using this image's version ${version} (database schema matches)"
  elif [ -z "$version" ]; then
    die "no version stamp at ${STAMP_FILE} (app image predates stamping). Pass --version, e.g. --version 0.7.4"
  else
    warn "no version stamp; trusting --version ${version}"
  fi

  case "$version" in
    "" | *[!A-Za-z0-9._+-]*) die "invalid version: ${version}" ;;
  esac

  name="$(date -u +%Y-%m-%d_%H%M%S)-${trigger}"
  final_dir="${BACKUP_DIR}/${version}/${name}"
  [ -e "$final_dir" ] && die "${final_dir} already exists"

  tmp_dir="${BACKUP_DIR}/.tmp-${name}-$$"
  mkdir -p "$BACKUP_DIR"
  (umask 077 && mkdir -p "${tmp_dir}/config")
  trap 'rm -rf "${WORK_DIR}" "${tmp_dir}"' EXIT INT TERM

  log "Backing up Sure ${version} to ${version}/${name}"

  log "Dumping database ${POSTGRES_DB}..."
  (umask 077 && pg_dump -Fc -d "$POSTGRES_DB" -f "${tmp_dir}/db.dump")

  storage_service=""
  if [ -f "${CONFIG_DIR}/.env" ]; then
    storage_service=$(sed -n 's/^ACTIVE_STORAGE_SERVICE=//p' "${CONFIG_DIR}/.env" | tail -n 1 | tr -d '"'"'"' ')
  fi
  case "$storage_service" in
    "" | local) ;;
    *) warn "uploaded files are stored in '${storage_service}' (ACTIVE_STORAGE_SERVICE), not in this backup" ;;
  esac

  if storage_mounted; then
    log "Archiving file storage..."
    (umask 077 && tar -C "$STORAGE_DIR" --numeric-owner --exclude=./.sure-runtime -czf "${tmp_dir}/storage.tar.gz" .)
  else
    warn "${STORAGE_DIR} is not mounted; uploaded files are NOT included"
  fi

  if [ -f "${CONFIG_DIR}/.env" ]; then
    cp "${CONFIG_DIR}/.env" "${tmp_dir}/config/.env"
  else
    warn "no .env in ${CONFIG_DIR}; it is NOT included"
  fi
  for f in compose.yml compose.yaml docker-compose.yml docker-compose.yaml; do
    [ -f "${CONFIG_DIR}/${f}" ] || continue
    cp "${CONFIG_DIR}/${f}" "${tmp_dir}/config/${f}"
    compose_found=true
  done
  [ "${compose_found:-}" = true ] || warn "no compose file in ${CONFIG_DIR}; it is NOT included"
  for f in compose.override.yml compose.override.yaml docker-compose.override.yml docker-compose.override.yaml; do
    [ -f "${CONFIG_DIR}/${f}" ] && cp "${CONFIG_DIR}/${f}" "${tmp_dir}/config/${f}"
  done
  find "${tmp_dir}/config" -type f -exec chmod 0600 {} +
  # This script and an entry point for it, so a bundle restores on its own.
  mkdir -p "${tmp_dir}/config/bin"
  cp "$0" "${tmp_dir}/config/bin/sure-backup"
  chmod 0755 "${tmp_dir}/config/bin/sure-backup"
  cat > "${tmp_dir}/restore.sh" <<'EOF'
#!/bin/sh
# Restores this backup into a new folder as a separate Sure instance.
# Run it with: sh restore.sh   (needs Docker with Compose; --help for options)
dir=$(cd "$(dirname "$0")" && pwd)
exec sh "$dir/config/bin/sure-backup" recover "$dir" "$@"
EOF
  chmod 0755 "${tmp_dir}/restore.sh"

