Skip to content

Commit e02e291

Browse files
mmlbmmlb
authored
Tighten up when AMI Release Nix runs (#2543)
* nix: drop build-test-ami Not really used much since AMI builds and tests mostly happen in CI. That being the case I don't really want to have to update it in these commits. build-test-ami will return in a future PR in a better form. * packer: drop redundant ansible/vars.yml file provisioner The whole ansible/ directory is already copied to /tmp/ansible-playbook and the playbook is run from /tmp/ansible-playbook/ansible/playbook.yml, which resolves ./vars.yml inside that copy. The standalone copy at /tmp/ansible-playbook/vars.yml is never read. Assisted-by: Claude Opus 5.5 <noreply@anthropic.com> * ci: Simplify reading vars.yml in publish-nix-pgupgrade-* workflows This was already a little convoluted and will only get more so in the following commits but it doesn't have to be that way with a little git and shell (low tier) magic. * ansible: split postgres_release into ansible/postgres_release.yml Split the postgres_release map out of ansible/vars.yml into its own file and load it in the playbook via vars_files. This way we can update ami-release-nix to match reality, it should only run when the version has been updated, otherwise we'll have a ami name conflict and it'll fail. Assisted-by: Claude Opus 5.5 <noreply@anthropic.com> * Simplify yq extraction of postgres_release Just because the yaml has `""` doesn't mean we need them in the yq filter, its smart enough to handle text w/o `"`. While here also drop the `[]` since `.` is effectively the same and is shorter because doesn't need ] pair. This cleans up bunch of " escaping or '"''"' junk. While working in these files, lets be defensive and add -e so yq errors out instead of giving us null/""/other garbage when we have wrong keys/missing values. * ci/ami-release-nix: Invoke only when postgres_release.yml is updated This workflow should only be run when the postgres_release.yml file is updated because if there's a change to one of the other files and not postgres_release.yml then the AMI build will fail anyway due to AMI name conflicts.
1 parent 6249549 commit e02e291

22 files changed

Lines changed: 118 additions & 259 deletions

‎.github/actions/build-ami/action.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -63,9 +63,8 @@ runs:
6363
id: generate-vars
6464
shell: bash
6565
run: |
66-
PG_VERSION=$(nix run nixpkgs#yq-go -- -r '.postgres_release["postgres${{ inputs.postgres_version }}"]' ansible/vars.yml)
67-
echo 'postgres-version = "'$PG_VERSION'"' > common-nix.vars.pkr.hcl
68-
echo "" >> common-nix.vars.pkr.hcl
66+
PG_VERSION=$(nix run nixpkgs#yq-go -- -er '.postgres_release.postgres${{ inputs.postgres_version }}' ansible/postgres_release.yml)
67+
printf 'postgres-version = "%s"\n' "$PG_VERSION" >common-nix.vars.pkr.hcl
6968
git add -f common-nix.vars.pkr.hcl
7069
echo "version=$PG_VERSION" >> $GITHUB_OUTPUT
7170

‎.github/workflows/ami-release-nix.yml‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,7 @@ on:
66
- develop
77
- release/*
88
paths:
9-
- .github/workflows/ami-release-nix.yml
10-
- ansible/vars.yml
11-
- flake.lock
12-
- flake.nix
13-
- nix/packages/build-ami.nix
9+
- ansible/postgres_release.yml
1410
workflow_dispatch:
1511

1612
permissions:

‎.github/workflows/dockerhub-release-matrix.yml‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,9 @@ on:
66
- develop
77
- release/*
88
paths:
9-
- ".github/workflows/dockerhub-release-matrix.yml"
10-
- "ansible/vars.yml"
9+
- .github/workflows/dockerhub-release-matrix.yml
10+
- ansible/postgres_release.yml
11+
- ansible/vars.yml
1112
workflow_dispatch:
1213

