ci: install AMI postgres profile via nix-env --set

ansible/tasks/stage2-setup-postgres.yml

@@ -62,17 +62,20 @@
   when:
     - stage2_nix
   block:
-    - name: Install packages from nix binary cache
+    - name: Resolve postgres profile store path
       ansible.builtin.shell: |
-        sudo -u postgres bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install github:supabase/postgres/{{ git_commit_sha }}#{{ nix_item }}"
-      loop:
-        - "{{ psql_version }}/bin"
-        - pg_prove
-        - supabase-groonga
-        - "{{ postgresql_version }}_debug"
-        - "{{ postgresql_version }}_src"
-      loop_control:
-        loop_var: 'nix_item'
+        sudo -u postgres bash -c "
+          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh &&
+          nix build --no-link --print-out-paths github:supabase/postgres/{{ git_commit_sha }}#postgres-{{ postgresql_major_version }}-profile
+        "
+      register: postgres_profile_path
+
+    - name: Install postgres profile from nix binary cache
+      ansible.builtin.shell: |
+        sudo -u postgres bash -c "
+          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh &&
+          nix-env --set {{ postgres_profile_path.stdout }}
+        "
 
     - name: Install supascan for baseline validation
       ansible.builtin.shell: |
@@ -134,11 +137,6 @@
             - stage2_nix
             - not is_psql_15
           block:
-            - name: Install gatekeeper from nix binary cache
-              become: yes
-              shell: |
-                sudo -u postgres bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install github:supabase/postgres/{{ git_commit_sha }}#gatekeeper"
-
             - name: Create symbolic link for linux-pam to find pam_jit_pg.so
               become: yes
               shell: |

nix/packages/default.nix

@@ -25,6 +25,19 @@
           postgresqlPackage = self'.packages."postgresql_${version}";
         in
         pkgs.callPackage ../ext/pg_isolation_regress.nix { postgresql = postgresqlPackage; };
+      # Bundles everything the AMI build installs into the postgres user's nix
+      # profile (via `nix-env --set`) into a single derivation.
+      makePostgresProfile =
+        version:
+        pkgs.symlinkJoin {
+          name = "postgres-${version}-profile";
+          paths = [
+            self'.packages."psql_${version}/bin"
+            self'.packages.pg_prove
+            self'.packages.supabase-groonga
+            self'.packages."postgresql_${version}_src"
+          ] ++ lib.optionals pkgs.stdenv.isLinux [ self'.packages."postgresql_${version}_debug" ];
+        };
       pgsqlSuperuser = "supabase_admin";
       supascan-pkgs = pkgs.callPackage ./supascan.nix {
         inherit (pkgs) lib;
@@ -75,6 +88,9 @@
           pg_prove = pkgs.perlPackages.TAPParserSourceHandlerpgTAP;
           pg_regress = makePgRegress activeVersion;
           pg_isolation_regress = makePgIsolationRegress activeVersion;
+          postgres-15-profile = makePostgresProfile "15";
+          postgres-17-profile = makePostgresProfile "17";
+          postgres-orioledb-17-profile = makePostgresProfile "orioledb-17";
           run-testinfra = pkgs.callPackage ./run-testinfra.nix { };
           show-commands = pkgs.callPackage ./show-commands.nix { };
           start-client = pkgs.callPackage ./start-client.nix {