Szenario: VPS-Totalausfall

# rclone-Creds aus Bitwarden Item "OVH-S3 rclone" einlesen
mkdir -p ~/.config/rclone && nano ~/.config/rclone/rclone.conf
# $OVH_S3_BUCKET = OVH-S3 bucket name aus Bitwarden Item "OVH-S3 rclone"
rclone copy ovh-backup:$OVH_S3_BUCKET/keys/keys-bundle.tar.gz.age .

# Passphrase NICHT in History — interaktiv eingeben
age -d keys-bundle.tar.gz.age > keys-bundle.tar.gz   # Passphrase aus Bitwarden, prompt

tar xzf keys-bundle.tar.gz -C /home/ubuntu/infrastructure/keys/
chmod 600 /home/ubuntu/infrastructure/keys/{sops,backup}.key

# Sofort wieder aufräumen
shred -u keys-bundle.tar.gz keys-bundle.tar.gz.age

# 1) Docker offizielle Repo (sops und docker-compose-plugin sind nicht in Standard-Ubuntu-apt)
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list

# 2) Update + alle benötigten Pakete (inklusive awscli, mariadb-client die im Original-Wizard fehlten)
sudo apt update
sudo apt install -y \
    docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin \
    age postgresql-client mariadb-client \
    rclone git curl wget mailutils awscli

# 3) sops binary (nicht in apt verfügbar)
sudo curl -fsSL -o /usr/local/bin/sops "https://github.com/getsops/sops/releases/download/v3.10.2/sops-v3.10.2.linux.amd64"
sudo chmod +x /usr/local/bin/sops

# 4) Verzeichnis-Skeleton (auf user $HOME, nicht hardcoded /home/ubuntu)
sudo systemctl enable docker
sudo usermod -aG docker $USER
mkdir -p $HOME/infrastructure/{keys,secrets,backups,logs,pg-credentials,state/backup}
mkdir -p $HOME/services

cd $HOME
git clone https://github.com/oysi2025/vps-infrastructure.git infrastructure
# Username: oysi2025
# Password: <PAT aus Bitwarden Item "GitHub PAT — DR" pasten — kein Echo>

# Optional: Credentials nicht persisten lassen (default ist auch off ohne credential helper)
git -C infrastructure config --unset credential.helper 2>/dev/null || true

cd $HOME && git clone git@github.com:oysi2025/vps-infrastructure.git infrastructure

# PAT in env-var, NICHT in URL
read -rs -p "GitHub PAT: " GH_PAT; echo
cd $HOME
git -c credential.helper='!f() { echo "username=oysi2025"; echo "password=$GH_PAT"; }; f' \
    clone https://github.com/oysi2025/vps-infrastructure.git infrastructure
unset GH_PAT

# Cleanup falls trotzdem in remote-URL gelandet
git -C infrastructure remote set-url origin https://github.com/oysi2025/vps-infrastructure.git

# Config-Tarball aus S3
# $OVH_S3_BUCKET = OVH-S3 bucket name aus Bitwarden Item "OVH-S3 rclone"
LATEST=$(rclone lsf ovh-backup:$OVH_S3_BUCKET/configs/ | sort | tail -1)
rclone copy "ovh-backup:$OVH_S3_BUCKET/configs/$LATEST" .
age -d -i $HOME/infrastructure/keys/backup.key -o configs.tar.gz "$LATEST"
mkdir -p /tmp/restore && tar xzf configs.tar.gz -C /tmp/restore/

# WICHTIG: Ubuntu 22.04 pg_restore (v14) kann KEINE PG18-Dumps lesen.
# Workaround: pg_restore aus postgres:18-alpine Container.

# 1) DB-Password ohne Echo lesen (KEIN Echo in History)
read -rs -p "DRILL_PWD (lokales Test-Passwort): " DRILL_PWD; echo

# 2) Dump entschlüsseln (Beispiel finance)
LATEST=$(ls -t $HOME/backups/clouddb/finance_*.dump.age | head -1)
age -d -i $HOME/infrastructure/keys/backup.key -o /tmp/finance.dump "$LATEST"

# 3) Lokalen Test-Postgres starten (NICHT zum Production-Cluster!)
docker run -d --name pg-restore -p 127.0.0.1:5432:5432 \
    -e POSTGRES_PASSWORD="$DRILL_PWD" \
    -e POSTGRES_USER=finance_user \
    -e POSTGRES_DB=finance \
    postgres:18-alpine

# 4) Wait until ready
until docker exec pg-restore pg_isready -U finance_user; do sleep 1; done

# 5) pg_restore via Container (PG18-tools eingebaut)
docker cp /tmp/finance.dump pg-restore:/tmp/
docker exec -e PGPASSWORD="$DRILL_PWD" pg-restore \
    pg_restore -h 127.0.0.1 -U finance_user -d finance \
    --no-owner --no-acl /tmp/finance.dump

