Whole lot of ansible clean up

ansible/files/adminapi.service.j2

@@ -14,7 +14,7 @@ Restart=always
 RestartSec=3
 TimeoutStopSec=10
 Environment="AWS_USE_DUALSTACK_ENDPOINT=true"
-{% if qemu_mode is defined and qemu_mode %}
+{% if qemu %}
 Environment="AWS_SDK_LOAD_CONFIG=true"
 {% endif %}
 StandardOutput=journal

ansible/files/gotrue.service.j2

@@ -90,7 +90,7 @@ Environment=GOTRUE_RELOADING_POLLER_ENABLED=false
 # ensures only 1 reload operation occurs during a burst of config updates.
 Environment=GOTRUE_RELOADING_GRACE_PERIOD_INTERVAL=2s
 
-{% if qemu_mode is defined and qemu_mode %}
+{% if qemu %}
 # v3 does not use filesystem notifications for config reloads.
 Environment=GOTRUE_RELOADING_NOTIFY_ENABLED=false
 {% else %}

ansible/files/postgres_exporter.service.j2

@@ -6,7 +6,7 @@ StartLimitBurst=0
 
 [Service]
 Type=simple
-ExecStart=/opt/postgres_exporter/postgres_exporter --disable-settings-metrics --extend.query-path="/opt/postgres_exporter/queries.yml" --disable-default-metrics --no-collector.locks --no-collector.replication --no-collector.replication_slot --no-collector.stat_bgwriter --no-collector.stat_database --no-collector.stat_user_tables --no-collector.statio_user_tables --no-collector.wal {% if qemu_mode is defined and qemu_mode %}--no-collector.database {% endif %}
+ExecStart=/opt/postgres_exporter/postgres_exporter --disable-settings-metrics --extend.query-path="/opt/postgres_exporter/queries.yml" --disable-default-metrics --no-collector.locks --no-collector.replication --no-collector.replication_slot --no-collector.stat_bgwriter --no-collector.stat_database --no-collector.stat_user_tables --no-collector.statio_user_tables --no-collector.wal {% if qemu %}--no-collector.database {% endif %}
 
 User=postgres
 Group=postgres

ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.service.j2

@@ -6,7 +6,7 @@ Requires=local-fs.target
 
 [Service]
 Type=oneshot
-{% if qemu_mode is defined and qemu_mode %}
+{% if qemu %}
 ExecStart=/opt/supabase-admin-agent/supabase-admin-agent --config /opt/supabase-admin-agent/config.yaml salt --apply --store-result --targets-key  targetsv3-main.yaml
 User=root
 Group=root

ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.timer.j2

@@ -4,7 +4,7 @@ Requires=supabase-admin-agent_salt.service
 
 [Timer]
 {# We're using a significantly lower frequency for triggering this agent on qemu images for the moment. Once we've performed additional validations re: the aggregate impact of running it more frequently, the frequency can be increased. #}
-{% if qemu_mode is defined and qemu_mode %}
+{% if qemu %}
 OnCalendar=*-*-* 0,6,12,18:00:00
 RandomizedDelaySec={{ supabase_admin_agent_splay }}
 AccuracySec=1h

ansible/playbook.yml

@@ -2,6 +2,10 @@
   become: yes
 
   pre_tasks:
+    - name: Set the platform arch as a fact
+      ansible.builtin.set_fact:
+        platform: "{{ 'amd64' if ansible_facts['architecture'] == 'x86_64' else 'arm64' }}"
+
     - import_tasks: tasks/setup-system.yml
   vars_files:
     - ./vars.yml
@@ -40,124 +44,119 @@
       tags:
         - install-pgbouncer
         - install-supabase-internal
-      when: nixpkg_mode or stage2_nix
 
     - name: Install WAL-G
       import_tasks: tasks/setup-wal-g.yml
-      when: nixpkg_mode or stage2_nix
 
     - name: Install pgBackRest
-      import_tasks: 
+      import_tasks:
         file: tasks/setup-pgbackrest.yml
-      when:
-        - nixpkg_mode or stage2_nix
 
     - name: Install Gotrue
+      when: not stage2
       import_tasks: tasks/setup-gotrue.yml
       tags:
         - install-gotrue
         - install-supabase-internal
-      when: nixpkg_mode
-
+
     - name: Install PostgREST
+      when: not stage2
       import_tasks: tasks/setup-postgrest.yml
       tags:
         - install-postgrest
         - install-supabase-internal
-      when: nixpkg_mode
 
     - name: Install Envoy
+      when: not stage2
       import_tasks: tasks/setup-envoy.yml
       tags:
         - install-supabase-internal
-      when: nixpkg_mode
 
     - name: Install Kong
+      when: not stage2
       import_tasks: tasks/setup-kong.yml
       tags:
         - install-supabase-internal
-      when: nixpkg_mode
 
     - name: Install nginx
+      when: not stage2
       import_tasks: tasks/setup-nginx.yml
       tags:
         - install-supabase-internal
-      when: nixpkg_mode
 