1314
permissions:
@@ -122,7 +123,7 @@ jobs:
122123
} else {
123124
$"postgres($base_version)"
124125
}
125-
let base_tag = (open ansible/vars.yml | get postgres_release | get $release_key | str trim)
126+
let base_tag = (open ansible/postgres_release.yml | get postgres_release | get $release_key | str trim)
126127
if $is_multigres { $"($base_tag)-multigres" } else { $base_tag }
127128
')
128129
echo "pg_version=supabase/postgres:$pg_version" >> $GITHUB_OUTPUT
@@ -136,7 +137,7 @@ jobs:
136137
} else {
137138
$"postgres($base_version)"
138139
}
139-
let base_tag = (open ansible/vars.yml | get postgres_release | get $release_key | str trim)
140+
let base_tag = (open ansible/postgres_release.yml | get postgres_release | get $release_key | str trim)
140141
if $is_multigres { $"($base_tag)-multigres" } else { $base_tag }
141142
')
142143
echo "pg_version=supabase/postgres:$pg_version" >> $GITHUB_OUTPUT
@@ -180,7 +181,7 @@ jobs:
180181
} else {
181182
$"postgres($base_version)"
182183
}
183-
let base_tag = (open ansible/vars.yml | get postgres_release | get $release_key | str trim)
184+
let base_tag = (open ansible/postgres_release.yml | get postgres_release | get $release_key | str trim)
184185
let pg_version = if $is_multigres { $"($base_tag)-multigres" } else { $base_tag }
185186
$"pg_version=supabase/postgres:($pg_version)" | save --append $env.GITHUB_OUTPUT
186187
'

‎.github/workflows/manual-docker-release.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -119,7 +119,7 @@ jobs:
119119
} else {
120120
$"postgres($base_version)"
121121
}
122-
let base_tag = (open ansible/vars.yml | get postgres_release | get $release_key | str trim)
122+
let base_tag = (open ansible/postgres_release.yml | get postgres_release | get $release_key | str trim)
123123
let final_version = if "${{ inputs.postgresVersion }}" != "" {
124124
"${{ inputs.postgresVersion }}"
125125
} else {
@@ -138,7 +138,7 @@ jobs:
138138
} else {
139139
$"postgres($base_version)"
140140
}
141-
let base_tag = (open ansible/vars.yml | get postgres_release | get $release_key | str trim)
141+
let base_tag = (open ansible/postgres_release.yml | get postgres_release | get $release_key | str trim)
142142
let final_version = if "${{ inputs.postgresVersion }}" != "" {
143143
"${{ inputs.postgresVersion }}"
144144
} else {
@@ -187,7 +187,7 @@ jobs:
187187
} else {
188188
$"postgres($base_version)"
189189
}
190-
let base_tag = (open ansible/vars.yml | get postgres_release | get $release_key | str trim)
190+
let base_tag = (open ansible/postgres_release.yml | get postgres_release | get $release_key | str trim)
191191
let pg_version = if $is_multigres { $"($base_tag)-multigres" } else { $base_tag }
192192
$"pg_version=supabase/postgres:($pg_version)" | save --append $env.GITHUB_OUTPUT
193193
'

