#!/usr/bin/env bash
# Refresh the SD card as a manual boot-fallback clone of the running root
# filesystem. Run manually after a push:
#   sudo ./failover/sync-sd-backup.sh
#
# R5C layout: the primary root is the eMMC (mmcblk1p1) and the SD card
# (root UUID below) is the backup. U-Boot has no persistent env and always
# prefers the SD if it finds a boot.scr there, so the SD's boot.scr is kept
# renamed to /boot/boot-failesafe-rename-to:boot.scr. U-Boot then skips the
# SD and boots the eMMC. To boot the SD: rename it back to boot.scr (e.g.
# from another machine with the SD mounted, or from a U-Boot console).
#
# Not copied verbatim, so the clone keeps its own identity:
#   /etc/fstab, /boot/armbianEnv.txt  copied with the root UUID rewritten
#   /boot/boot.scr                    never created; the eMMC's copy is
#                                     refreshed under the failsafe name
#   /etc/machine-id, /var/log         left alone (see repo memory
#                                     "sd-fallback-fstab-clobber")
# The bootloader in the SD's first sectors (idbloader/u-boot) is not touched.
set -euo pipefail

# Backup settings come from the host config (see hosts/vanlink.conf.example).
# shellcheck disable=SC1090
. "${VANLINK_CONF:-/etc/vanlink.conf}"
: "${SD_BACKUP_UUID:?set SD_BACKUP_UUID in /etc/vanlink.conf}"

[ "$(id -u)" -eq 0 ] || { echo "Run as root (sudo)." >&2; exit 1; }

SD_UUID=$SD_BACKUP_UUID
SD_ROOT_PART=/dev/disk/by-uuid/$SD_UUID
MOUNT_POINT=/mnt/sd-backup-root
FAILSAFE='boot-failesafe-rename-to:boot.scr'

[ -e "$SD_ROOT_PART" ] || { echo "SD card (UUID $SD_UUID) not present." >&2; exit 1; }

root_src=$(findmnt -no SOURCE /)
if [ "$(readlink -f "$SD_ROOT_PART")" = "$root_src" ]; then
    echo "Currently booted from the SD card ($root_src) — refusing to sync SD onto itself." >&2
    exit 1
fi
root_uuid=$(findmnt -no UUID /)

mkdir -p "$MOUNT_POINT"
mounted_here=0
if ! mountpoint -q "$MOUNT_POINT"; then
    mount "$SD_ROOT_PART" "$MOUNT_POINT"
    mounted_here=1
else
    mount -o remount,rw "$MOUNT_POINT"
fi

cleanup() {
    if [ "$mounted_here" -eq 1 ]; then
        umount "$MOUNT_POINT"
    fi
}
trap cleanup EXIT

# rsync exit 24 ("partial transfer due to vanished source files") is expected on a
# live root — files like container shm sockets or in-progress logs routinely disappear
# mid-sync. Tolerate that one code; anything else is a real failure and still aborts.
# Excluded paths are also protected from --delete (no --delete-excluded), which is
# what keeps the SD's failsafe-renamed boot script in place.
rc=0
rsync -aHAXx --numeric-ids --delete \
    --info=progress2 \
    --exclude=/proc/* --exclude=/sys/* --exclude=/dev/* --exclude=/run/* \
    --exclude=/tmp/* --exclude=/mnt/* --exclude=/media/* --exclude=/lost+found \
    --exclude=/swapfile \
    --exclude=/etc/fstab --exclude=/etc/machine-id --exclude=/var/log/* \
    --exclude=/boot/armbianEnv.txt --exclude=/boot/boot.scr --exclude="/boot/$FAILSAFE" \
    --stats / "$MOUNT_POINT/" || rc=$?

if [ "$rc" -ne 0 ] && [ "$rc" -ne 24 ]; then
    echo "rsync failed (exit $rc)." >&2
    exit "$rc"
fi
if [ "$rc" -eq 24 ]; then
    echo "Note: some files vanished mid-sync (rsync exit 24) — normal on a live root." >&2
fi

# fstab and armbianEnv.txt: take the source's content, point root at the SD.
for f in etc/fstab boot/armbianEnv.txt; do
    sed "s/$root_uuid/$SD_UUID/g" "/$f" > "$MOUNT_POINT/$f.new"
    chmod --reference="/$f" "$MOUNT_POINT/$f.new"
    mv "$MOUNT_POINT/$f.new" "$MOUNT_POINT/$f"
done

# Keep the SD's boot script current but dormant, so U-Boot never boots the SD
# while the eMMC is healthy.
install -m 0644 /boot/boot.scr "$MOUNT_POINT/boot/$FAILSAFE"
if [ -e "$MOUNT_POINT/boot/boot.scr" ]; then
    echo "WARNING: $MOUNT_POINT/boot/boot.scr exists — U-Boot will boot the SD, not the eMMC." >&2
fi

echo "SD backup ($SD_ROOT_PART) synced from $root_src."