name: Production backup

on:
  schedule:
    # One of these UTC hours is 02:00 in Europe/Oslo; the guard skips the other.
    - cron: '0 0,1 * * *'
  workflow_dispatch:

jobs:
  backup:
    runs-on: ubuntu-latest
    steps:
      - name: Create verified production recovery set
        uses: appleboy/ssh-action@v1.0.3
        with:
          host: ${{ secrets.PROD_HOST }}
          username: ${{ secrets.PROD_USER }}
          key: ${{ secrets.PROD_SSH_KEY }}
          command_timeout: 20m
          script: |
            set -euo pipefail
            if [ "${{ github.event_name }}" = "schedule" ] \
                && [ "$(TZ=Europe/Oslo date +%H)" != "02" ]; then
              echo "Outside the 02:00 Europe/Oslo backup window."
              exit 0
            fi
            cd /opt/job-tracker/app
            if [ ! -x deploy/deploy.sh ]; then
              echo "The deployed backup script is unavailable."
              exit 1
            fi
            DEPLOY_BACKUP_ONLY=true deploy/deploy.sh