‎.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml‎

Lines changed: 32 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -24,18 +24,14 @@ jobs:
2424
- name: Set PostgreSQL versions
2525
id: set-versions
2626
env:
27-
POSTGRES_VERSION: ${{ inputs.postgresVersion }}
27+
rev: ${{ inputs.postgresVersion || 'HEAD' }}
2828
run: |
29-
set -eo pipefail
30-
if [[ -n "$POSTGRES_VERSION" ]]; then
31-
git rev-parse --verify "$POSTGRES_VERSION" || {
32-
echo "Error: git tag '$POSTGRES_VERSION' not found"
33-
exit 1
34-
}
35-
VERSIONS=$(git show "$POSTGRES_VERSION:ansible/vars.yml" | nix run nixpkgs#yq-go -- -o=json -I=0 '.postgres_major')
36-
else
37-
VERSIONS=$(nix run nixpkgs#yq-go -- -o=json -I=0 '.postgres_major' ansible/vars.yml)
29+
set -euo pipefail
30+
if ! git rev-parse --verify "$rev"; then
31+
echo "Error: git revision '$rev' not found"
32+
exit 1
3833
fi
34+
VERSIONS=$(git show "$rev:ansible/vars.yml" | nix run nixpkgs#yq-go -- -e -o=json -I=0 '.postgres_major')
3935
echo "postgres_versions=$VERSIONS" >> $GITHUB_OUTPUT
4036
4137
publish-staging:
@@ -54,14 +50,21 @@ jobs:
5450
- name: Grab release version
5551
id: process_release_version
5652
env:
57-
POSTGRES_VERSION: ${{ inputs.postgresVersion }}
53+
rev: ${{ inputs.postgresVersion || 'HEAD' }}
5854
run: |
59-
set -eo pipefail
60-
if [[ -n "$POSTGRES_VERSION" ]]; then
61-
VERSION=$(git show "$POSTGRES_VERSION:ansible/vars.yml" | nix run nixpkgs#yq-go -- -r '.postgres_release["postgres'${{ matrix.postgres_version }}'"]')
62-
else
63-
VERSION=$(nix run nixpkgs#yq-go -- -r '.postgres_release["postgres'${{ matrix.postgres_version }}'"]' ansible/vars.yml)
55+
set -euo pipefail
56+
if ! git rev-parse --verify "$rev"; then
57+
echo "Error: git revision '$rev' not found"
58+
exit 1
6459
fi
60+
61+
# check if pg versions are in new file location or old
62+
file=ansible/postgres_release.yml
63+
if ! git cat-file -e "$rev:$file" 2>/dev/null; then
64+
file=ansible/vars.yml
65+
fi
66+
67+
VERSION=$(git show "$rev:$file" | nix run nixpkgs#yq-go -- -er '.postgres_release.postgres${{ matrix.postgres_version }}')
6568
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
6669
echo "major_version=$(echo $VERSION | cut -d'.' -f1)" >> "$GITHUB_OUTPUT"
6770
@@ -111,14 +114,21 @@ jobs:
111114
- name: Grab release version
112115
id: process_release_version
113116
env:
114-
POSTGRES_VERSION: ${{ inputs.postgresVersion }}
117+
rev: ${{ inputs.postgresVersion || 'HEAD' }}
115118
run: |
116-
set -eo pipefail
117-
if [[ -n "$POSTGRES_VERSION" ]]; then
118-
VERSION=$(git show "$POSTGRES_VERSION:ansible/vars.yml" | nix run nixpkgs#yq-go -- -r '.postgres_release["postgres'${{ matrix.postgres_version }}'"]')
119-
else
120-
VERSION=$(nix run nixpkgs#yq-go -- -r '.postgres_release["postgres'${{ matrix.postgres_version }}'"]' ansible/vars.yml)
119+
set -euo pipefail
120+
if ! git rev-parse --verify "$rev"; then
121+
echo "Error: git revision '$rev' not found"
122+
exit 1
121123
fi
124+
125+
# check if pg versions are in new file location or old
126+
file=ansible/postgres_release.yml
127+
if ! git cat-file -e "$rev:$file" 2>/dev/null; then
128+
file=ansible/vars.yml
129+
fi
130+
131+
VERSION=$(git show "$rev:$file" | nix run nixpkgs#yq-go -- -er '.postgres_release.postgres${{ matrix.postgres_version }}')
122132
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
123133
echo "major_version=$(echo $VERSION | cut -d'.' -f1)" >> "$GITHUB_OUTPUT"
124134