  pg_server=$(psql_value "SHOW server_version")
  if [ -n "$commit" ]; then
    commit_json=$(json_str "$commit")
    image_by_commit_json=$(json_str "${IMAGE_REPO}:sha-${commit}")
  else
    commit_json=null
    image_by_commit_json=null
  fi
  # One key per line: manifest_value reads it back with sed.
  {
    echo "{"
    echo "  \"format\": 1,"
    echo "  \"sure_version\": $(json_str "$version"),"
    echo "  \"sure_commit\": ${commit_json},"
    echo "  \"image\": $(json_str "${IMAGE_REPO}:${version}"),"
    echo "  \"image_by_commit\": ${image_by_commit_json},"
    echo "  \"schema_version\": $(json_str "$db_schema"),"
    echo "  \"created_at\": $(json_str "$(date -u +%Y-%m-%dT%H:%M:%SZ)"),"
    echo "  \"trigger\": $(json_str "$trigger"),"
    echo "  \"instance_id\": $(json_str "$INSTANCE_ID"),"
    echo "  \"database\": $(json_str "$POSTGRES_DB"),"
    echo "  \"postgres_server_version\": $(json_str "$pg_server"),"
    echo "  \"pg_dump_version\": $(json_str "$(pg_dump --version)")"
    echo "}"
  } > "${tmp_dir}/manifest.json"

  (cd "$tmp_dir" && find . -type f | sort | xargs sha256sum > "${WORK_DIR}/SHA256SUMS")
  mv "${WORK_DIR}/SHA256SUMS" "${tmp_dir}/SHA256SUMS"

  mkdir -p "${BACKUP_DIR}/${version}"
  mv "$tmp_dir" "$final_dir"
  log "Done: ${final_dir} ($(du -sh "$final_dir" | cut -f1))"
}

# --- list --------------------------------------------------------------------

bundles() {
  # Newest first; the directory name starts with a sortable UTC timestamp.
  find "$BACKUP_DIR" -mindepth 3 -maxdepth 3 -name manifest.json ! -path '*/.tmp-*' 2>/dev/null \
    | while read -r m; do
        d=$(dirname "$m")
        printf '%s\t%s\n' "$(basename "$d")" "$d"
      done | sort -r | cut -f2
}

cmd_list() {
  found=$(bundles)
  if [ -z "$found" ]; then
    log "No backups in ${BACKUP_DIR}"
    return 0
  fi
  printf '%-40s %-10s %-8s %s\n' "BACKUP" "TRIGGER" "SIZE" "IMAGE"
  echo "$found" | while read -r d; do
    printf '%-40s %-10s %-8s %s\n' \
      "${d#"${BACKUP_DIR}"/}" \
      "$(manifest_value "$d" trigger)" \
      "$(du -sh "$d" | cut -f1)" \
      "$(manifest_value "$d" image)"
  done
}

# --- restore -----------------------------------------------------------------

resolve_bundle() {
  case "$1" in
    "") die "restore needs a backup id (see 'list'), a path, or 'latest'" ;;
    latest) dir=$(bundles | head -n 1) ;;
    /*) dir=$1 ;;
    *) dir="${BACKUP_DIR}/$1" ;;
  esac
  [ -n "$dir" ] && [ -f "${dir}/manifest.json" ] || die "no backup found at ${dir:-$1}"
  echo "$dir"
}

env_secret_hash() {
  [ -f "$1" ] || return 0
  sed -n 's/^SECRET_KEY_BASE=//p' "$1" | tail -n 1 | sha256sum | cut -c1-16
}

cmd_restore() {
  target=""
  assume_yes=false
  force=false
  while [ $# -gt 0 ]; do
    case "$1" in
      --yes) assume_yes=true; shift ;;
      --force) force=true; shift ;;
      -*) die "unknown option for restore: $1" ;;
      *) target=$1; shift ;;
    esac
  done

  check_db_env
  ensure_deps
  dir=$(resolve_bundle "$target")
  setup_pgpass

  log "Verifying checksums..."
  (cd "$dir" && sha256sum -c SHA256SUMS >/dev/null) || die "checksum verification failed for ${dir}"

  version=$(manifest_value "$dir" sure_version)
  image=$(manifest_value "$dir" image)
  image_by_commit=$(manifest_value "$dir" image_by_commit)

  # pg_restore can't read dumps made by a newer pg_dump; say so plainly.
  dump_major=$(manifest_value "$dir" pg_dump_version | sed -n 's/.* \([0-9][0-9]*\)\..*/\1/p')
  client_major=$(pg_restore --version | sed -n 's/.* \([0-9][0-9]*\)\..*/\1/p')
  case "$client_major" in "" | *[!0-9]*) die "cannot read the pg_restore version" ;; esac
  case "$dump_major" in *[!0-9]*) dump_major="" ;; esac
  if [ -n "$dump_major" ] && [ "$dump_major" -gt "$client_major" ]; then
    die "this backup was made with pg_dump ${dump_major}, but this pg_restore is ${client_major}. Restore it from the host with 'sh sure-backup restore', which runs in the Sure image, or with PostgreSQL ${dump_major} client tools."
  fi

