From 1f57f4cc4856ae9997ec5b2435321de1ae064e1c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?M=C3=A1rton=20Boros?= Date: Thu, 23 Jul 2026 05:02:50 +0300 Subject: [PATCH 1/7] ci: install AMI postgres profile via nix-env --set instead of nix profile install Bundle psql/bin, pg_prove, supabase-groonga, and postgresql_src/_debug into a single postgres-*-profile derivation per major version, so the AMI build resolves and installs it with one nix-env --set instead of looping nix profile install over five separate flake attrs. Gatekeeper is not included here: it lives in the site-env-* profiles from #2283 instead, since it needs to roll out independently of a full AMI rebuild. --- ansible/tasks/stage2-setup-postgres.yml | 28 ++++++++++++------------- nix/packages/default.nix | 16 ++++++++++++++ 2 files changed, 29 insertions(+), 15 deletions(-) diff --git a/ansible/tasks/stage2-setup-postgres.yml b/ansible/tasks/stage2-setup-postgres.yml index d935d24473..06a220c8a8 100644 --- a/ansible/tasks/stage2-setup-postgres.yml +++ b/ansible/tasks/stage2-setup-postgres.yml @@ -62,17 +62,20 @@ when: - stage2_nix block: - - name: Install packages from nix binary cache + - name: Resolve postgres profile store path ansible.builtin.shell: | - sudo -u postgres bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install github:supabase/postgres/{{ git_commit_sha }}#{{ nix_item }}" - loop: - - "{{ psql_version }}/bin" - - pg_prove - - supabase-groonga - - "{{ postgresql_version }}_debug" - - "{{ postgresql_version }}_src" - loop_control: - loop_var: 'nix_item' + sudo -u postgres bash -c " + . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && + nix build --no-link --print-out-paths github:supabase/postgres/{{ git_commit_sha }}#postgres-{{ postgresql_major_version }}-profile + " + register: postgres_profile_path + + - name: Install postgres profile from nix binary cache + ansible.builtin.shell: | + sudo -u postgres bash -c " + . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && + nix-env --set {{ postgres_profile_path.stdout }} + " - name: Install supascan for baseline validation ansible.builtin.shell: | @@ -134,11 +137,6 @@ - stage2_nix - not is_psql_15 block: - - name: Install gatekeeper from nix binary cache - become: yes - shell: | - sudo -u postgres bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install github:supabase/postgres/{{ git_commit_sha }}#gatekeeper" - - name: Create symbolic link for linux-pam to find pam_jit_pg.so become: yes shell: | diff --git a/nix/packages/default.nix b/nix/packages/default.nix index a452a9b784..cf6ec66fbf 100644 --- a/nix/packages/default.nix +++ b/nix/packages/default.nix @@ -25,6 +25,19 @@ postgresqlPackage = self'.packages."postgresql_${version}"; in pkgs.callPackage ../ext/pg_isolation_regress.nix { postgresql = postgresqlPackage; }; + # Bundles everything the AMI build installs into the postgres user's nix + # profile (via `nix-env --set`) into a single derivation. + makePostgresProfile = + version: + pkgs.symlinkJoin { + name = "postgres-${version}-profile"; + paths = [ + self'.packages."psql_${version}/bin" + self'.packages.pg_prove + self'.packages.supabase-groonga + self'.packages."postgresql_${version}_src" + ] ++ lib.optionals pkgs.stdenv.isLinux [ self'.packages."postgresql_${version}_debug" ]; + }; pgsqlSuperuser = "supabase_admin"; supascan-pkgs = pkgs.callPackage ./supascan.nix { inherit (pkgs) lib; @@ -75,6 +88,9 @@ pg_prove = pkgs.perlPackages.TAPParserSourceHandlerpgTAP; pg_regress = makePgRegress activeVersion; pg_isolation_regress = makePgIsolationRegress activeVersion; + postgres-15-profile = makePostgresProfile "15"; + postgres-17-profile = makePostgresProfile "17"; + postgres-orioledb-17-profile = makePostgresProfile "orioledb-17"; run-testinfra = pkgs.callPackage ./run-testinfra.nix { }; show-commands = pkgs.callPackage ./show-commands.nix { }; start-client = pkgs.callPackage ./start-client.nix { From e185af37411318b23671a2c34edbc86a807f7b6d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?M=C3=A1rton=20Boros?