#!/usr/bin/env bash
# Runs ON gex44 (root). Copies the library to gs://forge-assets-library-eu (project forge-dev-492809, europe-west3,
# private, versioned). blobs/: write-once (--immutable: never overwrite, never delete). repo/: mirrored (versioning keeps
# old objects). Then verifies every blob by hash. Account: forge-assets-sync (objectAdmin on this bucket only).
# Called after every publish (README step 4) and nightly by forge-assets-gcs.timer.
set -euo pipefail
export RCLONE_CONFIG_FAL_TYPE='google cloud storage' RCLONE_CONFIG_FAL_SERVICE_ACCOUNT_FILE=/etc/forge-assets/gcs-sync.json \
       RCLONE_CONFIG_FAL_BUCKET_POLICY_ONLY=true RCLONE_CONFIG_FAL_LOCATION=europe-west3
B=fal:forge-assets-library-eu; L=/var/log/forge-assets-gcs.log
{
  echo "== $(date -u +%FT%TZ) sync start"
  rclone copy /srv/forge-assets/blobs "$B/blobs" --immutable --transfers 8
  rclone sync /srv/forge-assets/repo "$B/repo" --transfers 8
  rclone check /srv/forge-assets/blobs "$B/blobs" --one-way
  echo "== $(date -u +%FT%TZ) ok: $(ls /srv/forge-assets/blobs | wc -l) blobs verified"
} >> "$L" 2>&1 || { echo "== $(date -u +%FT%TZ) FAILED" >> "$L"; tail -5 "$L"; exit 1; }
tail -1 "$L"