     - name: Install Supabase specific content
+      when: not stage2
       import_tasks: tasks/setup-supabase-internal.yml
       tags:
         - install-supabase-internal
-      when: nixpkg_mode
 
     - name: Fix IPv6 NDisc issues (disabled)
+      when: not stage2 and not qemu
       import_tasks: tasks/fix-ipv6-ndisc.yml
       tags:
         - install-supabase-internal
-      when: nixpkg_mode and (qemu_mode is undefined)
 
     - name: Adjust APT update intervals
+      when: not stage2
       copy:
         src: files/apt_periodic
         dest: /etc/apt/apt.conf.d/10periodic
-      when: nixpkg_mode
-
+
     - name: Transfer init SQL files
+      when: stage2
       copy:
         src: files/{{ item.source }}
         dest: /tmp/{{ item.dest }}
       loop: "{{ sql_files }}"
-      when: stage2_nix
 
     - name: Create postgres role
+      when: stage2
       become: yes
       become_user: postgres
       shell:
         cmd: /usr/lib/postgresql/bin/psql --username=supabase_admin -d postgres -c "create role postgres superuser login; alter database postgres owner to postgres;"
-      when: stage2_nix
 
     - name: Execute init SQL files
+      when: stage2
       become: yes
       become_user: postgres
       shell:
         cmd: /usr/lib/postgresql/bin/psql -f /tmp/{{ item.dest }}
       loop: "{{ sql_files }}"
-      when: stage2_nix
 
     - name: Delete SQL scripts
+      when: stage2
       file:
         path: /tmp/{{ item.dest }}
         state: absent
       loop: "{{ sql_files }}"
-      when: stage2_nix
 
     - name: First boot optimizations
+      when: stage2
       import_tasks: tasks/internal/optimizations.yml
       tags:
         - install-supabase-internal
-      when: stage2_nix
-
+
     - name: Finalize AMI
+      when: not stage2
       import_tasks: tasks/finalize-ami.yml
       tags:
         - install-supabase-internal
-      when: nixpkg_mode
-
+
     - name: Enhance fail2ban
+      when: not stage2
       import_tasks: tasks/setup-fail2ban.yml
-      when: nixpkg_mode
-
 
     # Install EC2 instance connect
     # Only for AWS images
     - name: install EC2 instance connect
+      when: not qemu
       become: yes
       apt:
         pkg:
           - ec2-instance-connect
       tags:
         - aws-only
-      when: qemu_mode is undefined
 
     # Install this at the end to prevent it from kicking in during the apt process, causing conflicts
     - name: Install security tools
@@ -172,53 +171,53 @@
       import_tasks: tasks/clean-build-dependencies.yml
 
     - name: Run migrations
+      when: stage2
       import_tasks: tasks/setup-migrations.yml
       tags:
         - migrations
-      when: stage2_nix
 
     - name: Run unit tests
+      when: stage2
       import_tasks: tasks/test-image.yml
       tags:
         - unit-tests
-      when: stage2_nix
 
     - name: Purge snapd
+      when: stage2
       become: yes
       shell: |
         apt autoremove -y --purge snapd
-      when: stage2_nix
 
     - name: Run permission checks
+      when: stage2
       become: yes
       shell: |
         systemctl start postgresql.service
-        /usr/bin/python3 /tmp/ansible-playbook/ansible/files/permission_check.py {{ '--qemu' if qemu_mode is defined else '' }}
+        /usr/bin/python3 /tmp/ansible-playbook/ansible/files/permission_check.py {{ '--qemu' if qemu else '' }}
         systemctl stop postgresql.service
-      when: stage2_nix
 
     - name: Run fail2ban configuration checks
+      when: stage2
       become: yes
       shell: |
         systemctl start fail2ban.service
         /usr/bin/python3 /tmp/ansible-playbook/ansible/files/fail2ban_check.py
         systemctl stop fail2ban.service
-      when: stage2_nix
 
     - name: Run supascan baseline validation
+      when: stage2 and not qemu and ansible_architecture != "x86_64"
       become: yes
       shell: |
         /bin/bash /tmp/ansible-playbook/ansible/files/supascan_ami.sh /tmp/ansible-playbook/audit-specs/baselines/ami-build
-      when: stage2_nix and qemu_mode is not defined and ansible_architecture != "x86_64"
 
     - name: Remove supascan after validation
+      when: stage2
       become: yes
       shell: |
         sudo -u ubuntu bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile remove supascan"
-      when: stage2_nix
 
     - name: nix collect garbage
+      when: stage2
       become: yes
       shell: |
         sudo -u ubuntu bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix-collect-garbage -d"
-      when: stage2_nix

ansible/tasks/finalize-ami.yml

@@ -107,11 +107,10 @@
     state: 'restarted'
 