= Date: Wed, 29 Jul 2026 00:40:35 +0300 Subject: [PATCH 2/7] fix: satisfy treefmt formatting, restore gatekeeper, split postgres-profile.nix MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Reformat the profile paths list per treefmt (pre-commit-run/treefmt-check were failing on all platforms). - Re-add gatekeeper (pam_jit_pg.so) to the profile for Linux, non-PG15 builds — it was dropped when the profile packages were introduced, which broke testinfra's test_jit_pam_module_installed for PG17/orioledb-17. - Move the postgres-profile package definitions into their own nix/packages/postgres-profile.nix, imported from default.nix, and rename postgres--profile to postgres-profile-. --- ansible/tasks/stage2-setup-postgres.yml | 2 +- nix/packages/default.nix | 21 +++------------- nix/packages/postgres-profile.nix | 33 +++++++++++++++++++++++++ 3 files changed, 38 insertions(+), 18 deletions(-) create mode 100644 nix/packages/postgres-profile.nix diff --git a/ansible/tasks/stage2-setup-postgres.yml b/ansible/tasks/stage2-setup-postgres.yml index 06a220c8a8..a1b3f9feaf 100644 --- a/ansible/tasks/stage2-setup-postgres.yml +++ b/ansible/tasks/stage2-setup-postgres.yml @@ -66,7 +66,7 @@ ansible.builtin.shell: | sudo -u postgres bash -c " . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && - nix build --no-link --print-out-paths github:supabase/postgres/{{ git_commit_sha }}#postgres-{{ postgresql_major_version }}-profile + nix build --no-link --print-out-paths github:supabase/postgres/{{ git_commit_sha }}#postgres-profile-{{ postgresql_major_version }} " register: postgres_profile_path diff --git a/nix/packages/default.nix b/nix/packages/default.nix index 03bed83002..3fc6b06d77 100644 --- a/nix/packages/default.nix +++ b/nix/packages/default.nix @@ -1,6 +1,9 @@ { self, inputs, ... }: { - imports = [ ./postgres.nix ]; + imports = [ + ./postgres.nix + ./postgres-profile.nix + ]; perSystem = { inputs', @@ -25,19 +28,6 @@ postgresqlPackage = self'.packages."postgresql_${version}"; in pkgs.callPackage ../ext/pg_isolation_regress.nix { postgresql = postgresqlPackage; }; - # Bundles everything the AMI build installs into the postgres user's nix - # profile (via `nix-env --set`) into a single derivation. - makePostgresProfile = - version: - pkgs.symlinkJoin { - name = "postgres-${version}-profile"; - paths = [ - self'.packages."psql_${version}/bin" - self'.packages.pg_prove - self'.packages.supabase-groonga - self'.packages."postgresql_${version}_src" - ] ++ lib.optionals pkgs.stdenv.isLinux [ self'.packages."postgresql_${version}_debug" ]; - }; pgsqlSuperuser = "supabase_admin"; supascan-pkgs = pkgs.callPackage ./supascan.nix { inherit (pkgs) lib; @@ -89,9 +79,6 @@ pg_prove = pkgs.perlPackages.TAPParserSourceHandlerpgTAP; pg_regress = makePgRegress activeVersion; pg_isolation_regress = makePgIsolationRegress activeVersion; - postgres-15-profile = makePostgresProfile "15"; - postgres-17-profile = makePostgresProfile "17"; - postgres-orioledb-17-profile = makePostgresProfile "orioledb-17"; run-testinfra = pkgs.callPackage ./run-testinfra.nix { }; show-commands = pkgs.callPackage ./show-commands.nix { }; start-client = pkgs.callPackage ./start-client.nix { diff --git a/nix/packages/postgres-profile.nix b/nix/packages/postgres-profile.nix new file mode 100644 index 0000000000..b20b9ac5ac --- /dev/null +++ b/nix/packages/postgres-profile.nix @@ -0,0 +1,33 @@ +{ + perSystem = + { + lib, + pkgs, + self', + ... + }: + let + # Bundles everything the AMI build installs into the postgres user's nix + # profile (via `nix-env --set`) into a single derivation. + makePostgresProfile = + version: + pkgs.symlinkJoin { + name = "postgres-profile-${version}"; + paths = [ + self'.packages."psql_${version}/bin" + self'.packages.pg_prove + self'.packages.supabase-groonga + self'.packages."postgresql_${version}_src" + ] + ++ lib.optionals pkgs.stdenv.isLinux [ self'.packages."postgresql_${version}_debug" ] + ++ lib.optionals (pkgs.stdenv.isLinux && version != "15") [ self'.packages.gatekeeper ]; + }; + in + { + packages = { + postgres-profile-15 = makePostgresProfile "15"; + postgres-profile-17 = makePostgresProfile "17"; + postgres-profile-orioledb-17 = makePostgresProfile "orioledb-17"; + }; + }; +} From 244a84ef461533bff522bdb8f1e6eded7b9cc220 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?M=C3=A1rton=20Boros?