#!/bin/bash
## Ansible managed

## Secrets are passed via Ansible Vault variables
export RESTIC_REPOSITORY="{{ vault_restic_repo_url }}"
export RESTIC_PASSWORD="{{ vault_restic_password }}"
export AWS_ACCESS_KEY_ID="{{ vault_aws_access_key }}"
export AWS_SECRET_ACCESS_KEY="{{ vault_aws_secret_key }}"

set -e

echo "Starting Restic Backup at $(date)"

## Run the backup using paths and exclusions defined in group_vars
restic backup \
{% for path in backup_include_paths %}
  "{{ path }}" \
{% endfor %}
{% for path in backup_exclude_paths %}
  --exclude "{{ path }}" \
{% endfor %}
  --cleanup-cache

restic forget \
  --prune \
  --keep-daily {{ backup_retention_daily }} \
  --keep-weekly {{ backup_retention_weekly }} \
  --keep-monthly {{ backup_retention_monthly }}

echo "Restic backup completed at $(date)"