#!/usr/bin/env bash
set -euo pipefail
umask 077
STAMP=$(date -u +%F-%H%M%S); ROOT=${BACKUP_ROOT:-/backup/mikrodash}; DEST=$ROOT/$STAMP
install -d -m 0700 "$DEST"
log() { printf '%s %s\n' "$(date -u --iso-8601=seconds)" "$*" >> "$ROOT/backup.log"; }
log stopping
docker compose stop mikrodash
trap 'docker compose start mikrodash' EXIT
tar --numeric-owner -czf "$DEST/state.tgz" ./data ./compose.yaml
sha256sum "$DEST/state.tgz" > "$DEST/SHA256SUMS"
log complete
# Copy the protected encryption key from the approved vault; encrypt and ship off-host.