  # Checked up front so a missing mount can't leave a half-restored instance.
  if [ -f "${dir}/storage.tar.gz" ] && ! storage_mounted; then
    die "${STORAGE_DIR} is not mounted; cannot restore uploaded files"
  fi

  others=$(psql_value "SELECT count(*) FROM pg_stat_activity WHERE datname = '${POSTGRES_DB}' AND pid <> pg_backend_pid()" postgres)
  if [ "$others" -gt 0 ] && [ "$force" != true ]; then
    die "${others} other connection(s) to ${POSTGRES_DB}. Stop the app first: docker compose stop web worker (or pass --force)"
  fi

  if [ "$assume_yes" != true ]; then
    if [ -t 0 ]; then
      printf 'This REPLACES database %s and all uploaded files with %s. Type "restore" to continue: ' "$POSTGRES_DB" "${dir#"${BACKUP_DIR}"/}"
      read -r answer
      [ "$answer" = "restore" ] || die "aborted"
    else
      die "refusing to restore without a TTY; pass --yes"
    fi
  fi

  log "Recreating database ${POSTGRES_DB}..."
  dropdb --maintenance-db=postgres --if-exists --force "$POSTGRES_DB"
  createdb --maintenance-db=postgres -O "$POSTGRES_USER" "$POSTGRES_DB"

  log "Restoring database..."
  server_major=$(( $(psql_value "SHOW server_version_num" postgres) / 10000 ))
  if [ "$client_major" -le "$server_major" ]; then
    pg_restore --no-owner --role="$POSTGRES_USER" --exit-on-error -d "$POSTGRES_DB" "${dir}/db.dump"
  else
    # A newer pg_restore emits settings the older server rejects (e.g.
    # transaction_timeout, new in 17), so restore through SQL without them.
    pg_restore --no-owner --role="$POSTGRES_USER" -f "${WORK_DIR}/restore.sql" "${dir}/db.dump"
    sed '/^SET transaction_timeout = /d' "${WORK_DIR}/restore.sql" \
      | psql -X -q -v ON_ERROR_STOP=1 -d "$POSTGRES_DB" >/dev/null
    rm -f "${WORK_DIR}/restore.sql"
  fi

  if [ -f "${dir}/storage.tar.gz" ]; then
    log "Restoring file storage..."
    find "$STORAGE_DIR" -mindepth 1 -maxdepth 1 -exec rm -rf {} +
    tar -C "$STORAGE_DIR" --numeric-owner -xzpf "${dir}/storage.tar.gz"
  else
    warn "backup has no storage.tar.gz; file storage left untouched"
  fi

  if [ -f "${dir}/config/.env" ] && [ -f "${CONFIG_DIR}/.env" ] \
    && [ "$(env_secret_hash "${dir}/config/.env")" != "$(env_secret_hash "${CONFIG_DIR}/.env")" ]; then
    warn "SECRET_KEY_BASE in this backup differs from the current .env."
    warn "Encrypted data will not decrypt until you use the backup's value (see ${dir#"${BACKUP_DIR}"/}/config/.env)."
  fi

  if [ "${SURE_RECOVER:-}" = 1 ]; then
    # Called by `recover`, which pins the image and starts the app itself.
    log "Restored Sure ${version}."
    return 0
  fi
  log "Restored Sure ${version}. Next, on the host:"
  log "  1. Run the app on ${image}${image_by_commit:+ (or ${image_by_commit} for non-release builds)}:"
  if [ -f "${CONFIG_DIR}/compose.restore.yml" ]; then
    log "     set the web and worker image in compose.restore.yml (it overrides SURE_IMAGE_TAG)"
  else
    log "     set SURE_IMAGE_TAG=${version} in .env, or the web/worker image in your compose file"
  fi
  log "  2. docker compose up -d"
}

