feat(nix): expose per-version extension packages, catalog, and update tools

ansible/files/postgres_prestart.sh.j2

@@ -32,78 +32,18 @@ update_orioledb_buffers() {
    fi
 }
 
-check_extensions_file() {
+handle_extension_versions() {
     local extensions_file="/etc/adminapi/pg-extensions.json"
-    if [ ! -f "$extensions_file" ]; then
-        log "extensions: No extensions file found, skipping extensions versions check"
-        return 0 #if file not found, skip
-    fi
     if [ ! -r "$extensions_file" ]; then
-        log "extensions: Cannot read extensions file"
-        return 1 #a true error, we should be able to read file
-    fi
-    return 0
-}
-
-switch_extension_version() {
-    local extension_name="$1"
-    local version="$2"
-
-    # Use BIN_PATH environment variable or default to /var/lib/postgresql/.nix-profile
-    : ${BIN_PATH:="/var/lib/postgresql/.nix-profile"}
-
-    local switch_script="$BIN_PATH/bin/switch_${extension_name}_version"
-
-    if [ ! -x "$switch_script" ]; then
-        log "$extension_name: No version switch script available at $switch_script, skipping"
+        log "extensions: no manifest at $extensions_file, skipping"
         return 0
     fi
 
-    log "$extension_name: Switching to version $version"
-    # Run directly as root since we're already running as root
-    "$switch_script" "$version"
-    local exit_code=$?
-    if [ $exit_code -eq 0 ]; then
-        log "$extension_name: Version switch completed successfully"
+    if site-extensions-update "$extensions_file"; then
+        log "extensions: profile updated"
     else
-        log "$extension_name: Version switch failed with exit code $exit_code"
-    fi
-    return $exit_code
-}
-
-handle_extension_versions() {
-    if ! check_extensions_file; then
-        return
-    fi
-
-    local extensions_file="/etc/adminapi/pg-extensions.json"
-
-    # Get all extension names from the JSON file
-    local extensions
-    extensions=$(jq -r 'keys[]' "$extensions_file" 2>/dev/null)
-
-    if [ -z "$extensions" ]; then
-        log "extensions: No extensions found in configuration"
-        return
+        log "extensions: update failed, continuing with existing profile"
     fi
-
-    # Iterate through each extension
-    while IFS= read -r extension_name; do
-        # Get the version for this extension
-        local version
-        version=$(jq -r --arg ext "$extension_name" '.[$ext] // empty' "$extensions_file")
-
-        if [ -z "$version" ]; then
-            log "$extension_name: No version specified, skipping"
-            continue
-        fi
-
-        log "$extension_name: Found version $version in extensions file"
-
-        # Don't fail if version switch fails - just log and continue
-        switch_extension_version "$extension_name" "$version" || log "$extension_name: Version switch failed but continuing"
-
-    done <<< "$extensions"
 }
 
 main() {

ansible/files/postgresql_config/postgresql.service

@@ -10,7 +10,7 @@ After=database-optimizations.service
 Type=notify
 User=postgres
 ExecStart=/usr/lib/postgresql/bin/postgres -D /etc/postgresql
-ExecStartPre=+/usr/local/bin/postgres_prestart.sh
+ExecStartPre=-+/usr/local/bin/postgres_prestart.sh
 ExecReload=/bin/kill -HUP $MAINPID
 KillMode=mixed
 KillSignal=SIGINT
@@ -22,7 +22,7 @@ OOMScoreAdjust=-1000
 EnvironmentFile=-/etc/environment.d/postgresql.env
 LimitNOFILE=16384
 {% if supabase_internal is defined %}
-ReadOnlyPaths=/etc
+ReadOnlyPaths=/etc /usr/local
 InaccessiblePaths=/root -/var/lib/supabase -/var/lib/supabase-admin-agent -/var/cache/supabase-admin-agent -/opt/saltstack -/etc/salt
 AppArmorProfile=-sbpostgres
 {% endif %}

nix/ext/hypopg.nix

@@ -98,6 +98,7 @@ buildEnv {
   '';
 
   passthru = {
+    perVersion = lib.mapAttrs (name: value: build name value.hash) versionsToUse;
     versions = versionsBuilt;
     numberOfVersions = numberOfVersionsBuilt;
     inherit pname latestOnly;

nix/ext/index_advisor.nix

@@ -83,6 +83,7 @@ pkgs.buildEnv {
   ];
 
   passthru = {
+    perVersion = lib.mapAttrs (name: value: build name value.hash) versionsToUse;
     versions = versionsBuilt;
     numberOfVersions = numberOfVersionsBuilt;
     inherit pname latestOnly;

nix/ext/pg-safeupdate.nix

@@ -83,6 +83,7 @@ pkgs.buildEnv {
   '';
 
   passthru = {
+    perVersion = lib.mapAttrs (name: value: build name value.hash) versionsToUse;
     versions = versionsBuilt;
     numberOfVersions = numberOfVersionsBuilt;
     inherit pname latestOnly;

nix/ext/pg_cron/default.nix

@@ -116,6 +116,7 @@ buildEnv {
   };
 
   passthru = {
+    perVersion = lib.mapAttrs (name: value: build name value) versionsToUse;
     versions = versionsBuilt;
     numberOfVersions = numberOfVersionsBuilt;
     inherit switch-ext-version latestOnly;

