-- ─────────────────────────────────────────────────────────────────────────────
-- 059 — Local-disk backup repository, and a logical policy to feed it
--
-- Lets the whole backup subsystem run on a developer machine: pg_dump straight
-- to disk, no pgBackRest and no privileged agent, so the admin screen, the
-- quota logic, run history and retention are all exercisable on Windows.
--
-- Layout mirrors the object store key-for-key, with only the leading segment
-- differing by environment (BACKUP_ENV_PREFIX, default 'test') — the same split
-- media storage already uses:
--
--   test/database/backups/databases/<timestamp>_<database>.sql
--   test/database/backups/wal/<segment>.walfomat
--
--   production/database/backups/databases/...
--   production/database/backups/wal/...
--
-- ⚠ WHAT A LOCAL BACKUP IS NOT
--
-- pg_dump is a LOGICAL backup: it restores to the instant the dump ran, and
-- nothing between dumps. It is not point-in-time recovery, and a green dev
-- screen is not evidence that production PITR works. Runs taken this way are
-- recorded with backupType 'logical' precisely so nothing downstream — least of
-- all the recovery timeline — mistakes one for a physical base backup with
-- continuous WAL behind it.
-- ─────────────────────────────────────────────────────────────────────────────

BEGIN;

-- repoIndex 3: repo1 is the local pgBackRest spool on the server, repo2 is R2.
-- This is a third, distinct thing — the dev machine's own store — and giving it
-- its own index keeps the three from ever being confused for one another.
INSERT INTO platform.backup_repositories
  ("id", "code", "name", "kind", "repoIndex", "pathPrefix",
   "credentialRef", "encrypted", "immutable", "appendOnly",
   "retentionFull", "retentionDiff", "retentionDays",
   "quotaBytes", "softLimitPct", "hardLimitPct", "sortOrder")
VALUES
  ('bkr_local_disk', 'local-disk', 'Local disk (pg_dump)', 'posix', 3,
   -- The environment segment is resolved at runtime from BACKUP_ENV_PREFIX;
   -- this records the shape rather than a fixed path, so one row is correct in
   -- both environments.
   '{env}/database/backups',
   NULL,
   -- Honest flags. A plain .sql file on a developer's disk is not encrypted,
   -- not immutable, and trivially deletable. Claiming otherwise here would put
   -- reassuring ticks on the admin screen that nothing backs.
   false, false, false,
   3, 0, 7,
   -- The same 1 GB ceiling as the R2 budget, deliberately. Dev is where the
   -- quota path should be exercised, and a dev machine that never hits the
   -- limit never proves the refusal works.
   1073741824, 70, 90, 2)
ON CONFLICT ("code") DO NOTHING;

-- A logical policy for hosts running the local backend. Disabled by default:
-- on the server the agent handles backups and this would duplicate them, so
-- turning it on is a deliberate act from the admin screen.
INSERT INTO platform.backup_policies
  ("id", "targetId", "name", "backupType", "cronExpression", "timezone",
   "windowMinutes", "retentionCount", "retentionDays", "slaHours", "isEnabled", "sortOrder")
VALUES
  ('bkp_local_dump', 'bkt_forgestack', 'Local pg_dump (dev)', 'logical', '0 */4 * * *', 'Asia/Kolkata',
   -- A wide window: a developer machine is asleep at 02:00 and the run should
   -- still happen when it wakes rather than being skipped as "out of window".
   720, 3, 7, 26, false, 4)
ON CONFLICT ("id") DO NOTHING;

COMMIT;