# --- recover (runs on the host) -----------------------------------------------

# ask PROMPT DEFAULT: prints the answer, or DEFAULT on an empty line or EOF.
ask() {
  if [ "$assume_yes" = true ]; then
    printf '%s\n' "$2"
    return 0
  fi
  printf '%s%s: ' "$1" "${2:+ [$2]}" >&2
  answer=""
  read -r answer || true
  printf '%s\n' "${answer:-$2}"
}

env_set() {
  awk -v k="$2" -v v="$3" '
    $0 ~ "^" k "=" { if (!done) print k "=" v; done = 1; next }
    { print }
    END { if (!done) print k "=" v }
  ' "$1" > "$1.tmp"
  mv "$1.tmp" "$1"
  chmod 0600 "$1"
}

env_get() {
  sed -n "s/^$2=//p" "$1" 2>/dev/null | tail -n 1 | sed -e 's/[[:space:]]*#.*$//' -e 's/^"\(.*\)"$/\1/'
}

port_in_use() {
  docker ps --format '{{.Ports}}' 2>/dev/null | grep -q ":$1->" && return 0
  if command -v nc >/dev/null 2>&1 && nc -z 127.0.0.1 "$1" >/dev/null 2>&1; then
    return 0
  fi
  return 1
}

# Compose projects with a running Sure web or worker container.
running_sure_projects() {
  docker ps --format '{{.Label "com.docker.compose.project"}}|{{.Label "com.docker.compose.service"}}|{{.Image}}' 2>/dev/null \
    | awk -F'|' '($2 == "web" || $2 == "worker") && $3 ~ /sure/ { print ($1 == "" ? "(not compose)" : $1) }' \
    | sort -u
}

cmd_recover() {
  bundle=""
  target=""
  port=""
  worker=""
  assume_yes=false
  start=true
  while [ $# -gt 0 ]; do
    case "$1" in
      --target) target=$2; shift 2 ;;
      --port) port=$2; shift 2 ;;
      --with-worker) worker=yes; shift ;;
      --without-worker) worker=no; shift ;;
      --yes) assume_yes=true; shift ;;
      --no-start) start=false; shift ;;
      -h | --help) usage; return 0 ;;
      -*) die "unknown option for recover: $1" ;;
      *) bundle=$1; shift ;;
    esac
  done

  [ -n "$bundle" ] && [ -f "${bundle}/manifest.json" ] || die "recover needs a backup bundle folder (one with manifest.json)"
  bundle=$(cd "$bundle" && pwd)
  if ! command -v docker >/dev/null 2>&1 || ! docker compose version >/dev/null 2>&1; then
    die "Docker with the Compose plugin is required (https://docs.docker.com/compose/install/)"
  fi

  version=$(manifest_value "$bundle" sure_version)
  image=$(manifest_value "$bundle" image)
  created=$(manifest_value "$bundle" created_at)
  [ -n "$version" ] && [ -n "$image" ] || die "cannot read version and image from ${bundle}/manifest.json"
  [ -f "${bundle}/config/.env" ] || die "the bundle has no config/.env; restore it by hand (see docs/hosting/docker.md)"
  compose_file=""
  for f in compose.yml compose.yaml docker-compose.yml docker-compose.yaml; do
    [ -f "${bundle}/config/${f}" ] && { compose_file=$f; break; }
  done
  [ -n "$compose_file" ] || die "the bundle has no compose file; restore it by hand (see docs/hosting/docker.md)"

  log "Backup: Sure ${version}, taken ${created:-at an unknown time} (${image})"
  log "Verifying checksums..."
  if command -v sha256sum >/dev/null 2>&1; then
    (cd "$bundle" && sha256sum -c SHA256SUMS >/dev/null) || die "checksum verification failed"
  elif command -v shasum >/dev/null 2>&1; then
    (cd "$bundle" && shasum -a 256 -c SHA256SUMS >/dev/null) || die "checksum verification failed"
  else
    warn "no sha256sum or shasum; skipping checksum verification here (restore checks it again)"
  fi

