From e0c35ceab64a68045ea90b39f918e20ff6f1dce2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?M=C3=A1rton=20Boros?= Date: Fri, 16 Oct 2026 03:29:18 +0300 Subject: [PATCH 1/8] ci(ami): pass postgres env store path to packer via var Co-Authored-By: Claude Sonnet 5.5 --- .github/actions/build-ami/action.yml | 1 + ansible/tasks/stage2-setup-postgres.yml | 11 ++--------- ebssurrogate/scripts/nix-provision.sh | 1 + nix/packages/build-test-ami.nix | 1 + stage2-nix-psql.pkr.hcl | 5 +++++ 5 files changed, 10 insertions(+), 9 deletions(-) diff --git a/.github/actions/build-ami/action.yml b/.github/actions/build-ami/action.yml index b241ec4ee2..0d2ca3675f 100644 --- a/.github/actions/build-ami/action.yml +++ b/.github/actions/build-ami/action.yml @@ -110,6 +110,7 @@ runs: -var "git_sha=${{ inputs.packages_git_sha }}" \ -var "instance_type=${{ inputs.instance_type }}" \ -var "packer-execution-id=$PACKER_EXECUTION_ID" \ + -var "postgres_env_path=$(nix eval --raw "github:supabase/postgres/${{ inputs.packages_git_sha }}#packages.${{ inputs.arch == 'arm64' && 'aarch64' || 'x86_64' }}-linux.postgres-env-${{ inputs.postgres_version }}.outPath")" \ -var "postgres_major_version=${{ inputs.postgres_version }}" \ stage2-nix-psql.pkr.hcl diff --git a/ansible/tasks/stage2-setup-postgres.yml b/ansible/tasks/stage2-setup-postgres.yml index d4823238a7..80474685a9 100644 --- a/ansible/tasks/stage2-setup-postgres.yml +++ b/ansible/tasks/stage2-setup-postgres.yml @@ -62,19 +62,12 @@ when: stage2 become: true block: - - name: Resolve postgres env store path - ansible.builtin.shell: | - sudo -u postgres bash -c " - . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && - nix build --no-link --print-out-paths github:supabase/postgres/{{ git_commit_sha }}#postgres-env-{{ postgresql_major_version }} - " - register: postgres_env_path - - name: Install postgres env from nix binary cache ansible.builtin.shell: | sudo -u postgres bash -c " . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && - nix-env --set {{ postgres_env_path.stdout }} + nix-store --realise {{ postgres_env_path }} && + nix-env --set {{ postgres_env_path }} " - name: Install supascan for baseline validation diff --git a/ebssurrogate/scripts/nix-provision.sh b/ebssurrogate/scripts/nix-provision.sh index e8470fc635..b6ef25df90 100755 --- a/ebssurrogate/scripts/nix-provision.sh +++ b/ebssurrogate/scripts/nix-provision.sh @@ -59,6 +59,7 @@ function execute_stage2_playbook { ansible-playbook /tmp/ansible-playbook/ansible/playbook.yml \ --extra-vars '{"stage2":true, "qemu":false}' \ --extra-vars "git_commit_sha=$GIT_SHA" \ + --extra-vars "postgres_env_path=$POSTGRES_ENV_PATH" \ --extra-vars "psql_version=psql_$POSTGRES_MAJOR_VERSION" \ --extra-vars "postgresql_version=postgresql_$POSTGRES_MAJOR_VERSION" \ --extra-vars "postgresql_major_version=$POSTGRES_MAJOR_VERSION" \ diff --git a/nix/packages/build-test-ami.nix b/nix/packages/build-test-ami.nix index 27ad2d94d6..17ff8d637f 100644 --- a/nix/packages/build-test-ami.nix +++ b/nix/packages/build-test-ami.nix @@ -103,6 +103,7 @@ writeShellApplication { -var "region=$REGION" \ -var 'ami_regions=["'"$REGION"'"]' \ -var "git_sha=$GIT_SHA" \ + -var "postgres_env_path=$(nix eval --raw "github:supabase/postgres/$GIT_SHA#packages.aarch64-linux.postgres-env-$POSTGRES_VERSION.outPath")" \ stage2-nix-psql.pkr.hcl # Cleanup instances from AMI builds diff --git a/stage2-nix-psql.pkr.hcl b/stage2-nix-psql.pkr.hcl index 7278ccd2bf..7998e8cfce 100644 --- a/stage2-nix-psql.pkr.hcl +++ b/stage2-nix-psql.pkr.hcl @@ -27,6 +27,10 @@ variable "git_sha" { default = env("GIT_SHA") } +variable "postgres_env_path" { + type = string +} + variable "postgres_major_version" { type = string default = "" @@ -140,6 +144,7 @@ build { provisioner "shell" { environment_vars = [ "GIT_SHA=${var.git_sha}", + "POSTGRES_ENV_PATH=${var.postgres_env_path}", "POSTGRES_MAJOR_VERSION=${var.postgres_major_version}" ] use_env_var_file = true From 7482ddcae190c100a5350cb9c050a6399afae061 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?M=C3=A1rton=20Boros?