= Date: Wed, 29 Jul 2026 13:39:54 +0300 Subject: [PATCH 3/7] test: suffix postgres versions with -site for manual AMI release test Temporary change to avoid colliding with real production version tags while manually triggering ami-release-nix.yml against this branch. Will be reverted once the AMI/smoke tests pass. --- ansible/vars.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ansible/vars.yml b/ansible/vars.yml index 33714fe216..f3b8ce40a6 100644 --- a/ansible/vars.yml +++ b/ansible/vars.yml @@ -13,9 +13,9 @@ postgres_major: # This is the source of truth for Postgres versions used in the Dockerfiles, and # is used to derive image tags and base images in the release matrix. postgres_release: - postgresorioledb-17: "17.9.0.010-orioledb" - postgres17: "17.6.1.157" - postgres15: "15.14.1.157" + postgresorioledb-17: "17.9.0.010-orioledb-site" + postgres17: "17.6.1.157-site" + postgres15: "15.14.1.157-site" # Docker release matrix — base images built first, layered images built on top. # tag and base_tag are derived at build time from postgres_release via release_key. From d84d75b83c0152dc67dcda20ed8d3a1ca30daf1d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?M=C3=A1rton=20Boros?= Date: Thu, 30 Jul 2026 18:03:48 +0300 Subject: [PATCH 4/7] test: keep -site suffix on already-built AMI versions after develop merge MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Deliberately not adopting develop's version bump (.011/.158/.158) yet — the currently published AMIs are tagged with the old -site versions. Will switch to the real bumped versions once smoke tests against those AMIs pass. --- ansible/vars.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ansible/vars.yml b/ansible/vars.yml index 43cac8c074..5cfcb74ba0 100644 --- a/ansible/vars.yml +++ b/ansible/vars.yml @@ -11,9 +11,9 @@ postgres_major: # This is the source of truth for Postgres versions used in the Dockerfiles, and # is used to derive image tags and base images in the release matrix. postgres_release: - postgresorioledb-17: "17.9.0.011-orioledb" - postgres17: "17.6.1.158" - postgres15: "15.14.1.158" + postgresorioledb-17: "17.9.0.010-orioledb-site" + postgres17: "17.6.1.157-site" + postgres15: "15.14.1.157-site" # Docker release matrix — base images built first, layered images built on top. # tag and base_tag are derived at build time from postgres_release via release_key. # tag_suffix is appended to the release version to form the final image tag. From e2669dba7b16d66e2d0948a5d177df6f1848f96b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?M=C3=A1rton=20Boros?= Date: Fri, 31 Jul 2026 00:47:40 +0300 Subject: [PATCH 5/7] test: use numeric-only version suffix (.999) for AMI release test The previous -site suffix broke platform's parseAMIVersion regex (expects a numeric 4th segment), causing every smoke test project to get stuck in COMING_UP regardless of engine/arch. Use an unused numeric patch number instead, consistent with the version format platform already parses correctly. --- ansible/vars.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ansible/vars.yml b/ansible/vars.yml index 5cfcb74ba0..76c9a35ac7 100644 --- a/ansible/vars.yml +++ b/ansible/vars.yml @@ -11,9 +11,9 @@ postgres_major: # This is the source of truth for Postgres versions used in the Dockerfiles, and # is used to derive image tags and base images in the release matrix. postgres_release: - postgresorioledb-17: "17.9.0.010-orioledb-site" - postgres17: "17.6.1.157-site" - postgres15: "15.14.1.157-site" + postgresorioledb-17: "17.9.0.999-orioledb" + postgres17: "17.6.1.999" + postgres15: "15.14.1.999" # Docker release matrix — base images built first, layered images built on top. # tag and base_tag are derived at build time from postgres_release via release_key. # tag_suffix is appended to the release version to form the final image tag. From 3649a8ca1081d2ae6314d78dcde51b6c71999876 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?M=C3=A1rton=20Boros?