Back up local OpenTofu state before deletion

jeannie

@@ -494,6 +494,46 @@ run_tofu_plan_stack() {
     tofu -chdir="${REPO_ROOT}/${stack}" plan "${plan_args[@]}"
 }
 
+backup_tofu_state() {
+    local backup_dir="${HOMELAB_TOFU_STATE_BACKUP_DIR:-${HOMELAB_STATE_DIR}/tofu-state-backups}"
+    local timestamp
+    local archive
+    local -a paths=()
+    local path
+
+    timestamp="$(date +%Y%m%d-%H%M%S)"
+    archive="${backup_dir}/tofu-state-${timestamp}.tgz"
+    mkdir -p "${backup_dir}"
+
+    for path in \
+        bootstrap/provisioning/terraform.tfstate \
+        bootstrap/provisioning/terraform.tfstate.backup \
+        bootstrap/cluster/terraform.tfstate \
+        bootstrap/cluster/terraform.tfstate.backup \
+        bootstrap/platform/terraform.tfstate \
+        bootstrap/platform/terraform.tfstate.backup \
+        bootstrap/apps/terraform.tfstate \
+        bootstrap/apps/terraform.tfstate.backup \
+        bootstrap/edge/terraform.tfstate \
+        bootstrap/edge/terraform.tfstate.backup \
+        .lab/cluster-workers.auto.tfvars.json \
+        .lab/pimox-workers.tsv \
+        .lab/manual-workers.tsv; do
+        if [[ -e "${REPO_ROOT}/${path}" ]]; then
+            paths+=("${path}")
+        fi
+    done
+
+    if ((${#paths[@]} == 0)); then
+        echo "No local OpenTofu state files found to back up."
+        return 0
+    fi
+
+    tar -C "${REPO_ROOT}" -czf "${archive}" "${paths[@]}"
+    chmod 0600 "${archive}"
+    echo "Backed up local OpenTofu state to ${archive}."
+}
+
 move_prometheus_stack_workers() {
     local stack="bootstrap/platform"
     local namespace="${LAB_MONITORING_NAMESPACE:-monitoring}"
@@ -5101,6 +5141,9 @@ EOF
     docker rm -f buildx_buildkit_lab-builder0 2>/dev/null || true
     rm -f "${BUILDX_CONFIG}" || true
 
+    echo "--> Backing up local OpenTofu tracking state files..."
+    backup_tofu_state
+
     echo "--> Deleting OpenTofu tracking state files..."
     rm -rf "${REPO_ROOT}"/bootstrap/cluster/terraform.tfstate*
     rm -f "${REPO_ROOT}"/bootstrap/cluster/.terraform.tfstate.lock.info
@@ -5435,6 +5478,9 @@ case "${1:-}" in
     inventory-check)
         inventory_check
         ;;
+    state-backup)
+        backup_tofu_state
+        ;;
     fix-debian-docker-root)
         fix_debian_docker_root
         ;;
@@ -5464,7 +5510,7 @@ case "${1:-}" in
         echo "Log: ${JEANNIE_LOG_FILE}"
         ;;
     *)
-        echo "Usage: $0 {up|plan [all|provisioning|cluster|platform|apps|edge]|rebuild-cluster|stop-cluster|start-cluster|status|apps|website-translation-model|website-ollama-listen|ollama-setup|deploy-gitea|rpi-services|bootstrap-gitea-repo|backup-gitea|drill-gitea-restore|install-gitea-runner|move-prometheus-stack-workers|doctor-versions|doctor-edge|doctor-gitea|doctor-rpi|doctor-cluster|preflight|inventory-check|fix-debian-docker-root|secrets-init|secrets-check|tailnet-policy-check|ai-index|ai-check|openwrt|nuke}"
+        echo "Usage: $0 {up|plan [all|provisioning|cluster|platform|apps|edge]|rebuild-cluster|stop-cluster|start-cluster|status|apps|website-translation-model|website-ollama-listen|ollama-setup|deploy-gitea|rpi-services|bootstrap-gitea-repo|backup-gitea|drill-gitea-restore|install-gitea-runner|move-prometheus-stack-workers|doctor-versions|doctor-edge|doctor-gitea|doctor-rpi|doctor-cluster|preflight|inventory-check|state-backup|fix-debian-docker-root|secrets-init|secrets-check|tailnet-policy-check|ai-index|ai-check|openwrt|nuke}"
         exit 1
         ;;
 esac