#!/bin/bash
# Vaultwarden daily backup
BACKUP_DIR="/opt/vaultwarden/backups"
DATA_DIR="/opt/vaultwarden/data"
DATE=$(date +%Y-%m-%d)
BACKUP_FILE="$BACKUP_DIR/vaultwarden-$DATE.tar.gz.gpg"

mkdir -p "$BACKUP_DIR"

# Stop container briefly for consistent backup
docker stop vaultwarden
sleep 2

# Create encrypted backup (symmetric, passphrase from file)
tar czf - -C /opt/vaultwarden data | gpg --batch --yes --symmetric --cipher-algo AES256 --passphrase-file /opt/vaultwarden/.backup_passphrase -o "$BACKUP_FILE"

# Restart
docker start vaultwarden

# Upload to gdrive if rclone is configured
if rclone listremotes 2>/dev/null | grep -q gdrive; then
    rclone copy "$BACKUP_FILE" gdrive:backups/vaultwarden/
fi

# Retain only last 30 days
find "$BACKUP_DIR" -name "vaultwarden-*.tar.gz.gpg" -mtime +30 -delete

echo "Backup complete: $BACKUP_FILE ($(du -h "$BACKUP_FILE" | cut -f1))"