From d886f9e3a1af8d54d5a76eb27178e0c27f181957 Mon Sep 17 00:00:00 2001 From: Manuel Mendez Date: Mon, 24 Aug 2026 12:33:41 -0400 Subject: [PATCH 1/3] ansible: Drop nix GC at end of playbook We are doing GC and store optimise outside of ansible at the end of nix-provision.sh and qemu-bootstrap-nix.sh so no need to do it here. --- ansible/playbook.yml | 6 ------ 1 file changed, 6 deletions(-) diff --git a/ansible/playbook.yml b/ansible/playbook.yml index 5202fe987..63546447d 100644 --- a/ansible/playbook.yml +++ b/ansible/playbook.yml @@ -207,12 +207,6 @@ shell: | sudo -u ubuntu bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile remove supascan" - - name: nix collect garbage - when: stage2 - become: yes - shell: | - sudo -u ubuntu bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix-collect-garbage -d" - - name: Setup Swap when: stage2 and not qemu become: yes From 953de4322fb3b26e5640c1a82b56e618a0560590 Mon Sep 17 00:00:00 2001 From: Manuel Mendez Date: Mon, 24 Aug 2026 12:33:41 -0400 Subject: [PATCH 2/3] ansible: Use nix shell to run supascan instead of installing/removing One task/command is easier to follow/understand than 3 over 2 files. --- ansible/files/supascan_ami.sh | 0 ansible/playbook.yml | 13 +++++-------- ansible/tasks/stage2-setup-postgres.yml | 8 -------- 3 files changed, 5 insertions(+), 16 deletions(-) mode change 100644 => 100755 ansible/files/supascan_ami.sh diff --git a/ansible/files/supascan_ami.sh b/ansible/files/supascan_ami.sh old mode 100644 new mode 100755 diff --git a/ansible/playbook.yml b/ansible/playbook.yml index 63546447d..2caf24811 100644 --- a/ansible/playbook.yml +++ b/ansible/playbook.yml @@ -198,14 +198,11 @@ - name: Run supascan baseline validation when: stage2 and not qemu and ansible_architecture != "x86_64" become: yes - shell: | - /bin/bash /tmp/ansible-playbook/ansible/files/supascan_ami.sh /tmp/ansible-playbook/audit-specs/baselines/ami-build - - - name: Remove supascan after validation - when: stage2 - become: yes - shell: | - sudo -u ubuntu bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile remove supascan" + shell: >- + nix shell github:supabase/postgres/{{ git_commit_sha }}#supascan --command + bash + /tmp/ansible-playbook/ansible/files/supascan_ami.sh + /tmp/ansible-playbook/audit-specs/baselines/ami-build - name: Setup Swap when: stage2 and not qemu diff --git a/ansible/tasks/stage2-setup-postgres.yml b/ansible/tasks/stage2-setup-postgres.yml index d4823238a..d9819ca48 100644 --- a/ansible/tasks/stage2-setup-postgres.yml +++ b/ansible/tasks/stage2-setup-postgres.yml @@ -77,14 +77,6 @@ nix-env --set {{ postgres_env_path.stdout }} " - - name: Install supascan for baseline validation - ansible.builtin.shell: | - sudo -u ubuntu bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install github:supabase/postgres/{{ git_commit_sha }}#supascan" - - - name: nix collect garbage after supascan install - ansible.builtin.shell: - cmd: sudo -u ubuntu bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix-collect-garbage -d" - - name: Set ownership and permissions for file and dirs ansible.builtin.file: group: 'postgres' From cdc28b0141b7e31b8c643cb3a82b76e62ef587a3 Mon Sep 17 00:00:00 2001 From: Manuel Mendez Date: Mon, 24 Aug 2026 12:33:41 -0400 Subject: [PATCH 3/3] ansible: Simplify stage2 postgres install/setup Don't need sudo -u postgres just to get the paths and no need to source nix-daemon.sh explicitly. --- ansible/tasks/stage2-setup-postgres.yml | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/ansible/tasks/stage2-setup-postgres.yml b/ansible/tasks/stage2-setup-postgres.yml index d9819ca48..5e9eaedbb 100644 --- a/ansible/tasks/stage2-setup-postgres.yml +++ b/ansible/tasks/stage2-setup-postgres.yml @@ -62,20 +62,17 @@ when: stage2 become: true block: - - name: Resolve postgres env store path + - name: Resolve postgres env from nix binary cache ansible.builtin.shell: | - sudo -u postgres bash -c " - . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && - nix build --no-link --print-out-paths github:supabase/postgres/{{ git_commit_sha }}#postgres-env-{{ postgresql_major_version }} - " + nix build --no-link --print-out-paths github:supabase/postgres/{{ git_commit_sha }}#postgres-env-{{ postgresql_major_version }} register: postgres_env_path - name: Install postgres env from nix binary cache ansible.builtin.shell: | - sudo -u postgres bash -c " + sudo -u postgres bash -c ' . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix-env --set {{ postgres_env_path.stdout }} - " + ' - name: Set ownership and permissions for file and dirs ansible.builtin.file: