From 079096df7efe5a611712884f9348d806e1408b7f Mon Sep 17 00:00:00 2001 From: Manuel Mendez Date: Thu, 16 Jul 2026 14:22:00 -0400 Subject: [PATCH 01/15] ci/nix-install-ephemeral: Clean up action's nix-extra.conf * No need for sudo to write to /tmp * Put the github token into a separate file to avoid leaking by mistake * Do not set extra-system-features = kvm until we know we have a kvm device * Drop sourcing the shell env since its not actually used in this step --- .../actions/nix-install-ephemeral/action.yml | 33 ++++++++++--------- 1 file changed, 17 insertions(+), 16 deletions(-) diff --git a/.github/actions/nix-install-ephemeral/action.yml b/.github/actions/nix-install-ephemeral/action.yml index 638111853a..83bd67100e 100644 --- a/.github/actions/nix-install-ephemeral/action.yml +++ b/.github/actions/nix-install-ephemeral/action.yml @@ -44,34 +44,35 @@ runs: - name: Install Nix shell: bash run: | - sudo tee /tmp/nix-extra.conf > /dev/null <<'NIXCONF' + sudo tee /etc/nix/github.nix.conf >/dev/null <<'EOF' + access-tokens = github.com=${{ github.token }} + EOF + chmod 400 /etc/nix/github.nix.conf + cat >/tmp/nix-extra.conf <<'NIXCONF' always-allow-substitutes = true - extra-experimental-features = nix-command flakes - extra-system-features = kvm + extra-experimental-features = flakes nix-command + extra-substituters = https://nix-postgres-artifacts.s3.amazonaws.com + extra-trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI= max-jobs = 4 - substituters = https://cache.nixos.org https://nix-postgres-artifacts.s3.amazonaws.com - trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= NIXCONF - if [ "${{ inputs.push-to-cache }}" = "true" ]; then - echo "post-build-hook = /etc/nix/upload-to-cache.sh" | sudo tee -a /tmp/nix-extra.conf > /dev/null + + if [[ -e /dev/kvm ]]; then + echo 'extra-system-features = kvm' >>/tmp/nix-extra.conf + fi + + if [[ "${{ inputs.push-to-cache }}" == true ]]; then + echo 'post-build-hook = /etc/nix/upload-to-cache.sh' >>/tmp/nix-extra.conf fi + echo '!include /etc/nix/github.nix.conf' >>/tmp/nix-extra.conf + curl -L https://releases.nixos.org/nix/nix-2.34.6/install | sh -s -- --daemon --yes --nix-extra-conf-file /tmp/nix-extra.conf cat /etc/nix/nix.conf # Add nix to PATH for subsequent steps echo "/nix/var/nix/profiles/default/bin" >> "$GITHUB_PATH" - # Source the daemon profile so nix works in this step too - . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh - - name: Configure Nix with GitHub token - shell: bash - env: - GH_TOKEN: ${{ github.token }} - run: | - echo "access-tokens = github.com=$GH_TOKEN" | sudo tee -a /etc/nix/nix.conf > /dev/null - sudo systemctl restart nix-daemon || true - name: Print Nix version shell: bash run: nix --version From d4ed77cbeaa2fb2619ec65ea1dae2b711f341047 Mon Sep 17 00:00:00 2001 From: Manuel Mendez Date: Thu, 16 Jul 2026 14:22:00 -0400 Subject: [PATCH 02/15] ci/nix-install-ephemeral: Add multi-user input and single-user install support This way we can use this action in the qemu image build workflow that runs in dind and requires single-user install. --- .../actions/nix-install-ephemeral/action.yml | 47 +++++++++++++------ 1 file changed, 33 insertions(+), 14 deletions(-) diff --git a/.github/actions/nix-install-ephemeral/action.yml b/.github/actions/nix-install-ephemeral/action.yml index 83bd67100e..a0557554dc 100644 --- a/.github/actions/nix-install-ephemeral/action.yml +++ b/.github/actions/nix-install-ephemeral/action.yml @@ -1,14 +1,18 @@ name: 'Install Nix on ephemeral runners' description: 'Installs Nix and sets up AWS credentials to push to the Nix binary cache' inputs: + aws-region: + description: 'AWS region for the Nix binary cache S3 bucket' + required: false + default: 'us-east-1' push-to-cache: description: 'Whether to push build outputs to the Nix binary cache' required: false default: 'false' - aws-region: - description: 'AWS region for the Nix binary cache S3 bucket' + multi-user: + description: Whether to install nix in multi-user mode (default true) or single-user mode required: false - default: 'us-east-1' + default: 'true' runs: using: 'composite' steps: @@ -44,11 +48,26 @@ runs: - name: Install Nix shell: bash run: | - sudo tee /etc/nix/github.nix.conf >/dev/null <<'EOF' - access-tokens = github.com=${{ github.token }} - EOF - chmod 400 /etc/nix/github.nix.conf - cat >/tmp/nix-extra.conf <<'NIXCONF' + if [[ "${{ inputs.multi-user }}" == true ]]; then + daemon=--daemon + nixconfdir=/etc/nix + path=/nix/var/nix/profiles/default/bin + tmpconf=/tmp/nix-extra.conf + + echo 'access-tokens = github.com=${{ github.token }}' | sudo tee $nixconfdir/github.nix.conf >/dev/null + sudo chmod 400 $nixconfdir/github.nix.conf + else + daemon=--no-daemon + nixconfdir=$HOME/.config/nix + path=$HOME/.nix-profile/bin + tmpconf=$nixconfdir/nix.conf # --nix-extra-conf-files is ignored for single-user installs + + mkdir -p "$(dirname $tmpconf)" + echo 'access-tokens = github.com=${{ github.token }}' | tee $nixconfdir/github.nix.conf >/dev/null + chmod 400 $nixconfdir/github.nix.conf + fi + + cat >$tmpconf <<'NIXCONF' always-allow-substitutes = true extra-experimental-features = flakes nix-command extra-substituters = https://nix-postgres-artifacts.s3.amazonaws.com @@ -58,21 +77,21 @@ runs: if [[ -e /dev/kvm ]]; then - echo 'extra-system-features = kvm' >>/tmp/nix-extra.conf + echo 'extra-system-features = kvm' >>$tmpconf fi if [[ "${{ inputs.push-to-cache }}" == true ]]; then - echo 'post-build-hook = /etc/nix/upload-to-cache.sh' >>/tmp/nix-extra.conf + echo 'post-build-hook = /etc/nix/upload-to-cache.sh' >>$tmpconf fi - echo '!include /etc/nix/github.nix.conf' >>/tmp/nix-extra.conf + echo "!include $nixconfdir/github.nix.conf" >>$tmpconf - curl -L https://releases.nixos.org/nix/nix-2.34.6/install | sh -s -- --daemon --yes --nix-extra-conf-file /tmp/nix-extra.conf + curl -L https://releases.nixos.org/nix/nix-2.34.6/install | sh -s -- $daemon --yes --nix-extra-conf-file $tmpconf - cat /etc/nix/nix.conf + sudo cat $nixconfdir/nix.conf # Add nix to PATH for subsequent steps - echo "/nix/var/nix/profiles/default/bin" >> "$GITHUB_PATH" + echo "$path" >> "$GITHUB_PATH" - name: Print Nix version shell: bash run: nix --version From 95e101ecc81dbfa301f211c433894072dbf1fba2 Mon Sep 17 00:00:00 2001 From: Manuel Mendez Date: Thu, 16 Jul 2026 14:22:00 -0400 Subject: [PATCH 03/15] ci/nix-install-ephemeral: Add force-clean input Signals to force clean known nix paths. This is temporarily useful for native arm runners that have a pre-existing detsys nix install. --- .github/actions/nix-install-ephemeral/action.yml | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/.github/actions/nix-install-ephemeral/action.yml b/.github/actions/nix-install-ephemeral/action.yml index a0557554dc..af4c2292d4 100644 --- a/.github/actions/nix-install-ephemeral/action.yml +++ b/.github/actions/nix-install-ephemeral/action.yml @@ -5,6 +5,10 @@ inputs: description: 'AWS region for the Nix binary cache S3 bucket' required: false default: 'us-east-1' + force-clean: + description: Whether to delete pre-existing nix paths + required: false + default: 'false' push-to-cache: description: 'Whether to push build outputs to the Nix binary cache' required: false @@ -24,6 +28,13 @@ runs: aws-region: ${{ inputs.aws-region }} output-credentials: true role-duration-seconds: 7200 + - name: Force Clean Pre-Existing Nix Paths + if: inputs.force-clean == 'true' + shell: bash + run: sudo rm -rf /nix /etc/nix "$HOME/.nix-profile" "$HOME/.nix-channels" "$HOME/.config/nix" + - name: Ensure /etc/nix exists + shell: bash + run: sudo mkdir -p /etc/nix - name: Setup AWS credentials for Nix if: ${{ inputs.push-to-cache == 'true' }} shell: bash @@ -32,7 +43,6 @@ runs: sudo -H aws configure set aws_secret_access_key $AWS_SECRET_ACCESS_KEY sudo -H aws configure set aws_session_token $AWS_SESSION_TOKEN sudo -H aws configure set region ${{ inputs.aws-region }} - sudo mkdir -p /etc/nix sudo -E python -c "import os; file = open('/etc/nix/nix-secret-key', 'w'); file.write(os.environ['NIX_SIGN_SECRET_KEY']); file.close()" cat << 'EOF' | sudo tee /etc/nix/upload-to-cache.sh > /dev/null #!/usr/bin/env bash From 2e0a33964b7874be3671c03b6d5432c72c3b84e5 Mon Sep 17 00:00:00 2001 From: Manuel Mendez Date: Tue, 14 Jul 2026 22:05:53 -0400 Subject: [PATCH 04/15] packer/qemu: Wrap image build in nix --- .github/workflows/qemu-image-build.yml | 41 ++++++------------- .gitignore | 5 ++- .../build-qemu-image/build-qemu-image.sh | 37 +++++++++++++++++ nix/packages/build-qemu-image/default.nix | 23 +++++++++++ nix/packages/default.nix | 1 + qemu-arm64-nix.pkr.hcl | 40 ++++++++---------- 6 files changed, 96 insertions(+), 51 deletions(-) create mode 100644 nix/packages/build-qemu-image/build-qemu-image.sh create mode 100644 nix/packages/build-qemu-image/default.nix diff --git a/.github/workflows/qemu-image-build.yml b/.github/workflows/qemu-image-build.yml index f3f9e417a8..2ab5ce8504 100644 --- a/.github/workflows/qemu-image-build.yml +++ b/.github/workflows/qemu-image-build.yml @@ -3,11 +3,11 @@ name: Build QEMU image on: push: paths: - - '.github/workflows/qemu-image-build.yml' - - 'qemu-arm64-nix.pkr.hcl' - - 'common-nix.vars.pkr.hcl' - - 'ansible/vars.yml' - - 'scripts/*' + - .github/workflows/qemu-image-build.yml + - ansible/vars.yml + - nix/packages/build-qemu-image/* + - qemu-arm64-nix.pkr.hcl + - scripts/* workflow_dispatch: permissions: @@ -64,35 +64,20 @@ jobs: echo "POSTGRES_MAJOR_VERSION=${{ matrix.postgres_version }}" >> $GITHUB_ENV echo "EXECUTION_ID=${{ github.run_id }}-${{ matrix.postgres_version }}" >> $GITHUB_ENV - - name: Generate common-nix.vars.pkr.hcl - run: | - curl -L https://github.com/mikefarah/yq/releases/download/v4.45.1/yq_linux_arm64 -o yq && chmod +x yq - PG_VERSION=$(./yq '.postgres_release["postgres'${{ matrix.postgres_version }}'"]' ansible/vars.yml) - PG_VERSION=$(echo "$PG_VERSION" | tr -d '"') # Remove any surrounding quotes - echo 'postgres-version = "'$PG_VERSION'"' > common-nix.vars.pkr.hcl - echo 'postgres_major_version = "'$POSTGRES_MAJOR_VERSION'"' >> common-nix.vars.pkr.hcl - # Ensure there's a newline at the end of the file - echo "" >> common-nix.vars.pkr.hcl - - # TODO (darora): not quite sure why I'm having to uninstall and re-install these deps, but the build fails w/o this - - name: Install dependencies - run: | - sudo apt-get update - sudo apt-get remove -y qemu-efi-aarch64 cloud-image-utils qemu-system-arm qemu-utils - sudo apt-get install -y qemu-efi-aarch64 cloud-image-utils qemu-system-arm qemu-utils + - name: Install Nix + uses: ./.github/actions/nix-install-ephemeral + with: + force-clean: "true" + multi-user: "false" - name: Build QEMU artifact - run: | - make init - GIT_SHA=${{github.sha}} - export PACKER_LOG=1 - packer build -var "git_sha=${GIT_SHA}" -var-file="common-nix.vars.pkr.hcl" qemu-arm64-nix.pkr.hcl + run: nix run .#build-qemu-image "${{ matrix.postgres_version }}" - name: Grab release version id: process_release_version run: | - VERSION=$(cat common-nix.vars.pkr.hcl | sed -e 's/postgres-version = "\(.*\)"/\1/g') - echo "version=$VERSION" >> $GITHUB_OUTPUT + PG_VERSION=$(nix run nixpkgs#yq -- -r '.postgres_release["postgres'${{ matrix.postgres_version }}'"]' ansible/vars.yml) + echo "version=$PG_VERSION" >> $GITHUB_OUTPUT - name: configure aws credentials - staging if: ${{ github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/heads/release/') }} diff --git a/.gitignore b/.gitignore index f24b95b1b3..15429d4357 100644 --- a/.gitignore +++ b/.gitignore @@ -12,6 +12,10 @@ # ansible related ansible/image-manifest*.json +# packer releasted +output-cloudimg/ +packer-qemu-working/ + # python related *$py.class *.py[cod] @@ -21,5 +25,4 @@ venv/ #nix related common-nix.vars.pkr.hcl db/schema.sql -nixos.qcow2 result* diff --git a/nix/packages/build-qemu-image/build-qemu-image.sh b/nix/packages/build-qemu-image/build-qemu-image.sh new file mode 100644 index 0000000000..23e43b659e --- /dev/null +++ b/nix/packages/build-qemu-image/build-qemu-image.sh @@ -0,0 +1,37 @@ +# shellcheck shell=bash + +# nix-built qemu resolves its libraries via RPATH; an inherited +# LD_LIBRARY_PATH (e.g. from a devshell) can inject a mismatched glibc and +# break `qemu-system-* --version`, so drop it. +unset LD_LIBRARY_PATH + +postgres_major_version=${1:-} +if [ -z "$postgres_major_version" ]; then + echo "Usage: build-qemu-image [arch]" >&2 + exit 1 +fi + +qemu_bin=$(which qemu-system-aarch64) +fw_code=${qemu_bin%/bin/*}/share/qemu/edk2-aarch64-code.fd +fw_vars=${qemu_bin%/bin/*}/share/qemu/edk2-arm-vars.fd + +mkdir -p packer-qemu-working +# qemu writes to the vars pflash during boot, so make a local writable copy. +cp "$fw_vars" packer-qemu-working/fw-vars.fd +chmod u+w packer-qemu-working/fw-vars.fd + +git_sha=${GIT_SHA:-$(git rev-parse HEAD)} +postgres_version=$(yq -r ".postgres_release[\"postgres$postgres_major_version\"]" ansible/vars.yml) + +# Build the cloud-init seed ISO before invoking packer. +cloud-localds packer-qemu-working/seeds-cloudimg.iso user-data-cloudimg meta-data + +packer init qemu-nix-arm64.pkr.hcl +PACKER_LOG=${PACKER_LOG:-1} packer build \ + -var "fw_code=$fw_code" \ + -var "fw_vars=packer-qemu-working/fw-vars.fd" \ + -var "git_sha=$git_sha" \ + -var "postgres-version=$postgres_version" \ + -var "postgres_major_version=$postgres_major_version" \ + -var "seeds_iso=packer-qemu-working/seeds-cloudimg.iso" \ + qemu-nix-arm64.pkr.hcl diff --git a/nix/packages/build-qemu-image/default.nix b/nix/packages/build-qemu-image/default.nix new file mode 100644 index 0000000000..94762f6f47 --- /dev/null +++ b/nix/packages/build-qemu-image/default.nix @@ -0,0 +1,23 @@ +{ + cloud-utils, + coreutils, + gitMinimal, + packer, + qemu, + writeShellApplication, + yq, +}: +writeShellApplication { + name = "build-qemu-image"; + + runtimeInputs = [ + cloud-utils + coreutils + gitMinimal + packer + qemu + yq + ]; + + text = builtins.readFile ./build-qemu-image.sh; +} diff --git a/nix/packages/default.nix b/nix/packages/default.nix index a452a9b784..c3b1ae012e 100644 --- a/nix/packages/default.nix +++ b/nix/packages/default.nix @@ -44,6 +44,7 @@ packages = ( { build-ami = pkgs.callPackage ./build-ami.nix { packer = self'.packages.packer; }; + build-qemu-image = pkgs.callPackage ./build-qemu-image { packer = self'.packages.packer; }; build-test-ami = pkgs.callPackage ./build-test-ami.nix { packer = self'.packages.packer; }; cleanup-ami = pkgs.callPackage ./cleanup-ami.nix { }; dbmate-tool = pkgs.callPackage ./dbmate-tool.nix { inherit (self.supabase) defaults; }; diff --git a/qemu-arm64-nix.pkr.hcl b/qemu-arm64-nix.pkr.hcl index 61c0bdc4e5..82b7539b3f 100644 --- a/qemu-arm64-nix.pkr.hcl +++ b/qemu-arm64-nix.pkr.hcl @@ -12,6 +12,21 @@ variable "postgres_major_version" { default = "" } +# Path to the UEFI firmware code image. Provided from /nix by build-qemu-image. +variable "fw_code" { + type = string +} + +# Path to a writable UEFI firmware vars image created by build-qemu-image before packer runs. +variable "fw_vars" { + type = string +} + +# Path to the cloud-init seed ISO created by build-qemu-image before packer runs. +variable "seeds_iso" { + type = string +} + packer { required_plugins { qemu = { @@ -21,25 +36,6 @@ packer { } } -source "null" "dependencies" { - communicator = "none" -} - -build { - name = "cloudimg.deps" - sources = [ - "source.null.dependencies" - ] - - provisioner "shell-local" { - inline = [ - "cp /usr/share/AAVMF/AAVMF_VARS.fd AAVMF_VARS.fd", - "cloud-localds seeds-cloudimg.iso user-data-cloudimg meta-data" - ] - inline_shebang = "/bin/bash -e" - } -} - source "qemu" "cloudimg" { boot_wait = "2s" cpus = 8 @@ -59,10 +55,10 @@ source "qemu" "cloudimg" { ["-machine", "virt,gic-version=3"], ["-cpu", "host"], ["-device", "virtio-gpu-pci"], - ["-drive", "if=pflash,format=raw,id=ovmf_code,readonly=on,file=/usr/share/AAVMF/AAVMF_CODE.fd"], - ["-drive", "if=pflash,format=raw,id=ovmf_vars,file=AAVMF_VARS.fd"], + ["-drive", "if=pflash,format=raw,id=ovmf_code,readonly=on,file=${var.fw_code}"], + ["-drive", "if=pflash,format=raw,id=ovmf_vars,file=${var.fw_vars}"], ["-drive", "file=output-cloudimg/packer-cloudimg,if=virtio,format=qcow2,discard=on,detect-zeroes=unmap"], - ["-drive", "file=seeds-cloudimg.iso,format=raw"], + ["-drive", "file=${var.seeds_iso},format=raw"], ["--enable-kvm"] ] shutdown_command = "sudo -S shutdown -P now" From 8dce8c9ce6b480b1f5973832acfcaf1f1e79e578 Mon Sep 17 00:00:00 2001 From: Manuel Mendez Date: Wed, 15 Jul 2026 09:07:36 -0400 Subject: [PATCH 05/15] packer/qemu: Support x86_64 Same as before where host must match target. This is nice to test x86_64 specific playbook tasks. --- .github/workflows/qemu-image-build.yml | 4 +-- .../build-qemu-image/build-qemu-image.sh | 28 +++++++++++++++---- qemu-arm64-nix.pkr.hcl => qemu.pkr.hcl | 19 +++++++++++-- 3 files changed, 40 insertions(+), 11 deletions(-) rename qemu-arm64-nix.pkr.hcl => qemu.pkr.hcl (90%) diff --git a/.github/workflows/qemu-image-build.yml b/.github/workflows/qemu-image-build.yml index 2ab5ce8504..589c3e8c47 100644 --- a/.github/workflows/qemu-image-build.yml +++ b/.github/workflows/qemu-image-build.yml @@ -6,7 +6,7 @@ on: - .github/workflows/qemu-image-build.yml - ansible/vars.yml - nix/packages/build-qemu-image/* - - qemu-arm64-nix.pkr.hcl + - qemu.pkr.hcl - scripts/* workflow_dispatch: @@ -71,7 +71,7 @@ jobs: multi-user: "false" - name: Build QEMU artifact - run: nix run .#build-qemu-image "${{ matrix.postgres_version }}" + run: nix run .#build-qemu-image "${{ matrix.postgres_version }}" arm64 - name: Grab release version id: process_release_version diff --git a/nix/packages/build-qemu-image/build-qemu-image.sh b/nix/packages/build-qemu-image/build-qemu-image.sh index 23e43b659e..b97ea98327 100644 --- a/nix/packages/build-qemu-image/build-qemu-image.sh +++ b/nix/packages/build-qemu-image/build-qemu-image.sh @@ -11,12 +11,25 @@ if [ -z "$postgres_major_version" ]; then exit 1 fi -qemu_bin=$(which qemu-system-aarch64) -fw_code=${qemu_bin%/bin/*}/share/qemu/edk2-aarch64-code.fd -fw_vars=${qemu_bin%/bin/*}/share/qemu/edk2-arm-vars.fd +case ${2:-} in +arm64) + qemu_bin=$(which qemu-system-aarch64) + fw_code=${qemu_bin%/bin/*}/share/qemu/edk2-aarch64-code.fd + fw_vars=${qemu_bin%/bin/*}/share/qemu/edk2-arm-vars.fd + image=https://cloud-images.ubuntu.com/minimal/releases/noble/release/ubuntu-24.04-minimal-cloudimg-arm64.img + machine=virt,gic-version=3 + ;; +amd64) + qemu_bin=$(which qemu-system-x86_64) + fw_code=${qemu_bin%/bin/*}/share/qemu/edk2-x86_64-code.fd + fw_vars=${qemu_bin%/bin/*}/share/qemu/edk2-i386-vars.fd + image=https://cloud-images.ubuntu.com/minimal/releases/noble/release/ubuntu-24.04-minimal-cloudimg-amd64.img + machine=q35 + ;; +*) echo "Error: Invalid arch '${2:-}'. Must be 'arm64' or 'amd64'" >&2 && exit 1 ;; +esac mkdir -p packer-qemu-working -# qemu writes to the vars pflash during boot, so make a local writable copy. cp "$fw_vars" packer-qemu-working/fw-vars.fd chmod u+w packer-qemu-working/fw-vars.fd @@ -26,12 +39,15 @@ postgres_version=$(yq -r ".postgres_release[\"postgres$postgres_major_version\"] # Build the cloud-init seed ISO before invoking packer. cloud-localds packer-qemu-working/seeds-cloudimg.iso user-data-cloudimg meta-data -packer init qemu-nix-arm64.pkr.hcl +packer init qemu.pkr.hcl PACKER_LOG=${PACKER_LOG:-1} packer build \ -var "fw_code=$fw_code" \ -var "fw_vars=packer-qemu-working/fw-vars.fd" \ -var "git_sha=$git_sha" \ + -var "iso_url=$image" \ + -var "machine=$machine" \ -var "postgres-version=$postgres_version" \ -var "postgres_major_version=$postgres_major_version" \ + -var "qemu_binary=$qemu_bin" \ -var "seeds_iso=packer-qemu-working/seeds-cloudimg.iso" \ - qemu-nix-arm64.pkr.hcl + qemu.pkr.hcl diff --git a/qemu-arm64-nix.pkr.hcl b/qemu.pkr.hcl similarity index 90% rename from qemu-arm64-nix.pkr.hcl rename to qemu.pkr.hcl index 82b7539b3f..2f2ef8f8b4 100644 --- a/qemu-arm64-nix.pkr.hcl +++ b/qemu.pkr.hcl @@ -27,6 +27,19 @@ variable "seeds_iso" { type = string } +# Arch-specific values supplied by build-qemu-image (arm64 or amd64). +variable "iso_url" { + type = string +} + +variable "machine" { + type = string +} + +variable "qemu_binary" { + type = string +} + packer { required_plugins { qemu = { @@ -45,14 +58,14 @@ source "qemu" "cloudimg" { headless = true http_directory = "http" iso_checksum = "file:https://cloud-images.ubuntu.com/minimal/releases/noble/release/SHA256SUMS" - iso_url = "https://cloud-images.ubuntu.com/minimal/releases/noble/release/ubuntu-24.04-minimal-cloudimg-arm64.img" + iso_url = var.iso_url memory = 40000 qemu_img_args { convert = ["-o", "compression_type=zstd"] } - qemu_binary = "qemu-system-aarch64" + qemu_binary = var.qemu_binary qemuargs = [ - ["-machine", "virt,gic-version=3"], + ["-machine", var.machine], ["-cpu", "host"], ["-device", "virtio-gpu-pci"], ["-drive", "if=pflash,format=raw,id=ovmf_code,readonly=on,file=${var.fw_code}"], From 881ef96a9463a67e7b792622f5e0ea90d7fe0671 Mon Sep 17 00:00:00 2001 From: Manuel Mendez Date: Thu, 16 Jul 2026 13:03:20 -0400 Subject: [PATCH 06/15] packer/qemu: Support building on Darwin --- nix/packages/build-qemu-image/build-qemu-image.sh | 9 +++++++-- qemu.pkr.hcl | 4 +--- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/nix/packages/build-qemu-image/build-qemu-image.sh b/nix/packages/build-qemu-image/build-qemu-image.sh index b97ea98327..dcf8af940e 100644 --- a/nix/packages/build-qemu-image/build-qemu-image.sh +++ b/nix/packages/build-qemu-image/build-qemu-image.sh @@ -11,20 +11,25 @@ if [ -z "$postgres_major_version" ]; then exit 1 fi +case $(uname -o) in +Darwin) accel=hvf ;; +GNU/Linux) accel=kvm ;; +*) echo "Error: Invalid os '$(uname -o)'. Must be Darwin or Linux" >&2 && exit 1 ;; +esac case ${2:-} in arm64) qemu_bin=$(which qemu-system-aarch64) fw_code=${qemu_bin%/bin/*}/share/qemu/edk2-aarch64-code.fd fw_vars=${qemu_bin%/bin/*}/share/qemu/edk2-arm-vars.fd image=https://cloud-images.ubuntu.com/minimal/releases/noble/release/ubuntu-24.04-minimal-cloudimg-arm64.img - machine=virt,gic-version=3 + machine=virt,accel=$accel,gic-version=max,highmem=on ;; amd64) qemu_bin=$(which qemu-system-x86_64) fw_code=${qemu_bin%/bin/*}/share/qemu/edk2-x86_64-code.fd fw_vars=${qemu_bin%/bin/*}/share/qemu/edk2-i386-vars.fd image=https://cloud-images.ubuntu.com/minimal/releases/noble/release/ubuntu-24.04-minimal-cloudimg-amd64.img - machine=q35 + machine=q35,accel=$accel ;; *) echo "Error: Invalid arch '${2:-}'. Must be 'arm64' or 'amd64'" >&2 && exit 1 ;; esac diff --git a/qemu.pkr.hcl b/qemu.pkr.hcl index 2f2ef8f8b4..9e935499de 100644 --- a/qemu.pkr.hcl +++ b/qemu.pkr.hcl @@ -59,7 +59,7 @@ source "qemu" "cloudimg" { http_directory = "http" iso_checksum = "file:https://cloud-images.ubuntu.com/minimal/releases/noble/release/SHA256SUMS" iso_url = var.iso_url - memory = 40000 + memory = 4096 # in MiB qemu_img_args { convert = ["-o", "compression_type=zstd"] } @@ -72,7 +72,6 @@ source "qemu" "cloudimg" { ["-drive", "if=pflash,format=raw,id=ovmf_vars,file=${var.fw_vars}"], ["-drive", "file=output-cloudimg/packer-cloudimg,if=virtio,format=qcow2,discard=on,detect-zeroes=unmap"], ["-drive", "file=${var.seeds_iso},format=raw"], - ["--enable-kvm"] ] shutdown_command = "sudo -S shutdown -P now" ssh_handshake_attempts = 500 @@ -81,7 +80,6 @@ source "qemu" "cloudimg" { ssh_username = "ubuntu" ssh_wait_timeout = "1h" use_backing_file = false - accelerator = "kvm" } build { From 1650510f5c3246cc9fdd6cd397a3b27d661cb3e6 Mon Sep 17 00:00:00 2001 From: Manuel Mendez Date: Sat, 18 Jul 2026 16:01:04 -0400 Subject: [PATCH 07/15] packer/qemu: Upgrade to 1.1.6 Fixes packer-qemu-plugin 100% cpu usage across all cores (similar to seen with the amazon ebssurrogate plugin). CPU usage seen with gnutime -v, before: ``` User time (seconds): 4703.36 System time (seconds): 259.53 Percent of CPU this job got: 781% Elapsed (wall clock) time (h:mm:ss or m:ss): 10:35.18 ``` after: ``` User time (seconds): 732.49 System time (seconds): 310.12 Percent of CPU this job got: 209% Elapsed (wall clock) time (h:mm:ss or m:ss): 8:17.33 ``` --- qemu.pkr.hcl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/qemu.pkr.hcl b/qemu.pkr.hcl index 9e935499de..3d4a2d6e64 100644 --- a/qemu.pkr.hcl +++ b/qemu.pkr.hcl @@ -44,7 +44,7 @@ packer { required_plugins { qemu = { source = "github.com/hashicorp/qemu" - version = "1.1.5" + version = "1.1.6" } } } From a99cdf3df632ea4bf0d8804bf730bc983adcfab5 Mon Sep 17 00:00:00 2001 From: Manuel Mendez Date: Sat, 18 Jul 2026 16:01:04 -0400 Subject: [PATCH 08/15] packer/qemu: Disable vnc We don't need it. --- qemu.pkr.hcl | 1 + 1 file changed, 1 insertion(+) diff --git a/qemu.pkr.hcl b/qemu.pkr.hcl index 3d4a2d6e64..b9cfb2fe8c 100644 --- a/qemu.pkr.hcl +++ b/qemu.pkr.hcl @@ -52,6 +52,7 @@ packer { source "qemu" "cloudimg" { boot_wait = "2s" cpus = 8 + disable_vnc = true disk_image = true disk_size = "15G" format = "qcow2" From ea336cfb596fb2643524acace98efd8ef82f6386 Mon Sep 17 00:00:00 2001 From: Manuel Mendez Date: Thu, 16 Jul 2026 14:22:00 -0400 Subject: [PATCH 09/15] packer/qemu: Install qemu specific packages in qemu-bootstrap-nix.sh We already have a pre-ansible step to install packages that are missing compared to the ebs setup so let move these 2 there and avoid some weird qemu only package install tasks (not to mention that I'm not sure installing gpg in supabase-admin-agent file made much sense anyway). --- ansible/tasks/internal/supabase-admin-agent.yml | 7 ------- ansible/tasks/setup-system.yml | 8 -------- ebssurrogate/scripts/qemu-bootstrap-nix.sh | 15 ++++++++++++++- 3 files changed, 14 insertions(+), 16 deletions(-) diff --git a/ansible/tasks/internal/supabase-admin-agent.yml b/ansible/tasks/internal/supabase-admin-agent.yml index 69e7861291..c5ab847362 100644 --- a/ansible/tasks/internal/supabase-admin-agent.yml +++ b/ansible/tasks/internal/supabase-admin-agent.yml @@ -68,13 +68,6 @@ arch: "arm64" when: platform == "arm64" -- name: install gpg explicitly for qemu artifacts - become: yes - apt: - pkg: - - gpg - when: qemu_mode is defined - - name: Download supabase-admin-agent archive get_url: url: "https://supabase-public-artifacts-bucket.s3.amazonaws.com/supabase-admin-agent/v{{ supabase_admin_agent_release }}/supabase-admin-agent-{{ supabase_admin_agent_release }}-linux-{{ arch }}.tar.gz" diff --git a/ansible/tasks/setup-system.yml b/ansible/tasks/setup-system.yml index 8b961516aa..631e5f3b28 100644 --- a/ansible/tasks/setup-system.yml +++ b/ansible/tasks/setup-system.yml @@ -76,14 +76,6 @@ owner: 'root' group: 'root' -- name: Install other useful tools - ansible.builtin.apt: - pkg: - - less - update_cache: true - when: - - qemu_mode is defined - - name: Set the platform arch as a fact ansible.builtin.set_fact: platform: "{{ 'amd64' if ansible_facts['architecture'] == 'x86_64' else 'arm64' }}" diff --git a/ebssurrogate/scripts/qemu-bootstrap-nix.sh b/ebssurrogate/scripts/qemu-bootstrap-nix.sh index 8a52260ee8..944d34d978 100755 --- a/ebssurrogate/scripts/qemu-bootstrap-nix.sh +++ b/ebssurrogate/scripts/qemu-bootstrap-nix.sh @@ -22,7 +22,20 @@ function waitfor_boot_finished { } function install_packages { - apt-get update && sudo apt-get install software-properties-common e2fsprogs nfs-common locales iptables arptables ebtables ufw logrotate -y + apt-get update + apt-get install -y \ + arptables \ + e2fsprogs \ + ebtables \ + gpg \ + iptables \ + less \ + locales \ + logrotate \ + nfs-common \ + software-properties-common \ + ufw \ + ; # TODO (darora): temporarily disabling while Launchpad is under ddos attack and very frequently timing out # add-apt-repository --yes --update ppa:ansible/ansible && sudo apt-get install ansible -y From 654223c76c68f5a4cae4a87a4077b1ae3df92295 Mon Sep 17 00:00:00 2001 From: Manuel Mendez Date: Mon, 13 Jul 2026 16:42:21 -0400 Subject: [PATCH 10/15] ansible: Clean up modes even further Now that we don't have debpkg_mode I noticed that we always call ansible with nixpkg_mode = !stage2_nix. We can use just one var in that case, lets go with stage2 since it already sort of exists. qemu_mode can be cleaned up a bit too by always having it present. Tasks and templates can now check simple bool vs defined or not. --- ansible/files/adminapi.service.j2 | 2 +- ansible/files/gotrue.service.j2 | 2 +- ansible/files/postgres_exporter.service.j2 | 2 +- .../supabase-admin-agent_salt.service.j2 | 2 +- .../supabase-admin-agent_salt.timer.j2 | 2 +- ansible/playbook.yml | 64 +++++++++---------- ansible/tasks/finalize-ami.yml | 2 +- ansible/tasks/internal/optimizations.yml | 4 +- ansible/tasks/setup-docker.yml | 4 +- ansible/tasks/setup-fail2ban.yml | 4 +- ansible/tasks/setup-migrations.yml | 4 +- ansible/tasks/setup-pgbackrest.yml | 12 ++-- ansible/tasks/setup-pgbouncer.yml | 2 +- ansible/tasks/setup-postgres.yml | 44 ++++++------- ansible/tasks/setup-system.yml | 12 ++-- ansible/tasks/setup-tuned.yml | 8 +-- ansible/tasks/setup-wal-g.yml | 8 +-- ansible/tasks/stage2-setup-postgres.yml | 14 ++-- ansible/tasks/test-image.yml | 12 ++-- ebssurrogate/scripts/qemu-bootstrap-nix.sh | 4 +- .../scripts/surrogate-bootstrap-nix.sh | 2 +- scripts/nix-provision.sh | 2 +- 22 files changed, 100 insertions(+), 112 deletions(-) diff --git a/ansible/files/adminapi.service.j2 b/ansible/files/adminapi.service.j2 index 305d1ac629..4e956703a5 100644 --- a/ansible/files/adminapi.service.j2 +++ b/ansible/files/adminapi.service.j2 @@ -14,7 +14,7 @@ Restart=always RestartSec=3 TimeoutStopSec=10 Environment="AWS_USE_DUALSTACK_ENDPOINT=true" -{% if qemu_mode is defined and qemu_mode %} +{% if qemu %} Environment="AWS_SDK_LOAD_CONFIG=true" {% endif %} StandardOutput=journal diff --git a/ansible/files/gotrue.service.j2 b/ansible/files/gotrue.service.j2 index 481ce7c986..4105e92c66 100644 --- a/ansible/files/gotrue.service.j2 +++ b/ansible/files/gotrue.service.j2 @@ -90,7 +90,7 @@ Environment=GOTRUE_RELOADING_POLLER_ENABLED=false # ensures only 1 reload operation occurs during a burst of config updates. Environment=GOTRUE_RELOADING_GRACE_PERIOD_INTERVAL=2s -{% if qemu_mode is defined and qemu_mode %} +{% if qemu %} # v3 does not use filesystem notifications for config reloads. Environment=GOTRUE_RELOADING_NOTIFY_ENABLED=false {% else %} diff --git a/ansible/files/postgres_exporter.service.j2 b/ansible/files/postgres_exporter.service.j2 index dcb107cb77..4cf067a9a2 100644 --- a/ansible/files/postgres_exporter.service.j2 +++ b/ansible/files/postgres_exporter.service.j2 @@ -6,7 +6,7 @@ StartLimitBurst=0 [Service] Type=simple -ExecStart=/opt/postgres_exporter/postgres_exporter --disable-settings-metrics --extend.query-path="/opt/postgres_exporter/queries.yml" --disable-default-metrics --no-collector.locks --no-collector.replication --no-collector.replication_slot --no-collector.stat_bgwriter --no-collector.stat_database --no-collector.stat_user_tables --no-collector.statio_user_tables --no-collector.wal {% if qemu_mode is defined and qemu_mode %}--no-collector.database {% endif %} +ExecStart=/opt/postgres_exporter/postgres_exporter --disable-settings-metrics --extend.query-path="/opt/postgres_exporter/queries.yml" --disable-default-metrics --no-collector.locks --no-collector.replication --no-collector.replication_slot --no-collector.stat_bgwriter --no-collector.stat_database --no-collector.stat_user_tables --no-collector.statio_user_tables --no-collector.wal {% if qemu %}--no-collector.database {% endif %} User=postgres Group=postgres diff --git a/ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.service.j2 b/ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.service.j2 index d93d87dfa4..d5647c8865 100644 --- a/ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.service.j2 +++ b/ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.service.j2 @@ -6,7 +6,7 @@ Requires=local-fs.target [Service] Type=oneshot -{% if qemu_mode is defined and qemu_mode %} +{% if qemu %} ExecStart=/opt/supabase-admin-agent/supabase-admin-agent --config /opt/supabase-admin-agent/config.yaml salt --apply --store-result --targets-key targetsv3-main.yaml User=root Group=root diff --git a/ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.timer.j2 b/ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.timer.j2 index 390e6da570..52a4a81558 100644 --- a/ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.timer.j2 +++ b/ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.timer.j2 @@ -4,7 +4,7 @@ Requires=supabase-admin-agent_salt.service [Timer] {# We're using a significantly lower frequency for triggering this agent on qemu images for the moment. Once we've performed additional validations re: the aggregate impact of running it more frequently, the frequency can be increased. #} -{% if qemu_mode is defined and qemu_mode %} +{% if qemu %} OnCalendar=*-*-* 0,6,12,18:00:00 RandomizedDelaySec={{ supabase_admin_agent_splay }} AccuracySec=1h diff --git a/ansible/playbook.yml b/ansible/playbook.yml index 488dcc26fe..7e8056ad19 100644 --- a/ansible/playbook.yml +++ b/ansible/playbook.yml @@ -40,81 +40,77 @@ tags: - install-pgbouncer - install-supabase-internal - when: nixpkg_mode or stage2_nix - name: Install WAL-G import_tasks: tasks/setup-wal-g.yml - when: nixpkg_mode or stage2_nix - name: Install pgBackRest - import_tasks: + import_tasks: file: tasks/setup-pgbackrest.yml - when: - - nixpkg_mode or stage2_nix - name: Install Gotrue import_tasks: tasks/setup-gotrue.yml tags: - install-gotrue - install-supabase-internal - when: nixpkg_mode - + when: not stage2 + - name: Install PostgREST import_tasks: tasks/setup-postgrest.yml tags: - install-postgrest - install-supabase-internal - when: nixpkg_mode + when: not stage2 - name: Install Envoy import_tasks: tasks/setup-envoy.yml tags: - install-supabase-internal - when: nixpkg_mode + when: not stage2 - name: Install Kong import_tasks: tasks/setup-kong.yml tags: - install-supabase-internal - when: nixpkg_mode + when: not stage2 - name: Install nginx import_tasks: tasks/setup-nginx.yml tags: - install-supabase-internal - when: nixpkg_mode + when: not stage2 - name: Install Supabase specific content import_tasks: tasks/setup-supabase-internal.yml tags: - install-supabase-internal - when: nixpkg_mode + when: not stage2 - name: Fix IPv6 NDisc issues (disabled) import_tasks: tasks/fix-ipv6-ndisc.yml tags: - install-supabase-internal - when: nixpkg_mode and (qemu_mode is undefined) + when: not stage2 and not qemu - name: Adjust APT update intervals copy: src: files/apt_periodic dest: /etc/apt/apt.conf.d/10periodic - when: nixpkg_mode - + when: not stage2 + - name: Transfer init SQL files copy: src: files/{{ item.source }} dest: /tmp/{{ item.dest }} loop: "{{ sql_files }}" - when: stage2_nix + when: stage2 - name: Create postgres role become: yes become_user: postgres shell: cmd: /usr/lib/postgresql/bin/psql --username=supabase_admin -d postgres -c "create role postgres superuser login; alter database postgres owner to postgres;" - when: stage2_nix + when: stage2 - name: Execute init SQL files become: yes @@ -122,30 +118,30 @@ shell: cmd: /usr/lib/postgresql/bin/psql -f /tmp/{{ item.dest }} loop: "{{ sql_files }}" - when: stage2_nix + when: stage2 - name: Delete SQL scripts file: path: /tmp/{{ item.dest }} state: absent loop: "{{ sql_files }}" - when: stage2_nix + when: stage2 - name: First boot optimizations import_tasks: tasks/internal/optimizations.yml tags: - install-supabase-internal - when: stage2_nix - + when: stage2 + - name: Finalize AMI import_tasks: tasks/finalize-ami.yml tags: - install-supabase-internal - when: nixpkg_mode - + when: not stage2 + - name: Enhance fail2ban import_tasks: tasks/setup-fail2ban.yml - when: nixpkg_mode + when: not stage2 # Install EC2 instance connect @@ -157,7 +153,7 @@ - ec2-instance-connect tags: - aws-only - when: qemu_mode is undefined + when: not qemu # Install this at the end to prevent it from kicking in during the apt process, causing conflicts - name: Install security tools @@ -175,27 +171,27 @@ import_tasks: tasks/setup-migrations.yml tags: - migrations - when: stage2_nix + when: stage2 - name: Run unit tests import_tasks: tasks/test-image.yml tags: - unit-tests - when: stage2_nix + when: stage2 - name: Purge snapd become: yes shell: | apt autoremove -y --purge snapd - when: stage2_nix + when: stage2 - name: Run permission checks become: yes shell: | systemctl start postgresql.service - /usr/bin/python3 /tmp/ansible-playbook/ansible/files/permission_check.py {{ '--qemu' if qemu_mode is defined else '' }} + /usr/bin/python3 /tmp/ansible-playbook/ansible/files/permission_check.py {{ '--qemu' if qemu else '' }} systemctl stop postgresql.service - when: stage2_nix + when: stage2 - name: Run fail2ban configuration checks become: yes @@ -203,22 +199,22 @@ systemctl start fail2ban.service /usr/bin/python3 /tmp/ansible-playbook/ansible/files/fail2ban_check.py systemctl stop fail2ban.service - when: stage2_nix + when: stage2 - name: Run supascan baseline validation become: yes shell: | /bin/bash /tmp/ansible-playbook/ansible/files/supascan_ami.sh /tmp/ansible-playbook/audit-specs/baselines/ami-build - when: stage2_nix and qemu_mode is not defined and ansible_architecture != "x86_64" + when: stage2 and not qemu and ansible_architecture != "x86_64" - name: Remove supascan after validation become: yes shell: | sudo -u ubuntu bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile remove supascan" - when: stage2_nix + when: stage2 - name: nix collect garbage become: yes shell: | sudo -u ubuntu bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix-collect-garbage -d" - when: stage2_nix + when: stage2 diff --git a/ansible/tasks/finalize-ami.yml b/ansible/tasks/finalize-ami.yml index 0735e69182..f706c81915 100644 --- a/ansible/tasks/finalize-ami.yml +++ b/ansible/tasks/finalize-ami.yml @@ -113,4 +113,4 @@ owner: 'postgres' src: 'files/pgsodium_getkey_readonly.sh.j2' when: - - stage2_nix + - stage2 diff --git a/ansible/tasks/internal/optimizations.yml b/ansible/tasks/internal/optimizations.yml index 0338fdd9a7..f40183156b 100644 --- a/ansible/tasks/internal/optimizations.yml +++ b/ansible/tasks/internal/optimizations.yml @@ -10,7 +10,7 @@ - motd-news - vector - salt-minion - when: stage2_nix + when: stage2 - name: disable man-db become: yes @@ -21,4 +21,4 @@ - man-db - popularity-contest - ubuntu-advantage-tools - when: stage2_nix + when: stage2 diff --git a/ansible/tasks/setup-docker.yml b/ansible/tasks/setup-docker.yml index 88d093af32..4861cab892 100644 --- a/ansible/tasks/setup-docker.yml +++ b/ansible/tasks/setup-docker.yml @@ -1,6 +1,6 @@ -- name: stage2_nix actions +- name: stage2 actions when: - - stage2_nix + - stage2 block: # supautils - name: supautils - add supautils to session_preload_libraries diff --git a/ansible/tasks/setup-fail2ban.yml b/ansible/tasks/setup-fail2ban.yml index 4c73988661..453b96b70d 100644 --- a/ansible/tasks/setup-fail2ban.yml +++ b/ansible/tasks/setup-fail2ban.yml @@ -1,7 +1,7 @@ # set default bantime to 1 hour -- name: do nixpkg_mode tasks +- name: do stage1 tasks when: - - nixpkg_mode + - not stage2 block: - name: extend the default bantime to an hour become: true diff --git a/ansible/tasks/setup-migrations.yml b/ansible/tasks/setup-migrations.yml index 9df70a49ae..1ef207db24 100644 --- a/ansible/tasks/setup-migrations.yml +++ b/ansible/tasks/setup-migrations.yml @@ -1,6 +1,6 @@ -- name: run stage2_nix tasks +- name: run stage2 tasks when: - - stage2_nix + - stage2 block: - name: Run migrate.sh script ansible.builtin.command: diff --git a/ansible/tasks/setup-pgbackrest.yml b/ansible/tasks/setup-pgbackrest.yml index 340fb7d963..a1a51ae548 100644 --- a/ansible/tasks/setup-pgbackrest.yml +++ b/ansible/tasks/setup-pgbackrest.yml @@ -3,7 +3,7 @@ name: pgbackrest state: present when: - - nixpkg_mode + - not stage2 - name: Create pgBackRest user ansible.builtin.user: @@ -15,7 +15,7 @@ shell: /sbin/nologin system: true when: - - nixpkg_mode + - not stage2 - name: Configure sudoers for pgBackRest ansible.builtin.lineinfile: @@ -43,7 +43,7 @@ become_user: pgbackrest changed_when: true when: - - stage2_nix + - stage2 - name: Create needed directories for pgBackRest ansible.legacy.file: @@ -62,8 +62,6 @@ - {dir: /var/log/pgbackrest} loop_control: loop_var: backrest_dir - when: - - nixpkg_mode or stage2_nix # supabase-admin-agent opens these log files with O_APPEND|O_WRONLY (no # O_CREATE). They must exist before SAA runs; a missing file causes the @@ -82,8 +80,6 @@ - /var/log/pgbackrest/saa-pgb.log - /var/log/pgbackrest/wal-push.log - /var/log/pgbackrest/wal-fetch.log - when: - - nixpkg_mode or stage2_nix - name: Symlink pgbackrest.conf ansible.legacy.file: @@ -108,7 +104,7 @@ loop_control: loop_var: conf_item when: - - stage2_nix + - stage2 - name: Create pgBackRest wrapper script ansible.builtin.copy: diff --git a/ansible/tasks/setup-pgbouncer.yml b/ansible/tasks/setup-pgbouncer.yml index 16cdfbb3b2..65c2b8baf6 100644 --- a/ansible/tasks/setup-pgbouncer.yml +++ b/ansible/tasks/setup-pgbouncer.yml @@ -81,7 +81,7 @@ - 'custom-overrides.ini' - 'generated-optimizations.ini' - 'ssl-config.ini' - when: nixpkg_mode + when: not stage2 - name: PgBouncer - adjust pgbouncer.ini ansible.builtin.copy: diff --git a/ansible/tasks/setup-postgres.yml b/ansible/tasks/setup-postgres.yml index be6bb8ad15..dbb82e215f 100644 --- a/ansible/tasks/setup-postgres.yml +++ b/ansible/tasks/setup-postgres.yml @@ -1,6 +1,6 @@ -- name: execute stage2_nix tasks +- name: execute stage2 tasks when: - - stage2_nix + - stage2 block: - name: install locales ansible.builtin.apt: @@ -31,9 +31,9 @@ cmd: 'update-locale' become: true -- name: execute nixpkg_mode tasks +- name: execute stage1 tasks when: - - nixpkg_mode + - not stage2 block: # the old method of installing from debian creates this group, but we must create it explicitly # for the nix built version @@ -60,9 +60,9 @@ system: true become: yes -- name: execute nixpkg_mode tasks +- name: execute stage1 tasks when: - - nixpkg_mode + - not stage2 block: - name: Create relevant directories ansible.builtin.file: @@ -163,19 +163,19 @@ ansible.builtin.import_tasks: file: 'tasks/setup-docker.yml' when: - - stage2_nix + - stage2 #stage 2 postgres tasks - name: stage2 postgres tasks ansible.builtin.import_tasks: file: 'tasks/stage2-setup-postgres.yml' when: - - stage2_nix + - stage2 # init DB -- name: init the db when nixpkg_mode +- name: init the db when stage1 when: - - nixpkg_mode + - not stage2 block: - name: Create directory on data volume ansible.builtin.file: @@ -200,11 +200,11 @@ path: '/var/lib/postgresql/.bashrc' state: 'touch' when: - - nixpkg_mode + - not stage2 - name: Ensure /data configured for production runtime when: - - stage2_nix and (qemu_mode is not defined) + - stage2 and not qemu ansible.posix.mount: src: "UUID={{ ansible_mounts | selectattr('mount', 'equalto', '/data') | map(attribute='uuid') | first }}" path: /data @@ -214,11 +214,11 @@ passno: "2" state: mounted -- name: Run initdb (stage2_nix) +- name: Run initdb (stage2) when: - - stage2_nix + - stage2 block: - - name: Initialize the database stage2_nix (NOT PG17 NOR PG17-OrioleDB) + - name: Initialize the database stage2 (NOT PG17 NOR PG17-OrioleDB) become: true become_user: 'postgres' ansible.builtin.command: @@ -233,7 +233,7 @@ ansible_command_timeout: 60 when: psql_version not in ['psql_17', 'psql_orioledb-17'] - - name: Initialize the database stage2_nix (PG17 OR PG17-OrioleDB) + - name: Initialize the database stage2 (PG17 OR PG17-OrioleDB) become: true become_user: 'postgres' ansible.builtin.command: @@ -278,7 +278,7 @@ loop_control: loop_var: 'systemd_svc_item' when: - - stage2_nix + - stage2 - name: initialize pg required state become: true @@ -288,8 +288,8 @@ path: '/run/postgresql' state: 'directory' when: - - stage2_nix - - qemu_mode is defined + - stage2 + - qemu - name: Restart Postgres Database without Systemd become: true @@ -303,7 +303,7 @@ LC_CTYPE: en_US.UTF-8 LOCALE_ARCHIVE: /usr/lib/locale/locale-archive when: - - stage2_nix + - stage2 # Reload @@ -349,7 +349,7 @@ enabled: true name: 'postgresql' when: - - stage2_nix + - stage2 - name: Add lang and locale items to .bashrc @@ -368,4 +368,4 @@ loop_control: loop_var: 'lang_item' when: - - nixpkg_mode + - not stage2 diff --git a/ansible/tasks/setup-system.yml b/ansible/tasks/setup-system.yml index 631e5f3b28..1186ea0223 100644 --- a/ansible/tasks/setup-system.yml +++ b/ansible/tasks/setup-system.yml @@ -1,5 +1,5 @@ -- name: Execute tasks when nixpkg_mode - when: nixpkg_mode +- name: Execute tasks when stage1 + when: not stage2 block: - name: System - apt update and apt upgrade ansible.builtin.apt: @@ -82,12 +82,10 @@ tags: - update - update-only - when: - - nixpkg_mode or stage2_nix -- name: Execute more tasks when nixpkg_mode +- name: Execute more tasks when when: - - nixpkg_mode + - not stage2 block: - name: Custom systemd overrides for resolved ansible.builtin.copy: @@ -155,4 +153,4 @@ owner: 'root' group: 'root' when: - - stage2_nix + - stage2 diff --git a/ansible/tasks/setup-tuned.yml b/ansible/tasks/setup-tuned.yml index 0677d1942a..5f5e6545b8 100644 --- a/ansible/tasks/setup-tuned.yml +++ b/ansible/tasks/setup-tuned.yml @@ -1,6 +1,4 @@ - name: 'tuned - Install and configure tuned' # noqa: name[casing] - when: - - (stage2_nix or nixpkg_mode) block: - name: 'tuned - Install tuned' # noqa: name[casing] ansible.builtin.apt: @@ -187,7 +185,7 @@ value: '10' become: true when: - - nixpkg_mode + - not stage2 - name: 'tuned - Enable zswap if swap is present' # noqa: name[casing] when: @@ -234,7 +232,7 @@ daemon_reload: true enabled: true name: 'tuned' - state: "{{ 'restarted' if stage2_nix else 'stopped' }}" + state: "{{ 'restarted' if stage2 else 'stopped' }}" become: true - name: 'tuned - Activate the PostgreSQL tuned profile' # noqa: name[casing] @@ -243,4 +241,4 @@ become: true changed_when: false when: - - stage2_nix + - stage2 diff --git a/ansible/tasks/setup-wal-g.yml b/ansible/tasks/setup-wal-g.yml index 0d923cd05d..2062ee3142 100644 --- a/ansible/tasks/setup-wal-g.yml +++ b/ansible/tasks/setup-wal-g.yml @@ -1,6 +1,6 @@ -- name: Execute wal-g things when nixpkg_mode +- name: Execute wal-g things when stage1 when: - - nixpkg_mode + - not stage2 block: - name: Create wal-g group ansible.builtin.group: @@ -24,9 +24,9 @@ path: '/etc/wal-g' state: 'directory' -- name: Execute wal-g things when stage2_nix +- name: Execute wal-g things when stage2 when: - - stage2_nix + - stage2 block: - name: Install wal-g 2 from nix binary cache ansible.builtin.shell: diff --git a/ansible/tasks/stage2-setup-postgres.yml b/ansible/tasks/stage2-setup-postgres.yml index d935d24473..f910bf7857 100644 --- a/ansible/tasks/stage2-setup-postgres.yml +++ b/ansible/tasks/stage2-setup-postgres.yml @@ -6,11 +6,11 @@ is_psql_17: "{{ psql_version in ['psql_17'] }}" is_psql_15: "{{ psql_version in ['psql_15'] }}" - - name: Execute tasks when (is_psql_oriole or is_psql_17) and stage2_nix + - name: Execute tasks when (is_psql_oriole or is_psql_17) and stage2 become: true when: - (is_psql_oriole or is_psql_17) - - stage2_nix + - stage2 block: - name: Remove specified extensions from postgresql.conf if orioledb-17 or 17 build ansible.builtin.replace: @@ -34,11 +34,11 @@ regexp: 'db_user_namespace\ =\ off' replace: '#db_user_namespace\ =\ off' - - name: Execute things when is_psql_oriole and stage2_nix + - name: Execute things when is_psql_oriole and stage2 become: true when: - is_psql_oriole - - stage2_nix + - stage2 block: - name: Append orioledb to shared_preload_libraries append within closing quote ansible.builtin.replace: @@ -57,10 +57,10 @@ line: 'ORIOLEDB_ENABLED=true' path: '/etc/environment' -- name: Execute things when stage2_nix +- name: Execute things when stage2 become: true when: - - stage2_nix + - stage2 block: - name: Install packages from nix binary cache ansible.builtin.shell: | @@ -131,7 +131,7 @@ - name: Install gatekeeper if not pg15 when: - - stage2_nix + - stage2 - not is_psql_15 block: - name: Install gatekeeper from nix binary cache diff --git a/ansible/tasks/test-image.yml b/ansible/tasks/test-image.yml index 1733e6ca6d..f3b6473735 100644 --- a/ansible/tasks/test-image.yml +++ b/ansible/tasks/test-image.yml @@ -1,6 +1,6 @@ -- name: Execute tasks when stage2_nix +- name: Execute tasks when stage2 when: - - stage2_nix + - stage2 block: - name: Make a backup of the /etc/postgresql/postgresql.conf file ansible.builtin.copy: @@ -39,9 +39,9 @@ loop_var: 'regx' register: 'pgconf' -- name: Execute tasks when stage2_nix +- name: Execute tasks when stage2 when: - - stage2_nix + - stage2 block: - name: Restart Postgres Database in stage 2 to load all extensions ansible.builtin.command: @@ -60,9 +60,9 @@ loop_control: loop_var: 'ctlcmd' -- name: Execute tasks when stage2_nix +- name: Execute tasks when stage2 when: - - stage2_nix + - stage2 block: - name: Re-enable PG Sodium references in /etc/postgresql/postgresql.conf ansible.builtin.command: diff --git a/ebssurrogate/scripts/qemu-bootstrap-nix.sh b/ebssurrogate/scripts/qemu-bootstrap-nix.sh index 944d34d978..0c432cb696 100755 --- a/ebssurrogate/scripts/qemu-bootstrap-nix.sh +++ b/ebssurrogate/scripts/qemu-bootstrap-nix.sh @@ -50,7 +50,7 @@ callbacks_enabled = timer, profile_tasks, profile_roles EOF # Run Ansible playbook export ANSIBLE_LOG_PATH=/tmp/ansible.log && export ANSIBLE_REMOTE_TEMP=/mnt/tmp - ansible-playbook ./ansible/playbook.yml --extra-vars '{"nixpkg_mode": true, "stage2_nix": false, "qemu_mode": true}' \ + ansible-playbook ./ansible/playbook.yml --extra-vars '{"stage2": false, "qemu": true}' \ --extra-vars "postgresql_version=postgresql_${POSTGRES_MAJOR_VERSION}" \ --extra-vars "postgresql_major_version=${POSTGRES_MAJOR_VERSION}" \ --extra-vars "postgresql_major=${POSTGRES_MAJOR_VERSION}" \ @@ -116,7 +116,7 @@ EOF # Run Ansible playbook export ANSIBLE_LOG_PATH=/tmp/ansible.log && export ANSIBLE_REMOTE_TEMP=/tmp ansible-playbook ./ansible/playbook.yml \ - --extra-vars '{"nixpkg_mode": false, "stage2_nix": true, "qemu_mode": true}' \ + --extra-vars '{"stage2": true, "qemu": true}' \ --extra-vars "git_commit_sha=${GIT_SHA}" \ --extra-vars "postgresql_version=postgresql_${POSTGRES_MAJOR_VERSION}" \ --extra-vars "postgresql_major_version=${POSTGRES_MAJOR_VERSION}" \ diff --git a/ebssurrogate/scripts/surrogate-bootstrap-nix.sh b/ebssurrogate/scripts/surrogate-bootstrap-nix.sh index 947fd86077..a89f7daf50 100755 --- a/ebssurrogate/scripts/surrogate-bootstrap-nix.sh +++ b/ebssurrogate/scripts/surrogate-bootstrap-nix.sh @@ -341,7 +341,7 @@ EOF #export ANSIBLE_LOG_PATH=/tmp/ansible.log && export ANSIBLE_DEBUG=True && export ANSIBLE_REMOTE_TEMP=/mnt/tmp export ANSIBLE_LOG_PATH=/tmp/ansible.log && export ANSIBLE_REMOTE_TEMP=/mnt/tmp ansible-playbook -c chroot -i '/mnt,' /tmp/ansible-playbook/ansible/playbook.yml \ - --extra-vars '{"nixpkg_mode": true, "stage2_nix": false} ' \ + --extra-vars '{"stage2":false, "qemu":true} ' \ --extra-vars "psql_version=psql_${POSTGRES_MAJOR_VERSION}" \ $ARGS } diff --git a/scripts/nix-provision.sh b/scripts/nix-provision.sh index f1f4b9e6f5..8a69f7156a 100644 --- a/scripts/nix-provision.sh +++ b/scripts/nix-provision.sh @@ -52,7 +52,7 @@ EOF # Run Ansible playbook export ANSIBLE_LOG_PATH=/tmp/ansible.log && export ANSIBLE_REMOTE_TEMP=/tmp ansible-playbook /tmp/ansible-playbook/ansible/playbook.yml \ - --extra-vars '{"nixpkg_mode": false, "stage2_nix": true}' \ + --extra-vars '{"stage2":true, "qemu":false}' \ --extra-vars "git_commit_sha=${GIT_SHA}" \ --extra-vars "psql_version=psql_${POSTGRES_MAJOR_VERSION}" \ --extra-vars "postgresql_version=postgresql_${POSTGRES_MAJOR_VERSION}" \ From 07f53235975b019de60cf24bd6e7e689dbbd8dda Mon Sep 17 00:00:00 2001 From: Manuel Mendez Date: Mon, 13 Jul 2026 16:46:49 -0400 Subject: [PATCH 11/15] ansible: Standardize `when:` 2 things going on here, 1) `when:` is always just one line and 2) `when:` are directly after `name:` 1. Most of our `when:` clauses are a simple statements or `or`d. Only 4/74 are ands that benefit from list mode. Having the full condition on one line is just plain nicer for grep-ability. Best to just do it one way. 2. We have a bunch of files that mix stage1 and stage2 and even some that have multiple mixed `when:`s. By having the `when`s up top with the name we can skip over/to when reading the files for a specific stage of the ami build. --- ansible/playbook.yml | 49 +++++++++---------- ansible/tasks/finalize-ami.yml | 3 +- ansible/tasks/internal/admin-api.yml | 4 +- ansible/tasks/internal/admin-mgr.yml | 4 +- ansible/tasks/internal/install-salt.yml | 4 +- ansible/tasks/internal/optimizations.yml | 4 +- .../tasks/internal/supabase-admin-agent.yml | 4 +- ansible/tasks/setup-docker.yml | 3 +- ansible/tasks/setup-fail2ban.yml | 3 +- ansible/tasks/setup-migrations.yml | 3 +- ansible/tasks/setup-pgbackrest.yml | 12 ++--- ansible/tasks/setup-pgbouncer.yml | 2 +- ansible/tasks/setup-postgres.yml | 45 ++++++----------- ansible/tasks/setup-system.yml | 6 +-- ansible/tasks/setup-tuned.yml | 12 ++--- ansible/tasks/setup-wal-g.yml | 6 +-- ansible/tasks/stage2-setup-postgres.yml | 15 ++---- ansible/tasks/test-image.yml | 9 ++-- 18 files changed, 74 insertions(+), 114 deletions(-) diff --git a/ansible/playbook.yml b/ansible/playbook.yml index 7e8056ad19..30c895da9f 100644 --- a/ansible/playbook.yml +++ b/ansible/playbook.yml @@ -49,111 +49,110 @@ file: tasks/setup-pgbackrest.yml - name: Install Gotrue + when: not stage2 import_tasks: tasks/setup-gotrue.yml tags: - install-gotrue - install-supabase-internal - when: not stage2 - name: Install PostgREST + when: not stage2 import_tasks: tasks/setup-postgrest.yml tags: - install-postgrest - install-supabase-internal - when: not stage2 - name: Install Envoy + when: not stage2 import_tasks: tasks/setup-envoy.yml tags: - install-supabase-internal - when: not stage2 - name: Install Kong + when: not stage2 import_tasks: tasks/setup-kong.yml tags: - install-supabase-internal - when: not stage2 - name: Install nginx + when: not stage2 import_tasks: tasks/setup-nginx.yml tags: - install-supabase-internal - when: not stage2 - name: Install Supabase specific content + when: not stage2 import_tasks: tasks/setup-supabase-internal.yml tags: - install-supabase-internal - when: not stage2 - name: Fix IPv6 NDisc issues (disabled) + when: not stage2 and not qemu import_tasks: tasks/fix-ipv6-ndisc.yml tags: - install-supabase-internal - when: not stage2 and not qemu - name: Adjust APT update intervals + when: not stage2 copy: src: files/apt_periodic dest: /etc/apt/apt.conf.d/10periodic - when: not stage2 - name: Transfer init SQL files + when: stage2 copy: src: files/{{ item.source }} dest: /tmp/{{ item.dest }} loop: "{{ sql_files }}" - when: stage2 - name: Create postgres role + when: stage2 become: yes become_user: postgres shell: cmd: /usr/lib/postgresql/bin/psql --username=supabase_admin -d postgres -c "create role postgres superuser login; alter database postgres owner to postgres;" - when: stage2 - name: Execute init SQL files + when: stage2 become: yes become_user: postgres shell: cmd: /usr/lib/postgresql/bin/psql -f /tmp/{{ item.dest }} loop: "{{ sql_files }}" - when: stage2 - name: Delete SQL scripts + when: stage2 file: path: /tmp/{{ item.dest }} state: absent loop: "{{ sql_files }}" - when: stage2 - name: First boot optimizations + when: stage2 import_tasks: tasks/internal/optimizations.yml tags: - install-supabase-internal - when: stage2 - name: Finalize AMI + when: not stage2 import_tasks: tasks/finalize-ami.yml tags: - install-supabase-internal - when: not stage2 - name: Enhance fail2ban - import_tasks: tasks/setup-fail2ban.yml when: not stage2 - + import_tasks: tasks/setup-fail2ban.yml # Install EC2 instance connect # Only for AWS images - name: install EC2 instance connect + when: not qemu become: yes apt: pkg: - ec2-instance-connect tags: - aws-only - when: not qemu # Install this at the end to prevent it from kicking in during the apt process, causing conflicts - name: Install security tools @@ -168,53 +167,53 @@ import_tasks: tasks/clean-build-dependencies.yml - name: Run migrations + when: stage2 import_tasks: tasks/setup-migrations.yml tags: - migrations - when: stage2 - name: Run unit tests + when: stage2 import_tasks: tasks/test-image.yml tags: - unit-tests - when: stage2 - name: Purge snapd + when: stage2 become: yes shell: | apt autoremove -y --purge snapd - when: stage2 - name: Run permission checks + when: stage2 become: yes shell: | systemctl start postgresql.service /usr/bin/python3 /tmp/ansible-playbook/ansible/files/permission_check.py {{ '--qemu' if qemu else '' }} systemctl stop postgresql.service - when: stage2 - name: Run fail2ban configuration checks + when: stage2 become: yes shell: | systemctl start fail2ban.service /usr/bin/python3 /tmp/ansible-playbook/ansible/files/fail2ban_check.py systemctl stop fail2ban.service - when: stage2 - name: Run supascan baseline validation + when: stage2 and not qemu and ansible_architecture != "x86_64" become: yes shell: | /bin/bash /tmp/ansible-playbook/ansible/files/supascan_ami.sh /tmp/ansible-playbook/audit-specs/baselines/ami-build - when: stage2 and not qemu and ansible_architecture != "x86_64" - name: Remove supascan after validation + when: stage2 become: yes shell: | sudo -u ubuntu bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile remove supascan" - when: stage2 - name: nix collect garbage + when: stage2 become: yes shell: | sudo -u ubuntu bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix-collect-garbage -d" - when: stage2 diff --git a/ansible/tasks/finalize-ami.yml b/ansible/tasks/finalize-ami.yml index f706c81915..bf2350cd0e 100644 --- a/ansible/tasks/finalize-ami.yml +++ b/ansible/tasks/finalize-ami.yml @@ -106,11 +106,10 @@ state: 'restarted' - name: import pgsodium_getkey script + when: stage2 ansible.builtin.template: dest: "{{ pg_bindir }}/pgsodium_getkey.sh" group: 'postgres' mode: '0700' owner: 'postgres' src: 'files/pgsodium_getkey_readonly.sh.j2' - when: - - stage2 diff --git a/ansible/tasks/internal/admin-api.yml b/ansible/tasks/internal/admin-api.yml index 0c8e4020e6..04f8a65584 100644 --- a/ansible/tasks/internal/admin-api.yml +++ b/ansible/tasks/internal/admin-api.yml @@ -28,14 +28,14 @@ chmod g+w /etc - name: Setting arch (amd64) + when: platform == "amd64" set_fact: arch: "amd64" - when: platform == "amd64" - name: Setting arch (arm) + when: platform == "arm64" set_fact: arch: "arm64" - when: platform == "arm64" - name: Download adminapi archive get_url: diff --git a/ansible/tasks/internal/admin-mgr.yml b/ansible/tasks/internal/admin-mgr.yml index 46a1231c84..594ea7a05c 100644 --- a/ansible/tasks/internal/admin-mgr.yml +++ b/ansible/tasks/internal/admin-mgr.yml @@ -1,12 +1,12 @@ - name: Setting arch (x86) + when: platform == "amd64" set_fact: arch: "amd64" - when: platform == "amd64" - name: Setting arch (arm) + when: platform == "arm64" set_fact: arch: "arm64" - when: platform == "arm64" - name: Download admin-mgr archive get_url: diff --git a/ansible/tasks/internal/install-salt.yml b/ansible/tasks/internal/install-salt.yml index 47436ded31..a43ea446f5 100644 --- a/ansible/tasks/internal/install-salt.yml +++ b/ansible/tasks/internal/install-salt.yml @@ -1,4 +1,5 @@ - name: Add apt repository for Saltstack (arm) + when: platform == "arm64" block: - name: Ensure /etc/apt/keyrings directory exists file: @@ -21,9 +22,9 @@ repo: "deb [signed-by=/etc/apt/keyrings/salt-archive-keyring-2023.pgp arch=arm64] https://packages.broadcom.com/artifactory/saltproject-deb/ stable main" filename: "salt" state: present - when: platform == "arm64" - name: Add apt repository for Saltstack (amd) + when: platform == "amd64" block: - name: Ensure /etc/apt/keyrings directory exists file: @@ -46,7 +47,6 @@ repo: "deb [signed-by=/etc/apt/keyrings/salt-archive-keyring-2023.pgp arch=amd64] https://packages.broadcom.com/artifactory/saltproject-deb/ stable main" filename: "salt" state: present - when: platform == "amd64" - name: Salt minion install apt: diff --git a/ansible/tasks/internal/optimizations.yml b/ansible/tasks/internal/optimizations.yml index f40183156b..1fcdd83c1f 100644 --- a/ansible/tasks/internal/optimizations.yml +++ b/ansible/tasks/internal/optimizations.yml @@ -1,4 +1,5 @@ - name: ensure services are stopped and disabled for first boot nix build + when: stage2 systemd: enabled: no name: '{{ item }}' @@ -10,9 +11,9 @@ - motd-news - vector - salt-minion - when: stage2 - name: disable man-db + when: stage2 become: yes file: state: absent @@ -21,4 +22,3 @@ - man-db - popularity-contest - ubuntu-advantage-tools - when: stage2 diff --git a/ansible/tasks/internal/supabase-admin-agent.yml b/ansible/tasks/internal/supabase-admin-agent.yml index c5ab847362..90bb148a01 100644 --- a/ansible/tasks/internal/supabase-admin-agent.yml +++ b/ansible/tasks/internal/supabase-admin-agent.yml @@ -59,14 +59,14 @@ mode: "0755" - name: Setting arch (amd64) + when: platform == "amd64" set_fact: arch: "amd64" - when: platform == "amd64" - name: Setting arch (arm) + when: platform == "arm64" set_fact: arch: "arm64" - when: platform == "arm64" - name: Download supabase-admin-agent archive get_url: diff --git a/ansible/tasks/setup-docker.yml b/ansible/tasks/setup-docker.yml index 4861cab892..7559341482 100644 --- a/ansible/tasks/setup-docker.yml +++ b/ansible/tasks/setup-docker.yml @@ -1,6 +1,5 @@ - name: stage2 actions - when: - - stage2 + when: stage2 block: # supautils - name: supautils - add supautils to session_preload_libraries diff --git a/ansible/tasks/setup-fail2ban.yml b/ansible/tasks/setup-fail2ban.yml index 453b96b70d..f4863d2b24 100644 --- a/ansible/tasks/setup-fail2ban.yml +++ b/ansible/tasks/setup-fail2ban.yml @@ -1,7 +1,6 @@ # set default bantime to 1 hour - name: do stage1 tasks - when: - - not stage2 + when: not stage2 block: - name: extend the default bantime to an hour become: true diff --git a/ansible/tasks/setup-migrations.yml b/ansible/tasks/setup-migrations.yml index 1ef207db24..a5c46a901c 100644 --- a/ansible/tasks/setup-migrations.yml +++ b/ansible/tasks/setup-migrations.yml @@ -1,6 +1,5 @@ - name: run stage2 tasks - when: - - stage2 + when: stage2 block: - name: Run migrate.sh script ansible.builtin.command: diff --git a/ansible/tasks/setup-pgbackrest.yml b/ansible/tasks/setup-pgbackrest.yml index a1a51ae548..4442a91822 100644 --- a/ansible/tasks/setup-pgbackrest.yml +++ b/ansible/tasks/setup-pgbackrest.yml @@ -1,11 +1,11 @@ - name: Create pgBackRest group + when: not stage2 ansible.builtin.group: name: pgbackrest state: present - when: - - not stage2 - name: Create pgBackRest user + when: not stage2 ansible.builtin.user: comment: pgBackRest user group: pgbackrest @@ -14,8 +14,6 @@ name: pgbackrest shell: /sbin/nologin system: true - when: - - not stage2 - name: Configure sudoers for pgBackRest ansible.builtin.lineinfile: @@ -37,13 +35,12 @@ - 'pgbackrest ALL=(pgbackrest) NOPASSWD: /var/lib/pgbackrest/.nix-profile/bin/pgbackrest' - name: Install pgBackRest + when: stage2 ansible.builtin.shell: | sudo -u pgbackrest bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install github:supabase/postgres/{{ git_commit_sha }}#pg-backrest" become: true become_user: pgbackrest changed_when: true - when: - - stage2 - name: Create needed directories for pgBackRest ansible.legacy.file: @@ -89,6 +86,7 @@ state: link - name: Move pgBackRest files to /etc/pgbackrest + when: stage2 ansible.legacy.copy: group: postgres dest: "/etc/pgbackrest/{{ conf_item['path'] }}/{{ conf_item['name'] }}" @@ -103,8 +101,6 @@ - {name: repo1.conf, path: conf.d} loop_control: loop_var: conf_item - when: - - stage2 - name: Create pgBackRest wrapper script ansible.builtin.copy: diff --git a/ansible/tasks/setup-pgbouncer.yml b/ansible/tasks/setup-pgbouncer.yml index 65c2b8baf6..4e4e1445a4 100644 --- a/ansible/tasks/setup-pgbouncer.yml +++ b/ansible/tasks/setup-pgbouncer.yml @@ -69,6 +69,7 @@ - { mode: '0775', dir: '/etc/pgbouncer-custom' } - name: create PgBouncer placeholder config files + when: not stage2 ansible.builtin.file: group: 'pgbouncer' mode: '0664' @@ -81,7 +82,6 @@ - 'custom-overrides.ini' - 'generated-optimizations.ini' - 'ssl-config.ini' - when: not stage2 - name: PgBouncer - adjust pgbouncer.ini ansible.builtin.copy: diff --git a/ansible/tasks/setup-postgres.yml b/ansible/tasks/setup-postgres.yml index dbb82e215f..c74cbdbd7e 100644 --- a/ansible/tasks/setup-postgres.yml +++ b/ansible/tasks/setup-postgres.yml @@ -1,6 +1,5 @@ - name: execute stage2 tasks - when: - - stage2 + when: stage2 block: - name: install locales ansible.builtin.apt: @@ -32,8 +31,7 @@ become: true - name: execute stage1 tasks - when: - - not stage2 + when: not stage2 block: # the old method of installing from debian creates this group, but we must create it explicitly # for the nix built version @@ -61,8 +59,7 @@ become: yes - name: execute stage1 tasks - when: - - not stage2 + when: not stage2 block: - name: Create relevant directories ansible.builtin.file: @@ -150,32 +147,29 @@ is_psql_15: "{{ psql_version in ['psql_15'] }}" - name: create placeholder pam config + when: not is_psql_15 file: path: '/etc/pam.d/postgresql' state: touch owner: postgres group: postgres mode: 0664 - when: not is_psql_15 # Install extensions before init - name: Install Postgres extensions + when: stage2 ansible.builtin.import_tasks: file: 'tasks/setup-docker.yml' - when: - - stage2 #stage 2 postgres tasks - name: stage2 postgres tasks + when: stage2 ansible.builtin.import_tasks: file: 'tasks/stage2-setup-postgres.yml' - when: - - stage2 # init DB - name: init the db when stage1 - when: - - not stage2 + when: not stage2 block: - name: Create directory on data volume ansible.builtin.file: @@ -194,17 +188,15 @@ state: 'link' - name: Make sure .bashrc exists + when: not stage2 ansible.builtin.file: group: 'postgres' owner: 'postgres' path: '/var/lib/postgresql/.bashrc' state: 'touch' - when: - - not stage2 - name: Ensure /data configured for production runtime - when: - - stage2 and not qemu + when: stage2 and not qemu ansible.posix.mount: src: "UUID={{ ansible_mounts | selectattr('mount', 'equalto', '/data') | map(attribute='uuid') | first }}" path: /data @@ -215,10 +207,10 @@ state: mounted - name: Run initdb (stage2) - when: - - stage2 + when: stage2 block: - name: Initialize the database stage2 (NOT PG17 NOR PG17-OrioleDB) + when: psql_version not in ['psql_17', 'psql_orioledb-17'] become: true become_user: 'postgres' ansible.builtin.command: @@ -231,9 +223,9 @@ LOCALE_ARCHIVE: /usr/lib/locale/locale-archive vars: ansible_command_timeout: 60 - when: psql_version not in ['psql_17', 'psql_orioledb-17'] - name: Initialize the database stage2 (PG17 OR PG17-OrioleDB) + when: psql_version in ['psql_17', 'psql_orioledb-17'] become: true become_user: 'postgres' ansible.builtin.command: @@ -246,7 +238,6 @@ LOCALE_ARCHIVE: /usr/lib/locale/locale-archive vars: ansible_command_timeout: 60 - when: psql_version in ['psql_17', 'psql_orioledb-17'] - name: copy PG apparmor profile ansible.builtin.copy: @@ -269,6 +260,7 @@ cmd: '/usr/sbin/aa-enforce sbpostgres' - name: copy PG and optimizations systemd units + when: stage2 ansible.builtin.template: dest: "/etc/systemd/system/{{ systemd_svc_item | basename }}" src: "files/{{ systemd_svc_item }}" @@ -277,8 +269,6 @@ - 'postgresql_config/postgresql.service' loop_control: loop_var: 'systemd_svc_item' - when: - - stage2 - name: initialize pg required state become: true @@ -292,6 +282,7 @@ - qemu - name: Restart Postgres Database without Systemd + when: stage2 become: true become_user: 'postgres' ansible.builtin.command: @@ -302,8 +293,6 @@ LC_ALL: en_US.UTF-8 LC_CTYPE: en_US.UTF-8 LOCALE_ARCHIVE: /usr/lib/locale/locale-archive - when: - - stage2 # Reload @@ -344,15 +333,15 @@ state: 'present' value: 'tuned.service' - name: System - systemd reload + when: stage2 ansible.builtin.systemd_service: daemon_reload: true enabled: true name: 'postgresql' - when: - - stage2 - name: Add lang and locale items to .bashrc + when: not stage2 ansible.builtin.lineinfile: create: true dest: '/var/lib/postgresql/.bashrc' @@ -367,5 +356,3 @@ - 'export LC_CTYPE="en_US.UTF-8"' loop_control: loop_var: 'lang_item' - when: - - not stage2 diff --git a/ansible/tasks/setup-system.yml b/ansible/tasks/setup-system.yml index 1186ea0223..8506d3ee25 100644 --- a/ansible/tasks/setup-system.yml +++ b/ansible/tasks/setup-system.yml @@ -84,8 +84,7 @@ - update-only - name: Execute more tasks when - when: - - not stage2 + when: not stage2 block: - name: Custom systemd overrides for resolved ansible.builtin.copy: @@ -144,6 +143,7 @@ group: 'root' - name: set hosts file + when: stage2 ansible.builtin.copy: content: | 127.0.0.1 localhost @@ -152,5 +152,3 @@ mode: '0644' owner: 'root' group: 'root' - when: - - stage2 diff --git a/ansible/tasks/setup-tuned.yml b/ansible/tasks/setup-tuned.yml index 5f5e6545b8..6b5c4595ab 100644 --- a/ansible/tasks/setup-tuned.yml +++ b/ansible/tasks/setup-tuned.yml @@ -69,6 +69,7 @@ become: true - name: 'tuned - Configure Intel CPUs for maximum performance' # noqa: name[casing] + when: ansible_facts['processor'][0] is search('GenuineIntel', ignorecase=True) community.general.ini_file: create: true group: 'root' @@ -89,8 +90,6 @@ value: '100' loop_control: loop_var: 'intel_item' - when: - - ansible_facts['processor'][0] is search('GenuineIntel', ignorecase=True) - name: 'tuned - Set sysctl parameters' # noqa: name[casing] community.general.ini_file: @@ -173,6 +172,7 @@ loop_var: 'sysctl_item' - name: 'tuned - Set kernel.panic=10' # noqa: name[casing] + when: not stage2 community.general.ini_file: create: true group: 'root' @@ -184,12 +184,9 @@ state: 'present' value: '10' become: true - when: - - not stage2 - name: 'tuned - Enable zswap if swap is present' # noqa: name[casing] - when: - - ansible_facts['swaptotal_mb'] > 0 + when: ansible_facts['swaptotal_mb'] > 0 block: - name: 'tuned - Decrease the kernel swappiness' # noqa: name[casing] community.general.ini_file: @@ -236,9 +233,8 @@ become: true - name: 'tuned - Activate the PostgreSQL tuned profile' # noqa: name[casing] + when: stage2 ansible.builtin.command: cmd: 'tuned-adm profile postgresql' become: true changed_when: false - when: - - stage2 diff --git a/ansible/tasks/setup-wal-g.yml b/ansible/tasks/setup-wal-g.yml index 2062ee3142..d7311beb7a 100644 --- a/ansible/tasks/setup-wal-g.yml +++ b/ansible/tasks/setup-wal-g.yml @@ -1,6 +1,5 @@ - name: Execute wal-g things when stage1 - when: - - not stage2 + when: not stage2 block: - name: Create wal-g group ansible.builtin.group: @@ -25,8 +24,7 @@ state: 'directory' - name: Execute wal-g things when stage2 - when: - - stage2 + when: stage2 block: - name: Install wal-g 2 from nix binary cache ansible.builtin.shell: diff --git a/ansible/tasks/stage2-setup-postgres.yml b/ansible/tasks/stage2-setup-postgres.yml index f910bf7857..1a2bd9d9e6 100644 --- a/ansible/tasks/stage2-setup-postgres.yml +++ b/ansible/tasks/stage2-setup-postgres.yml @@ -7,10 +7,8 @@ is_psql_15: "{{ psql_version in ['psql_15'] }}" - name: Execute tasks when (is_psql_oriole or is_psql_17) and stage2 + when: stage2 and (is_psql_oriole or is_psql_17) become: true - when: - - (is_psql_oriole or is_psql_17) - - stage2 block: - name: Remove specified extensions from postgresql.conf if orioledb-17 or 17 build ansible.builtin.replace: @@ -35,10 +33,8 @@ replace: '#db_user_namespace\ =\ off' - name: Execute things when is_psql_oriole and stage2 + when: stage2 and is_psql_oriole become: true - when: - - is_psql_oriole - - stage2 block: - name: Append orioledb to shared_preload_libraries append within closing quote ansible.builtin.replace: @@ -58,9 +54,8 @@ path: '/etc/environment' - name: Execute things when stage2 + when: stage2 become: true - when: - - stage2 block: - name: Install packages from nix binary cache ansible.builtin.shell: | @@ -130,9 +125,7 @@ is_psql_15: "{{ psql_version == 'psql_15' }}" - name: Install gatekeeper if not pg15 - when: - - stage2 - - not is_psql_15 + when: stage2 and not is_psql_15 block: - name: Install gatekeeper from nix binary cache become: yes diff --git a/ansible/tasks/test-image.yml b/ansible/tasks/test-image.yml index f3b6473735..d7678d18ca 100644 --- a/ansible/tasks/test-image.yml +++ b/ansible/tasks/test-image.yml @@ -1,6 +1,5 @@ - name: Execute tasks when stage2 - when: - - stage2 + when: stage2 block: - name: Make a backup of the /etc/postgresql/postgresql.conf file ansible.builtin.copy: @@ -40,8 +39,7 @@ register: 'pgconf' - name: Execute tasks when stage2 - when: - - stage2 + when: stage2 block: - name: Restart Postgres Database in stage 2 to load all extensions ansible.builtin.command: @@ -61,8 +59,7 @@ loop_var: 'ctlcmd' - name: Execute tasks when stage2 - when: - - stage2 + when: stage2 block: - name: Re-enable PG Sodium references in /etc/postgresql/postgresql.conf ansible.builtin.command: From 5e741b336a7970a2f09abad78009039856f8f4ba Mon Sep 17 00:00:00 2001 From: Manuel Mendez Date: Mon, 13 Jul 2026 17:32:11 -0400 Subject: [PATCH 12/15] ansible: Simple refactors Mostly just merging consecutive `when: stage2` or `when: not stage2` tasks & blocks. Some slight re-arrangements happened but should be no-ops because they happen a little later during `stage2` but should have been no behavioral change due to it running originally in `stage1`. Other things done: * I renamed setup-docker -> setup-supautils because there was nothing to do with docker in the file. * Dropped explicit 'install gpg explicitly for qemu artifacts' because gpg has been used by ansible before we get here so gpg is definitely already installed. --- ansible/tasks/setup-pgbackrest.yml | 50 +++---- ansible/tasks/setup-postgres.yml | 132 ++++++++---------- .../{setup-docker.yml => setup-supautils.yml} | 3 +- ansible/tasks/setup-system.yml | 19 ++- ansible/tasks/test-image.yml | 6 - 5 files changed, 92 insertions(+), 118 deletions(-) rename ansible/tasks/{setup-docker.yml => setup-supautils.yml} (97%) diff --git a/ansible/tasks/setup-pgbackrest.yml b/ansible/tasks/setup-pgbackrest.yml index 4442a91822..6d4eebcdb1 100644 --- a/ansible/tasks/setup-pgbackrest.yml +++ b/ansible/tasks/setup-pgbackrest.yml @@ -34,14 +34,6 @@ # that inner sudo fails even though the outer caller is already pgbackrest. - 'pgbackrest ALL=(pgbackrest) NOPASSWD: /var/lib/pgbackrest/.nix-profile/bin/pgbackrest' -- name: Install pgBackRest - when: stage2 - ansible.builtin.shell: | - sudo -u pgbackrest bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install github:supabase/postgres/{{ git_commit_sha }}#pg-backrest" - become: true - become_user: pgbackrest - changed_when: true - - name: Create needed directories for pgBackRest ansible.legacy.file: group: postgres @@ -85,23 +77,6 @@ src: /etc/pgbackrest.conf state: link -- name: Move pgBackRest files to /etc/pgbackrest - when: stage2 - ansible.legacy.copy: - group: postgres - dest: "/etc/pgbackrest/{{ conf_item['path'] }}/{{ conf_item['name'] }}" - mode: '0640' - owner: pgbackrest - src: "files/pgbackrest_config/{{ conf_item['name'] }}" - loop: - - {name: computed_globals.conf, path: conf.d} - - {name: pgbackrest.conf, path: ''} - - {name: repo1_async.conf, path: conf.d} - - {name: repo1_encrypted.conf, path: conf.d} - - {name: repo1.conf, path: conf.d} - loop_control: - loop_var: conf_item - - name: Create pgBackRest wrapper script ansible.builtin.copy: content: | @@ -141,3 +116,28 @@ group: 'root' mode: '0755' owner: 'root' + +- name: Install pgBackRest + when: stage2 + ansible.builtin.shell: | + sudo -u pgbackrest bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install github:supabase/postgres/{{ git_commit_sha }}#pg-backrest" + become: true + become_user: pgbackrest + changed_when: true + +- name: Move pgBackRest files to /etc/pgbackrest + when: stage2 + ansible.legacy.copy: + group: postgres + dest: "/etc/pgbackrest/{{ conf_item['path'] }}/{{ conf_item['name'] }}" + mode: '0640' + owner: pgbackrest + src: "files/pgbackrest_config/{{ conf_item['name'] }}" + loop: + - {name: computed_globals.conf, path: conf.d} + - {name: pgbackrest.conf, path: ''} + - {name: repo1_async.conf, path: conf.d} + - {name: repo1_encrypted.conf, path: conf.d} + - {name: repo1.conf, path: conf.d} + loop_control: + loop_var: conf_item diff --git a/ansible/tasks/setup-postgres.yml b/ansible/tasks/setup-postgres.yml index c74cbdbd7e..c4d065451b 100644 --- a/ansible/tasks/setup-postgres.yml +++ b/ansible/tasks/setup-postgres.yml @@ -1,35 +1,3 @@ -- name: execute stage2 tasks - when: stage2 - block: - - name: install locales - ansible.builtin.apt: - name: 'locales' - state: 'present' - become: true - - - name: configure locales - ansible.builtin.lineinfile: - create: true - line: "{{ locale_item }}.UTF-8 UTF-8" - path: '/etc/locale.gen' - state: 'present' - become: true - loop: - - 'C' - - 'en_US' - loop_control: - loop_var: 'locale_item' - - - name: locale-gen - ansible.builtin.command: - cmd: 'locale-gen' - become: true - - - name: update-locale - ansible.builtin.command: - cmd: 'update-locale' - become: true - - name: execute stage1 tasks when: not stage2 block: @@ -58,9 +26,6 @@ system: true become: yes -- name: execute stage1 tasks - when: not stage2 - block: - name: Create relevant directories ansible.builtin.file: group: 'postgres' @@ -155,22 +120,6 @@ group: postgres mode: 0664 -# Install extensions before init -- name: Install Postgres extensions - when: stage2 - ansible.builtin.import_tasks: - file: 'tasks/setup-docker.yml' - -#stage 2 postgres tasks -- name: stage2 postgres tasks - when: stage2 - ansible.builtin.import_tasks: - file: 'tasks/stage2-setup-postgres.yml' - -# init DB -- name: init the db when stage1 - when: not stage2 - block: - name: Create directory on data volume ansible.builtin.file: group: 'postgres' @@ -187,28 +136,64 @@ src: '/data/pgdata' state: 'link' -- name: Make sure .bashrc exists - when: not stage2 - ansible.builtin.file: - group: 'postgres' - owner: 'postgres' - path: '/var/lib/postgresql/.bashrc' - state: 'touch' - -- name: Ensure /data configured for production runtime - when: stage2 and not qemu - ansible.posix.mount: - src: "UUID={{ ansible_mounts | selectattr('mount', 'equalto', '/data') | map(attribute='uuid') | first }}" - path: /data - fstype: ext4 - opts: defaults,discard,nofail,x-systemd.device-timeout=5s - dump: "0" - passno: "2" - state: mounted - -- name: Run initdb (stage2) + - name: Make sure .bashrc exists + ansible.builtin.file: + group: 'postgres' + owner: 'postgres' + path: '/var/lib/postgresql/.bashrc' + state: 'touch' + +- name: execute stage2 tasks when: stage2 block: + - name: install locales + ansible.builtin.apt: + name: 'locales' + state: 'present' + become: true + + - name: configure locales + ansible.builtin.lineinfile: + create: true + line: "{{ locale_item }}.UTF-8 UTF-8" + path: '/etc/locale.gen' + state: 'present' + become: true + loop: + - 'C' + - 'en_US' + loop_control: + loop_var: 'locale_item' + + - name: locale-gen + ansible.builtin.command: + cmd: 'locale-gen' + become: true + + - name: update-locale + ansible.builtin.command: + cmd: 'update-locale' + become: true + + - name: Install Postgres extensions + ansible.builtin.import_tasks: + file: 'tasks/setup-supautils.yml' + + - name: stage2 postgres tasks + ansible.builtin.import_tasks: + file: 'tasks/stage2-setup-postgres.yml' + + - name: Ensure /data configured for production runtime + when: stage2 and not qemu + ansible.posix.mount: + src: "UUID={{ ansible_mounts | selectattr('mount', 'equalto', '/data') | map(attribute='uuid') | first }}" + path: /data + fstype: ext4 + opts: defaults,discard,nofail,x-systemd.device-timeout=5s + dump: "0" + passno: "2" + state: mounted + - name: Initialize the database stage2 (NOT PG17 NOR PG17-OrioleDB) when: psql_version not in ['psql_17', 'psql_orioledb-17'] become: true @@ -294,9 +279,8 @@ LC_CTYPE: en_US.UTF-8 LOCALE_ARCHIVE: /usr/lib/locale/locale-archive - # Reload -- name: Create a SystemD override dir for PostgreSQL +- name: Create a Systemd override dir for PostgreSQL ansible.builtin.file: group: 'root' mode: '0755' @@ -332,6 +316,7 @@ section: 'Unit' state: 'present' value: 'tuned.service' + - name: System - systemd reload when: stage2 ansible.builtin.systemd_service: @@ -339,7 +324,6 @@ enabled: true name: 'postgresql' - - name: Add lang and locale items to .bashrc when: not stage2 ansible.builtin.lineinfile: diff --git a/ansible/tasks/setup-docker.yml b/ansible/tasks/setup-supautils.yml similarity index 97% rename from ansible/tasks/setup-docker.yml rename to ansible/tasks/setup-supautils.yml index 7559341482..d9520191f7 100644 --- a/ansible/tasks/setup-docker.yml +++ b/ansible/tasks/setup-supautils.yml @@ -1,7 +1,6 @@ -- name: stage2 actions +- name: Setup Supautils when: stage2 block: - # supautils - name: supautils - add supautils to session_preload_libraries ansible.builtin.replace: path: '/etc/postgresql/postgresql.conf' diff --git a/ansible/tasks/setup-system.yml b/ansible/tasks/setup-system.yml index 8506d3ee25..2aef7b9df8 100644 --- a/ansible/tasks/setup-system.yml +++ b/ansible/tasks/setup-system.yml @@ -1,4 +1,11 @@ -- name: Execute tasks when stage1 +- name: Set the platform arch as a fact + ansible.builtin.set_fact: + platform: "{{ 'amd64' if ansible_facts['architecture'] == 'x86_64' else 'arm64' }}" + tags: + - update + - update-only + +- name: Execute stage1 tasks when: not stage2 block: - name: System - apt update and apt upgrade @@ -76,16 +83,6 @@ owner: 'root' group: 'root' -- name: Set the platform arch as a fact - ansible.builtin.set_fact: - platform: "{{ 'amd64' if ansible_facts['architecture'] == 'x86_64' else 'arm64' }}" - tags: - - update - - update-only - -- name: Execute more tasks when - when: not stage2 - block: - name: Custom systemd overrides for resolved ansible.builtin.copy: dest: '/etc/systemd/system/systemd-resolved.service.d/' diff --git a/ansible/tasks/test-image.yml b/ansible/tasks/test-image.yml index d7678d18ca..3acd25cefa 100644 --- a/ansible/tasks/test-image.yml +++ b/ansible/tasks/test-image.yml @@ -38,9 +38,6 @@ loop_var: 'regx' register: 'pgconf' -- name: Execute tasks when stage2 - when: stage2 - block: - name: Restart Postgres Database in