#!/bin/sh
set -eu
umask 077

BACKUP_DIR=${BACKUP_DIR:-./backups}
mkdir -p "$BACKUP_DIR"
WORK=$(mktemp -d "$BACKUP_DIR/.backup.XXXXXX")
trap 'rm -rf "$WORK"' EXIT
trap 'exit 1' HUP INT TERM
STAMP=$(date +%Y-%m-%d_%H%M%S)
FILE="$BACKUP_DIR/backup_${STAMP}_$$.sql.gz"

# Separate commands: POSIX sh has no portable pipefail. Credentials stay inside
# the container; a .env file must never be sourced as shell code.
docker compose exec -T db sh -c 'exec pg_dump --no-owner --no-acl -U "$POSTGRES_USER" -d "$POSTGRES_DB"' > "$WORK/dump.sql"
test -s "$WORK/dump.sql"
gzip -c "$WORK/dump.sql" > "$WORK/dump.sql.gz"
gzip -t "$WORK/dump.sql.gz"
mv "$WORK/dump.sql.gz" "$FILE"
echo "Backup erstellt: $FILE"