#!/usr/bin/env bash
set -euo pipefail
umask 077
STAMP=$(date -u +%F-%H%M%S); ROOT=${BACKUP_ROOT:-/backup/netdisco}; DEST=$ROOT/$STAMP
install -d -m 0700 "$DEST"
log() { printf '%s %s\n' "$(date -u --iso-8601=seconds)" "$*" >> "$ROOT/backup.log"; }
log start
docker compose exec -T netdisco-postgresql pg_dump -U netdisco -Fc netdisco > "$DEST/netdisco.dump"
tar --numeric-owner -czf "$DEST/config-and-local.tgz" netdisco/config netdisco/nd-site-local
sha256sum "$DEST"/* > "$DEST/SHA256SUMS"
log verified
# Encrypt and copy the complete set off-host before retention cleanup.