= Date: Fri, 16 Oct 2026 03:32:08 +0300 Subject: [PATCH 2/8] ci(ami): drop separate realise step Co-Authored-By: Claude Sonnet 5.5 --- ansible/tasks/stage2-setup-postgres.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/ansible/tasks/stage2-setup-postgres.yml b/ansible/tasks/stage2-setup-postgres.yml index 80474685a9..538ad7970c 100644 --- a/ansible/tasks/stage2-setup-postgres.yml +++ b/ansible/tasks/stage2-setup-postgres.yml @@ -66,8 +66,7 @@ ansible.builtin.shell: | sudo -u postgres bash -c " . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && - nix-store --realise {{ postgres_env_path }} && - nix-env --set {{ postgres_env_path }} + nix-env --quiet --set {{ postgres_env_path }} " - name: Install supascan for baseline validation From 98cb0ff47ef9fe0c9700b3686d928e19fd9e9d25 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?M=C3=A1rton=20Boros?= Date: Tue, 20 Oct 2026 02:42:29 +0300 Subject: [PATCH 3/8] ci(ami): pass all stage 2 nix store paths to packer via var Co-Authored-By: Claude Sonnet 5.5 --- .github/actions/build-ami/action.yml | 2 +- ansible/tasks/setup-pgbackrest.yml | 2 +- ansible/tasks/setup-pgbouncer.yml | 2 +- ansible/tasks/setup-wal-g.yml | 4 ++-- ansible/tasks/stage2-setup-postgres.yml | 4 ++-- ebssurrogate/scripts/nix-provision.sh | 2 +- nix/packages/build-test-ami.nix | 2 +- stage2-nix-psql.pkr.hcl | 4 ++-- 8 files changed, 11 insertions(+), 11 deletions(-) diff --git a/.github/actions/build-ami/action.yml b/.github/actions/build-ami/action.yml index 0d2ca3675f..8adbb0763a 100644 --- a/.github/actions/build-ami/action.yml +++ b/.github/actions/build-ami/action.yml @@ -110,7 +110,7 @@ runs: -var "git_sha=${{ inputs.packages_git_sha }}" \ -var "instance_type=${{ inputs.instance_type }}" \ -var "packer-execution-id=$PACKER_EXECUTION_ID" \ - -var "postgres_env_path=$(nix eval --raw "github:supabase/postgres/${{ inputs.packages_git_sha }}#packages.${{ inputs.arch == 'arm64' && 'aarch64' || 'x86_64' }}-linux.postgres-env-${{ inputs.postgres_version }}.outPath")" \ + -var "nix_store_paths=$(nix eval --json "github:supabase/postgres/${{ inputs.packages_git_sha }}#packages.${{ inputs.arch == 'arm64' && 'aarch64' || 'x86_64' }}-linux" --apply 'p: builtins.mapAttrs (_: d: d.outPath) { inherit (p) supascan pgbouncer pg-backrest wal-g-2 wal-g-3; postgres-env = p.postgres-env-${{ inputs.postgres_version }}; }')" \ -var "postgres_major_version=${{ inputs.postgres_version }}" \ stage2-nix-psql.pkr.hcl diff --git a/ansible/tasks/setup-pgbackrest.yml b/ansible/tasks/setup-pgbackrest.yml index 1aac4189f0..f92b016666 100644 --- a/ansible/tasks/setup-pgbackrest.yml +++ b/ansible/tasks/setup-pgbackrest.yml @@ -122,7 +122,7 @@ - name: Install pgBackRest when: stage2 ansible.builtin.shell: | - sudo -u pgbackrest bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install github:supabase/postgres/{{ git_commit_sha }}#pg-backrest" + sudo -u pgbackrest bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install {{ nix_store_paths['pg-backrest'] }}" become: true become_user: pgbackrest changed_when: true diff --git a/ansible/tasks/setup-pgbouncer.yml b/ansible/tasks/setup-pgbouncer.yml index d76aa46b8e..9c96479b70 100644 --- a/ansible/tasks/setup-pgbouncer.yml +++ b/ansible/tasks/setup-pgbouncer.yml @@ -18,7 +18,7 @@ - name: Install PgBouncer from nix binary cache when: stage2 ansible.builtin.shell: - cmd: sudo -u pgbouncer bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install github:supabase/postgres/{{ git_commit_sha }}#pgbouncer" + cmd: sudo -u pgbouncer bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install {{ nix_store_paths['pgbouncer'] }}" become: true - name: Link PgBouncer into /usr/local/bin diff --git a/ansible/tasks/setup-wal-g.yml b/ansible/tasks/setup-wal-g.yml index c0d1edfd90..c63992be67 100644 --- a/ansible/tasks/setup-wal-g.yml +++ b/ansible/tasks/setup-wal-g.yml @@ -36,14 +36,14 @@ block: - name: Install wal-g 2 from nix binary cache ansible.builtin.shell: - cmd: sudo -u wal-g bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install github:supabase/postgres/{{ git_commit_sha }}#wal-g-2" + cmd: sudo -u wal-g bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install {{ nix_store_paths['wal-g-2'] }}" become: true # Installed alongside v2 (INDATA-904). The /usr/local/bin/wal-g symlink below # only points at v3 on orioledb builds; v2 remains the default everywhere else. - name: Install wal-g 3 from nix binary cache ansible.builtin.shell: - cmd: . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install github:supabase/postgres/{{ git_commit_sha }}#wal-g-3 + cmd: . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install {{ nix_store_paths['wal-g-3'] }} become: true become_user: wal-g diff --git a/ansible/tasks/stage2-setup-postgres.yml b/ansible/tasks/stage2-setup-postgres.yml index 538ad7970c..7fefba524f 100644 --- a/ansible/tasks/stage2-setup-postgres.yml +++ b/ansible/tasks/stage2-setup-postgres.yml @@ -66,12 +66,12 @@ ansible.builtin.shell: | sudo -u postgres bash -c " . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && - nix-env --quiet --set {{ postgres_env_path }} + nix-env --quiet --set {{ nix_store_paths['postgres-env'] }} " - name: Install supascan for baseline validation ansible.builtin.shell: | - sudo -u ubuntu bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install github:supabase/postgres/{{ git_commit_sha }}#supascan" + sudo -u ubuntu bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install {{ nix_store_paths['supascan'] }}" - name: nix collect garbage after supascan install ansible.builtin.shell: diff --git a/ebssurrogate/scripts/nix-provision.sh b/ebssurrogate/scripts/nix-provision.sh index b6ef25df90..db4f1d7ae6 100755 --- a/ebssurrogate/scripts/nix-provision.sh +++ b/ebssurrogate/scripts/nix-provision.sh @@ -59,7 +59,7 @@ function execute_stage2_playbook { ansible-playbook /tmp/ansible-playbook/ansible/playbook.yml \ --extra-vars '{"stage2":true, "qemu":false}' \ --extra-vars "git_commit_sha=$GIT_SHA" \ - --extra-vars "postgres_env_path=$POSTGRES_ENV_PATH" \ + --extra-vars "{\"nix_store_paths\": $NIX_STORE_PATHS}" \ --extra-vars "psql_version=psql_$POSTGRES_MAJOR_VERSION" \ --extra-vars "postgresql_version=postgresql_$POSTGRES_MAJOR_VERSION" \ --extra-vars "postgresql_major_version=$POSTGRES_MAJOR_VERSION" \ diff --git a/nix/packages/build-test-ami.nix b/nix/packages/build-test-ami.nix index 17ff8d637f..4a71e8d107 100644 --- a/nix/packages/build-test-ami.nix +++ b/nix/packages/build-test-ami.nix @@ -103,7 +103,7 @@ writeShellApplication { -var "region=$REGION" \ -var 'ami_regions=["'"$REGION"'"]' \ -var "git_sha=$GIT_SHA" \ - -var "postgres_env_path=$(nix eval --raw "github:supabase/postgres/$GIT_SHA#packages.aarch64-linux.postgres-env-$POSTGRES_VERSION.outPath")" \ + -var "nix_store_paths=$(nix eval --json "github:supabase/postgres/$GIT_SHA#packages.aarch64-linux" --apply 'p: builtins.mapAttrs (_: d: d.outPath) { inherit (p) supascan pgbouncer pg-backrest wal-g-2 wal-g-3; postgres-env = p.postgres-env-'"$POSTGRES_VERSION"'; }')" \ stage2-nix-psql.pkr.hcl # Cleanup instances from AMI builds diff --git a/stage2-nix-psql.pkr.hcl b/stage2-nix-psql.pkr.hcl index 7998e8cfce..5c1af0df4e 100644 --- a/stage2-nix-psql.pkr.hcl +++ b/stage2-nix-psql.pkr.hcl @@ -27,7 +27,7 @@ variable "git_sha" { default = env("GIT_SHA") } -variable "postgres_env_path" { +variable "nix_store_paths" { type = string } @@ -144,7 +144,7 @@ build { provisioner "shell" { environment_vars = [ "GIT_SHA=${var.git_sha}", - "POSTGRES_ENV_PATH=${var.postgres_env_path}", + "NIX_STORE_PATHS=${var.nix_store_paths}", "POSTGRES_MAJOR_VERSION=${var.postgres_major_version}" ] use_env_var_file = true From 7ddc4be4b29662432e670a61ec7bbde9fed6a54d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?M=C3=A1rton=20Boros?