‎.github/workflows/publish-nix-pgupgrade-scripts.yml‎

Lines changed: 40 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,10 @@ on:
66
- develop
77
- release/*
88
paths:
9-
- '.github/workflows/publish-nix-pgupgrade-scripts.yml'
10-
- 'ansible/vars.yml'
11-
- 'ansible/files/admin_api_scripts/pg_upgrade_scripts/**'
9+
- .github/workflows/publish-nix-pgupgrade-scripts.yml
10+
- ansible/files/admin_api_scripts/pg_upgrade_scripts/**
11+
- ansible/postgres_release.yml
12+
- ansible/vars.yml
1213
workflow_dispatch:
1314
inputs:
1415
postgresVersion:
@@ -30,18 +31,14 @@ jobs:
3031
- name: Set PostgreSQL versions
3132
id: set-versions
3233
env:
33-
POSTGRES_VERSION: ${{ inputs.postgresVersion }}
34+
rev: ${{ inputs.postgresVersion || 'HEAD' }}
3435
run: |
35-
set -eo pipefail
36-
if [[ -n "$POSTGRES_VERSION" ]]; then
37-
git rev-parse --verify "$POSTGRES_VERSION" || {
38-
echo "Error: git tag '$POSTGRES_VERSION' not found"
39-
exit 1
40-
}
41-
VERSIONS=$(git show "$POSTGRES_VERSION:ansible/vars.yml" | nix run nixpkgs#yq-go -- -o=json -I=0 '.postgres_major')
42-
else
43-
VERSIONS=$(nix run nixpkgs#yq-go -- -o=json -I=0 '.postgres_major' ansible/vars.yml)
36+
set -euo pipefail
37+
if ! git rev-parse --verify "$rev"; then
38+
echo "Error: git revision '$rev' not found"
39+
exit 1
4440
fi
41+
VERSIONS=$(git show "$rev:ansible/vars.yml" | nix run nixpkgs#yq-go -- -e -o=json -I=0 '.postgres_major')
4542
echo "postgres_versions=$VERSIONS" >> $GITHUB_OUTPUT
4643
4744
publish-staging:
@@ -60,14 +57,21 @@ jobs:
6057
- name: Grab release version
6158
id: process_release_version
6259
env:
63-
POSTGRES_VERSION: ${{ inputs.postgresVersion }}
60+
rev: ${{ inputs.postgresVersion || 'HEAD' }}
6461
run: |
65-
set -eo pipefail
66-
if [[ -n "$POSTGRES_VERSION" ]]; then
67-
VERSION=$(git show "$POSTGRES_VERSION:ansible/vars.yml" | nix run nixpkgs#yq-go -- -r '.postgres_release["postgres'${{ matrix.postgres_version }}'"]')
68-
else
69-
VERSION=$(nix run nixpkgs#yq-go -- -r '.postgres_release["postgres'${{ matrix.postgres_version }}'"]' ansible/vars.yml)
62+
set -euo pipefail
63+
if ! git rev-parse --verify "$rev"; then
64+
echo "Error: git revision '$rev' not found"
65+
exit 1
7066
fi
67+
68+
# check if pg versions are in new file location or old
69+
file=ansible/postgres_release.yml
70+
if ! git cat-file -e "$rev:$file" 2>/dev/null; then
71+
file=ansible/vars.yml
72+
fi
73+
74+
VERSION=$(git show "$rev:$file" | nix run nixpkgs#yq-go -- -er '.postgres_release.postgres${{ matrix.postgres_version }}')
7175
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
7276
7377
- name: Create a tarball containing pg_upgrade scripts
@@ -84,8 +88,8 @@ jobs:
8488

8589
- name: Upload pg_upgrade scripts to s3 staging
8690
run: |
87-
aws s3 cp /tmp/pg_upgrade_scripts.tar.gz "s3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/pg_upgrade_scripts.tar.gz"
88-
aws s3 cp /tmp/pg_upgrade_scripts.tar.gz "s3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades-x86/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/pg_upgrade_scripts.tar.gz"
91+
aws s3 cp /tmp/pg_upgrade_scripts.tar.gz 's3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/pg_upgrade_scripts.tar.gz'
92+
aws s3 cp /tmp/pg_upgrade_scripts.tar.gz 's3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades-x86/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/pg_upgrade_scripts.tar.gz'
8993
9094
- name: Slack Notification on Failure
9195
if: ${{ failure() }}
@@ -115,14 +119,21 @@ jobs:
115119
- name: Grab release version
116120
id: process_release_version
117121
env:
118-
POSTGRES_VERSION: ${{ inputs.postgresVersion }}
122+
rev: ${{ inputs.postgresVersion || 'HEAD' }}
119123
run: |
120-
set -eo pipefail
121-
if [[ -n "$POSTGRES_VERSION" ]]; then
122-
VERSION=$(git show "$POSTGRES_VERSION:ansible/vars.yml" | nix run nixpkgs#yq-go -- -r '.postgres_release["postgres'${{ matrix.postgres_version }}'"]')
123-
else
124-
VERSION=$(nix run nixpkgs#yq-go -- -r '.postgres_release["postgres'${{ matrix.postgres_version }}'"]' ansible/vars.yml)
124+
set -euo pipefail
125+
if ! git rev-parse --verify "$rev"; then
126+
echo "Error: git revision '$rev' not found"
127+
exit 1
125128
fi
129+
130+
# check if pg versions are in new file location or old
131+
file=ansible/postgres_release.yml
132+
if ! git cat-file -e "$rev:$file" 2>/dev/null; then
133+
file=ansible/vars.yml
134+
fi
135+
136+
VERSION=$(git show "$rev:$file" | nix run nixpkgs#yq-go -- -er '.postgres_release.postgres${{ matrix.postgres_version }}')
126137
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
127138
128139
- name: Create a tarball containing pg_upgrade scripts
@@ -139,8 +150,8 @@ jobs:
139150

140151
- name: Upload pg_upgrade scripts to s3 prod
141152
run: |
142-
aws s3 cp /tmp/pg_upgrade_scripts.tar.gz "s3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/pg_upgrade_scripts.tar.gz"
143-
aws s3 cp /tmp/pg_upgrade_scripts.tar.gz "s3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades-x86/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/pg_upgrade_scripts.tar.gz"
153+
aws s3 cp /tmp/pg_upgrade_scripts.tar.gz 's3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/pg_upgrade_scripts.tar.gz'
154+
aws s3 cp /tmp/pg_upgrade_scripts.tar.gz 's3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades-x86/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/pg_upgrade_scripts.tar.gz'
144155
145156
- name: Slack Notification on Failure
146157
if: ${{ failure() }}

‎.github/workflows/qemu-image-build.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ on:
55
paths:
66
- .github/workflows/qemu-image-build.yml
77
- Dockerfile-kubernetes
8+
- ansible/postgres_release.yml
89
- ansible/vars.yml
910
- ebssurrogate/scripts/*
1011
- nix/packages/build-qemu-image/*
@@ -35,7 +36,7 @@ jobs:
3536
- name: Set PostgreSQL versions - only builds pg17 atm
3637
id: set-versions
3738
run: |
38-
VERSIONS=$(yq -o=json -I=0 '[.postgres_major[1]]' ansible/vars.yml)
39+
VERSIONS=$(yq -e -o=json -I=0 '[.postgres_major[1]]' ansible/vars.yml)
3940
echo "postgres_versions=$VERSIONS" >> $GITHUB_OUTPUT
4041
4142
build:
@@ -72,7 +73,7 @@ jobs:
7273
- name: Run checks if triggered manually
7374
if: ${{ github.event_name == 'workflow_dispatch' && matrix.arch == 'arm64' }}
7475
run: |
75-
SUFFIX=$(nix run nixpkgs#yq -- ".postgres_release[\"postgres${{ matrix.postgres_version }}\"]" ansible/vars.yml | sed -E 's/[0-9\.]+(.*)$/\1/')
76+
SUFFIX=$(nix run nixpkgs#yq -- -e '.postgres_release.postgres${{ matrix.postgres_version }}' ansible/postgres_release.yml | sed -E 's/[0-9\.]+(.*)$/\1/')
7677
if [[ -z $SUFFIX ]] ; then
7778
echo "Version must include non-numeric characters if built manually."
7879
exit 1
@@ -106,7 +107,7 @@ jobs:
106107
- name: Grab release version
107108
id: process_release_version
108109
run: |
109-
PG_VERSION=$(nix run nixpkgs#yq -- -r '.postgres_release["postgres'${{ matrix.postgres_version }}'"]' ansible/vars.yml)
110+
PG_VERSION=$(nix run nixpkgs#yq -- -er '.postgres_release.postgres${{ matrix.postgres_version }}' ansible/postgres_release.yml)
110111
if [[ "$TARGET_ARCH" == amd64 ]]; then
111112
PG_VERSION="$PG_VERSION-amd64-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
112113
fi

