Switch to PostgreSQL 16 image

src/roles/postgresql/defaults/main.yml

@@ -1,5 +1,5 @@
 ---
-postgresql_container_image: quay.io/sclorg/postgresql-13-c9s
+postgresql_container_image: quay.io/sclorg/postgresql-16-c10s
 postgresql_container_tag: "latest"
 postgresql_container_name: postgresql
 postgresql_network: host
@@ -12,3 +12,5 @@ postgresql_admin_password: "{{ undef(hint='Set a secure database password') }}"
 postgresql_max_connections: 500
 postgresql_shared_buffers: 512MB
 postgresql_effective_cache_size: 1GB
+
+postgresql_upgrade: "hardlink"

src/roles/postgresql/tasks/main.yml

@@ -17,6 +17,9 @@
   notify:
     - Restart postgresql
 
+- name: Upgrade PostgreSQL database
+  ansible.builtin.include_tasks: upgrade.yaml
+
 - name: Deploy PostgreSQL container
   containers.podman.podman_container:
     name: "{{ postgresql_container_name }}"
@@ -107,18 +110,6 @@
     name: "{{ postgresql_container_name }}"
     state: started
 
-# SCRAM-SHA-256 is default for PostgreSQL 14+,
-# after the upgrade, we can drop this task.
-- name: Use scram-sha-256 for password encryption
-  community.postgresql.postgresql_set:
-    login_user: postgres
-    login_password: "{{ postgresql_admin_password }}"
-    login_host: localhost
-    name: password_encryption
-    value: "scram-sha-256"
-  notify:
-    - Restart postgresql
-
 - name: Create PostgreSQL users
   community.postgresql.postgresql_user:
     name: "{{ item.name }}"

src/roles/postgresql/tasks/upgrade.yaml

@@ -0,0 +1,79 @@
+---
+- name: Check if PG_VERSION file exists
+  ansible.builtin.stat:
+    path: "{{ postgresql_data_dir }}/userdata/PG_VERSION"
+  register: postgresql_version_file
+
+- name: Set postgresql_version version fact
+  when: postgresql_version_file.stat.exists
+  block:
+    - name: Read PG_VERSION file
+      ansible.builtin.slurp:
+        src: "{{ postgresql_data_dir }}/userdata/PG_VERSION"
+      register: postgresql_version_encoded
+
+    - name: Register PG version fact
+      ansible.builtin.set_fact:
+        postgresql_version: "{{ postgresql_version_encoded.content | b64decode | trim }}"
+
+- name: Upgrade PostgreSQL 13 to 16
+  when:
+    - "postgresql_version is defined"
+    - "postgresql_version == '13'"
+  block:
+    - name: Stop foreman target
+      ansible.builtin.systemd:
+        name: foreman.target
+        state: stopped
+
+    - name: Wait for port 5432 to be completely freed by Podman
+      ansible.builtin.wait_for:
+        port: 5432
+        state: stopped
+        timeout: 30
+
+    - name: Deploy PostgreSQL upgrade container
+      containers.podman.podman_container:
+        name: "{{ postgresql_container_name }}-upgrade"
+        image: postgresql.image
+        state: quadlet
+        sdnotify: false
+        volumes:
+          - "{{ postgresql_data_dir }}:/var/lib/pgsql/data:rw,Z"
+        secrets:
+          - 'postgresql-admin-password,target=POSTGRESQL_ADMIN_PASSWORD,type=env'
+        env:
+          POSTGRESQL_MAX_CONNECTIONS: "{{ postgresql_max_connections }}"
+          POSTGRESQL_SHARED_BUFFERS: "{{ postgresql_shared_buffers }}"
+          POSTGRESQL_EFFECTIVE_CACHE_SIZE: "{{ postgresql_effective_cache_size }}"
+          # explicitly set the previous version to avoid the upgrade failure
+          # see https://github.com/sclorg/postgresql-container/issues/661
+          POSTGRESQL_PREV_VERSION: "{{ postgresql_version }}"
+          POSTGRESQL_UPGRADE: "{{ postgresql_upgrade }}"
+        command: "run-postgresql -V"
+        quadlet_options:
+          - |
+            [Unit]
+            Description=PostgreSQL Database Upgrade from 13 to 16
+            [Service]
+            Type=oneshot
+            RemainAfterExit=yes
+            TimeoutStartSec=30m
+
+    - name: Run daemon reload to make Quadlet create the upgrade service file
+      ansible.builtin.systemd:
+        daemon_reload: true
+
+    - name: Upgrade the database from 13 to 16 but don't start the server
+      ansible.builtin.systemd:
+        name: "{{ postgresql_container_name }}-upgrade.service"
+        state: restarted
+
+    - name: Remove the quadlet file
+      ansible.builtin.file:
+        path: "/etc/containers/systemd/{{ postgresql_container_name }}-upgrade.container"
+        state: absent
+
+    - name: Reload systemd
+      ansible.builtin.systemd_service:
+        daemon_reload: true

src/roles/pre_install/tasks/main.yaml

@@ -3,6 +3,17 @@
   ansible.builtin.include_role:
     name: debug_tools
 
+- name: 'Enable postgresql:16 module'
+  ansible.builtin.command: dnf module enable -y postgresql:16
+  # can't use the `dnf` module for modules without a default stream
+  # https://github.com/ansible/ansible/issues/56504
+  # https://github.com/ansible/ansible/issues/64852
+  args:
+    creates: /etc/dnf/modules.d/postgresql.module
+  when:
+    - ansible_facts['os_family'] == 'RedHat'
+    - ansible_facts['distribution_major_version'] == '9'
+
 - name: Install podman and utilities
   ansible.builtin.package:
     name:

src/vars/images.yml

@@ -9,7 +9,7 @@ foreman_container_tag: "{{ container_tag_stream }}"
 foreman_proxy_container_image: "quay.io/foreman/foreman-proxy"
 foreman_proxy_container_tag: "{{ container_tag_stream }}"
 
-postgresql_container_image: quay.io/sclorg/postgresql-13-c9s
+postgresql_container_image: quay.io/sclorg/postgresql-16-c10s
 postgresql_container_tag: "latest"
 pulp_container_image: quay.io/foreman/pulp
 pulp_container_tag: "foreman-{{ container_tag_stream }}"