set -euo pipefail

if [ "$(id -u)" -ne 0 ]; then
    echo "Run with sudo"
    exit 1
fi

source /root/.restic-env

# Backup LUKS header into a location restic will pick up
cryptsetup luksHeaderBackup /dev/nvme0n1p2 \
    --header-backup-file /root/luks-header-backup.tmp
mv /root/luks-header-backup.tmp /root/luks-header-backup

# Run backup (/ and /boot since /boot is a separate partition)
restic backup / /boot \
    --exclude-file=/home/benj/.mycfg/backup/ad3/restic-exclude.txt \
    --exclude-caches \
    --verbose

# Retention: 4 weekly, 6 monthly, 1 yearly
restic forget \
    --keep-weekly 4 \
    --keep-monthly 6 \
    --keep-yearly 1 \
    --prune

echo ""
echo "=== Latest snapshots ==="
restic snapshots --latest 5