---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: gitea-repositories-backup
  namespace: default
spec:
  schedule: "@daily"
  jobTemplate:
    spec:
      template:
        metadata:
          name: gitea-repositories-backup
        spec:
          containers:
            - name: gitea-repositories-backup
              image: ghcr.io/auricom/kubectl:v1.25.0@sha256:75d43a3131e25f10139174e77e689eafb1b40ed9d9094d5c8c96eba5571aeefd
              imagePullPolicy: IfNotPresent
              env:
                - name: ENV_GITEA_API_TOKEN
                  valueFrom:
                    secretKeyRef:
                      name: gitea-config
                      key: apiToken
              command:
                - "/bin/bash"
                - "-c"
                - |
                  #!/bin/bash

                  set -o nounset
                  set -o errexit

                  mkdir -p ~/.ssh
                  cp /opt/id_rsa ~/.ssh/id_rsa
                  chmod 600 ~/.ssh/id_rsa

                  ssh -o StrictHostKeyChecking=no homelab@${LOCAL_LAN_TRUENAS} << 'EOF'

                    WORK_DIR="/mnt/storage/backups/apps/gitea"

                    ORGANISATIONS=$(curl --silent --location --request GET "https://gitea.${SECRET_CLUSTER_DOMAIN}/api/v1/orgs" --header "Authorization: Bearer ${ENV_GITEA_API_TOKEN}" | jq --raw-output .[].username)
                    ORGANISATIONS+=" auricom"

                    for org in $ORGANISATIONS
                    do
                        mkdir -p $WORK_DIR/$org
                        if [ $org == "auricom" ]; then
                            keyword="users"
                        else
                            keyword="orgs"
                        fi
                        REPOSITORIES=$(curl --silent --location --request GET "https://gitea.${SECRET_CLUSTER_DOMAIN}/api/v1/$keyword/$org/repos?limit=1000" --header "Authorization: Bearer ${ENV_GITEA_API_TOKEN}" | jq --raw-output .[].name)
                        for repo in $REPOSITORIES
                        do
                            if [ -d "$WORK_DIR/$org/$repo" ]; then
                                echo "INFO: pull $org/$repo..."
                                cd $WORK_DIR/$org/$repo
                                git remote show origin -n | grep -c main &> /dev/null && MAIN_BRANCH="main" || MAIN_BRANCH="master"
                                git fetch --all
                                test $? -ne 0 && exit 1
                                git reset --hard origin/$MAIN_BRANCH
                                test $? -ne 0 && exit 1
                                git pull origin $MAIN_BRANCH
                                test $? -ne 0 && exit 1
                                echo "INFO: clean $org/$repo..."
                                git fetch --prune
                                for branch in $(git branch -vv | grep ': gone]' | awk '{print $1}')
                                do
                                  git branch -D $branch
                                done
                            else
                                echo "INFO: clone $org/$repo..."
                                cd $WORK_DIR/$org
                                git clone git@gitea.${SECRET_DOMAIN}:$org/$repo.git
                                test $? -ne 0 && exit 1
                            fi
                        done
                    done
                    echo "INFO: Backup done"
                  EOF

                  curl -m 10 --retry 5 http://healthchecks.default.svc.cluster.local./ping/${SECRET_HEALTHCHECKS_PING_KEY}/k3s-gitea-repositories-backup
              volumeMounts:
                - name: secret
                  mountPath: /opt/id_rsa
                  subPath: deployment_rsa_priv_key
          volumes:
            - name: secret
              secret:
                secretName: gitea-config
          restartPolicy: Never