#!/bin/bash
# home-router-backup.sh — Backup CCR config via WireGuard tunnel
# Uses the wg-itpp tunnel to reach the router at 10.77.0.2

DATE=$(date +%Y-%m-%d)
LOG="$HOME/.hermes/scripts/logs/home-router-backup-$DATE.log"
BACKUP_DIR="/tmp/home-router-backup"
SSH_KEY="$HOME/.ssh/wisp_rsa"
ROUTER="admin@10.77.0.2"

mkdir -p "$BACKUP_DIR" "$(dirname "$LOG")"

echo "=== Home Router Backup $(date -u '+%Y-%m-%d %H:%M:%S UTC') ===" >> "$LOG"

# Check tunnel is up
ping -c 1 -W 3 10.77.0.2 > /dev/null 2>&1
if [ $? -ne 0 ]; then
    echo "FAILED: WireGuard tunnel down (10.77.0.2 unreachable)" >> "$LOG"
    echo "Home Router Backup FAILED — tunnel down"
    exit 1
fi

# Export config
ssh -i "$SSH_KEY" -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
    "$ROUTER" "/export terse file=itpp-backup-$DATE" >> "$LOG" 2>&1

# Download the export
scp -i "$SSH_KEY" -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
    "$ROUTER:itpp-backup-$DATE.rsc" "$BACKUP_DIR/" >> "$LOG" 2>&1

# Clean up remote file
ssh -i "$SSH_KEY" -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
    "$ROUTER" "/file remove itpp-backup-$DATE.rsc" >> "$LOG" 2>&1

# Upload to S3
source /opt/awscli-venv/bin/activate 2>/dev/null
aws s3 cp "$BACKUP_DIR/itpp-backup-$DATE.rsc" \
    "s3://itpropartner-backups/home-router/$DATE-config.rsc" \
    --endpoint-url https://s3.us-east-1.wasabisys.com >> "$LOG" 2>&1

if [ $? -eq 0 ]; then
    echo "SUCCESS — uploaded to S3" >> "$LOG"
    rm -f "$BACKUP_DIR/itpp-backup-$DATE.rsc"
    echo "[SILENT]"
else
    echo "FAILED: S3 upload error" >> "$LOG"
    echo "Home Router Backup FAILED — S3 upload"
    exit 1
fi