ansible: Stop compiling binaries

ansible/files/permission_check.py

@@ -69,7 +69,6 @@
     "gotrue": [{"groupname": "gotrue", "username": "gotrue"}],
     "envoy": [{"groupname": "envoy", "username": "envoy"}],
     "kong": [{"groupname": "kong", "username": "kong"}],
-    "nginx": [{"groupname": "nginx", "username": "nginx"}],
     "vector": [
         {"groupname": "adm", "username": "vector"},
         {"groupname": "postgres", "username": "vector"},
@@ -376,7 +375,6 @@ def main():
         "gotrue",
         "envoy",
         "kong",
-        "nginx",
         "vector",
         "adminapi",
         "postgrest",

ansible/playbook.yml

@@ -78,12 +78,6 @@
       tags:
         - install-supabase-internal
 
-    - name: Install nginx
-      when: not stage2
-      import_tasks: tasks/setup-nginx.yml
-      tags:
-        - install-supabase-internal
-
     - name: Install Supabase specific content
       when: not stage2
       import_tasks: tasks/setup-supabase-internal.yml
@@ -167,9 +161,6 @@
         update_cache: yes
         cache_valid_time: 3600
 
-    - name: Clean out build dependencies
-      import_tasks: tasks/clean-build-dependencies.yml
-
     - name: Run migrations
       when: stage2
       import_tasks: tasks/setup-migrations.yml

ansible/tasks/setup-pgbouncer.yml

@@ -1,52 +1,4 @@
 # PgBouncer
-- name: PgBouncer - download & install dependencies
-  ansible.builtin.apt:
-    pkg:
-      - build-essential
-      - libevent-dev
-      - libssl-dev
-      - libsystemd-dev
-      - pkg-config
-      - pandoc
-      - python3
-    update_cache: true
-
-- name: PgBouncer - download latest release
-  ansible.builtin.get_url:
-    url: "{{ pgbouncer_artifacts['url'] }}"
-    checksum: "{{ pgbouncer_artifacts['checksum'] }}"
-    dest: "/tmp/pgbouncer-{{ pgbouncer_release }}.tar.gz"
-    timeout: 60
-  register: download_result
-  until: download_result is succeeded
-  retries: 3
-  delay: 2
-
-- name: PgBouncer - unpack archive
-  ansible.builtin.unarchive:
-    dest: '/tmp'
-    remote_src: true
-    src: "/tmp/pgbouncer-{{ pgbouncer_release }}.tar.gz"
-  become: true
-
-- name: PgBouncer - configure
-  ansible.builtin.command:
-    cmd: './configure --prefix=/usr/local --with-systemd'
-  args:
-    chdir: "/tmp/pgbouncer-{{ pgbouncer_release }}"
-  become: true
-
-- name: PgBouncer - build and install
-  community.general.make:
-    chdir: "/tmp/pgbouncer-{{ pgbouncer_release }}"
-    target: "{{ pgbouncer_make_item }}"
-  become: true
-  loop:
-    - 'all'
-    - 'install'
-  loop_control:
-    loop_var: 'pgbouncer_make_item'
-
 - name: Create pgbouncer user
   ansible.builtin.user:
     comment: 'PgBouncer user'
@@ -55,6 +7,21 @@
     shell: '/usr/sbin/nolign'
     state: 'present'
 
+- name: Install PgBouncer from nix binary cache
+  when: stage2
+  ansible.builtin.shell:
+    cmd: sudo -u pgbouncer bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install github:supabase/postgres/{{ git_commit_sha }}#pgbouncer"
+  become: true
+
+- name: Link PgBouncer into /usr/local/bin
+  when: stage2
+  ansible.builtin.file:
+    dest: '/usr/local/bin/pgbouncer'
+    force: true
+    src: '/home/pgbouncer/.nix-profile/bin/pgbouncer'
+    state: 'link'
+  become: true
+
 - name: Create PgBouncer directories if they do not exist
   ansible.builtin.file:
     group: 'pgbouncer'

ansible/vars.yml

@@ -118,14 +118,6 @@ gotrue_artifacts:
   arm64:
     url: "https://github.com/supabase/gotrue/releases/download/v{{ gotrue_release }}/auth-v{{ gotrue_release }}-arm64.tar.gz"
     checksum: sha256:547b80c455f2bbf01a624d0e3bc98c31237ca479d4aa0d236d40678370e34a69
-nginx_release: 1.22.0
-nginx_artifacts:
-  url: "https://nginx.org/download/nginx-{{ nginx_release }}.tar.gz"
-  checksum: sha256:b33d569a6f11a01433a57ce17e83935e953ad4dc77cdd4d40f896c88ac26eb53
-pgbouncer_release: 1.25.1
-pgbouncer_artifacts:
-  url: "https://www.pgbouncer.org/downloads/files/{{ pgbouncer_release }}/pgbouncer-{{ pgbouncer_release }}.tar.gz"
-  checksum: sha256:6e566ae92fe3ef7f6a1b9e26d6049f7d7ca39c40e29e7b38f6d5500ae15d8465
 postgrest_release: "14.17" # keep this as an *explicit* string, otherwise gets treated as yaml float which will likely only lead to tears
 postgrest_artifacts:
   amd64:

audit-specs/baselines/ami-build/group.yml

@@ -39,8 +39,6 @@ group:
     exists: true
   envoy:
     exists: true
-  nginx:
-    exists: true
   vector:
     exists: true
   supabase-admin-agent:

audit-specs/baselines/ami-build/user.yml

@@ -43,9 +43,6 @@ user:
   envoy:
     exists: true
     home: /home/envoy
-  nginx:
-    exists: true
-    home: /home/nginx
   vector:
     exists: true
     home: /var/lib/vector