#!/usr/bin/env bash
# ZENTRAX (zentraxshop.in) — Automated Transactional Database & Private Vault Backup Script
set -euo pipefail

APP_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
BACKUP_DIR="${ZTX_BACKUP_DIR:-${HOME}/zentrax_backups}"
RETENTION_DAYS="${ZTX_BACKUP_RETENTION_DAYS:-14}"
STAMP="$(date -u +%Y%m%d_%H%M%S)"
WORK_DIR="$(mktemp -d)"

cleanup() {
  rm -rf "${WORK_DIR}"
}
trap cleanup EXIT

mkdir -p "${BACKUP_DIR}"
chmod 0700 "${BACKUP_DIR}"

DB_HOST="${ZTX_DB_HOST:-localhost}"
DB_NAME="${ZTX_DB_NAME:-cpaneluser_zentraxshop}"
DB_USER="${ZTX_DB_USER:-cpaneluser_ztxadmin}"
DB_PASS="${ZTX_DB_PASS:-}"

if command -v mysqldump >/dev/null 2>&1 && [[ -n "${DB_PASS}" ]]; then
  MYSQL_PWD="${DB_PASS}" mysqldump \
    --host="${DB_HOST}" \
    --user="${DB_USER}" \
    --single-transaction \
    --quick \
    --routines \
    --triggers \
    --default-character-set=utf8mb4 \
    "${DB_NAME}" > "${WORK_DIR}/database_${STAMP}.sql"
fi

mkdir -p "${WORK_DIR}/private_snapshot"
for item in .env.php .ztx_master_secret .installed.lock certs vault payment_proofs ticket_attachments; do
  if [[ -e "${APP_ROOT}/private/${item}" ]]; then
    cp -a "${APP_ROOT}/private/${item}" "${WORK_DIR}/private_snapshot/"
  fi
done

ARCHIVE_PATH="${BACKUP_DIR}/zentrax_backup_${STAMP}.tar.gz"
tar -czf "${ARCHIVE_PATH}" -C "${WORK_DIR}" .
chmod 0600 "${ARCHIVE_PATH}"

if [[ -n "${ZTX_BACKUP_PASSPHRASE:-}" ]] && command -v openssl >/dev/null 2>&1; then
  openssl enc -aes-256-cbc -pbkdf2 -salt \
    -pass env:ZTX_BACKUP_PASSPHRASE \
    -in "${ARCHIVE_PATH}" \
    -out "${ARCHIVE_PATH}.enc"
  chmod 0600 "${ARCHIVE_PATH}.enc"
  rm -f "${ARCHIVE_PATH}"
  ARCHIVE_PATH="${ARCHIVE_PATH}.enc"
fi

find "${BACKUP_DIR}" -maxdepth 1 -type f -name "zentrax_backup_*" -mtime +"${RETENTION_DAYS}" -delete
echo "[ZENTRAX BACKUP] Completed snapshot: ${ARCHIVE_PATH}"