nix/ext/pg_net.nix

@@ -145,6 +145,7 @@ pkgs.buildEnv {
   '';
 
   passthru = {
+    perVersion = lib.mapAttrs (name: value: build name value.hash) versionsToUse;
     versions = versionsBuilt;
     numberOfVersions = numberOfVersionsBuilt;
     inherit pname latestOnly;

nix/ext/pg_partman.nix

@@ -100,6 +100,7 @@ pkgs.buildEnv {
   '';
 
   passthru = {
+    perVersion = lib.mapAttrs (name: value: build name value.hash) versionsToUse;
     versions = versionsBuilt;
     numberOfVersions = numberOfVersionsBuilt;
     inherit switch-ext-version libName latestOnly;

nix/ext/pg_repack.nix

@@ -140,6 +140,7 @@ buildEnv {
   '';
 
   passthru = {
+    perVersion = lib.mapAttrs (name: value: build name value.hash) versionsToUse;
     versions = versionsBuilt;
     numberOfVersions = numberOfVersionsBuilt;
     inherit pname latestOnly;

nix/ext/pg_tle.nix

@@ -111,6 +111,7 @@ buildEnv {
   '';
 
   passthru = {
+    perVersion = lib.mapAttrs (name: value: build name value.hash) versionsToUse;
     versions = versionsBuilt;
     numberOfVersions = numberOfVersionsBuilt;
     inherit pname latestOnly;

nix/ext/pgaudit.nix

@@ -240,6 +240,7 @@ buildEnv {
   '';
 
   passthru = {
+    perVersion = lib.mapAttrs (name: value: build name value.hash) versionsToUse;
     versions = versionsBuilt;
     numberOfVersions = numberOfVersionsBuilt;
     inherit pname latestOnly;

nix/ext/pgmq/default.nix

@@ -104,6 +104,7 @@ buildEnv {
   pathsToLink = [ "/share/postgresql/extension" ];
 
   passthru = {
+    perVersion = lib.mapAttrs (name: value: build name value.hash) versionsToUse;
     versions = versionsBuilt;
     numberOfVersions = numberOfVersionsBuilt;
     inherit pname latestOnly;

nix/ext/pgroonga/default.nix

@@ -181,6 +181,7 @@ buildEnv {
   '';
 
   passthru = {
+    perVersion = lib.mapAttrs (name: value: build name value.hash) versionsToUse;
     versions = versionsBuilt;
     numberOfVersions = numberOfVersionsBuilt;
     inherit pname latestOnly;

nix/ext/pgrouting/default.nix

@@ -153,6 +153,7 @@ buildEnv {
   '';
 
   passthru = {
+    perVersion = lib.mapAttrs (name: value: build name value.hash) versionsToUse;
     versions = versionsBuilt;
     numberOfVersions = numberOfVersionsBuilt;
     inherit pname latestOnly;

nix/ext/pgsodium.nix

@@ -112,6 +112,7 @@ pkgs.buildEnv {
   '';
 
   passthru = {
+    perVersion = lib.mapAttrs (name: value: build name value.hash) versionsToUse;
     versions = versionsBuilt;
     numberOfVersions = numberOfVersionsBuilt;
     inherit pname latestOnly;

nix/ext/pgsql-http.nix

@@ -113,6 +113,7 @@ pkgs.buildEnv {
   '';
 
   passthru = {
+    perVersion = lib.mapAttrs (name: value: build name value.hash) versionsToUse;
     versions = versionsBuilt;
     numberOfVersions = numberOfVersionsBuilt;
     inherit pname latestOnly;

nix/ext/pgvector.nix

@@ -96,6 +96,7 @@ pkgs.buildEnv {
   '';
 
   passthru = {
+    perVersion = lib.mapAttrs (name: value: build name value.hash) versionsToUse;
     versions = versionsBuilt;
     numberOfVersions = numberOfVersionsBuilt;
     inherit pname latestOnly;

nix/ext/plv8/default.nix

@@ -238,6 +238,7 @@ buildEnv {
   '';
 
   passthru = {
+    perVersion = lib.mapAttrs (name: value: build name value.hash) versionsToUse;
     versions = versionsBuilt;
     numberOfVersions = numberOfVersionsBuilt;
     inherit pname latestOnly;

nix/ext/postgis.nix

@@ -256,6 +256,7 @@ in
   '';
 
   passthru = {
+    perVersion = lib.mapAttrs (name: value: build name value.hash) versionsToUse;
     versions = versionsBuilt;
     numberOfVersions = numberOfVersionsBuilt;
     inherit pname latestOnly;

nix/ext/vault.nix

@@ -99,6 +99,7 @@ pkgs.buildEnv {
   '';
 
   passthru = {
+    perVersion = lib.mapAttrs (name: value: build name value.hash) versionsToUse;
     versions = versionsBuilt;
     numberOfVersions = numberOfVersionsBuilt;
     inherit pname latestOnly;

nix/packages/default.nix

@@ -1,6 +1,9 @@
 { self, inputs, ... }:
 {
-  imports = [ ./postgres.nix ];
+  imports = [
+    ./postgres.nix
+    ./extension-catalog.nix
+  ];
   perSystem =
     {
       inputs',