# 6) Verify
docker exec -e PGPASSWORD="$DRILL_PWD" pg-restore psql -U finance_user -d finance \
    -c "SELECT count(*) FROM information_schema.tables WHERE table_schema='public';"

# 7) Cleanup
shred -u /tmp/finance.dump
unset DRILL_PWD

# 8) Wenn Test-Restore OK → neuen OVH-Cluster im OVH Manager bestellen
#    (Web Cloud → Databases → "+ Create"), dann Connection-String in
#    services/<service>/secrets/.env.enc.yaml updaten + sops re-encrypten

# 0) Root-Password ohne Echo lesen
read -rs -p "ERPNext ROOT_PWD: " ROOT_PWD; echo

# 1) Neueste ERPNext-Dump dynamisch finden (statt hardcoded Datums-Strings)
LATEST_ERP=$(ls -t $HOME/backups/erpnext/*.sql.gz.age | head -1)
echo "Using: $LATEST_ERP"

# 2) Entschlüsseln + entpacken
age -d -i $HOME/infrastructure/keys/backup.key -o erpnext.sql.gz "$LATEST_ERP"
gunzip -f erpnext.sql.gz
# erpnext.sql liegt jetzt im CWD

# 3) DB-Name extrahieren — aus Dump-Header-Comment "Database: _8dd95132..."
DB_NAME=$(head -10 erpnext.sql | grep -oP 'Database:\s+\K[^ ]+' || basename "$LATEST_ERP" | grep -oP '_[a-f0-9]{16}' | head -1 | tr -d '\n')
[ -z "$DB_NAME" ] && DB_NAME="_8dd95132afac5d61"   # Bekannter Fallback aus Production
echo "Restoring to DB: $DB_NAME"

# 4) MariaDB starten + DB anlegen + Dump einlesen
docker compose -f services/erp/docker-compose.yml up -d mariadb
until docker exec erp-mariadb mariadb -uroot -p"$ROOT_PWD" -e "SELECT 1;" >/dev/null 2>&1; do sleep 1; done

docker exec erp-mariadb mariadb -uroot -p"$ROOT_PWD" -e "CREATE DATABASE IF NOT EXISTS \`$DB_NAME\`;"
docker cp erpnext.sql erp-mariadb:/tmp/erpnext.sql
docker exec erp-mariadb sh -c "mariadb -uroot -p\"$ROOT_PWD\" $DB_NAME < /tmp/erpnext.sql"

# 5) Verify
docker exec erp-mariadb mariadb -uroot -p"$ROOT_PWD" "$DB_NAME" \
  -e "SELECT COUNT(*) FROM information_schema.tables WHERE table_schema='$DB_NAME';"

# 6) Cleanup
shred -u erpnext.sql 2>/dev/null || rm -f erpnext.sql
unset ROOT_PWD

# Neuesten Volume-Backup-Ordner dynamisch finden (statt hardcoded 20260430_030155)
# $OVH_S3_BUCKET = OVH-S3 bucket name aus Bitwarden Item "OVH-S3 rclone"
LATEST_VOL_DIR=$(rclone lsf ovh-backup:$OVH_S3_BUCKET/volumes/ -d | sort | tail -1 | sed 's|/$||')
echo "Latest volume snapshot: $LATEST_VOL_DIR"

# Pro Volume (Beispiel zammad_zammad-data):
rclone copy "ovh-backup:$OVH_S3_BUCKET/volumes/$LATEST_VOL_DIR/zammad_zammad-data.tar.gz.age" .
age -d -i $HOME/infrastructure/keys/backup.key -o vol.tar.gz zammad_zammad-data.tar.gz.age
docker volume create zammad_zammad-data
docker run --rm -v zammad_zammad-data:/target -v "$PWD":/backup alpine \
  sh -c 'cd /target && tar xzf /backup/vol.tar.gz'

# Volume-Liste der 22 zu restaurierenden:
grep -E '^\s*"' $HOME/infrastructure/scripts/backup-volumes.sh | grep -v '^\s*#' | head -30

# Neuesten wg-easy Backup dynamisch finden (statt hardcoded -20260430.db.gz)
LATEST_WG=$(ls -t $HOME/backups/vpn/wg-easy-*.db.gz.age | head -1)
age -d -i $HOME/infrastructure/keys/backup.key -o wg.db.gz "$LATEST_WG"
gunzip -f wg.db.gz
mkdir -p $HOME/services/vpn/config
sudo cp wg.db $HOME/services/vpn/config/wg-easy.db
docker compose -f services/vpn/docker-compose.yml up -d wg-easy

sudo systemctl start infra-compose.service
cd $HOME/services/zammad && ./compose-sops.sh up -d
cd $HOME/services/efsd && ./compose-sops.sh up -d
cd $HOME/services/finance && ./compose-sops.sh up -d
cd $HOME/services/shipping && ./compose-sops.sh up -d
cd $HOME/services/erp && ./compose-sops.sh up -d