[Unit]
Description=Matrix Homeserver - Database Backup
Documentation=https://matrix-construct.github.io/tuwunel/maintenance.html
After=network.target matrix-homeserver.service var-lib-virtiofs-data.mount matrix-tools-build.service
Requires=matrix-homeserver.service var-lib-virtiofs-data.mount
Wants=matrix-tools-build.service

# Only run if the homeserver has been configured
ConditionPathExists=/etc/quadlets/matrix/tuwunel.env

# Only run once backup credentials have been generated by matrix-init
ConditionPathExists=/var/lib/virtiofs/data/matrix/tuwunel-backup.env

PartOf=matrix.target

[Container]
ContainerName=matrix-backup-job
Image=localhost/matrix-tools:latest

# Network (to reach Tuwunel API on localhost)
Network=host

# No need for root privileges
User=10031
Group=10000

# TUWUNEL_* vars (port, server name, backup path, retention)
EnvironmentFile=/etc/quadlets/matrix/tuwunel.env
# MATRIX_BACKUP_ACCESS_TOKEN and MATRIX_BACKUP_ROOM_ID (generated by matrix-init)
EnvironmentFile=/var/lib/virtiofs/data/matrix/tuwunel-backup.env

# Custom backup script
Entrypoint=/usr/local/bin/backup.sh
Volume=/etc/quadlets/matrix/backup.sh:/usr/local/bin/backup.sh:z,ro

# RocksDB backup directory (read-only - Tuwunel writes here, we archive it)
Environment=BACKUP_SOURCE=/var/lib/tuwunel/backup
Volume=/var/lib/quadlets/matrix/tuwunel/backup-staging:/var/lib/tuwunel/backup:z,ro

# Backup archive destination on virtiofs
Environment=BACKUP_DEST=/backup
Volume=/var/lib/virtiofs/data/matrix/tuwunel/backup:/backup:z

[Service]
Restart=no
TimeoutStartSec=infinity
Type=oneshot

# Make sure the staging area is cleaned up after the backup job completes (successfully or not)
ExecStartPost=find /var/lib/quadlets/matrix/tuwunel/backup-staging -mindepth 1 -delete