#!/bin/sh
set -eu

: "${PGHOST:?PGHOST is required}"
: "${PGDATABASE:?PGDATABASE is required}"
: "${PGUSER:?PGUSER is required}"
: "${PGPASSFILE:?PGPASSFILE must point to a mounted PostgreSQL password file}"

backup_dir="${BACKUP_DIR:-/backups}"
timestamp="$(date -u +%Y%m%dT%H%M%SZ)"
final_path="${backup_dir}/${PGDATABASE}-${timestamp}.dump"
temporary_path="${final_path}.tmp"

umask 077
mkdir -p "${backup_dir}"
cleanup() {
  rm -f -- "${temporary_path}"
}
trap cleanup EXIT HUP INT TERM

pg_dump \
  --format=custom \
  --compress=9 \
  --no-owner \
  --no-privileges \
  --file="${temporary_path}"
pg_restore --list "${temporary_path}" >/dev/null
mv -- "${temporary_path}" "${final_path}"
sha256sum "${final_path}" >"${final_path}.sha256"

printf 'POSTGRES_BACKUP_OK file=%s checksum=%s\n' "${final_path}" "${final_path}.sha256"