devolutions-backup.ps1

# Secrets
$envFile = Join-Path $PSScriptRoot '.env'
if (!(Test-Path $envFile)) {
    Write-Error "Missing .env file at '$envFile'. Copy .env.example and fill in values." -ErrorAction Stop
}
$secrets     = Get-Content $envFile -Raw | ConvertFrom-StringData
$appKey      = $secrets.APP_KEY
$appSecret   = $secrets.APP_SECRET
$zipPassword = $secrets.ZIP_PASSWORD

# Config
$config               = Import-PowerShellDataFile (Join-Path $PSScriptRoot 'config.psd1')
$url                  = $config.Url
$pathToExportedFolder = $config.PathToExportedFolder
$sevenZipPath         = $config.SevenZipPath
$timestamp            = Get-Date -Format "yyyy-MM-dd_HHmmss"
$zipOutputPath        = Join-Path $config.ZipOutputDir "devolutions_$timestamp.7z"
$sfxOutputPath        = Join-Path $config.ZipOutputDir "devolutions_$timestamp.exe"

# Create the folder
New-Item -ItemType Directory -Path $pathToExportedFolder -Force

# Test if folder exists
if (!(Test-Path -Path $pathToExportedFolder)) {
    Write-Error -Message "Folder doesn't exist" -ErrorAction Stop
}

# Register PSGallery if not already registered
Register-PSRepository -Default -ErrorAction SilentlyContinue

# Install Devolutions PowerShell Module if not already available
if (-not (Get-Module -ListAvailable -Name Devolutions.PowerShell)) {
    Install-Module -Name Devolutions.PowerShell -Force
}
Import-Module Devolutions.PowerShell

# Connect
Connect-HubAccount -Url $url -ApplicationKey $appKey -ApplicationSecret $appSecret

# Export
$vaults = Get-HubVaultsForExport

foreach ($vault in $vaults) {
    Write-Host "Exporting vault $($vault.name) ($($vault.id))."

    if ($vault.type -eq 'PAM' -or "$($vault.type)" -eq 'PAM') {
        Write-Host "PAM Vault can't be exported, skipping."
        continue
    }

    $entries  = Get-HubEntriesForExport -VaultId $vault.id
    $safeName = $vault.name.Split([IO.Path]::GetInvalidFileNameChars()) -join '_' -replace ' ', '_'
    $filepath = Join-Path -Path $pathToExportedFolder -ChildPath "exported-entries-from-$safeName.json"
    $entries | Out-File -FilePath $filepath
}

Write-Host "All vaults exported. Creating archives..."

# Verify 7-Zip is available
if (!(Test-Path $sevenZipPath)) {
    Write-Error "7-Zip not found at '$sevenZipPath'. Install it or update the path." -ErrorAction Stop
}

# Create password-protected .7z archive with header encryption
& $sevenZipPath a -t7z "-p$zipPassword" -mhe=on "$zipOutputPath" "$pathToExportedFolder\*"
if ($LASTEXITCODE -eq 0) {
    Write-Host "Archive created successfully: $zipOutputPath"
} else {
    Write-Warning "7-Zip exited with code $LASTEXITCODE - .7z archive may be incomplete."
}

# Create self-extracting archive
& $sevenZipPath a -t7z -sfx "-p$zipPassword" -mhe=on "$sfxOutputPath" "$pathToExportedFolder\*"
if ($LASTEXITCODE -eq 0) {
    Write-Host "Archive created successfully: $sfxOutputPath"
} else {
    Write-Warning "7-Zip exited with code $LASTEXITCODE - SFX archive may be incomplete."
}

# Always clean up the export folder regardless of result
Write-Host "Cleaning up exported files..."
Remove-Item -Path $pathToExportedFolder -Recurse -Force
Write-Host "Done."