  # Where to put the restored project. Its folder name becomes the Compose
  # project name, which names its containers and data volumes.
  [ -n "$target" ] || target=$(ask "Folder for the restored instance" "$(pwd)/sure-restore-${version}")
  # A literal "~" typed at the prompt is not expanded by the shell.
  # shellcheck disable=SC2088
  case "$target" in
    "~") target=$HOME ;;
    "~/"*) target="${HOME}/${target#"~/"}" ;;
  esac
  if [ -e "$target" ] && [ -n "$(ls -A "$target" 2>/dev/null)" ]; then
    die "${target} is not empty. Pick a new folder; to roll back an existing install, use 'restore' there instead."
  fi
  created_target=false
  [ -d "$target" ] || created_target=true
  mkdir -p "$target"
  target=$(cd "$target" && pwd)
  # On abort, remove the folder only if this run created it.
  cleanup_target() { [ "$created_target" = true ] && rmdir "$target" 2>/dev/null; true; }

  project=$(basename "$target" | tr '[:upper:]' '[:lower:]' | tr -cd 'a-z0-9_-' | sed 's/^[^a-z0-9]*//')
  [ -n "$project" ] || project="sure-restore"
  if [ -n "$(docker ps -aq --filter "label=com.docker.compose.project=${project}")" ] \
    || [ -n "$(docker volume ls -q --filter "label=com.docker.compose.project=${project}")" ]; then
    cleanup_target
    die "Docker already has containers or volumes for a project named '${project}'. Pick a folder with another name, or this would overwrite that instance's data."
  fi

  # Other Sure instances on this machine.
  others=$(running_sure_projects)
  if [ -n "$others" ]; then
    warn "Other Sure instances are running on this machine: $(echo "$others" | tr '\n' ' ')"
    cat >&2 <<'EOF'
If one of them holds the same data as this backup, running both at once means:
  - Both workers sync the same bank connections. Some providers rotate access
    tokens on every sync, so the copy can disconnect the original.
  - Scheduled jobs, such as recurring transactions and emails, run twice.
  - Signing in to both on the same host name (e.g. localhost on another port)
    signs you out of the other, because browsers share cookies across ports.
Starting the restored instance without its worker avoids the first two.
EOF
    [ -n "$worker" ] || case "$(ask "Start the restored worker too? (no = web only, abort = stop here)" "no")" in
      y | yes) worker=yes ;;
      abort | a | q) cleanup_target; die "aborted" ;;
      *) worker=no ;;
    esac
  fi
  [ -n "$worker" ] || worker=yes

  backup_port=$(env_get "${bundle}/config/.env" PORT)
  backup_port=${backup_port:-3000}
  if [ -z "$port" ]; then
    port=$backup_port
    if port_in_use "$port"; then
      suggestion=$port
      while port_in_use "$suggestion"; do suggestion=$((suggestion + 1)); done
      warn "port ${port} is already in use"
      port=$(ask "Port for the restored instance" "$suggestion")
    fi
  fi
  case "$port" in "" | *[!0-9]*) die "invalid port: ${port}" ;; esac
  port_in_use "$port" && warn "port ${port} looks busy; the web container may fail to start"

  log "Restoring into ${target} (project '${project}', port ${port})"
  cp -R "${bundle}/config/." "${target}/"
  # Use this copy of the script, which may be newer than the bundle's.
  mkdir -p "${target}/bin"
  cp "$0" "${target}/bin/sure-backup"
  chmod 0755 "${target}/bin/sure-backup"
  mkdir -p "${target}/backups/${version}"
  cp -R "$bundle" "${target}/backups/${version}/"
  name=$(basename "$bundle")

  compose_files=$compose_file
  for f in compose.override.yml compose.override.yaml docker-compose.override.yml docker-compose.override.yaml; do
    [ -f "${target}/${f}" ] && compose_files="${compose_files}:${f}"
  done
  compose_files="${compose_files}:compose.restore.yml"

  cat > "${target}/compose.restore.yml" <<EOF
# Written by \`sure-backup recover\` from backup ${version}/${name}.
# Pins web and worker to the backed-up version and adds the sure-backup
# service; COMPOSE_FILE in .env loads it with the main compose file.
# To upgrade later, change the image here (or remove it to follow the
# compose file's tag) and run: docker compose pull && docker compose up -d
services:
  web:
    image: ${image}
  worker:
    image: ${image}
  sure-backup:
    profiles: [sure-backup]
    image: ${image}
    user: "0"
    entrypoint: ["/usr/local/bin/sure-backup"]
    volumes:
      - ./bin/sure-backup:/usr/local/bin/sure-backup:ro
      - ./backups:/backups
      - app-storage:/rails/storage
      - .:/config:ro
    environment:
      POSTGRES_HOST: db
      POSTGRES_USER: \${POSTGRES_USER:-sure_user}
      POSTGRES_PASSWORD: \${POSTGRES_PASSWORD:-sure_password}
      POSTGRES_DB: \${POSTGRES_DB:-sure_production}
    depends_on:
      db:
        condition: service_healthy
    networks:
      - sure_net
EOF
  env_set "${target}/.env" COMPOSE_PROJECT_NAME "$project"
  env_set "${target}/.env" COMPOSE_FILE "$compose_files"
  env_set "${target}/.env" PORT "$port"

