#!/bin/sh
set -eu
case "${RESTIC_REPOSITORY:-}" in
    s3:*)
        if ! test -f "${AWS_SHARED_CREDENTIALS_FILE:-}" || ! awk '
            /^[[:space:]]*\[default\][[:space:]]*$/ { selected=1; next }
            /^[[:space:]]*\[/ { selected=0 }
            selected && /^[[:space:]]*aws_access_key_id[[:space:]]*=/ { value=$0; sub(/^[^=]*=/, "", value); gsub(/[[:space:]"\047]/, "", value); key=(length(value)>0) }
            selected && /^[[:space:]]*aws_secret_access_key[[:space:]]*=/ { value=$0; sub(/^[^=]*=/, "", value); gsub(/[[:space:]"\047]/, "", value); secret=(length(value)>0) }
            END { exit !(key && secret) }
        ' "$AWS_SHARED_CREDENTIALS_FILE"; then
            echo "An explicit default-profile S3 credential file is required." >&2
            exit 1
        fi
        ;;
esac
case "${1:-}" in
    backup)
        test -s /capture/database.sql && test -s /capture/manifest.json && test -s /keys/app_key && test -s /redis/dump.rdb || exit 1
        if test -n "$(find /capture /uploads /keys /configuration /redis/dump.rdb -type l -print -quit)"; then
            echo "Backup sources must not contain symbolic links." >&2
            exit 1
        fi
        if test "${POST76_BACKUP_INCLUDE_LEGACY:-false}" = "true" && test -n "$(find /legacy/attachment /legacy/avatar -type l -print -quit)"; then
            echo "Legacy backup sources must not contain symbolic links." >&2
            exit 1
        fi
        ;;
    init|snapshots|tag|dump|ls|restore|check|version) ;;
    *) echo "Unsupported backup operation." >&2; exit 2 ;;
esac
exec /usr/bin/restic --cache-dir=/cache --json "$@"