AMI: Clean up messy apt handling

.github/workflows/test.yml

@@ -39,33 +39,41 @@ jobs:
     steps:
       - name: Checkout Repo
         uses: supabase/postgres/.github/actions/shared-checkout@HEAD
+
       - uses: ./.github/actions/nix-install-ephemeral
+
       - name: Set PostgreSQL version environment variable
         run: echo "POSTGRES_MAJOR_VERSION=${{ matrix.postgres_version }}" >> $GITHUB_ENV
+
       - name: Strip quotes from pg major and set env var
         run: |
           stripped_version=$(echo "${{ matrix.postgres_version }}" | sed 's/^"\(.*\)"$/\1/')
           echo "PGMAJOR=$stripped_version" >> $GITHUB_ENV
+
       - name: Generate common-nix.vars.pkr.hcl
         run: |
           PG_VERSION=$(nix run nixpkgs#yq-go -- '.postgres_release["postgres'${{ matrix.postgres_version }}'"]' ansible/vars.yml)
           PG_VERSION=$(echo $PG_VERSION | tr -d '"')  # Remove any surrounding quotes
           echo 'postgres-version = "'$PG_VERSION'"' > common-nix.vars.pkr.hcl
           echo "" >> common-nix.vars.pkr.hcl
+
       - id: settings
         run: sed -r 's/(\s|\")+//g' common-nix.vars.pkr.hcl >> $GITHUB_OUTPUT
+
       - name: Generate args
         id: args
         run: |
           ARGS=$(nix run nixpkgs#yq-go -- 'to_entries | map(select(.value|type == "!!str")) | map(.key + "=" + .value) | join("\n")' ansible/vars.yml)
           echo "result<<EOF" >> $GITHUB_OUTPUT
           echo "$ARGS" >> $GITHUB_OUTPUT
           echo "EOF" >> $GITHUB_OUTPUT
+
       - name: Resolve git sha
         id: resolve-git-sha
         uses: ./.github/actions/resolve-git-sha
         with:
           flake_input: ${{ vars.GIT_SHA_FROM_FLAKE_INPUT }}
+
       - name: verify schema.sql is committed
         run: |
           nix run github:supabase/postgres/${{ steps.resolve-git-sha.outputs.sha }}#dbmate-tool -- --version ${{ env.PGMAJOR }} --flake-url github:supabase/postgres/${{ steps.resolve-git-sha.outputs.sha }}

amazon-amd64-nix.pkr.hcl

@@ -170,11 +170,6 @@ source "amazon-ebssurrogate" "source" {
 build {
   sources = ["source.amazon-ebssurrogate.source"]
 
-  provisioner "file" {
-    source      = "ebssurrogate/files/sources.cfg"
-    destination = "/tmp/sources.list"
-  }
-
   provisioner "file" {
     source      = "ebssurrogate/files/ebsnvme-id"
     destination = "/tmp/ebsnvme-id"

amazon-arm64-nix.pkr.hcl

@@ -170,11 +170,6 @@ source "amazon-ebssurrogate" "source" {
 build {
   sources = ["source.amazon-ebssurrogate.source"]
 
-  provisioner "file" {
-    source      = "ebssurrogate/files/sources-arm64.cfg"
-    destination = "/tmp/sources.list"
-  }
-
   provisioner "file" {
     source      = "ebssurrogate/files/ebsnvme-id"
     destination = "/tmp/ebsnvme-id"

ansible/playbook.yml

@@ -141,25 +141,12 @@
       when: not stage2
       import_tasks: tasks/setup-fail2ban.yml
 
-    # Install EC2 instance connect
-    # Only for AWS images
-    - name: install EC2 instance connect
-      when: not qemu
-      become: yes
-      apt:
-        pkg:
-          - ec2-instance-connect
-      tags:
-        - aws-only
-
     # Install this at the end to prevent it from kicking in during the apt process, causing conflicts
     - name: Install security tools
       become: yes
       apt:
         pkg:
           - unattended-upgrades
-        update_cache: yes
-        cache_valid_time: 3600
 
     - name: Run migrations
       when: stage2

ansible/tasks/internal/install-salt.yml

@@ -29,7 +29,6 @@
       - salt-common={{ salt_release }}
       - salt-minion={{ salt_release }}
     state: present
-    update_cache: yes
 
 - name: Pin salt packages at major version
   ansible.builtin.copy:

ansible/tasks/setup-postgrest.yml

@@ -27,7 +27,6 @@
     package:
       - libnuma-dev
       - libpq5
-    update_cache: true
     state: 'present'
 
 - name: PostgREST - grab the list of installed packages

ansible/tasks/setup-system.yml

@@ -1,15 +1,8 @@
 - name: Execute stage1 tasks
   when: not stage2
   block:
-    - name: System - apt update and apt upgrade
-      ansible.builtin.apt:
-        update_cache: true
-        upgrade: true
-      # SEE http://archive.vn/DKJjs#parameter-upgrade
-
     - name: Install required security updates Ansible dependencies, security tools, and other useful things
       ansible.builtin.apt:
-        cache_valid_time: 3600
         pkg:
           - acl
           - bwm-ng
@@ -23,7 +16,6 @@
           - sysstat
           - tzdata
           - vim
-        update_cache: true
     # SEE https://github.com/georchestra/ansible/issues/55#issuecomment-588313638
     # Without this, a similar error is faced
 

ansible/tasks/setup-tmux.yml

@@ -2,7 +2,6 @@
   ansible.builtin.apt:
     name: 'tmux'
     state: 'present'
-    update_cache: true
   become: true
 
 - name: tmux - Configure tmux alias

ansible/tasks/setup-tuned.yml

@@ -6,7 +6,6 @@
         name: 'tuned'
         policy_rc_d: 101
         state: 'present'
-        update_cache: true
       become: true
 
     - name: 'tuned - Create a tuned profile directory'  # noqa: name[casing]

ansible/tasks/test-image.yml

@@ -65,7 +65,6 @@
       ansible.builtin.apt:
         name: 'python3-psycopg2'
         state: 'present'
-        update_cache: true
       become: true
 
     - name: Reset db stats