  # Values exported in the caller's shell override .env, and could point
  # Compose at the original install. Pin every call below to this project.
  export COMPOSE_PROJECT_NAME="$project" COMPOSE_FILE="$compose_files"
  unset COMPOSE_PROFILES COMPOSE_PROJECT_DIR
  cd "$target"
  restore_cmd="docker compose run --rm -e SURE_RECOVER=1 sure-backup restore ${version}/${name} --yes"

  # The copied compose files must not reach shared storage: external volumes
  # or networks, or host paths outside this folder, could belong to the
  # original install, whose database or files the restore would replace.
  resolved=$(docker compose config 2>/dev/null) || die "docker compose cannot read the copied configuration in ${target}"
  shared=$(printf '%s\n' "$resolved" | awk -v t="$target" '
    /^[[:space:]]*external: true/ { print "  an external volume or network (external: true)" }
    /^[[:space:]]*source: \// { if (index($2, t) != 1) print "  host path " $2 }
  ' | sort -u)
  if [ -n "$shared" ]; then
    warn "the copied compose configuration uses storage outside ${target}:"
    printf '%s\n' "$shared" >&2
    die "restoring here could overwrite another instance's data. Make these local to ${target} in its compose files, then run there: docker compose up -d db redis && ${restore_cmd}"
  fi

  # Local files the compose files mount (e.g. "- ./certs/ca.pem:/...") are not
  # part of the backup. Docker would create empty directories in their place
  # and the containers using them would fail to start.
  missing_mounts=""
  for f in $(echo "$compose_files" | tr ':' ' '); do
    # The pattern stops at whitespace, so word splitting is safe here.
    # shellcheck disable=SC2013
    for src in $(sed -n 's/^[[:space:]]*-[[:space:]]*\(\.\/[^:[:space:]]*\):.*/\1/p' "${target}/${f}"); do
      case "$src" in ./backups | ./backups/* | ./bin/sure-backup) continue ;; esac
      [ -e "${target}/${src}" ] || missing_mounts="${missing_mounts} ${src}"
    done
  done
  if [ -n "$missing_mounts" ]; then
    warn "the compose files mount local paths that are not in the backup:${missing_mounts}"
    warn "copy them into ${target} from the original install before starting."
    start=false
  fi

  if [ "$start" != true ]; then
    log "Prepared ${target}. Start it with:"
    services="web worker"; [ "$worker" = yes ] || services="web"
    log "  cd ${target}"
    log "  export COMPOSE_PROJECT_NAME=${project} COMPOSE_FILE=${compose_files}"
    log "  docker compose up -d db redis && ${restore_cmd} && docker compose up -d ${services}"
    return 0
  fi

  log "Starting the database..."
  docker compose up -d db redis
  log "Restoring the backup..."
  docker compose run --rm -e SURE_RECOVER=1 sure-backup restore "${version}/${name}" --yes
  if [ "$worker" = yes ]; then
    log "Starting web and worker..."
    docker compose up -d web worker
  else
    log "Starting web only (no worker)..."
    docker compose up -d web
  fi

  url="http://localhost:${port}"
  if command -v curl >/dev/null 2>&1; then
    log "Waiting for ${url} ..."
    tries=0
    until curl -fsS -o /dev/null "${url}/up" 2>/dev/null; do
      tries=$((tries + 1))
      [ "$tries" -lt 60 ] || { warn "the app did not answer within 3 minutes; check: docker compose logs web"; break; }
      sleep 3
    done
  fi

  log ""
  log "Restored Sure ${version} is running at ${url}"
  log "  Folder:  ${target}"
  log "  Manage:  cd ${target} && docker compose ps | logs web | down"
  [ "$worker" = yes ] || log "  Worker:  not started; start it with 'docker compose up -d worker' once the original instance is stopped"
  log "  Remove:  cd ${target} && docker compose down -v   (deletes this copy's data)"
}

