#!/usr/bin/env bash
set -euo pipefail
umask 077
STAMP=$(date -u +%F-%H%M%S); ROOT=${BACKUP_ROOT:-/backup/akvorado}; DEST=$ROOT/$STAMP
install -d -m 0700 "$DEST"
log() { printf '%s %s\n' "$(date -u --iso-8601=seconds)" "$*" >> "$ROOT/backup.log"; }
log stopping
trap 'docker compose start' EXIT
docker compose stop
for volume in $(docker volume ls -q --filter label=com.docker.compose.project="$(basename "$PWD")"); do
  docker run --rm -v "$volume:/src:ro" -v "$DEST:/dst" alpine:3.22 tar -czf "/dst/$volume.tgz" -C /src .
done
cp -a compose.yaml config "$DEST/"
sha256sum "$DEST"/* > "$DEST/SHA256SUMS"
log complete
# Encrypt and transfer the cold volume snapshot off-host before retention cleanup.