{ config, lib, pkgs, ... }:

/*
this module enables a backup script made with borg!
to use import & set the options below
to declare a backup add the following code
to a module and it will backup all listed paths
in a borg archive to the specified repo

      |     <3yy>    |
      V              V
  modules.system.backups.baks = {
    ${service} = { paths = [ cfg.data_dir ]; };
  };
*/

let
  cfg = config.modules.system.backups;
  sec = config.sops.secrets;
  borg = "${pkgs.borgbackup}/bin/borg";
  baks = lib.unique config.modules.system.backups.baks;
  passwd_file = ;
in
{
  options.modules.system.backups = {
    enable = lib.mkEnableOption "enables backups with borg";
    baks = lib.mkOption {
      type = lib.types.attrsOf ( lib.types.attrsOf (lib.types.listOf lib.types.path) );
      default = {};
      description = "backup jobs, nested attribute sets should be <bak_name> = paths [<list_of_paths>]";
    };
    repo = lib.mkOption {
      type = lib.types.path;
      default = "/holocron/borg";
      description = "borg repository path";
    };
    passwd_file = lib.mkOption {
      type = lib.types.path;
      default = sec."borg_passwd".path;
      description = "borg repository passphrase file";
    };
  };

  config = lib.mkIf (cfg.enable && baks != {}) {
    
    systemd.services.backups = {
      description = "backup service with borg!";
      path = [ pkgs.borgbackup ];
      serviceConfig = {
        Type = "oneshot";
#        EnvironmentFile = config.modules.system.backups.passphraseFile;
        # the actual script borg is using
        ExecStart = pkgs.writeShellScript "borg-backup" ''
          set -euo pipefail
          export BORG_PASSPHRASE="$(cat ${passwd_file})"
          export BORG_REPO="${cfg.repo}"
          timestamp="$(date +'%Y-%m-%d_%H:%M:%S')"

          # init repo in needed
          if ! borg info "$BORG_REPO" >/dev/null 2>&1; then
            echo "Initializing Borg repo at $BORG_REPO"
            borg init --encryption=repokey "$BORG_REPO"
          fi

          echo "starting backup at $timestamp"

          # loop for each backup
          ${lib.concatStringsSep "\n\n" (lib.mapAttrsToList (bak_name: bak_paths:
            ''
              echo "------------ Backing up ${bak_name} ------------"
              archive="$timestamp-${bak_name}"
              echo "backing up: ${lib.concatStringsSep " " bak_paths.paths} → $archive"
              borg create \
                --verbose \
                --filter AME \
                --list \
                --stats \
                --show-rc \
                --compression lzma,9 \
                "$BORG_REPO::$archive" \
                ${lib.concatStringsSep " " bak_paths.paths}

              echo "pruning old backups for ${bak_name}..."
              borg prune -v --list "$BORG_REPO" \
                --prefix "${bak_name}-" \
                --keep-daily=7 \
                --keep-weekly=52 \
                --keep-monthly=-1
            ''
          ) cfg.jobs)}
          echo "backup run complete at \"$BORG_REPO::$archive\""
        '';
      };
    };

    # create timer to run backups daily
    systemd.timers.backups = {
      description = "daily borg backup timer";
      wantedBy = [ "timers.target" ];
      timerConfig = {
        OnCalendar = "daily";
        Persistent = true;
      };
    };

    # install borg binary
    environment.systemPackages = [ pkgs.borgbackup ];

    # declare secret for repo password
    sops.secrets = {
      "borg_passwd" = { 
        owner = "root";
        group = "root";
      };
    };
  };
}