= Date: Tue, 20 Oct 2026 02:45:26 +0300 Subject: [PATCH 4/8] ci(qemu): pass nix store paths to packer via var Co-Authored-By: Claude Sonnet 5.5 --- ebssurrogate/scripts/qemu-bootstrap-nix.sh | 1 + nix/packages/build-qemu-image/build-qemu-image.sh | 1 + qemu.pkr.hcl | 5 +++++ 3 files changed, 7 insertions(+) diff --git a/ebssurrogate/scripts/qemu-bootstrap-nix.sh b/ebssurrogate/scripts/qemu-bootstrap-nix.sh index c064454b0d..ff3793b0f3 100755 --- a/ebssurrogate/scripts/qemu-bootstrap-nix.sh +++ b/ebssurrogate/scripts/qemu-bootstrap-nix.sh @@ -155,6 +155,7 @@ function execute_stage2_playbook { ansible-playbook ./ansible/playbook.yml \ --extra-vars '{"stage2": true, "qemu": true}' \ --extra-vars "git_commit_sha=$GIT_SHA" \ + --extra-vars "{\"nix_store_paths\": $NIX_STORE_PATHS}" \ --extra-vars "postgresql_version=postgresql_$POSTGRES_MAJOR_VERSION" \ --extra-vars "postgresql_major_version=$POSTGRES_MAJOR_VERSION" \ --extra-vars "postgresql_major=$POSTGRES_MAJOR_VERSION" \ diff --git a/nix/packages/build-qemu-image/build-qemu-image.sh b/nix/packages/build-qemu-image/build-qemu-image.sh index c6c36a2bf0..2c0fc8b27a 100644 --- a/nix/packages/build-qemu-image/build-qemu-image.sh +++ b/nix/packages/build-qemu-image/build-qemu-image.sh @@ -63,6 +63,7 @@ PACKER_LOG=${PACKER_LOG:-1} packer build \ -var "cpu=$cpu" \ -var "git_sha=$git_sha" \ -var "machine=$machine" \ + -var "nix_store_paths=$(nix eval --json "github:supabase/postgres/$git_sha#packages.$([ "$arch" = arm64 ] && echo aarch64 || echo x86_64)-linux" --apply 'p: builtins.mapAttrs (_: d: d.outPath) { inherit (p) supascan pgbouncer pg-backrest wal-g-2 wal-g-3; postgres-env = p.postgres-env-'"$postgres_major_version"'; }')" \ -var "postgres-version=$postgres_version" \ -var "postgres_major_version=$postgres_major_version" \ -var "qemu_binary=$qemu" \ diff --git a/qemu.pkr.hcl b/qemu.pkr.hcl index ab854240f0..05b91073d9 100644 --- a/qemu.pkr.hcl +++ b/qemu.pkr.hcl @@ -2,6 +2,10 @@ variable "git_sha" { type = string } +variable "nix_store_paths" { + type = string +} + variable "postgres-version" { type = string default = "" @@ -109,6 +113,7 @@ build { provisioner "shell" { environment_vars = [ "GIT_SHA=${var.git_sha}", + "NIX_STORE_PATHS=${var.nix_store_paths}", "POSTGRES_MAJOR_VERSION=${var.postgres_major_version}" ] use_env_var_file = true From 5f66a29932bf877fec23ce2883ff70ef95e13655 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?M=C3=A1rton=20Boros?= Date: Tue, 20 Oct 2026 02:51:21 +0300 Subject: [PATCH 5/8] ci(ami): pass nix store paths via vars file Co-Authored-By: Claude Sonnet 5.5 --- .github/actions/build-ami/action.yml | 4 +++- .gitignore | 1 + ebssurrogate/scripts/nix-provision.sh | 2 +- ebssurrogate/scripts/qemu-bootstrap-nix.sh | 2 +- nix/packages/build-qemu-image/build-qemu-image.sh | 2 +- qemu.pkr.hcl | 5 ----- stage2-nix-psql.pkr.hcl | 5 ----- 7 files changed, 7 insertions(+), 14 deletions(-) diff --git a/.github/actions/build-ami/action.yml b/.github/actions/build-ami/action.yml index 3b04ad5882..03b8d24e87 100644 --- a/.github/actions/build-ami/action.yml +++ b/.github/actions/build-ami/action.yml @@ -103,13 +103,15 @@ runs: run: | echo "::group::AMI Build: Stage 2" + nix eval --json "github:supabase/postgres/${{ inputs.packages_git_sha }}#packages.