#!/usr/bin/env bash
# Backup all private keys and sensitive configurations
# Following prime directive: durable, thoughtful backup strategy

set -euo pipefail

BACKUP_DIR="$HOME/dotfiles/backups"
TIMESTAMP=$(date +%Y%m%d_%H%M%S)

# Colors
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
RED='\033[0;31m'
NC='\033[0m'

echo -e "${YELLOW}🔐 Creating encrypted backup of private keys and secrets${NC}"
echo "Timestamp: $TIMESTAMP"
echo ""

# Create backup directory
mkdir -p "$BACKUP_DIR"/{ssh,gpg,docker}

# Function to create encrypted backup
create_encrypted_backup() {
    local source_dir="$1"
    local backup_name="$2"
    local backup_path="$BACKUP_DIR/$backup_name"
    
    if [[ -d "$source_dir" ]] || [[ -f "$source_dir" ]]; then
        echo -e "${YELLOW}Backing up: $source_dir${NC}"
        
        # Create tar archive and encrypt in one step
        tar -czf - -C "$(dirname "$source_dir")" "$(basename "$source_dir")" | \
        gpg --symmetric --cipher-algo AES256 --compress-algo 2 \
            --output "${backup_path}/${backup_name}_${TIMESTAMP}.tar.gz.gpg"
        
        # Create restore instructions
        cat > "${backup_path}/RESTORE_INSTRUCTIONS.md" << EOF
# ${backup_name^} Restore Instructions

## Decrypting and Restoring ${backup_name^}

To restore from backup: \`${backup_name}_${TIMESTAMP}.tar.gz.gpg\`

### Step 1: Decrypt the backup
\`\`\`bash
gpg --decrypt ${backup_name}_${TIMESTAMP}.tar.gz.gpg > ${backup_name}_${TIMESTAMP}.tar.gz
\`\`\`

### Step 2: Extract the archive
\`\`\`bash
tar -xzf ${backup_name}_${TIMESTAMP}.tar.gz -C ~/
\`\`\`

### Step 3: Set correct permissions
\`\`\`bash
chmod 700 ~/$(basename "$source_dir")
find ~/$(basename "$source_dir") -type f -exec chmod 600 {} \;
\`\`\`

## Security Notes

- Keep this encrypted backup secure
- Contains private keys/sensitive data
- Test restore process periodically

## Backup Contents

This backup includes: $(basename "$source_dir")

Created: $(date)
System: $(sw_vers -productVersion)
EOF
        
        echo -e "${GREEN}✅ Backup created: ${backup_path}/${backup_name}_${TIMESTAMP}.tar.gz.gpg${NC}"
    else
        echo -e "${RED}⚠️  Source not found: $source_dir${NC}"
    fi
}

# Backup GPG private keys and keyring
if [[ -d "$HOME/.gnupg" ]]; then
    echo -e "${YELLOW}🔑 Backing up GPG private keys and keyring...${NC}"
    
    # Create temporary directory with essential GPG files
    temp_gpg=$(mktemp -d)
    mkdir -p "$temp_gpg/.gnupg"
    
    # Copy essential GPG files (not temporary/socket files)
    cp -r "$HOME/.gnupg/private-keys-v1.d" "$temp_gpg/.gnupg/" 2>/dev/null || true
    cp "$HOME/.gnupg/pubring.kbx" "$temp_gpg/.gnupg/" 2>/dev/null || true
    cp "$HOME/.gnupg/trustdb.gpg" "$temp_gpg/.gnupg/" 2>/dev/null || true
    cp "$HOME/.gnupg/gpg.conf" "$temp_gpg/.gnupg/" 2>/dev/null || true
    cp "$HOME/.gnupg/gpg-agent.conf" "$temp_gpg/.gnupg/" 2>/dev/null || true
    cp "$HOME/.gnupg/dirmngr.conf" "$temp_gpg/.gnupg/" 2>/dev/null || true
    
    # Create encrypted backup
    tar -czf - -C "$temp_gpg" .gnupg | \
    gpg --symmetric --cipher-algo AES256 --compress-algo 2 \
        --output "$BACKUP_DIR/gpg/gpg_keyring_${TIMESTAMP}.tar.gz.gpg"
    
    # Cleanup
    rm -rf "$temp_gpg"
    
    # Create restore instructions
    cat > "$BACKUP_DIR/gpg/RESTORE_INSTRUCTIONS.md" << 'EOF'
# GPG Keyring Restore Instructions

## Decrypting and Restoring GPG Keys

To restore from backup: `gpg_keyring_TIMESTAMP.tar.gz.gpg`

### Step 1: Decrypt the backup
```bash
gpg --decrypt gpg_keyring_TIMESTAMP.tar.gz.gpg > gpg_keyring_TIMESTAMP.tar.gz
```

### Step 2: Extract to home directory
```bash
tar -xzf gpg_keyring_TIMESTAMP.tar.gz -C ~/
```

### Step 3: Set correct permissions
```bash
chmod 700 ~/.gnupg
chmod 600 ~/.gnupg/*
chmod 700 ~/.gnupg/private-keys-v1.d
chmod 600 ~/.gnupg/private-keys-v1.d/*
```

### Step 4: Restart GPG agent
```bash
gpgconf --kill gpg-agent
gpg --list-secret-keys  # This will restart the agent
```

## Security Notes

- Contains your GPG private keys - highly sensitive
- Keep encrypted backup in secure location
- Test restore process periodically

## What's Included

- Private keys (private-keys-v1.d/)
- Public keyring (pubring.kbx)
- Trust database (trustdb.gpg)
- GPG configuration files

Created: $(date)
System: $(sw_vers -productVersion)
EOF
    
    echo -e "${GREEN}✅ GPG keyring backup created${NC}"
fi

# Backup Docker configuration
if [[ -f "$HOME/.docker/config.json" ]]; then
    create_encrypted_backup "$HOME/.docker" "docker"
fi

# Summary
echo ""
echo -e "${GREEN}🎉 Backup Summary:${NC}"
echo "📁 Backups stored in: $BACKUP_DIR"
echo "🔐 All backups are GPG encrypted with AES256"
echo "📋 Each backup includes restore instructions"
echo ""
echo -e "${YELLOW}💡 Recommended: Store a copy of these backups in a separate secure location${NC}"
echo -e "${YELLOW}📋 Test restore process periodically to ensure backups work${NC}"