= Date: Fri, 31 Jul 2026 00:48:11 +0300 Subject: [PATCH 6/7] test: use .15799999 as the numeric version suffix for AMI release test --- ansible/vars.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ansible/vars.yml b/ansible/vars.yml index 76c9a35ac7..c46b9d666e 100644 --- a/ansible/vars.yml +++ b/ansible/vars.yml @@ -11,9 +11,9 @@ postgres_major: # This is the source of truth for Postgres versions used in the Dockerfiles, and # is used to derive image tags and base images in the release matrix. postgres_release: - postgresorioledb-17: "17.9.0.999-orioledb" - postgres17: "17.6.1.999" - postgres15: "15.14.1.999" + postgresorioledb-17: "17.9.0.15799999-orioledb" + postgres17: "17.6.1.15799999" + postgres15: "15.14.1.15799999" # Docker release matrix — base images built first, layered images built on top. # tag and base_tag are derived at build time from postgres_release via release_key. # tag_suffix is appended to the release version to form the final image tag. From 3f0f33528a26df3af09f4a992c07b76f9933b88f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?M=C3=A1rton=20Boros?= Date: Fri, 31 Jul 2026 00:54:49 +0300 Subject: [PATCH 7/7] refactor: rename postgres-profile -> postgres-env Renames nix/packages/postgres-profile.nix -> postgres-env.nix, postgres-profile-{15,17,orioledb-17} packages -> postgres-env-*, and updates ansible/tasks/stage2-setup-postgres.yml accordingly. --- ansible/tasks/stage2-setup-postgres.yml | 10 +++++----- nix/packages/default.nix | 2 +- .../{postgres-profile.nix => postgres-env.nix} | 10 +++++----- 3 files changed, 11 insertions(+), 11 deletions(-) rename nix/packages/{postgres-profile.nix => postgres-env.nix} (73%) diff --git a/ansible/tasks/stage2-setup-postgres.yml b/ansible/tasks/stage2-setup-postgres.yml index 5eb4b6bae1..4e8176f64e 100644 --- a/ansible/tasks/stage2-setup-postgres.yml +++ b/ansible/tasks/stage2-setup-postgres.yml @@ -57,19 +57,19 @@ when: stage2 become: true block: - - name: Resolve postgres profile store path + - name: Resolve postgres env store path ansible.builtin.shell: | sudo -u postgres bash -c " . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && - nix build --no-link --print-out-paths github:supabase/postgres/{{ git_commit_sha }}#postgres-profile-{{ postgresql_major_version }} + nix build --no-link --print-out-paths github:supabase/postgres/{{ git_commit_sha }}#postgres-env-{{ postgresql_major_version }} " - register: postgres_profile_path + register: postgres_env_path - - name: Install postgres profile from nix binary cache + - name: Install postgres env from nix binary cache ansible.builtin.shell: | sudo -u postgres bash -c " . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && - nix-env --set {{ postgres_profile_path.stdout }} + nix-env --set {{ postgres_env_path.stdout }} " - name: Install supascan for baseline validation diff --git a/nix/packages/default.nix b/nix/packages/default.nix index 3fc6b06d77..c3bbea579f 100644 --- a/nix/packages/default.nix +++ b/nix/packages/default.nix @@ -2,7 +2,7 @@ { imports = [ ./postgres.nix - ./postgres-profile.nix + ./postgres-env.nix ]; perSystem = { diff --git a/nix/packages/postgres-profile.nix b/nix/packages/postgres-env.nix similarity index 73% rename from nix/packages/postgres-profile.nix rename to nix/packages/postgres-env.nix index b20b9ac5ac..0229440216 100644 --- a/nix/packages/postgres-profile.nix +++ b/nix/packages/postgres-env.nix @@ -9,10 +9,10 @@ let # Bundles everything the AMI build installs into the postgres user's nix # profile (via `nix-env --set`) into a single derivation. - makePostgresProfile = + makePostgresEnv = version: pkgs.symlinkJoin { - name = "postgres-profile-${version}"; + name = "postgres-env-${version}"; paths = [ self'.packages."psql_${version}/bin" self'.packages.pg_prove @@ -25,9 +25,9 @@ in { packages = { - postgres-profile-15 = makePostgresProfile "15"; - postgres-profile-17 = makePostgresProfile "17"; - postgres-profile-orioledb-17 = makePostgresProfile "orioledb-17"; + postgres-env-15 = makePostgresEnv "15"; + postgres-env-17 = makePostgresEnv "17"; + postgres-env-orioledb-17 = makePostgresEnv "orioledb-17"; }; }; }