${{ inputs.arch == 'arm64' && 'aarch64' || 'x86_64' }}-linux" --apply 'p: { nix_store_paths = builtins.mapAttrs (_: d: d.outPath) { inherit (p) supascan pgbouncer pg-backrest wal-g-2 wal-g-3; postgres-env = p.postgres-env-${{ inputs.postgres_version }}; }; }' >ansible/nix-store-paths.json + git add -f ansible/nix-store-paths.json + nix run .#build-ami -- stage2 ${{ inputs.arch }} \ -var "ami_name=${{ inputs.ami_name_prefix }}" \ -var "git-head-version=${{ inputs.git_sha }}" \ -var "git_sha=${{ inputs.packages_git_sha }}" \ -var "instance_type=${{ inputs.instance_type }}" \ -var "packer-execution-id=$PACKER_EXECUTION_ID" \ - -var "nix_store_paths=$(nix eval --json "github:supabase/postgres/${{ inputs.packages_git_sha }}#packages.${{ inputs.arch == 'arm64' && 'aarch64' || 'x86_64' }}-linux" --apply 'p: builtins.mapAttrs (_: d: d.outPath) { inherit (p) supascan pgbouncer pg-backrest wal-g-2 wal-g-3; postgres-env = p.postgres-env-${{ inputs.postgres_version }}; }')" \ -var "postgres_major_version=${{ inputs.postgres_version }}" \ stage2-nix-psql.pkr.hcl diff --git a/.gitignore b/.gitignore index 3e2d7c09d2..587f8adb9e 100644 --- a/.gitignore +++ b/.gitignore @@ -24,5 +24,6 @@ venv/ #nix related common-nix.vars.pkr.hcl +ansible/nix-store-paths.json db/schema.sql result* diff --git a/ebssurrogate/scripts/nix-provision.sh b/ebssurrogate/scripts/nix-provision.sh index db4f1d7ae6..174822fb35 100755 --- a/ebssurrogate/scripts/nix-provision.sh +++ b/ebssurrogate/scripts/nix-provision.sh @@ -59,7 +59,7 @@ function execute_stage2_playbook { ansible-playbook /tmp/ansible-playbook/ansible/playbook.yml \ --extra-vars '{"stage2":true, "qemu":false}' \ --extra-vars "git_commit_sha=$GIT_SHA" \ - --extra-vars "{\"nix_store_paths\": $NIX_STORE_PATHS}" \ + --extra-vars @/tmp/ansible-playbook/ansible/nix-store-paths.json \ --extra-vars "psql_version=psql_$POSTGRES_MAJOR_VERSION" \ --extra-vars "postgresql_version=postgresql_$POSTGRES_MAJOR_VERSION" \ --extra-vars "postgresql_major_version=$POSTGRES_MAJOR_VERSION" \ diff --git a/ebssurrogate/scripts/qemu-bootstrap-nix.sh b/ebssurrogate/scripts/qemu-bootstrap-nix.sh index ff3793b0f3..e1ef592884 100755 --- a/ebssurrogate/scripts/qemu-bootstrap-nix.sh +++ b/ebssurrogate/scripts/qemu-bootstrap-nix.sh @@ -155,7 +155,7 @@ function execute_stage2_playbook { ansible-playbook ./ansible/playbook.yml \ --extra-vars '{"stage2": true, "qemu": true}' \ --extra-vars "git_commit_sha=$GIT_SHA" \ - --extra-vars "{\"nix_store_paths\": $NIX_STORE_PATHS}" \ + --extra-vars @./ansible/nix-store-paths.json \ --extra-vars "postgresql_version=postgresql_$POSTGRES_MAJOR_VERSION" \ --extra-vars "postgresql_major_version=$POSTGRES_MAJOR_VERSION" \ --extra-vars "postgresql_major=$POSTGRES_MAJOR_VERSION" \ diff --git a/nix/packages/build-qemu-image/build-qemu-image.sh b/nix/packages/build-qemu-image/build-qemu-image.sh index 2c0fc8b27a..0b294e8fc5 100644 --- a/nix/packages/build-qemu-image/build-qemu-image.sh +++ b/nix/packages/build-qemu-image/build-qemu-image.sh @@ -55,6 +55,7 @@ postgres_version=$(yq -er ".postgres_release.postgres$postgres_major_version" an # Build the cloud-init seed ISO before invoking packer. cloud-localds "$workdir/seeds-cloudimg.iso" user-data-cloudimg meta-data +nix eval --json "github:supabase/postgres/$git_sha#packages.$([ "$arch" = arm64 ] && echo aarch64 || echo x86_64)-linux" --apply 'p: { nix_store_paths = builtins.mapAttrs (_: d: d.outPath) { inherit (p) supascan pgbouncer pg-backrest wal-g-2 wal-g-3; postgres-env = p.postgres-env-'"$postgres_major_version"'; }; }' >ansible/nix-store-paths.json export LC_ALL=C.UTF-8 export TZ=UTC packer init qemu.pkr.hcl @@ -63,7 +64,6 @@ PACKER_LOG=${PACKER_LOG:-1} packer build \ -var "cpu=$cpu" \ -var "git_sha=$git_sha" \ -var "machine=$machine" \ - -var "nix_store_paths=$(nix eval --json "github:supabase/postgres/$git_sha#packages.$([ "$arch" = arm64 ] && echo aarch64 || echo x86_64)-linux" --apply 'p: builtins.mapAttrs (_: d: d.outPath) { inherit (p) supascan pgbouncer pg-backrest wal-g-2 wal-g-3; postgres-env = p.postgres-env-'"$postgres_major_version"'; }')" \ -var "postgres-version=$postgres_version" \ -var "postgres_major_version=$postgres_major_version" \ -var "qemu_binary=$qemu" \ diff --git a/qemu.pkr.hcl b/qemu.pkr.hcl index 05b91073d9..ab854240f0 100644 --- a/qemu.pkr.hcl +++ b/qemu.pkr.hcl @@ -2,10 +2,6 @@ variable "git_sha" { type = string } -variable "nix_store_paths" { - type = string -} - variable "postgres-version" { type = string default = "" @@ -113,7 +109,6 @@ build { provisioner "shell" { environment_vars = [ "GIT_SHA=${var.git_sha}", - "NIX_STORE_PATHS=${var.nix_store_paths}", "POSTGRES_MAJOR_VERSION=${var.postgres_major_version}" ] use_env_var_file = true diff --git a/stage2-nix-psql.pkr.hcl b/stage2-nix-psql.pkr.hcl index 5c1af0df4e..7278ccd2bf 100644 --- a/stage2-nix-psql.pkr.hcl +++ b/stage2-nix-psql.pkr.hcl @@ -27,10 +27,6 @@ variable "git_sha" { default = env("GIT_SHA") } -variable "nix_store_paths" { - type = string -} - variable "postgres_major_version" { type = string default = "" @@ -144,7 +140,6 @@ build { provisioner "shell" { environment_vars = [ "GIT_SHA=${var.git_sha}", - "NIX_STORE_PATHS=${var.nix_store_paths}", "POSTGRES_MAJOR_VERSION=${var.postgres_major_version}" ] use_env_var_file = true From 040357d5c0e156fdbe8f10fe3f69f86c477cd27b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?M=C3=A1rton=20Boros?= Date: Tue, 20 Oct 2026 03:28:26 +0300 Subject: [PATCH 6/8] ci(ami): define stage 2 store paths in the flake Co-Authored-By: Claude Sonnet 5.5 --- .github/actions/build-ami/action.yml | 2 +- .../build-qemu-image/build-qemu-image.sh | 2 +- nix/packages/postgres-env.nix | 22 +++++++++++++++++++ 3 files changed, 24 insertions(+), 2 deletions(-) diff --git a/.github/actions/build-ami/action.yml b/.github/actions/build-ami/action.yml index 03b8d24e87..5d6a105103 100644 --- a/.github/actions/build-ami/action.yml +++ b/.github/actions/build-ami/action.yml @@ -103,7 +103,7 @@ runs: run: | echo "::group::AMI Build: Stage 2" - nix eval --json "github:supabase/postgres/${{ inputs.packages_git_sha }}#packages.${{ inputs.arch == 'arm64' && 'aarch64' || 'x86_64' }}-linux" --apply 'p: { nix_store_paths = builtins.mapAttrs (_: d: d.outPath) { inherit (p) supascan pgbouncer pg-backrest wal-g-2 wal-g-3; postgres-env = p.postgres-env-${{ inputs.postgres_version }}; }; }' >ansible/nix-store-paths.json + nix eval --json "github:supabase/postgres/${{ inputs.packages_git_sha }}#legacyPackages.${{ inputs.arch == 'arm64' && 'aarch64' || 'x86_64' }}-linux.stage2-store-paths-${{ inputs.postgres_version }}" >ansible/nix-store-paths.json git add -f ansible/nix-store-paths.json nix run .#build-ami -- stage2 ${{ inputs.arch }} \ diff --git a/nix/packages/build-qemu-image/build-qemu-image.sh b/nix/packages/build-qemu-image/build-qemu-image.sh index 0b294e8fc5..669c4a9d24 100644 --- a/nix/packages/build-qemu-image/build-qemu-image.sh +++ b/nix/packages/build-qemu-image/build-qemu-image.sh @@ -55,7 +55,7 @@ postgres_version=$(yq -er ".postgres_release.postgres$postgres_major_version" an # Build the cloud-init seed ISO before invoking packer. cloud-localds "$workdir/seeds-cloudimg.iso" user-data-cloudimg meta-data -nix eval --json "github:supabase/postgres/$git_sha#packages.$([ "$arch" = arm64 ] && echo aarch64 || echo x86_64)-linux" --apply 'p: { nix_store_paths = builtins.mapAttrs (_: d: d.outPath) { inherit (p) supascan pgbouncer pg-backrest wal-g-2 wal-g-3; postgres-env = p.postgres-env-'"$postgres_major_version"'; }; }' >ansible/nix-store-paths.json +nix eval --json "github:supabase/postgres/$git_sha#legacyPackages.$([ "$arch" = arm64 ] && echo aarch64 || echo x86_64)-linux.stage2-store-paths-$postgres_major_version" >ansible/nix-store-paths.json export LC_ALL=C.UTF-8 export TZ=UTC packer init qemu.pkr.hcl diff --git a/nix/packages/postgres-env.nix b/nix/packages/postgres-env.nix index 0ae009fff7..8d57c3edb8 100644 --- a/nix/packages/postgres-env.nix +++ b/nix/packages/postgres-env.nix @@ -35,5 +35,27 @@ postgres-env-17 = makePostgresEnv "17"; postgres-env-orioledb-17 = makePostgresEnv "orioledb-17"; }; + + legacyPackages = builtins.listToAttrs ( + map + (version: { + name = "stage2-store-paths-${version}"; + value.nix_store_paths = builtins.mapAttrs (_: drv: drv.outPath) { + inherit (self'.packages) + supascan + pgbouncer + pg-backrest + wal-g-2 + wal-g-3 + ; + postgres-env = self'.packages."postgres-env-${version}"; + }; + }) + [ + "15" + "17" + "orioledb-17" + ] + ); }; } From d24b033b4c8e77b7e5187043c23fec1fdb418dfd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?M=C3=A1rton=20Boros?= Date: Tue, 20 Oct 2026 03:48:54 +0300 Subject: [PATCH 7/8] ci(ami): rename store paths attribute Co-Authored-By: Claude Sonnet 5.5 --- .github/actions/build-ami/action.yml | 2 +- nix/packages/build-qemu-image/build-qemu-image.sh | 2 +- nix/packages/postgres-env.nix | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/actions/build-ami/action.yml b/.github/actions/build-ami/action.yml index 5d6a105103..90c35b4240 100644 --- a/.github/actions/build-ami/action.yml +++ b/.github/actions/build-ami/action.yml @@ -103,7 +103,7 @@ runs: run: | echo "::group::AMI Build: Stage 2" - nix eval --json "github:supabase/postgres/${{ inputs.packages_git_sha }}#legacyPackages.${{ inputs.arch == 'arm64' && 'aarch64' || 'x86_64' }}-linux.stage2-store-paths-${{ inputs.postgres_version }}" >ansible/nix-store-paths.json + nix eval --json "github:supabase/postgres/${{ inputs.packages_git_sha }}#legacyPackages.${{ inputs.arch == 'arm64' && 'aarch64' || 'x86_64' }}-linux.nix-store-paths-${{ inputs.postgres_version }}" >ansible/nix-store-paths.json git add -f ansible/nix-store-paths.json nix run .#build-ami -- stage2 ${{ inputs.arch }} \ diff --git a/nix/packages/build-qemu-image/build-qemu-image.sh b/nix/packages/build-qemu-image/build-qemu-image.sh index 669c4a9d24..8d924a231c 100644 --- a/nix/packages/build-qemu-image/build-qemu-image.sh +++ b/nix/packages/build-qemu-image/build-qemu-image.sh @@ -55,7 +55,7 @@ postgres_version=$(yq -er ".postgres_release.postgres$postgres_major_version" an # Build the cloud-init seed ISO before invoking packer. cloud-localds "$workdir/seeds-cloudimg.iso" user-data-cloudimg meta-data -nix eval --json "github:supabase/postgres/$git_sha#legacyPackages.$([ "$arch" = arm64 ] && echo aarch64 || echo x86_64)-linux.stage2-store-paths-$postgres_major_version" >ansible/nix-store-paths.json +nix eval --json "github:supabase/postgres/$git_sha#legacyPackages.$([ "$arch" = arm64 ] && echo aarch64 || echo x86_64)-linux.nix-store-paths-$postgres_major_version" >ansible/nix-store-paths.json export LC_ALL=C.UTF-8 export TZ=UTC packer init qemu.pkr.hcl diff --git a/nix/packages/postgres-env.nix b/nix/packages/postgres-env.nix index 8d57c3edb8..9f8167d361 100644 --- a/nix/packages/postgres-env.nix +++ b/nix/packages/postgres-env.nix @@ -39,7 +39,7 @@ legacyPackages = builtins.listToAttrs ( map (version: { - name = "stage2-store-paths-${version}"; + name = "nix-store-paths-${version}"; value.nix_store_paths = builtins.mapAttrs (_: drv: drv.outPath) { inherit (self'.packages) supascan From 92a898a62a4aa4e4bfa3ab760716483036395563 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?M=C3=A1rton=20Boros?