#!/usr/local/bin/bash

#
# NOTICE:
# all SSH commands are handled on the other side by sync_keys_wrapper.sh
# which runs the actual commands based on mnemonics used here
# so that access is strictly limited to what we expect and want to be run
#

echo
echo "################################################################################"
echo "# $0 run started at: $( date )"
echo

# make sure we're not already running
# this needs to happen before we set the EXIT signal trap
if pgrep -f "/usr/local/bin/bash $0" >/dev/null; then
    echo "!!! Error: already running";
    exit 0;
fi

function do_ssh {
    # we want a timeout so that we don't hang in case there is an issue
    # 10s till SIGTERM
    # 30s till SIGKILL
    # also, running SSH in batch mode so that passwords are not asked for
    # and giving it 5s to connect - this is all in our infra, so anything longer is a bug
    timeout --kill-after 30 \
        10 \
        ssh -q \
            -i /home/knot/.ssh/id_rsa \
            -o BatchMode=yes \
            -o ConnectTimeout=5 \
                "$@"
}

#
# active signer
#

# cleaning backup target directory
# ref. https://gitlab.isnic.is/is/nic/devops/-/issues/12792#note_101122
echo "+-- cleaning /var/tmp/knot-sync..."
shopt -s dotglob # in case there are dotfiles
rm -rf "/var/tmp/knot-sync"/*
COMMAND_RESULT="$?"
if [ $COMMAND_RESULT != 0 ]; then
    echo "!!! Error cleaning up backup target directory (exit status: $COMMAND_RESULT)!"
    echo "!!! Aborting."
    exit 1
fi
shopt -u dotglob

# Prepare keys for backup
echo "+-- preparing backup..."
# playing it safe with a timeout
timeout --kill-after 60 30 knotc zone-backup +backupdir "/var/tmp/knot-sync" +nozonefile +nojournal +notimers +kaspdb +nocatalog
COMMAND_RESULT="$?"
if [ $COMMAND_RESULT != 0 ]; then
    echo "!!! Error preparing knot zone backup (exit status: $COMMAND_RESULT)!"
    echo "!!! Aborting."
    exit 1
fi

# make sure the lockfile in the backup target directory is gone
# ref. https://gitlab.isnic.is/is/nic/devops/-/issues/13163
sleep 1
LOCKFILE_WAIT_COUNT=0
while stat "/var/tmp/knot-sync/lock.knot_backup" >/dev/null 2>&1 ; do
    echo "+-- backup lockfile still present, waiting a bit..."
    LOCKFILE_WAIT_COUNT=$(( $LOCKFILE_WAIT_COUNT + 1 ))
    # if it's still there after 10s, something's up
    if (( $LOCKFILE_WAIT_COUNT > 10 )); then
        echo "!!! Error: possibly stale lockfile in /var/tmp/knot-sync/lock.knot_backup!"
        echo "!!! Aborting."
        exit 2
    fi
    sleep 1;
done

 
#
# secondaries
#
 

  

  
    # Sync keys to a backup location on secondaries
    echo "+-- rsyncing /var/tmp/knot-sync/ to ht-signer02.stg.isnic.is:/var/tmp/knot-sync/..."
    rsync -acv -e "ssh -i /home/knot/.ssh/id_rsa" --delete "/var/tmp/knot-sync/" "knot@ht-signer02.stg.isnic.is:/var/tmp/knot-sync/"
    COMMAND_RESULT="$?"
    if [ $COMMAND_RESULT != 0 ]; then
        echo "!!! Error rsyncing /var/tmp/knot-sync to ht-signer02.stg.isnic.is:/var/tmp/knot-sync/ (exit status: $COMMAND_RESULT)!"
        echo "!!! Not deploying rsynced backup on ht-signer02.stg.isnic.is."
    else
        echo "+-- knotc zone-restore on ht-signer02.stg.isnic.is..."
        do_ssh knot@ht-signer02.stg.isnic.is "deploy-rsynced-backup" || echo "!!! Error deploying rsynced backup on ht-signer02.stg.isnic.is (exit status: $?)!"
    fi
  
  
