Better nix in ansible (#2394)

* ansible: Drop nix GCs

We are doing GC and store optimise outside of ansible at the end of
nix-provision.sh and qemu-bootstrap-nix.sh so no need to do them here.

* ansible: Use nix shell to run supascan instead of installing/removing

One task/command is easier to follow/understand than 3 over 2 files.

Author: mmlb

ansible/files/supascan_ami.sh

@@ -195,22 +195,11 @@
 
     - name: Run supascan baseline validation
       when: stage2
-      become: yes
-      shell: |
+      shell: >-
         baseline={{ 'ami' if not qemu else 'qemu' }}-build-{{ platform }}
-        /bin/bash /tmp/ansible-playbook/ansible/files/supascan_ami.sh /tmp/ansible-playbook/audit-specs/baselines/$baseline
-
-    - name: Remove supascan after validation
-      when: stage2
-      become: yes
-      shell: |
-        sudo -u ubuntu bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile remove supascan"
-
-    - name: nix collect garbage
-      when: stage2
-      become: yes
-      shell: |
-        sudo -u ubuntu bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix-collect-garbage -d"
+        nix shell github:supabase/postgres/{{ git_commit_sha }}#supascan --command
+        /tmp/ansible-playbook/ansible/files/supascan_ami.sh
+        /tmp/ansible-playbook/audit-specs/baselines/$baseline
 
     - name: Setup Swap
       when: stage2 and not qemu

ansible/playbook.yml

@@ -47,11 +47,6 @@
       become: true
       become_user: wal-g
 
-    - name: nix collect garbage
-      ansible.builtin.shell:
-        cmd: sudo -u ubuntu bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix-collect-garbage -d"
-      become: true
-
     - name: Create symlink to make wal-g the default (v3 on orioledb builds, v2 otherwise)
       ansible.builtin.file:
         dest: '/usr/local/bin/wal-g'

ansible/tasks/setup-wal-g.yml

@@ -77,14 +77,6 @@
           nix-env --set {{ postgres_env_path.stdout }}
         "
 
-    - name: Install supascan for baseline validation
-      ansible.builtin.shell: |
-        sudo -u ubuntu bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install github:supabase/postgres/{{ git_commit_sha }}#supascan"
-
-    - name: nix collect garbage after supascan install
-      ansible.builtin.shell:
-        cmd: sudo -u ubuntu bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix-collect-garbage -d"
-
     - name: Set ownership and permissions for file and dirs
       ansible.builtin.file:
         group: 'postgres'