= Date: Wed, 21 Oct 2026 01:27:32 +0300 Subject: [PATCH 8/8] ci(ami): pass nix store paths via PKR_VAR env Co-Authored-By: Claude Sonnet 5.5 --- .github/actions/build-ami/action.yml | 4 ++-- .gitignore | 1 - nix/packages/build-qemu-image/build-qemu-image.sh | 3 ++- nix/packages/postgres-env.nix | 2 +- qemu.pkr.hcl | 9 +++++++++ stage2-nix-psql.pkr.hcl | 9 +++++++++ 6 files changed, 23 insertions(+), 5 deletions(-) diff --git a/.github/actions/build-ami/action.yml b/.github/actions/build-ami/action.yml index 90c35b4240..ef2d4c7a94 100644 --- a/.github/actions/build-ami/action.yml +++ b/.github/actions/build-ami/action.yml @@ -103,8 +103,8 @@ runs: run: | echo "::group::AMI Build: Stage 2" - nix eval --json "github:supabase/postgres/${{ inputs.packages_git_sha }}#legacyPackages.${{ inputs.arch == 'arm64' && 'aarch64' || 'x86_64' }}-linux.nix-store-paths-${{ inputs.postgres_version }}" >ansible/nix-store-paths.json - git add -f ansible/nix-store-paths.json + PKR_VAR_nix_store_paths=$(nix eval --json "github:supabase/postgres/${{ inputs.packages_git_sha }}#legacyPackages.${{ inputs.arch == 'arm64' && 'aarch64' || 'x86_64' }}-linux.nix-store-paths-${{ inputs.postgres_version }}") + export PKR_VAR_nix_store_paths nix run .#build-ami -- stage2 ${{ inputs.arch }} \ -var "ami_name=${{ inputs.ami_name_prefix }}" \ diff --git a/.gitignore b/.gitignore index 587f8adb9e..3e2d7c09d2 100644 --- a/.gitignore +++ b/.gitignore @@ -24,6 +24,5 @@ venv/ #nix related common-nix.vars.pkr.hcl -ansible/nix-store-paths.json db/schema.sql result* diff --git a/nix/packages/build-qemu-image/build-qemu-image.sh b/nix/packages/build-qemu-image/build-qemu-image.sh index 8d924a231c..cbce236fff 100644 --- a/nix/packages/build-qemu-image/build-qemu-image.sh +++ b/nix/packages/build-qemu-image/build-qemu-image.sh @@ -55,7 +55,8 @@ postgres_version=$(yq -er ".postgres_release.postgres$postgres_major_version" an # Build the cloud-init seed ISO before invoking packer. cloud-localds "$workdir/seeds-cloudimg.iso" user-data-cloudimg meta-data -nix eval --json "github:supabase/postgres/$git_sha#legacyPackages.$([ "$arch" = arm64 ] && echo aarch64 || echo x86_64)-linux.nix-store-paths-$postgres_major_version" >ansible/nix-store-paths.json +PKR_VAR_nix_store_paths=$(nix eval --json "github:supabase/postgres/$git_sha#legacyPackages.$([ "$arch" = arm64 ] && echo aarch64 || echo x86_64)-linux.nix-store-paths-$postgres_major_version") +export PKR_VAR_nix_store_paths export LC_ALL=C.UTF-8 export TZ=UTC packer init qemu.pkr.hcl diff --git a/nix/packages/postgres-env.nix b/nix/packages/postgres-env.nix index 9f8167d361..47cf7c7f71 100644 --- a/nix/packages/postgres-env.nix +++ b/nix/packages/postgres-env.nix @@ -40,7 +40,7 @@ map (version: { name = "nix-store-paths-${version}"; - value.nix_store_paths = builtins.mapAttrs (_: drv: drv.outPath) { + value = builtins.mapAttrs (_: drv: drv.outPath) { inherit (self'.packages) supascan pgbouncer diff --git a/qemu.pkr.hcl b/qemu.pkr.hcl index ab854240f0..f94713769d 100644 --- a/qemu.pkr.hcl +++ b/qemu.pkr.hcl @@ -2,6 +2,10 @@ variable "git_sha" { type = string } +variable "nix_store_paths" { + type = map(string) +} + variable "postgres-version" { type = string default = "" @@ -91,6 +95,11 @@ build { destination = "/tmp/ansible-playbook" } + provisioner "file" { + content = jsonencode({ nix_store_paths = var.nix_store_paths }) + destination = "/tmp/ansible-playbook/ansible/nix-store-paths.json" + } + provisioner "file" { source = "audit-specs" destination = "/tmp/ansible-playbook" diff --git a/stage2-nix-psql.pkr.hcl b/stage2-nix-psql.pkr.hcl index 7278ccd2bf..d2fef93ac0 100644 --- a/stage2-nix-psql.pkr.hcl +++ b/stage2-nix-psql.pkr.hcl @@ -27,6 +27,10 @@ variable "git_sha" { default = env("GIT_SHA") } +variable "nix_store_paths" { + type = map(string) +} + variable "postgres_major_version" { type = string default = "" @@ -127,6 +131,11 @@ build { destination = "/tmp/ansible-playbook" } + provisioner "file" { + content = jsonencode({ nix_store_paths = var.nix_store_paths }) + destination = "/tmp/ansible-playbook/ansible/nix-store-paths.json" + } + provisioner "file" { source = "migrations" destination = "/tmp"