"""Create a pg_dump backup without putting passwords in argv or output."""
import os
from pathlib import Path
import subprocess

from sqlalchemy.engine import make_url


def main():
    url = make_url(os.environ["DATABASE_URL"])
    if url.get_backend_name() != "postgresql":
        raise SystemExit("Production deployment requires PostgreSQL")
    path = Path(os.environ["BACKUP_FILE"])
    environment = dict(os.environ, PGPASSWORD=url.password or "")
    if "sslmode" in url.query:
        environment["PGSSLMODE"] = url.query["sslmode"]
    with path.open("xb") as backup:
        path.chmod(0o600)
        subprocess.run(["pg_dump", "--format=custom", "--no-password", "--host", url.host or "localhost",
                        "--port", str(url.port or 5432), "--username", url.username or "postgres",
                        "--dbname", url.database], env=environment, stdout=backup, check=True, timeout=600)
    print("Database backup created")


if __name__ == "__main__":
    main()