#!/usr/bin/env bash
# Jar Lid Archive dump - managed by Ansible (roles/jar_lid_archive).
#
# Writes ONE uncompressed tar to STDOUT, for roles/backup_source to encrypt:
#   db.dump      pg_dump custom format   -> pg_restore -d jarlid db.dump
#   seaweedfs/   the photo store, as files
#
# Called with `web` stopped (the backup playbook arranges it). web is the only
# writer to db and storage, so both are quiescent and agree with each other: no
# row points at a photo the tar does not have. storage keeps running; with no
# writes arriving its volume files do not change under tar.
#
# The pg_dump lands in a temp dir on the same disk as the live database, which
# is already plaintext; it is gone before this script exits.
#
# tar, not tar.gz: the bulk is JPEGs, which do not compress, and gzip on one
# core would only make the window longer.
set -euo pipefail

cd {{ jar_lid_archive_dir }}
tmp=$(mktemp -d {{ jar_lid_archive_dir }}/.dump.XXXXXX)
trap 'rm -rf "$tmp"' EXIT

docker compose exec -T db pg_dump -U {{ jar_lid_archive_postgres_user }} -d {{ jar_lid_archive_postgres_db }} -Fc > "$tmp/db.dump"
tar -cf - -C "$tmp" db.dump -C {{ jar_lid_archive_dir }} seaweedfs