 - name: import pgsodium_getkey script
+  when: stage2
   ansible.builtin.template:
     dest: "{{ pg_bindir }}/pgsodium_getkey.sh"
     group: 'postgres'
     mode: '0700'
     owner: 'postgres'
     src: 'files/pgsodium_getkey_readonly.sh.j2'
-  when:
-    - stage2_nix

ansible/tasks/internal/admin-api.yml

@@ -27,19 +27,10 @@
   shell: |
     chmod g+w /etc
 
-- name: Setting arch (amd64)
-  set_fact:
-    arch: "amd64"
-  when: platform == "amd64"
-
-- name: Setting arch (arm)
-  set_fact:
-    arch: "arm64"
-  when: platform == "arm64"
-
 - name: Download adminapi archive
   get_url:
-    url: "https://supabase-public-artifacts-bucket.s3.amazonaws.com/supabase-admin-api/v{{ adminapi_release }}/supabase-admin-api_{{ adminapi_release }}_linux_{{ arch }}.tar.gz"
+    url: "{{ adminapi_artifacts[platform]['url'] }}"
+    checksum: "{{ adminapi_artifacts[platform]['checksum'] }}"
     dest: "/tmp/adminapi.tar.gz"
     timeout: 90
 

ansible/tasks/internal/admin-mgr.yml

@@ -1,16 +1,7 @@
-- name: Setting arch (x86)
-  set_fact:
-    arch: "amd64"
-  when: platform == "amd64"
-
-- name: Setting arch (arm)
-  set_fact:
-    arch: "arm64"
-  when: platform == "arm64"
-
 - name: Download admin-mgr archive
   get_url:
-    url: "https://supabase-public-artifacts-bucket.s3.amazonaws.com/admin-mgr/v{{ adminmgr_release }}/admin-mgr_{{ adminmgr_release }}_linux_{{ arch }}.tar.gz"
+    url: "{{ adminmgr_artifacts[platform]['url'] }}"
+    checksum: "{{ adminmgr_artifacts[platform]['checksum'] }}"
     dest: "/tmp/admin-mgr.tar.gz"
     timeout: 90
   register: download_result

ansible/tasks/internal/install-aws-cli.yml

@@ -19,9 +19,10 @@
 
 - name: AWS CLI - get
   ansible.builtin.get_url:
+    url: "{{ aws_cli_artifacts[platform]['url'] }}"
+    checksum: "{{ aws_cli_artifacts[platform]['checksum'] }}"
     dest: '/tmp/awscliv2.zip'
     timeout: 60
-    url: "https://awscli.amazonaws.com/awscli-exe-linux-{{ 'aarch64' if platform == 'arm64' else 'x86_64' }}-{{ aws_cli_release }}.zip"
   register: download_result
   until: download_result is succeeded
   retries: 3

ansible/tasks/internal/install-salt.yml

@@ -1,4 +1,4 @@
-- name: Add apt repository for Saltstack (arm)
+- name: Add apt repository for Saltstack
   block:
     - name: Ensure /etc/apt/keyrings directory exists
       file:
@@ -9,6 +9,7 @@
     - name: salt gpg key
       ansible.builtin.get_url:
         url: https://packages.broadcom.com/artifactory/api/security/keypair/SaltProjectKey/public
+        checksum: sha256:36decef986477acb8ba2a1fc4041bcf9f22229ef6c939d0317c9e36a9d142b34
         dest: /etc/apt/keyrings/salt-archive-keyring-2023.pgp
         mode: '0644'
       register: download_result
@@ -18,35 +19,9 @@
 
     - name: salt apt repo
       ansible.builtin.apt_repository:
-        repo: "deb [signed-by=/etc/apt/keyrings/salt-archive-keyring-2023.pgp arch=arm64] https://packages.broadcom.com/artifactory/saltproject-deb/ stable main"
+        repo: "deb [signed-by=/etc/apt/keyrings/salt-archive-keyring-2023.pgp arch={{ platform }}] https://packages.broadcom.com/artifactory/saltproject-deb/ stable main"
         filename: "salt"
         state: present
-  when: platform == "arm64"
-
-- name: Add apt repository for Saltstack (amd)
-  block:
-    - name: Ensure /etc/apt/keyrings directory exists
-      file:
-        path: /etc/apt/keyrings
-        state: directory
-        mode: "0755"
-
-    - name: salt gpg key
-      ansible.builtin.get_url:
-        url: https://packages.broadcom.com/artifactory/api/security/keypair/SaltProjectKey/public
-        dest: /etc/apt/keyrings/salt-archive-keyring-2023.pgp
-        mode: '0644'
-      register: download_result
-      until: download_result is succeeded
-      retries: 3
-      delay: 2
-
-    - name: salt apt repo
-      ansible.builtin.apt_repository:
-        repo: "deb [signed-by=/etc/apt/keyrings/salt-archive-keyring-2023.pgp arch=amd64] https://packages.broadcom.com/artifactory/saltproject-deb/ stable main"
-        filename: "salt"
-        state: present
-  when: platform == "amd64"
 
 - name: Salt minion install
   apt: