ci(ami): pass nix store paths to packer via var

.github/actions/build-ami/action.yml

@@ -103,14 +103,13 @@ runs:
       run: |
         echo "::group::AMI Build: Stage 2"
 
-        system=$([[ ${{ inputs.arch }} == arm64 ]] && echo aarch64-linux || echo x86_64-linux)
-        site_env_path=$(nix eval --raw "github:supabase/postgres/${{ inputs.packages_git_sha }}#packages.$system.site-env-${{ inputs.postgres_version }}.outPath")
+        PKR_VAR_nix_store_paths=$(nix eval --json "github:supabase/postgres/${{ inputs.packages_git_sha }}#legacyPackages.${{ inputs.arch == 'arm64' && 'aarch64' || 'x86_64' }}-linux.nix-store-paths-${{ inputs.postgres_version }}")
+        export PKR_VAR_nix_store_paths
 
         nix run .#build-ami -- stage2 ${{ inputs.arch }} \
           -var "ami_name=${{ inputs.ami_name_prefix }}" \
           -var "git-head-version=${{ inputs.git_sha }}" \
           -var "git_sha=${{ inputs.packages_git_sha }}" \
-          -var "site_env_path=$site_env_path" \
           -var "instance_type=${{ inputs.instance_type }}" \
           -var "packer-execution-id=$PACKER_EXECUTION_ID" \
           -var "postgres_major_version=${{ inputs.postgres_version }}" \

ansible/playbook.yml

@@ -187,7 +187,7 @@
       when: stage2
       shell: >-
         baseline={{ 'ami' if not qemu else 'qemu' }}-build-{{ platform }}
-        nix shell github:supabase/postgres/{{ git_commit_sha }}#supascan --command
+        nix shell {{ nix_store_paths['supascan'] }} --command
         /tmp/ansible-playbook/ansible/files/supascan_ami.sh
         /tmp/ansible-playbook/audit-specs/baselines/$baseline
 

ansible/tasks/setup-pgbackrest.yml

@@ -122,7 +122,7 @@
 - name: Install pgBackRest
   when: stage2
   ansible.builtin.shell: |
-    sudo -u pgbackrest bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install github:supabase/postgres/{{ git_commit_sha }}#pg-backrest"
+    sudo -u pgbackrest bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install {{ nix_store_paths['pg-backrest'] }}"
   become: true
   become_user: pgbackrest
   changed_when: true

ansible/tasks/setup-pgbouncer.yml

@@ -18,7 +18,7 @@
 - name: Install PgBouncer from nix binary cache
   when: stage2
   ansible.builtin.shell:
-    cmd: sudo -u pgbouncer bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install github:supabase/postgres/{{ git_commit_sha }}#pgbouncer"
+    cmd: sudo -u pgbouncer bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install {{ nix_store_paths['pgbouncer'] }}"
   become: true
 
 - name: Link PgBouncer into /usr/local/bin

ansible/tasks/setup-wal-g.yml

@@ -36,14 +36,14 @@
   block:
     - name: Install wal-g 2 from nix binary cache
       ansible.builtin.shell:
-        cmd: sudo -u wal-g bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install github:supabase/postgres/{{ git_commit_sha }}#wal-g-2"
+        cmd: sudo -u wal-g bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install {{ nix_store_paths['wal-g-2'] }}"
       become: true
 
     # Installed alongside v2 (INDATA-904). The /usr/local/bin/wal-g symlink below
     # only points at v3 on orioledb builds; v2 remains the default everywhere else.
     - name: Install wal-g 3 from nix binary cache
       ansible.builtin.shell:
-        cmd: . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install github:supabase/postgres/{{ git_commit_sha }}#wal-g-3
+        cmd: . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install {{ nix_store_paths['wal-g-3'] }}
       become: true
       become_user: wal-g
 

ansible/tasks/stage2-setup-postgres.yml

@@ -56,25 +56,17 @@
   when: stage2
   become: true
   block:
-    - name: Resolve postgres env store path
-      ansible.builtin.shell: |
-        sudo -u postgres bash -c "
-          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh &&
-          nix build --no-link --print-out-paths github:supabase/postgres/{{ git_commit_sha }}#postgres-env-{{ postgresql_major_version }}
-        "
-      register: postgres_env_path
-
     - name: Install postgres env from nix binary cache
       ansible.builtin.shell: |
         sudo -u postgres bash -c "
           . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh &&
-          nix-env --set {{ postgres_env_path.stdout }}
+          nix-env --quiet --set {{ nix_store_paths['postgres-env'] }}
         "
 
     - name: Install and activate site env from nix binary cache
       ansible.builtin.shell: |
         . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh &&
-        nix-env --profile /nix/var/nix/profiles/site --set {{ site_env_path }} &&
+        nix-env --profile /nix/var/nix/profiles/site --set {{ nix_store_paths['site-env'] }} &&
         /nix/var/nix/profiles/site/bin/activate
 
