#!/usr/bin/env bash
# Pushes the git-backed state repo (groups, users, host permissions, audit
# metadata) to a remote so a dead/lost jump host does not mean re-creating
# every user and permission by hand. Deliberately does NOT touch the export
# archive directory: those .7z files contain (encrypted) private keys and
# should be deleted from the jump host once delivered, not retained/backed up.
set -euo pipefail

STATE_DIR="${1:-/var/lib/ssh-access-tui/state}"

if [ ! -d "$STATE_DIR/.git" ]; then
  echo "ssh-access-tui-backup: $STATE_DIR is not a git repo yet — run the tool at least once first." >&2
  exit 1
fi

cd "$STATE_DIR"

if ! git remote get-url origin >/dev/null 2>&1; then
  cat >&2 <<EOF
No git remote 'origin' is configured for $STATE_DIR.
This is local-only right now: a disk failure on this host would lose it.
Configure a remote (a private repo, or a git server on separate storage) with:
  git -C $STATE_DIR remote add origin <url>
EOF
  exit 1
fi

git push origin HEAD:refs/heads/main
echo "ssh-access-tui-backup: pushed $STATE_DIR to origin at $(date -Is)"