‎CLAUDE.md‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ extensions not yet ported.
3333
| Path | Purpose |
3434
|---|---|
3535
| `nix/` | Core build system (flake-parts modules). `nix/postgresql/` = PG version configs/patches; `nix/ext/` = one file per extension package; `nix/config.nix` = pinned PG versions/hashes per major (source of truth for "what version are we on"); `nix/tests/` = pg_regress + smoke + migration NixOS tests; `nix/docs/` = the real developer docs (start here, not README) |
36-
| `ansible/` | Config management for the production AMI. `ansible/playbook.yml` = main playbook (Postgres/PostgREST/pgbouncer/Auth); `ansible/vars.yml` = **source of truth for AMI version tracking** (`postgres_release`, Docker release matrix); `ansible/files/postgresql_config/postgresql.conf.j2` = the actual GUC defaults shipped to customers |
36+
| `ansible/` | Config management for the production AMI. `ansible/playbook.yml` = main playbook (Postgres/PostgREST/pgbouncer/Auth); `ansible/postgres_release.yml` = **source of truth for the packaged PG release version** (`postgres_release`, used for Docker/AMI tags); `ansible/vars.yml` = AMI component version tracking (PostgREST, pgbouncer, etc.); `ansible/files/postgresql_config/postgresql.conf.j2` = the actual GUC defaults shipped to customers |
3737
| `migrations/db/` | SQL migrations and `init-scripts/` (what every new project's schema starts with — default-enabled extensions, roles) |
3838
| `migrations/tests/extensions/` | pgTAP tests, one per extension, run via `pg_prove` against a Nix-built Postgres as part of `nix flake check` (`nix/checks.nix`) — not against a Docker image |
3939
| `docker/`, `Dockerfile-*` | Container image definitions (`Dockerfile-supabase` is the version-parameterized base; `Dockerfile-multigres` layers `pgctld` + `pgbackrest` on top) |
@@ -63,10 +63,10 @@ docker build -f Dockerfile-15 -t supabase-postgres:15 .
6363
docker build -f Dockerfile-supabase --build-arg PG_VERSION=17 -t supabase-postgres:17 .
6464
docker build -f Dockerfile-multigres --build-arg SUPABASE_IMAGE=supabase-postgres:17 -t multigres:17 .
6565

66-
# Remote build/cache + AMI build + testinfra (needs aws-vault; see
67-
# nix/docs/development-workflow.md for the full loop)
66+
# Remote build/cache; the AMI build + testinfra run in CI only
67+
# (.github/workflows/testinfra-ami-build.yml). Testing an existing AMI locally
68+
# needs aws-vault; see nix/docs/development-workflow.md for the full loop.
6869
nix run .#trigger-nix-build
69-
aws-vault exec <profile> -- nix run .#build-test-ami 17
7070
nix run .#run-testinfra -- --aws-vault-profile <profile> --ami-name <ami-name>
7171
```
7272

@@ -77,7 +77,7 @@ pre-commit hook when using `nix develop`/direnv; also enforced in CI, so
7777
## Non-obvious conventions and gotchas
7878

7979
- **Version pinning**: `nix/config.nix` pins the exact upstream PG version +
80-
source hash per major (`supabase.supportedPostgresVersions`). `ansible/vars.yml`
80+
source hash per major (`supabase.supportedPostgresVersions`). `ansible/postgres_release.yml`
8181
(`postgres_release`) separately pins the *packaged* version string used for
8282
Docker/AMI tags — the two numbers look similar but serve different layers
8383
(Nix build input vs. release artifact tag); update both when bumping a PG

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,7 @@ Here's a comprehensive overview of the project's directory structure:
5858
| ansible/playbook.yml | Main Ansible playbook for PostgreSQL/PostgREST/pgbouncer/Auth server setup |
5959
| ansible/tasks/ | Modular Ansible tasks for specific configuration steps |
6060
| ansible/files/ | Static files, scripts, and templates used by Ansible |
61+
| ansible/postgres_release.yml | Packaged Postgres release version per major (Docker/AMI tags) |
6162
| ansible/vars.yml | AMI version tracking, legacy package version tracking |
6263
| **migrations/** | Database migration management and upgrade tools |
6364
| migrations/db/ | Database schema migrations |

‎amazon-amd64-nix.pkr.hcl‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -228,11 +228,6 @@ build {
228228
destination = "/tmp/ansible-playbook"
229229
}
230230

231-
provisioner "file" {
232-
source = "ansible/vars.yml"
233-
destination = "/tmp/ansible-playbook/vars.yml"
234-
}
235-
236231
provisioner "shell" {
237232
environment_vars = [
238233
"ARGS=${var.ansible_arguments}",

0 commit comments

Comments
 (0)