IMAGE_NAME="rds-postgres"
IMAGE_DESCRIPTION="Spinifex RDS PostgreSQL instance — Alpine + PostgreSQL 18 + rds-init first-boot bootstrap"
DISTRO="alpine"
ALPINE_VERSION="3.24.1"

# Engine binaries, ICU collation data and the postmaster log only. The datadir
# lives on the data volume, so the boot volume stays a disposable COW clone.
IMAGE_SIZE="2G"

# icu-data-full is deliberate: the cluster uses an ICU locale provider (musl has
# no libc locales) and stock english-only data would reject other collations.
# blkid is a hard requirement — without it rds-datadir refuses to run rather
# than risk formatting a customer's datadir. postgresql-pgvector ships the vector
# extension for the Ochre appliance; it stays inert on tenant DBs until a
# CREATE EXTENSION runs, so baking it into the shared image is harmless.
APK_PACKAGES="postgresql18 postgresql18-client postgresql18-contrib postgresql-pgvector postgresql18-openrc postgresql-common-openrc icu-data-full ca-certificates cloud-utils-growpart e2fsprogs-extra xfsprogs blkid openrc"

# rds-agent is the only built binary (static, FIPS boot like the host build).
BUILD_COMMANDS="CGO_ENABLED=0 GOFIPS140=v1.0.0 go build -ldflags \"-s -w\" -o bin/rds-agent ./cmd/rds-agent"

INSTALL_BINARIES="bin/rds-agent:/usr/local/bin/rds-agent"

# mulga-mgmt-net is shared with eks-node: this is a three-NIC system VM (system
# ENI, customer ENI, mgmt0), so the host's fw_cfg netcfg blob needs a consumer in
# the guest, or mgmt0 never gets its static address and rds-agent cannot reach
# the gateway, and the customer ENI never comes up so nothing reaches the DB.
INSTALL_FILES="\
scripts/images/common/rds-datadir:/usr/local/sbin/rds-datadir \
scripts/images/rds-postgres/rds-datadir.initd:/etc/init.d/rds-datadir \
scripts/images/rds-postgres/rds-init:/usr/local/sbin/rds-init \
scripts/images/rds-postgres/rds-init.initd:/etc/init.d/rds-init \
scripts/images/rds-postgres/rds-agent.initd:/etc/init.d/rds-agent \
scripts/images/common/mulga-mgmt-net.initd:/etc/init.d/mulga-mgmt-net \
scripts/images/common/mulga-mgmt-net-routes.initd:/etc/init.d/mulga-mgmt-net-routes \
scripts/images/common/mulga-mgmt-net.sh:/usr/local/sbin/mulga-mgmt-net \
scripts/images/rds-postgres/postgresql.confd:/etc/conf.d/postgresql"

# Each service's own depend() asserts the ordering; this lists it to match.
# mulga-mgmt-net is NOT here: setup.sh adds it to the boot runlevel, since a
# default-runlevel entry would run after cloud-init-local and be too late. Its
# route-enforcement second pass is the opposite — it has to follow cloud-init, so
# the default runlevel is exactly where it belongs.
ENABLE_SERVICES="rds-datadir rds-agent rds-init postgresql mulga-mgmt-net-routes"

SETUP_SCRIPT="scripts/images/rds-postgres/setup.sh"

AMI_NAME="spinifex-rds-postgres"

# The contract tag prevents the control plane from issuing a format grant to an
# older image that still discovers generic vol* devices.
SYSTEM_TAG="spinifex:managed-by=rds engine=postgres engine-version=18 rds-data-volume-contract=format-auth-v1"