#!/usr/bin/env bash
set -euo pipefail

# Restore Authentik database from RustFS backup into K8s CloudNativePG
#
# Prerequisites:
#   - kubectl configured
#   - AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY env vars set (RustFS creds)
#
# Usage:
#   export AWS_ACCESS_KEY_ID=... AWS_SECRET_ACCESS_KEY=...
#   ./restore-authentik-db.sh

S3_ENDPOINT="http://s3.renner.uno:9000"
S3_BUCKET="migration"
S3_KEY="authentik-backup.dump"
NAMESPACE="authentik"
PG_POD="ak-pg-1"

: "${AWS_ACCESS_KEY_ID:?Set AWS_ACCESS_KEY_ID}"
: "${AWS_SECRET_ACCESS_KEY:?Set AWS_SECRET_ACCESS_KEY}"

echo "=== Authentik DB Restore ==="

# Scale down Authentik
echo "Scaling down Authentik..."
kubectl scale -n "$NAMESPACE" deploy/authentik-server --replicas=0
kubectl scale -n "$NAMESPACE" deploy/authentik-worker --replicas=0
kubectl wait -n "$NAMESPACE" --for=delete pod -l app.kubernetes.io/name=authentik --timeout=120s 2>/dev/null || true
sleep 5

# Install mc (MinIO client) in the PG pod and download the backup
echo "Downloading backup into PG pod..."
kubectl exec -n "$NAMESPACE" "$PG_POD" -c postgres -- bash -c "
  curl -sfL https://dl.min.io/client/mc/release/linux-amd64/mc -o /tmp/mc && chmod +x /tmp/mc
  /tmp/mc alias set rustfs '$S3_ENDPOINT' '$AWS_ACCESS_KEY_ID' '$AWS_SECRET_ACCESS_KEY'
  /tmp/mc cp rustfs/$S3_BUCKET/$S3_KEY /tmp/backup.dump
  ls -lh /tmp/backup.dump
"

# Restore
echo "Restoring database..."
kubectl exec -n "$NAMESPACE" "$PG_POD" -c postgres -- \
  pg_restore --clean --if-exists --no-owner --no-privileges \
  --dbname=authentik /tmp/backup.dump \
  || echo "Warning: pg_restore reported errors (usually safe to ignore for pre-existing objects)"

# Cleanup
echo "Cleaning up..."
kubectl exec -n "$NAMESPACE" "$PG_POD" -c postgres -- rm -f /tmp/backup.dump /tmp/mc

# Scale back up
echo "Scaling up Authentik..."
kubectl scale -n "$NAMESPACE" deploy/authentik-server --replicas=2
kubectl scale -n "$NAMESPACE" deploy/authentik-worker --replicas=2
kubectl wait -n "$NAMESPACE" --for=condition=Ready pod -l app.kubernetes.io/component=server --timeout=120s

echo "=== Restore Complete ==="
echo "All users, passwords, 2FA devices, and sessions preserved."