# --- prune / offsite ----------------------------------------------------------

cmd_prune() {
  check_keep_days
  minutes=$((BACKUP_KEEP_DAYS * 1440))
  log "Pruning scheduled backups older than ${BACKUP_KEEP_DAYS} days (manual backups are kept)..."
  find "$BACKUP_DIR" -mindepth 2 -maxdepth 2 -type d -name '*-scheduled' -mmin "+${minutes}" ! -path '*/.tmp-*' \
    | while read -r d; do
        log "  removing ${d#"${BACKUP_DIR}"/}"
        rm -rf "$d"
      done
  # Version directories left empty by pruning.
  find "$BACKUP_DIR" -mindepth 1 -maxdepth 1 -type d ! -name '.tmp-*' -empty -exec rmdir {} + 2>/dev/null || true
  # Interrupted runs.
  find "$BACKUP_DIR" -mindepth 1 -maxdepth 1 -type d -name '.tmp-*' -mmin +1440 -exec rm -rf {} + 2>/dev/null || true
}

cmd_scheduled() {
  check_keep_days
  cmd_create --scheduled
  cmd_prune
}

# Seconds until the next daily run at H:M (UTC).
seconds_until() {
  now=$(date -u +%s)
  next=$(date -u -d "$(date -u +%Y-%m-%d) $1:$2:00" +%s)
  [ "$next" -gt "$now" ] || next=$((next + 86400))
  echo $((next - now))
}

cmd_daemon() {
  check_db_env
  check_keep_days
  ensure_deps

  # Only daily schedules: "M H * * *" with a numeric minute and hour.
  set -f
  # shellcheck disable=SC2086
  set -- $BACKUP_SCHEDULE
  set +f
  minute=${1:-}; hour=${2:-}
  if [ $# -ne 5 ] || [ "$3" != "*" ] || [ "$4" != "*" ] || [ "$5" != "*" ] \
    || ! [ "$minute" -ge 0 ] 2>/dev/null || [ "$minute" -gt 59 ] \
    || ! [ "$hour" -ge 0 ] 2>/dev/null || [ "$hour" -gt 23 ]; then
    die "BACKUP_SCHEDULE must be a daily time like \"0 2 * * *\" (minute hour * * *, UTC); got \"${BACKUP_SCHEDULE}\""
  fi
  minute=$((minute + 0)); hour=$((hour + 0))
  hhmm=$(printf '%02d:%02d' "$hour" "$minute")

  if [ -n "${BACKUP_DESTINATION:-}" ]; then
    warn "BACKUP_DESTINATION is ignored here; off-site copies are made by the backup-offsite service"
  fi
  # Exit promptly on docker stop; the sleep runs in the background so the trap fires.
  trap 'exit 0' TERM INT
  log "Scheduled backups every day at ${hhmm} UTC into ${BACKUP_DIR}"
  while true; do
    wait_s=$(seconds_until "$hour" "$minute")
    log "Next backup in $((wait_s / 3600))h $((wait_s % 3600 / 60))m"
    sleep "$wait_s" &
    wait $!
    ( cmd_scheduled ) || warn "scheduled backup failed; retrying at the next scheduled time"
  done
}

# --- host mode -----------------------------------------------------------------
#
# Run on the host from the folder with compose.yml, `create`, `restore`,
# `prune` and `scheduled` start this script once in a container from the
# exact image of the install's `web` container, with its uploaded-files
# volume, network and database settings. No backup service needed, so it
# also works for Sure 0.7.5 and older.

on_host() {
  [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && command -v docker >/dev/null 2>&1
}

host_run() {
  docker compose version >/dev/null 2>&1 || die "Docker with the Compose plugin is required"
  cid=$(docker compose ps -aq web 2>/dev/null | head -n 1)
  [ -n "$cid" ] || die "no Sure 'web' container for the Compose project in $(pwd). Run this from the folder with your compose.yml; the app must have been started at least once."

