#!/bin/bash
# alpha-rollback <snapshot.tar.gz> — restore /var/www/alpha from a snapshot,
# keeping a pre-rollback safety copy. Root-owned, NOPASSWD.
set -u
DIR=/var/backups/alpha
f="${1:-}"
[[ "$f" =~ ^alpha-backup-[0-9]{8}-[0-9]{6}(-v[0-9A-Za-z._-]+)?\.tar\.gz$ ]] || { echo BAD_FILE; exit 2; }
[ -f "$DIR/$f" ] || { echo NO_FILE; exit 3; }
tmp=$(mktemp -d)
if ! tar xzf "$DIR/$f" -C "$tmp" ./alpha-panel.tar.gz 2>/dev/null; then echo NO_PANEL; rm -rf "$tmp"; exit 4; fi
tar czf "$DIR/pre-rollback-$(date +%Y%m%d-%H%M%S).tar.gz" --exclude="alpha/phpmyadmin" --exclude="alpha/.git" -C /var/www alpha 2>/dev/null || true
tar xzf "$tmp/alpha-panel.tar.gz" -C /var/www 2>/dev/null || { echo EXTRACT_FAIL; rm -rf "$tmp"; exit 5; }
chown -R www-data:www-data /var/www/alpha
rm -rf "$tmp"
echo OK