     - name: Set ownership and permissions for file and dirs

ebssurrogate/scripts/nix-provision.sh

@@ -59,7 +59,7 @@ function execute_stage2_playbook {
 	ansible-playbook /tmp/ansible-playbook/ansible/playbook.yml \
 		--extra-vars '{"stage2":true, "qemu":false}' \
 		--extra-vars "git_commit_sha=$GIT_SHA" \
-		--extra-vars "site_env_path=$SITE_ENV_PATH" \
+		--extra-vars @/tmp/ansible-playbook/ansible/nix-store-paths.json \
 		--extra-vars "psql_version=psql_$POSTGRES_MAJOR_VERSION" \
 		--extra-vars "postgresql_version=postgresql_$POSTGRES_MAJOR_VERSION" \
 		--extra-vars "postgresql_major_version=$POSTGRES_MAJOR_VERSION" \

ebssurrogate/scripts/qemu-bootstrap-nix.sh

@@ -155,7 +155,7 @@ function execute_stage2_playbook {
 	ansible-playbook ./ansible/playbook.yml \
 		--extra-vars '{"stage2": true, "qemu": true}' \
 		--extra-vars "git_commit_sha=$GIT_SHA" \
-		--extra-vars "site_env_path=$SITE_ENV_PATH" \
+		--extra-vars @./ansible/nix-store-paths.json \
 		--extra-vars "postgresql_version=postgresql_$POSTGRES_MAJOR_VERSION" \
 		--extra-vars "postgresql_major_version=$POSTGRES_MAJOR_VERSION" \
 		--extra-vars "postgresql_major=$POSTGRES_MAJOR_VERSION" \

nix/packages/build-qemu-image/build-qemu-image.sh

@@ -51,12 +51,13 @@ install --mode 644 "$vars" "$workdir/ovmf_vars.fd" # qemu writes to the vars pfl
 
 git_sha=${GIT_SHA:-$(git rev-parse HEAD)}
 system=$([[ $arch == arm64 ]] && echo aarch64-linux || echo x86_64-linux)
-site_env_path=$(nix eval --raw "github:supabase/postgres/$git_sha#packages.$system.site-env-$postgres_major_version.outPath")
 postgres_version=$(yq -er ".postgres_release.postgres$postgres_major_version" ansible/postgres_release.yml)
 
 # Build the cloud-init seed ISO before invoking packer.
 cloud-localds "$workdir/seeds-cloudimg.iso" user-data-cloudimg meta-data
 
+PKR_VAR_nix_store_paths=$(nix eval --json "github:supabase/postgres/$git_sha#legacyPackages.$system.nix-store-paths-$postgres_major_version")
+export PKR_VAR_nix_store_paths
 export LC_ALL=C.UTF-8
 export TZ=UTC
 packer init qemu.pkr.hcl
@@ -66,7 +67,6 @@ PACKER_LOG=${PACKER_LOG:-1} packer build \
 	-var "git_sha=$git_sha" \
 	-var "machine=$machine" \
 	-var "postgres-version=$postgres_version" \
-	-var "site_env_path=$site_env_path" \
 	-var "postgres_major_version=$postgres_major_version" \
 	-var "qemu_binary=$qemu" \
 	-var "workdir=$workdir" \

nix/packages/postgres-env.nix

@@ -35,5 +35,28 @@
         postgres-env-17 = makePostgresEnv "17";
         postgres-env-orioledb-17 = makePostgresEnv "orioledb-17";
       };
+
+      legacyPackages = builtins.listToAttrs (
+        map
+          (version: {
+            name = "nix-store-paths-${version}";
+            value = builtins.mapAttrs (_: drv: drv.outPath) {
+              inherit (self'.packages)
+                supascan
+                pgbouncer
+                pg-backrest
+                wal-g-2
+                wal-g-3
+                ;
+              postgres-env = self'.packages."postgres-env-${version}";
+              site-env = self'.packages."site-env-${version}";
+            };
+          })
+          [
+            "15"
+            "17"
+            "orioledb-17"
+          ]
+      );
     };
 }

qemu.pkr.hcl

@@ -2,8 +2,8 @@ variable "git_sha" {
   type = string
 }
 
-variable "site_env_path" {
-  type = string
+variable "nix_store_paths" {
+  type = map(string)
 }
 
 variable "postgres-version" {
@@ -95,6 +95,11 @@ build {
     destination = "/tmp/ansible-playbook"
   }
 
+  provisioner "file" {
+    content     = jsonencode({ nix_store_paths = var.nix_store_paths })
+    destination = "/tmp/ansible-playbook/ansible/nix-store-paths.json"
+  }
+
   provisioner "file" {
     source      = "audit-specs"
     destination = "/tmp/ansible-playbook"
@@ -113,7 +118,6 @@ build {
   provisioner "shell" {
     environment_vars = [
       "GIT_SHA=${var.git_sha}",
-      "SITE_ENV_PATH=${var.site_env_path}",
       "POSTGRES_MAJOR_VERSION=${var.postgres_major_version}"
     ]
     use_env_var_file    = true

stage2-nix-psql.pkr.hcl

@@ -27,8 +27,8 @@ variable "git_sha" {
   default = env("GIT_SHA")
 }
 
-variable "site_env_path" {
-  type = string
+variable "nix_store_paths" {
+  type = map(string)
 }
 
 variable "postgres_major_version" {
@@ -131,6 +131,11 @@ build {
     destination = "/tmp/ansible-playbook"
   }
 
+  provisioner "file" {
+    content     = jsonencode({ nix_store_paths = var.nix_store_paths })
+    destination = "/tmp/ansible-playbook/ansible/nix-store-paths.json"
+  }
+
   provisioner "file" {
     source      = "migrations"
     destination = "/tmp"
@@ -144,7 +149,6 @@ build {
   provisioner "shell" {
     environment_vars = [
       "GIT_SHA=${var.git_sha}",
-      "SITE_ENV_PATH=${var.site_env_path}",
       "POSTGRES_MAJOR_VERSION=${var.postgres_major_version}"
     ]
     use_env_var_file = true