$ErrorActionPreference = 'Stop'
$linux = @'
set -euo pipefail
RESTORE=/opt/infisical/imports/nas-20260611-233438/backup
APP=/opt/infisical
EXPECTED='653ba589b1bb6bbcf50cde91de0cda6f08b2414c14af093827f1a9c1d4cd5d3c'
ARCHIVE='/mnt/c/ProgramData/kube-bot/incoming/infisical/infisical-backup-20260611-233438-transfer-20260612-073445.tar.gz'
cd "$APP"
echo '== preflight =='
sha256sum "$ARCHIVE" | awk '{print "archive_sha256=" $1}'
[ "$(sha256sum "$ARCHIVE" | awk '{print $1}')" = "$EXPECTED" ]
cd "$RESTORE"
awk '{n=$2; sub(/^.*\//,"",n); print $1 "  " n}' SHA256SUMS > SHA256SUMS.local
sha256sum -c SHA256SUMS.local
cd "$APP"
echo '== backup current before restore =='
PRE_OUT=$(/opt/infisical/bin/backup-infisical.sh)
echo "$PRE_OUT"
PRE_BDIR=$(printf '%s\n' "$PRE_OUT" | sed -n 's/^backup_dir=//p')
echo "pre_restore_backup=$PRE_BDIR"
echo '== stop current stack =='
docker compose -f docker-compose.prod.yml down --remove-orphans
TS=$(date -u +%Y%m%d-%H%M%S)
cp -a docker-compose.prod.yml "docker-compose.prod.yml.pre-restore-$TS"
cp -a .env ".env.pre-restore-$TS"
echo '== install NAS env/compose =='
cp "$RESTORE/compose.yml" "$APP/docker-compose.prod.yml"
cp "$RESTORE/.env" "$APP/.env"
chmod 600 "$APP/.env"
# Ensure service stays on intended IT15 port 8088. Preserve compose otherwise.
python3 - <<'PY'
from pathlib import Path
p=Path('/opt/infisical/docker-compose.prod.yml')
s=p.read_text()
# normalize common Infisical mappings to 8088:8080
s=s.replace('- 80:8080', '- "8088:8080"')
s=s.replace('- "80:8080"', '- "8088:8080"')
s=s.replace('- 8088:8080', '- "8088:8080"')
# If compose has no 8088:8080 but contains backend ports stanza already, leave it and report later.
p.write_text(s)
PY
echo '== sanitized target config =='
grep -E '^(SITE_URL|POSTGRES_USER|POSTGRES_DB|DB_CONNECTION_URI|REDIS_URL)=' .env | sed -E 's#(://[^:]+:)[^@]+#\1***#;s#(REDIS_URL=redis://[^:]*:).*#\1***#;s#(SITE_URL=http://[^:]+:).*#\1***#' || true
grep -A3 'ports:' docker-compose.prod.yml || true
echo '== reset volumes and start db/redis =='
docker compose -f docker-compose.prod.yml down -v --remove-orphans
set +x
set -a
. "$APP/.env"
set +a
set -x
docker compose -f docker-compose.prod.yml up -d db redis
ready=0
for _ in $(seq 1 90); do
  if docker exec -e PGPASSWORD="$POSTGRES_PASSWORD" infisical-db psql -h 127.0.0.1 -U "$POSTGRES_USER" -d "$POSTGRES_DB" -tAc 'select 1' >/dev/null 2>&1; then ready=1; break; fi
  sleep 2
done
[ "$ready" = 1 ]
echo '== restore database dump =='
docker cp "$RESTORE/infisical-db.dump" infisical-db:/tmp/infisical-db.dump >/dev/null
docker exec -e PGPASSWORD="$POSTGRES_PASSWORD" infisical-db pg_restore -h 127.0.0.1 -U "$POSTGRES_USER" -d "$POSTGRES_DB" --clean --if-exists /tmp/infisical-db.dump >/dev/null
TABLE_COUNT=$(docker exec -e PGPASSWORD="$POSTGRES_PASSWORD" infisical-db psql -h 127.0.0.1 -U "$POSTGRES_USER" -d "$POSTGRES_DB" -tAc "select count(*) from information_schema.tables where table_schema='public';")
echo "restored_public_table_count=$TABLE_COUNT"
echo '== start full stack =='
docker compose -f docker-compose.prod.yml up -d
echo '== wait health =='
for i in $(seq 1 60); do
  if curl -fsS --max-time 5 http://127.0.0.1:8088/api/status; then echo; echo "health_ok_try=$i"; break; fi
  sleep 5
  if [ "$i" = 60 ]; then
    echo 'health_failed'
    docker compose -f docker-compose.prod.yml ps || true
    docker logs --tail 120 infisical-backend || true
    exit 1
  fi
done
echo '== final ps =='
docker compose -f docker-compose.prod.yml ps
echo "pre_restore_backup=$PRE_BDIR"
echo "restore_source=$RESTORE"
'@
$b64 = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($linux))
$b64 | wsl -d Ubuntu -u root -- bash -lc 'base64 -d > /root/real-restore-infisical.sh && chmod +x /root/real-restore-infisical.sh && bash /root/real-restore-infisical.sh'