feat: implement SQLite backup & data integrity plan (Phases 2-4)

scripts/backup-sqlite.sh

@@ -0,0 +1,35 @@
+#!/bin/bash
+# backup-sqlite.sh — Safe hot backup of the XAMXAM SQLite database.
+#
+# Uses sqlite3's .backup command (WAL-safe) then gzip-compresses.
+# Prunes backups older than RETENTION_DAYS.
+#
+# Usage:
+#   /usr/local/bin/backup-sqlite.sh                      # default: 30 days
+#   RETENTION_DAYS=90 /usr/local/bin/backup-sqlite.sh     # 90 days
+#
+# Expected to be run from cron:
+#   0 * * * * /usr/local/bin/backup-sqlite.sh >> /var/log/sqlite-backup.log 2>&1
+#   0 2 * * * RETENTION_DAYS=90 /usr/local/bin/backup-sqlite.sh >> /var/log/sqlite-backup.log 2>&1
+
+set -euo pipefail
+
+DB_PATH="${DB_PATH:-/var/www/xamxam/storage/xamxam.db}"
+BACKUP_DIR="${BACKUP_DIR:-/var/backups/xamxam}"
+RETENTION_DAYS="${RETENTION_DAYS:-30}"
+
+TIMESTAMP=$(date +"%Y-%m-%dT%H-%M-%S")
+BACKUP_FILE="$BACKUP_DIR/db-$TIMESTAMP.db.gz"
+TMP_SNAPSHOT="/tmp/xamxam-snapshot-$$.db"
+
+mkdir -p "$BACKUP_DIR"
+
+# Safe hot backup using SQLite's online backup API
+sqlite3 "$DB_PATH" ".backup $TMP_SNAPSHOT"
+gzip -c "$TMP_SNAPSHOT" > "$BACKUP_FILE"
+rm -f "$TMP_SNAPSHOT"
+
+# Prune old backups
+find "$BACKUP_DIR" -name "*.db.gz" -mtime "+${RETENTION_DAYS}" -delete 2>/dev/null || true
+
+echo "[$(date '+%Y-%m-%d %H:%M:%S')] Backup written: $BACKUP_FILE ($(du -h "$BACKUP_FILE" | cut -f1))"