#!/usr/bin/env bash
# Complete backup of all private keys, secrets, and sensitive configurations
# Following prime directive: one durable, encrypted container for everything

set -euo pipefail

BACKUP_DIR="$HOME/dotfiles/backups"
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
TEMP_DIR=$(mktemp -d)

# Colors
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
RED='\033[0;31m'
NC='\033[0m'

echo -e "${YELLOW}🔐 Creating complete encrypted backup of all secrets${NC}"
echo "Timestamp: $TIMESTAMP"
echo ""

# Create backup structure in temp directory
mkdir -p "$TEMP_DIR/secrets"/{ssh,gnupg,docker,config}

echo -e "${YELLOW}📦 Collecting all sensitive data...${NC}"

# SSH keys and config
if [[ -d "$HOME/.ssh" ]]; then
    echo "  🔑 SSH keys and configuration"
    cp -r "$HOME/.ssh" "$TEMP_DIR/secrets/"
fi

# GPG keyring and keys
if [[ -d "$HOME/.gnupg" ]]; then
    echo "  🔐 GPG private keys and keyring"
    mkdir -p "$TEMP_DIR/secrets/.gnupg"
    
    # Copy essential GPG files (not temporary/socket files)
    cp -r "$HOME/.gnupg/private-keys-v1.d" "$TEMP_DIR/secrets/.gnupg/" 2>/dev/null || true
    cp "$HOME/.gnupg/pubring.kbx" "$TEMP_DIR/secrets/.gnupg/" 2>/dev/null || true
    cp "$HOME/.gnupg/trustdb.gpg" "$TEMP_DIR/secrets/.gnupg/" 2>/dev/null || true
    cp "$HOME/.gnupg/gpg.conf" "$TEMP_DIR/secrets/.gnupg/" 2>/dev/null || true
    cp "$HOME/.gnupg/gpg-agent.conf" "$TEMP_DIR/secrets/.gnupg/" 2>/dev/null || true
    cp "$HOME/.gnupg/dirmngr.conf" "$TEMP_DIR/secrets/.gnupg/" 2>/dev/null || true
fi

# Docker configuration
if [[ -f "$HOME/.docker/config.json" ]]; then
    echo "  🐳 Docker authentication"
    mkdir -p "$TEMP_DIR/secrets/.docker"
    cp "$HOME/.docker/config.json" "$TEMP_DIR/secrets/.docker/"
fi

# Any license files or certificates (if found)
if [[ -f "$HOME/.vuescanrc" ]]; then
    echo "  📄 VueScan license"
    cp "$HOME/.vuescanrc" "$TEMP_DIR/secrets/"
fi

echo ""
echo -e "${YELLOW}🗜️  Creating encrypted archive...${NC}"

# Create the master encrypted backup
mkdir -p "$BACKUP_DIR/complete"
tar -czf - -C "$TEMP_DIR" secrets | \
gpg --symmetric --cipher-algo AES256 --compress-algo 2 \
    --output "$BACKUP_DIR/complete/all_secrets_${TIMESTAMP}.tar.gz.gpg"

# Create comprehensive restore instructions
cat > "$BACKUP_DIR/complete/RESTORE_INSTRUCTIONS.md" << 'EOF'
# Complete Secrets Restore Instructions

## Master Encrypted Backup

This is your complete backup of all private keys, certificates, and sensitive configurations.

### What's Included
- SSH keys and configuration
- GPG private keys and keyring  
- Docker authentication
- Application licenses
- Any other sensitive configuration files

### Restore Process

#### Step 1: Decrypt the backup
```bash
gpg --decrypt all_secrets_TIMESTAMP.tar.gz.gpg > all_secrets_TIMESTAMP.tar.gz
```

#### Step 2: Extract to temporary location first
```bash
mkdir ~/restore_temp
tar -xzf all_secrets_TIMESTAMP.tar.gz -C ~/restore_temp
```

#### Step 3: Review and restore selectively
```bash
# SSH (if needed)
cp -r ~/restore_temp/secrets/.ssh ~/
chmod 700 ~/.ssh
chmod 600 ~/.ssh/config ~/.ssh/*_rsa ~/.ssh/id_*
chmod 644 ~/.ssh/*.pub

# GPG (if needed)
cp -r ~/restore_temp/secrets/.gnupg ~/
chmod 700 ~/.gnupg
chmod 600 ~/.gnupg/*
chmod 700 ~/.gnupg/private-keys-v1.d
chmod 600 ~/.gnupg/private-keys-v1.d/*
gpgconf --kill gpg-agent  # Restart GPG agent

# Docker (if needed)
mkdir -p ~/.docker
cp ~/restore_temp/secrets/.docker/config.json ~/.docker/

# Other files as needed
```

#### Step 4: Cleanup
```bash
rm -rf ~/restore_temp
rm all_secrets_TIMESTAMP.tar.gz
```

## Security Notes

- This backup contains ALL your private keys and secrets
- Keep it in multiple secure locations
- Test restore process periodically
- Never store unencrypted - always use GPG encryption

Created: $(date)
System: $(sw_vers -productVersion)
EOF

# Cleanup
rm -rf "$TEMP_DIR"

echo -e "${GREEN}✅ Complete encrypted backup created!${NC}"
echo ""
echo -e "${GREEN}📍 Location: $BACKUP_DIR/complete/all_secrets_${TIMESTAMP}.tar.gz.gpg${NC}"
echo -e "${GREEN}📋 Instructions: $BACKUP_DIR/complete/RESTORE_INSTRUCTIONS.md${NC}"
echo ""
echo -e "${YELLOW}💡 This replaces all individual backups - one encrypted container for everything!${NC}"