stage 2 to load all extensions ansible.builtin.command: cmd: "/usr/lib/postgresql/bin/pg_ctl --pgdata /var/lib/postgresql/data --mode fast --options '-c config_file=/etc/postgresql/postgresql.conf' {{ ctlcmd }}" @@ -58,9 +55,6 @@ loop_control: loop_var: 'ctlcmd' -- name: Execute tasks when stage2 - when: stage2 - block: - name: Re-enable PG Sodium references in /etc/postgresql/postgresql.conf ansible.builtin.command: cmd: mv /etc/postgresql/postgresql.conf.bak /etc/postgresql/postgresql.conf From 131f7ce32d95480f9d78504323f7de31cee2bd64 Mon Sep 17 00:00:00 2001 From: Manuel Mendez Date: Mon, 13 Jul 2026 18:16:21 -0400 Subject: [PATCH 13/15] ansible: Set platform fact in playbook.yml and use it instead of arch everywhere It makes no sense to create a new fact (arch) that is same as platform, and even less sense to do so multiple times. Lets just do it once and early in the playbook so its available effectively always. --- ansible/playbook.yml | 4 +++ ansible/tasks/internal/admin-api.yml | 12 +------- ansible/tasks/internal/admin-mgr.yml | 12 +------- ansible/tasks/internal/install-salt.yml | 30 ++----------------- .../tasks/internal/supabase-admin-agent.yml | 4 +-- ansible/tasks/setup-gotrue.yml | 11 +------ ansible/tasks/setup-system.yml | 7 ----- 7 files changed, 11 insertions(+), 69 deletions(-) diff --git a/ansible/playbook.yml b/ansible/playbook.yml index 30c895da9f..1a2543244a 100644 --- a/ansible/playbook.yml +++ b/ansible/playbook.yml @@ -2,6 +2,10 @@ become: yes pre_tasks: + - name: Set the platform arch as a fact + ansible.builtin.set_fact: + platform: "{{ 'amd64' if ansible_facts['architecture'] == 'x86_64' else 'arm64' }}" + - import_tasks: tasks/setup-system.yml vars_files: - ./vars.yml diff --git a/ansible/tasks/internal/admin-api.yml b/ansible/tasks/internal/admin-api.yml index 04f8a65584..406baa0acc 100644 --- a/ansible/tasks/internal/admin-api.yml +++ b/ansible/tasks/internal/admin-api.yml @@ -27,19 +27,9 @@ shell: | chmod g+w /etc -- name: Setting arch (amd64) - when: platform == "amd64" - set_fact: - arch: "amd64" - -- name: Setting arch (arm) - when: platform == "arm64" - set_fact: - arch: "arm64" - - name: Download adminapi archive get_url: - url: "https://supabase-public-artifacts-bucket.s3.amazonaws.com/supabase-admin-api/v{{ adminapi_release }}/supabase-admin-api_{{ adminapi_release }}_linux_{{ arch }}.tar.gz" + url: "https://supabase-public-artifacts-bucket.s3.amazonaws.com/supabase-admin-api/v{{ adminapi_release }}/supabase-admin-api_{{ adminapi_release }}_linux_{{ platform }}.tar.gz" dest: "/tmp/adminapi.tar.gz" timeout: 90 diff --git a/ansible/tasks/internal/admin-mgr.yml b/ansible/tasks/internal/admin-mgr.yml index 594ea7a05c..7998386c63 100644 --- a/ansible/tasks/internal/admin-mgr.yml +++ b/ansible/tasks/internal/admin-mgr.yml @@ -1,16 +1,6 @@ -- name: Setting arch (x86) - when: platform == "amd64" - set_fact: - arch: "amd64" - -- name: Setting arch (arm) - when: platform == "arm64" - set_fact: - arch: "arm64" - - name: Download admin-mgr archive get_url: - url: "https://supabase-public-artifacts-bucket.s3.amazonaws.com/admin-mgr/v{{ adminmgr_release }}/admin-mgr_{{ adminmgr_release }}_linux_{{ arch }}.tar.gz" + url: "https://supabase-public-artifacts-bucket.s3.amazonaws.com/admin-mgr/v{{ adminmgr_release }}/admin-mgr_{{ adminmgr_release }}_linux_{{ platform }}.tar.gz" dest: "/tmp/admin-mgr.tar.gz" timeout: 90 register: download_result diff --git a/ansible/tasks/internal/install-salt.yml b/ansible/tasks/internal/install-salt.yml index a43ea446f5..46ab1963fc 100644 --- a/ansible/tasks/internal/install-salt.yml +++ b/ansible/tasks/internal/install-salt.yml @@ -1,5 +1,4 @@ -- name: Add apt repository for Saltstack (arm) - when: platform == "arm64" +- name: Add apt repository for Saltstack block: - name: Ensure /etc/apt/keyrings directory exists file: @@ -19,32 +18,7 @@ - name: salt apt repo ansible.builtin.apt_repository: - repo: "deb [signed-by=/etc/apt/keyrings/salt-archive-keyring-2023.pgp arch=arm64] https://packages.broadcom.com/artifactory/saltproject-deb/ stable main" - filename: "salt" - state: present - -- name: Add apt repository for Saltstack (amd) - when: platform == "amd64" - block: - - name: Ensure /etc/apt/keyrings directory exists - file: - path: /etc/apt/keyrings - state: directory - mode: "0755" - - - name: salt gpg key - ansible.builtin.get_url: - url: https://packages.broadcom.com/artifactory/api/security/keypair/SaltProjectKey/public - dest: /etc/apt/keyrings/salt-archive-keyring-2023.pgp - mode: '0644' - register: download_result - until: download_result is succeeded - retries: 3 - delay: 2 - - - name: salt apt repo - ansible.builtin.apt_repository: - repo: "deb [signed-by=/etc/apt/keyrings/salt-archive-keyring-2023.pgp arch=amd64] https://packages.broadcom.com/artifactory/saltproject-deb/ stable main" + repo: "deb [signed-by=/etc/apt/keyrings/salt-archive-keyring-2023.pgp arch={{ platform }}] https://packages.broadcom.com/artifactory/saltproject-deb/ stable main" filename: "salt" state: present diff --git a/ansible/tasks/internal/supabase-admin-agent.yml b/ansible/tasks/internal/supabase-admin-agent.yml index 90bb148a01..e6eafc2072 100644 --- a/ansible/tasks/internal/supabase-admin-agent.yml +++ b/ansible/tasks/internal/supabase-admin-agent.yml @@ -70,7 +70,7 @@ - name: Download supabase-admin-agent archive get_url: - url: "https://supabase-public-artifacts-bucket.s3.amazonaws.com/supabase-admin-agent/v{{ supabase_admin_agent_release }}/supabase-admin-agent-{{ supabase_admin_agent_release }}-linux-{{ arch }}.tar.gz" + url: "https://supabase-public-artifacts-bucket.s3.amazonaws.com/supabase-admin-agent/v{{ supabase_admin_agent_release }}/supabase-admin-agent-{{ supabase_admin_agent_release }}-linux-{{ platform }}.tar.gz" dest: "/tmp/supabase-admin-agent.tar.gz" timeout: 90 register: download_result @@ -90,7 +90,7 @@ - name: supabase-admin-agent - create symlink ansible.builtin.file: path: /opt/supabase-admin-agent/supabase-admin-agent - src: "/opt/supabase-admin-agent/supabase-admin-agent-linux-{{ arch }}" + src: "/opt/supabase-admin-agent/supabase-admin-agent-linux-{{ platform }}" state: link owner: supabase-admin-agent mode: "0755" diff --git a/ansible/tasks/setup-gotrue.yml b/ansible/tasks/setup-gotrue.yml index 940ce60dcc..d9b1fea070 100644 --- a/ansible/tasks/setup-gotrue.yml +++ b/ansible/tasks/setup-gotrue.yml @@ -9,20 +9,11 @@ name: 'gotrue' state: 'present' -- name: Setting arch as a fact - ansible.builtin.set_fact: - arch: >- - {%- if platform == 'amd64' -%} - x86 - {%- elif platform == 'arm64' -%} - arm64 - {%- endif -%} - - name: gotrue - download commit archive ansible.builtin.get_url: checksum: "{{ gotrue_arm_release_checksum if platform == 'arm64' else gotrue_x86_release_checksum }}" dest: '/tmp/gotrue.tar.gz' - url: "https://github.com/supabase/gotrue/releases/download/v{{ gotrue_release }}/auth-v{{ gotrue_release }}-{{ arch }}.tar.gz" + url: "https://github.com/supabase/gotrue/releases/download/v{{ gotrue_release }}/auth-v{{ gotrue_release }}-{{ 'arm64' if platform == 'arm64' else 'x86' }}.tar.gz" register: download_result until: download_result is succeeded retries: 3 diff --git a/ansible/tasks/setup-system.yml b/ansible/tasks/setup-system.yml index 2aef7b9df8..77aa343612 100644 --- a/ansible/tasks/setup-system.yml +++ b/ansible/tasks/setup-system.yml @@ -1,10 +1,3 @@ -- name: Set the platform arch as a fact - ansible.builtin.set_fact: - platform: "{{ 'amd64' if ansible_facts['architecture'] == 'x86_64' else 'arm64' }}" - tags: - - update - - update-only - - name: Execute stage1 tasks when: not stage2 block: From f5a871a81d2b94b68fb9c64059764dfff4420189 Mon Sep 17 00:00:00 2001 From: Manuel Mendez Date: Mon, 13 Jul 2026 18:43:52 -0400 Subject: [PATCH 14/15] ansible: Use better vars/facts for weird arch in file names This way similar tasks look (sort of) similar instead of everyone doing their own thing, which leads to bugs. --- ansible/tasks/internal/install-aws-cli.yml | 2 +- ansible/tasks/setup-envoy.yml | 4 +++- ansible/tasks/setup-gotrue.yml | 4 +++- ansible/tasks/setup-postgrest.yml | 7 +------ ansible/tasks/setup-supabase-internal.yml | 2 +- ansible/vars.yml | 3 --- 6 files changed, 9 insertions(+), 13 deletions(-) diff --git a/ansible/tasks/internal/install-aws-cli.yml b/ansible/tasks/internal/install-aws-cli.yml index 397c19ca15..e0859f3bee 100644 --- a/ansible/tasks/internal/install-aws-cli.yml +++ b/ansible/tasks/internal/install-aws-cli.yml @@ -21,7 +21,7 @@ ansible.builtin.get_url: dest: '/tmp/awscliv2.zip' timeout: 60 - url: "https://awscli.amazonaws.com/awscli-exe-linux-{{ 'aarch64' if platform == 'arm64' else 'x86_64' }}-{{ aws_cli_release }}.zip" + url: "https://awscli.amazonaws.com/awscli-exe-linux-{{ ansible_architecture }}-{{ aws_cli_release }}.zip" register: download_result until: download_result is succeeded retries: 3 diff --git a/ansible/tasks/setup-envoy.yml b/ansible/tasks/setup-envoy.yml index 7901cd6311..2ca087e570 100644 --- a/ansible/tasks/setup-envoy.yml +++ b/ansible/tasks/setup-envoy.yml @@ -11,11 +11,13 @@ mode: '0700' owner: 'envoy' # yamllint disable-line rule:line-length - url: "https://github.com/envoyproxy/envoy/releases/download/v{{ envoy_release }}/envoy-{{ envoy_release }}-linux-{{ 'aarch_64' if platform == 'arm64' else 'x86_64' }}" + url: "https://github.com/envoyproxy/envoy/releases/download/v{{ envoy_release }}/envoy-{{ envoy_release }}-linux-{{ envoy_arch }}" register: download_result until: download_result is succeeded retries: 3 delay: 2 + vars: + envoy_arch: "{{ 'aarch_64' if platform == 'arm64' else 'x86_64' }}" - name: Envoy - download hot restarter script ansible.builtin.get_url: diff --git a/ansible/tasks/setup-gotrue.yml b/ansible/tasks/setup-gotrue.yml index d9b1fea070..5d94729847 100644 --- a/ansible/tasks/setup-gotrue.yml +++ b/ansible/tasks/setup-gotrue.yml @@ -13,11 +13,13 @@ ansible.builtin.get_url: checksum: "{{ gotrue_arm_release_checksum if platform == 'arm64' else gotrue_x86_release_checksum }}" dest: '/tmp/gotrue.tar.gz' - url: "https://github.com/supabase/gotrue/releases/download/v{{ gotrue_release }}/auth-v{{ gotrue_release }}-{{ 'arm64' if platform == 'arm64' else 'x86' }}.tar.gz" + url: "https://github.com/supabase/gotrue/releases/download/v{{ gotrue_release }}/auth-v{{ gotrue_release }}-{{ gotrue_arch }}.tar.gz" register: download_result until: download_result is succeeded retries: 3 delay: 2 + vars: + gotrue_arch: "{{ 'arm64' if platform == 'arm64' else 'x86' }}" - name: gotrue - create /opt/gotrue and /etc/auth.d ansible.builtin.file: diff --git a/ansible/tasks/setup-postgrest.yml b/ansible/tasks/setup-postgrest.yml index 2fd001fa5b..4cc2711668 100644 --- a/ansible/tasks/setup-postgrest.yml +++ b/ansible/tasks/setup-postgrest.yml @@ -66,12 +66,7 @@ retries: 3 delay: 2 vars: - download_binary: >- - {%- if platform == "arm64" -%} - ubuntu-aarch64 - {%- elif platform == "amd64" -%} - linux-static-x86-64 - {%- endif -%} + download_binary: "{{ 'ubuntu-aarch64' if platform == 'arm64' else 'linux-static-x86-64' }}" - name: PostgREST - unpack archive in /opt ansible.builtin.unarchive: diff --git a/ansible/tasks/setup-supabase-internal.yml b/ansible/tasks/setup-supabase-internal.yml index 78a376efb4..be6f9baa9d 100644 --- a/ansible/tasks/setup-supabase-internal.yml +++ b/ansible/tasks/setup-supabase-internal.yml @@ -4,7 +4,7 @@ - name: download Vector package ansible.builtin.get_url: - url: "{{ vector_x86_deb if platform == 'amd64' else vector_arm_deb }}" + url: "https://packages.timber.io/vector/0.48.X/vector_0.48.0-1_{{ platform }}.deb" dest: /tmp/vector.deb timeout: 120 become: true diff --git a/ansible/vars.yml b/ansible/vars.yml index eee7137789..e801ed782e 100644 --- a/ansible/vars.yml +++ b/ansible/vars.yml @@ -64,6 +64,3 @@ adminapi_release: "0.111.1" adminmgr_release: "0.43.3" supabase_admin_agent_release: 1.11.2 supabase_admin_agent_splay: 30s - -vector_x86_deb: https://packages.timber.io/vector/0.48.X/vector_0.48.0-1_amd64.deb -vector_arm_deb: https://packages.timber.io/vector/0.48.X/vector_0.48.0-1_arm64.deb From 8b35c99e6322e354b6d0d39b1e9135e6bbb471dd Mon Sep 17 00:00:00 2001 From: Manuel Mendez Date: Mon, 13 Jul 2026 18:43:52 -0400 Subject: [PATCH 15/15] ansible: Standardize file downloading Every download *must* be verified, by either checksum or signature. Naturally this includes signature files that are fetched from the internets. All fetches need to be verified so we can detect modified/tampered/corrupt transfers. Use a common scheme of ${tool}_version (plain string) and ${tool}_checksum (dict with arm64 and amd64 keys) so that both human and computer pattern recognition can have the best chance at doing things right. --- ansible/tasks/internal/admin-api.yml | 1 + ansible/tasks/internal/admin-mgr.yml | 1 + ansible/tasks/internal/install-aws-cli.yml | 3 +- ansible/tasks/internal/install-salt.yml | 1 + ansible/tasks/internal/postgres-exporter.yml | 2 +- .../tasks/internal/supabase-admin-agent.yml | 1 + ansible/tasks/internal/supautils.yml | 2 +- ansible/tasks/setup-envoy.yml | 10 ++-- ansible/tasks/setup-gotrue.yml | 4 +- ansible/tasks/setup-kong.yml | 4 +- ansible/tasks/setup-nginx.yml | 2 +- ansible/tasks/setup-pgbouncer.yml | 2 +- ansible/tasks/setup-postgrest.yml | 8 ++-- ansible/tasks/setup-supabase-internal.yml | 3 +- ansible/vars.yml | 46 +++++++++++++------ 15 files changed, 57 insertions(+), 33 deletions(-) diff --git a/ansible/tasks/internal/admin-api.yml b/ansible/tasks/internal/admin-api.yml index 406baa0acc..9aec9eaebd 100644 --- a/ansible/tasks/internal/admin-api.yml +++ b/ansible/tasks/internal/admin-api.yml @@ -30,6 +30,7 @@ - name: Download adminapi archive get_url: url: "https://supabase-public-artifacts-bucket.s3.amazonaws.com/supabase-admin-api/v{{ adminapi_release }}/supabase-admin-api_{{ adminapi_release }}_linux_{{ platform }}.tar.gz" + checksum: "{{ adminapi_checksum[platform] }}" dest: "/tmp/adminapi.tar.gz" timeout: 90 diff --git a/ansible/tasks/internal/admin-mgr.yml b/ansible/tasks/internal/admin-mgr.yml index 7998386c63..f05cf8f7c2 100644 --- a/ansible/tasks/internal/admin-mgr.yml +++ b/ansible/tasks/internal/admin-mgr.yml @@ -1,6 +1,7 @@ - name: Download admin-mgr archive get_url: url: "https://supabase-public-artifacts-bucket.s3.amazonaws.com/admin-mgr/v{{ adminmgr_release }}/admin-mgr_{{ adminmgr_release }}_linux_{{ platform }}.tar.gz" + checksum: "{{ adminmgr_checksum[platform] }}" dest: "/tmp/admin-mgr.tar.gz" timeout: 90 register: download_result diff --git a/ansible/tasks/internal/install-aws-cli.yml b/ansible/tasks/internal/install-aws-cli.yml index e0859f3bee..af5c8c641f 100644 --- a/ansible/tasks/internal/install-aws-cli.yml +++ b/ansible/tasks/internal/install-aws-cli.yml @@ -19,9 +19,10 @@ - name: AWS CLI - get ansible.builtin.get_url: + url: "https://awscli.amazonaws.com/awscli-exe-linux-{{ ansible_architecture }}-{{ aws_cli_release }}.zip" + checksum: "{{ aws_cli_checksum[platform] }}" dest: '/tmp/awscliv2.zip' timeout: 60 - url: "https://awscli.amazonaws.com/awscli-exe-linux-{{ ansible_architecture }}-{{ aws_cli_release }}.zip" register: download_result until: download_result is succeeded retries: 3 diff --git a/ansible/tasks/internal/install-salt.yml b/ansible/tasks/internal/install-salt.yml index 46ab1963fc..8f9ba32340 100644 --- a/ansible/tasks/internal/install-salt.yml +++ b/ansible/tasks/internal/install-salt.yml @@ -9,6 +9,7 @@ - name: salt gpg key ansible.builtin.get_url: url: https://packages.broadcom.com/artifactory/api/security/keypair/SaltProjectKey/public + checksum: sha256:36decef986477acb8ba2a1fc4041bcf9f22229ef6c939d0317c9e36a9d142b34 dest: /etc/apt/keyrings/salt-archive-keyring-2023.pgp mode: '0644' register: download_result diff --git a/ansible/tasks/internal/postgres-exporter.yml b/ansible/tasks/internal/postgres-exporter.yml index 29dc896e79..73d0874309 100644 --- a/ansible/tasks/internal/postgres-exporter.yml +++ b/ansible/tasks/internal/postgres-exporter.yml @@ -23,8 +23,8 @@ - name: download postgres exporter get_url: url: "https://github.com/prometheus-community/postgres_exporter/releases/download/v{{ postgres_exporter_release }}/postgres_exporter-{{ postgres_exporter_release }}.linux-{{ platform }}.tar.gz" - dest: /tmp/postgres_exporter.tar.gz checksum: "{{ postgres_exporter_release_checksum[platform] }}" + dest: /tmp/postgres_exporter.tar.gz timeout: 60 register: download_result until: download_result is succeeded diff --git a/ansible/tasks/internal/supabase-admin-agent.yml b/ansible/tasks/internal/supabase-admin-agent.yml index e6eafc2072..32a97432e9 100644 --- a/ansible/tasks/internal/supabase-admin-agent.yml +++ b/ansible/tasks/internal/supabase-admin-agent.yml @@ -71,6 +71,7 @@ - name: Download supabase-admin-agent archive get_url: url: "https://supabase-public-artifacts-bucket.s3.amazonaws.com/supabase-admin-agent/v{{ supabase_admin_agent_release }}/supabase-admin-agent-{{ supabase_admin_agent_release }}-linux-{{ platform }}.tar.gz" + checksum: "{{ supabase_admin_agent_checksum[platform] }}" dest: "/tmp/supabase-admin-agent.tar.gz" timeout: 90 register: download_result diff --git a/ansible/tasks/internal/supautils.yml b/ansible/tasks/internal/supautils.yml index dc8866ebf7..0e0d7de284 100644 --- a/ansible/tasks/internal/supautils.yml +++ b/ansible/tasks/internal/supautils.yml @@ -10,8 +10,8 @@ - name: supautils - download latest release get_url: url: "https://github.com/supabase/supautils/archive/refs/tags/v{{ supautils_release }}.tar.gz" - dest: /tmp/supautils-{{ supautils_release }}.tar.gz checksum: "{{ supautils_release_checksum }}" + dest: /tmp/supautils-{{ supautils_release }}.tar.gz timeout: 60 register: download_result until: download_result is succeeded diff --git a/ansible/tasks/setup-envoy.yml b/ansible/tasks/setup-envoy.yml index 2ca087e570..98d7a0ab57 100644 --- a/ansible/tasks/setup-envoy.yml +++ b/ansible/tasks/setup-envoy.yml @@ -5,13 +5,12 @@ - name: Envoy - download binary ansible.builtin.get_url: - checksum: "{{ envoy_arm_release_checksum if platform == 'arm64' else envoy_x86_release_checksum }}" + url: "https://github.com/envoyproxy/envoy/releases/download/v{{ envoy_release }}/envoy-{{ envoy_release }}-linux-{{ envoy_arch }}" + checksum: "{{ envoy_checksum[platform] }}" dest: '/opt/envoy' group: 'envoy' mode: '0700' owner: 'envoy' - # yamllint disable-line rule:line-length - url: "https://github.com/envoyproxy/envoy/releases/download/v{{ envoy_release }}/envoy-{{ envoy_release }}-linux-{{ envoy_arch }}" register: download_result until: download_result is succeeded retries: 3 @@ -21,13 +20,12 @@ - name: Envoy - download hot restarter script ansible.builtin.get_url: - checksum: "{{ envoy_hot_restarter_release_checksum }}" + url: "https://raw.githubusercontent.com/envoyproxy/envoy/v{{ envoy_release }}/restarter/hot-restarter.py" + checksum: "{{ envoy_checksum['hot_restarter'] }}" dest: '/opt/envoy-hot-restarter.py' group: 'envoy' mode: '0700' owner: 'envoy' - # yamllint disable-line rule:line-length - url: "https://raw.githubusercontent.com/envoyproxy/envoy/v{{ envoy_release }}/restarter/hot-restarter.py" register: download_result until: download_result is succeeded retries: 3 diff --git a/ansible/tasks/setup-gotrue.yml b/ansible/tasks/setup-gotrue.yml index 5d94729847..dbc6854875 100644 --- a/ansible/tasks/setup-gotrue.yml +++ b/ansible/tasks/setup-gotrue.yml @@ -11,9 +11,9 @@ - name: gotrue - download commit archive ansible.builtin.get_url: - checksum: "{{ gotrue_arm_release_checksum if platform == 'arm64' else gotrue_x86_release_checksum }}" - dest: '/tmp/gotrue.tar.gz' url: "https://github.com/supabase/gotrue/releases/download/v{{ gotrue_release }}/auth-v{{ gotrue_release }}-{{ gotrue_arch }}.tar.gz" + checksum: "{{ gotrue_checksum[platform] }}" + dest: '/tmp/gotrue.tar.gz' register: download_result until: download_result is succeeded retries: 3 diff --git a/ansible/tasks/setup-kong.yml b/ansible/tasks/setup-kong.yml index 1908481fbb..c3eef8b696 100644 --- a/ansible/tasks/setup-kong.yml +++ b/ansible/tasks/setup-kong.yml @@ -14,9 +14,9 @@ - name: Kong - download deb package get_url: - checksum: "{{ kong_deb_checksum[platform] }}" + url: "https://packages.konghq.com/public/gateway-28/deb/ubuntu/pool/{{ kong_release_target }}/main/k/ko/kong_{{kong_release}}/kong_{{ kong_release }}_{{ platform }}.deb" + checksum: "{{ kong_checksum[platform] }}" dest: '/tmp/kong.deb' - url: "https://packages.konghq.com/public/gateway-28/deb/ubuntu/pool/{{ kong_release_target }}/main/k/ko/kong_2.8.1/{{ kong_deb[platform] }}" register: download_result until: download_result is succeeded retries: 3 diff --git a/ansible/tasks/setup-nginx.yml b/ansible/tasks/setup-nginx.yml index 8dda21e7a8..7b1595a4b9 100644 --- a/ansible/tasks/setup-nginx.yml +++ b/ansible/tasks/setup-nginx.yml @@ -14,9 +14,9 @@ - name: nginx - download source ansible.builtin.get_url: + url: "https://nginx.org/download/nginx-{{ nginx_release }}.tar.gz" checksum: "{{ nginx_release_checksum }}" dest: '/tmp/nginx-{{ nginx_release }}.tar.gz' - url: "https://nginx.org/download/nginx-{{ nginx_release }}.tar.gz" register: download_result until: download_result is succeeded retries: 3 diff --git a/ansible/tasks/setup-pgbouncer.yml b/ansible/tasks/setup-pgbouncer.yml index 4e4e1445a4..f58040af7f 100644 --- a/ansible/tasks/setup-pgbouncer.yml +++ b/ansible/tasks/setup-pgbouncer.yml @@ -13,10 +13,10 @@ - name: PgBouncer - download latest release ansible.builtin.get_url: + url: "https://www.pgbouncer.org/downloads/files/{{ pgbouncer_release }}/pgbouncer-{{ pgbouncer_release }}.tar.gz" checksum: "{{ pgbouncer_release_checksum }}" dest: "/tmp/pgbouncer-{{ pgbouncer_release }}.tar.gz" timeout: 60 - url: "https://www.pgbouncer.org/downloads/files/{{ pgbouncer_release }}/pgbouncer-{{ pgbouncer_release }}.tar.gz" register: download_result until: download_result is succeeded retries: 3 diff --git a/ansible/tasks/setup-postgrest.yml b/ansible/tasks/setup-postgrest.yml index 4cc2711668..7b95f74fa2 100644 --- a/ansible/tasks/setup-postgrest.yml +++ b/ansible/tasks/setup-postgrest.yml @@ -5,12 +5,12 @@ - name: PostgREST - add Postgres PPA gpg key ansible.builtin.get_url: + url: 'https://www.postgresql.org/media/keys/ACCC4CF8.asc' + checksum: sha256:0144068502a1eddd2a0280ede10ef607d1ec592ce819940991203941564e8e76 dest: /etc/apt/trusted.gpg.d/ppdg.asc force: true mode: '0644' - url: 'https://www.postgresql.org/media/keys/ACCC4CF8.asc' timeout: 60 - validate_certs: true register: pgdg_key_download retries: 6 delay: 2 @@ -57,10 +57,10 @@ - name: PostgREST - download ubuntu binary archive (arm) ansible.builtin.get_url: - checksum: "{{ postgrest_arm_release_checksum if platform == 'arm64' else postgrest_x86_release_checksum }}" + url: "https://github.com/PostgREST/postgrest/releases/download/v{{ postgrest_release }}/postgrest-v{{ postgrest_release }}-{{ download_binary }}.tar.xz" + checksum: "{{ postgrest_checksum[platform] }}" dest: '/tmp/postgrest.tar.xz' timeout: 60 - url: "https://github.com/PostgREST/postgrest/releases/download/v{{ postgrest_release }}/postgrest-v{{ postgrest_release }}-{{ download_binary }}.tar.xz" register: download_result until: download_result is succeeded retries: 3 diff --git a/ansible/tasks/setup-supabase-internal.yml b/ansible/tasks/setup-supabase-internal.yml index be6f9baa9d..10e02efe44 100644 --- a/ansible/tasks/setup-supabase-internal.yml +++ b/ansible/tasks/setup-supabase-internal.yml @@ -4,7 +4,8 @@ - name: download Vector package ansible.builtin.get_url: - url: "https://packages.timber.io/vector/0.48.X/vector_0.48.0-1_{{ platform }}.deb" + url: "https://packages.timber.io/vector/{{ vector_release.split('.')[:2] | join('.') }}.X/vector_{{ vector_release }}_{{ platform }}.deb" + checksum: "{{ vector_checksum[platform] }}" dest: /tmp/vector.deb timeout: 120 become: true diff --git a/ansible/vars.yml b/ansible/vars.yml index e801ed782e..6af8bb4f7b 100644 --- a/ansible/vars.yml +++ b/ansible/vars.yml @@ -22,15 +22,19 @@ pgbouncer_release_checksum: sha256:6e566ae92fe3ef7f6a1b9e26d6049f7d7ca39c40e29e7 # The binaries used are: ubuntu-aarch64 and linux-static. # https://github.com/PostgREST/postgrest/releases postgrest_release: "14.15" # keep this as a string, otherwise gets treated as yaml float which will likely only lead to tears -postgrest_arm_release_checksum: sha256:1eb007298c1536ba865e741da7eece6fba6db3da904c599abd15d9c3debe6c2f -postgrest_x86_release_checksum: sha256:4e78c7f065a6c36f350c7177f5fa9bb77ea380c67b8bf40f2fc9130d857678dc +postgrest_checksum: + amd64: sha256:4e78c7f065a6c36f350c7177f5fa9bb77ea380c67b8bf40f2fc9130d857678dc + arm64: sha256:1eb007298c1536ba865e741da7eece6fba6db3da904c599abd15d9c3debe6c2f gotrue_release: 2.190.0 -gotrue_release_checksum: sha1:7ceab0d91ebc68792afb58d07cfb73e1505de882 -gotrue_arm_release_checksum: sha1:7ceab0d91ebc68792afb58d07cfb73e1505de882 -gotrue_x86_release_checksum: sha1:56725ea31e32601dd5861f2e6f5d1e3cfd72299b +gotrue_checksum: + amd64: sha1:56725ea31e32601dd5861f2e6f5d1e3cfd72299b + arm64: sha1:7ceab0d91ebc68792afb58d07cfb73e1505de882 aws_cli_release: 2.23.11 +aws_cli_checksum: + amd64: sha256:d9cad44c58bbf5f43cfccd291d688d5297356608aeaa487ce65c4ac81251f4c7 + arm64: sha256:21e74a95c28ba2c9a55e6af215484ab4028500c8dc98b7188a2c9854ba116e8f salt_version: "3007.14" # keep this as a string, otherwise gets treated as yaml float which will likely only lead to tears @@ -40,15 +44,14 @@ golang_version_checksum: amd64: sha256:9ebfcab26801fa4cf0627c6439db7a4da4d3c6766142a3dd83508240e4f21031 envoy_release: 1.28.0 -envoy_arm_release_checksum: sha256:eb930e32ab5555643e09d11d490e392d0a790c5a80eb0b0ebacb1046bdbb114d -envoy_x86_release_checksum: sha256:2639563ce9bc09b1ee6bd4731760b596c8ed1e474cdd83cc9df9364516e14367 -envoy_hot_restarter_release_checksum: sha1:6d43b89d266fb2427a4b51756b649883b0617eda +envoy_checksum: + amd64: sha256:2639563ce9bc09b1ee6bd4731760b596c8ed1e474cdd83cc9df9364516e14367 + arm64: sha256:eb930e32ab5555643e09d11d490e392d0a790c5a80eb0b0ebacb1046bdbb114d + hot_restarter: sha1:6d43b89d266fb2427a4b51756b649883b0617eda +kong_release: 2.8.1 kong_release_target: focal -kong_deb: - arm64: kong_2.8.1_arm64.deb - amd64: kong_2.8.1_amd64.deb -kong_deb_checksum: +kong_checksum: arm64: sha1:2086f6ccf8454fe64435252fea4d29d736d7ec61 amd64: sha1:7346d558a467f05d9ed63675b59f974300647e9f @@ -61,6 +64,23 @@ postgres_exporter_release_checksum: amd64: sha256:cb89fc5bf4485fb554e0d640d9684fae143a4b2d5fa443009bd29c59f9129e84 adminapi_release: "0.111.1" +adminapi_checksum: + amd64: sha256:31c0b85973ca6454a23ece701299050a12d0a9efedea2c113eb5e6251c7335eb + arm64: sha256:74fe9c0f242b89937cdc811d12eafb2fe6b81e3ac6f903924699d4183f800309 + adminmgr_release: "0.43.3" -supabase_admin_agent_release: 1.11.2 +adminmgr_checksum: + amd64: sha256:ce7f601365accbb5cb5a141aa4e3949c900dc92fbc82bf0cc115b49481f0303d + arm64: sha256:c60dc478a042414be686ca986dd1a060183b4a18177141ca03cf7c66c27f4b75 + supabase_admin_agent_splay: 30s +supabase_admin_agent_release: 1.11.2 +supabase_admin_agent_checksum: + amd64: sha256:45b3a4509777fb6fefed1866096505fd032b2680a558ef6da0ffbbd6c509bbd3 + arm64: sha256:32637da2cb87aecd29bdd1873609a4ed56006c84cad6d66490ce49d336ef68ec + + +vector_release: "0.48.0-1" +vector_checksum: + amd64: sha256:a898f8e44b58ad9b3a87f877dfed160fa469edab1e4cbae5b7700d0ad28a444b + arm64: sha256:c52483bbd1aba387e8d83eded6fce0c1de31eb7eac810ad4d780895a887da6b1