  # An idle app holds no database connections, so the in-container check can
  # miss it; here Docker can tell whether the app is running.
  if [ "$1" = restore ]; then
    case " $* " in *" --force "*) ;; *)
      if [ -n "$(docker compose ps -q --status running web worker 2>/dev/null)" ]; then
        die "the app is running. Stop it first: docker compose stop web worker (or pass --force)"
      fi
    esac
  fi

  inspect() { docker inspect -f "$1" "$cid"; }
  image=$(inspect '{{.Image}}')
  workdir=$(inspect '{{index .Config.Labels "com.docker.compose.project.working_dir"}}')
  workdir=${workdir:-$(pwd)}
  # A Go template for docker inspect, not shell expansion.
  # shellcheck disable=SC2016
  network=$(inspect '{{range $name, $_ := .NetworkSettings.Networks}}{{$name}}{{"\n"}}{{end}}' | sed -n '1p')
  storage=$(inspect '{{range .Mounts}}{{if eq .Destination "/rails/storage"}}{{if eq .Type "volume"}}{{.Name}}{{else}}{{.Source}}{{end}}{{end}}{{end}}')
  container_env=$(inspect '{{range .Config.Env}}{{println .}}{{end}}')
  env_of() { printf '%s\n' "$container_env" | sed -n "s/^$1=//p" | tail -n 1; }

  backups=$(env_get "${workdir}/.env" BACKUP_DIR)
  backups=${backups:-./backups}
  case "$backups" in /*) ;; *) backups="${workdir}/${backups#./}" ;; esac
  mkdir -p "$backups"
  script_path=$(cd "$(dirname "$0")" && pwd)/$(basename "$0")

  # Database credentials go through a private env file, not the command line.
  host_tmp=$(umask 077 && mktemp -d)
  trap 'rm -rf "${host_tmp}"' EXIT INT TERM
  {
    echo "POSTGRES_HOST=$(env_of DB_HOST)"
    echo "POSTGRES_PORT=$(env_of DB_PORT)"
    echo "POSTGRES_USER=$(env_of POSTGRES_USER)"
    echo "POSTGRES_PASSWORD=$(env_of POSTGRES_PASSWORD)"
    echo "POSTGRES_DB=$(env_of POSTGRES_DB)"
    echo "BUILD_COMMIT_SHA=$(env_of BUILD_COMMIT_SHA)"
    for v in BACKUP_KEEP_DAYS INSTANCE_ID; do
      val=$(env_get "${workdir}/.env" "$v")
      [ -z "$val" ] || echo "${v}=${val}"
    done
  } > "${host_tmp}/env"

  # Build `docker run [options] IMAGE SUBCOMMAND ARGS` by prepending to "$@".
  set -- "$image" "$@"
  set -- --entrypoint /usr/local/bin/sure-backup "$@"
  set -- -v "${script_path}:/usr/local/bin/sure-backup:ro" "$@"
  set -- -v "${workdir}:/config:ro" -v "${backups}:/backups" "$@"
  if [ -n "$storage" ]; then
    set -- -v "${storage}:/rails/storage" "$@"
  else
    warn "the web container has no /rails/storage mount; uploaded files are not included"
  fi
  [ -n "$network" ] && set -- --network "$network" "$@"
  [ -t 0 ] && set -- -t "$@"
  set -- --rm -i --user 0 --env-file "${host_tmp}/env" "$@"

  host_status=0
  docker run "$@" || host_status=$?
  rm -rf "$host_tmp"
  return "$host_status"
}

command=${1:-daemon}
[ $# -gt 0 ] && shift

# On the host, run the database work in a container (see host_run).
if on_host; then
  case "$command" in
    create | restore | prune | scheduled)
      host_run "$command" "$@"
      exit $?
      ;;
    list)
      dir=$(env_get .env BACKUP_DIR)
      BACKUP_DIR=${dir:-./backups}
      ;;
  esac
fi

case "$command" in
  daemon) cmd_daemon ;;
  create) cmd_create "$@" ;;
  scheduled) cmd_scheduled ;;
  list) cmd_list ;;
  restore) cmd_restore "$@" ;;
  recover) cmd_recover "$@" ;;
  prune) ensure_deps; cmd_prune ;;
  -h | --help | help) usage ;;
  *) usage; exit 1 ;;
esac