#!/bin/bash
#
# Purpose : Point restic at your backup in your Nextcloud files. Sourced by
#           system/backup and configure.d/20-backup.sh, and by you to look at
#           or restore from a backup:
#
#             source ~/.local/share/coredesktop/system/backup-env.sh
#             restic snapshots
#
#           To use another computer's backup, name its folder:
#
#             source ~/.local/share/coredesktop/system/backup-env.sh .backup-<name>
#
# restic reaches Nextcloud over WebDAV through rclone, not the davfs2 mount,
# which can't safely replace files. The Nextcloud app password and the
# backup's passphrase are kept in your keyring.

BACKUP_CONF="$HOME/.config/coredesktop/backup.conf"

# A secret from the keyring: nextcloud (app password) or passphrase
backup_secret() {
  secret-tool lookup coredesktop backup item "$1" url "$2"
}

if [ -f "$BACKUP_CONF" ]; then
  source "$BACKUP_CONF"
  BACKUP_DIR="${1:-$BACKUP_DIR}"

  export RCLONE_WEBDAV_URL="$BACKUP_WEBDAV"
  export RCLONE_WEBDAV_VENDOR=nextcloud
  export RCLONE_WEBDAV_USER="$BACKUP_USER"
  RCLONE_WEBDAV_PASS="$(backup_secret nextcloud "$BACKUP_WEBDAV" | rclone obscure -)"
  export RCLONE_WEBDAV_PASS
  export RESTIC_REPOSITORY="rclone::webdav:$BACKUP_DIR"

  # Without a passphrase in the keyring, e.g. for another computer's backup,
  # restic asks for it
  unset RESTIC_PASSWORD_COMMAND
  if [ -n "$(backup_secret passphrase "$BACKUP_WEBDAV/$BACKUP_DIR")" ]; then
    export RESTIC_PASSWORD_COMMAND="secret-tool lookup coredesktop backup item passphrase url $BACKUP_WEBDAV/$BACKUP_DIR"
  fi
else
  echo "Backups aren't set up. Run: configure backup" >&2
fi