Air-gapped

#!/usr/bin/env bash

#

# Build an offline PostgreSQL install bundle for an air-gapped host.

#

# Dependency resolution: apt resolves the FULL closure as if nothing were

# installed (Dir::State::status -> an empty file), so the bundle is complete

# regardless of what's on this build host - the apt equivalent of dnf's

# --alldeps. The real system is never touched (download-only + a throwaway

# status file).

set -euo pipefail

# ---- configuration ---------------------------------------------------------

PG_VERSION="${PG_VERSION:-16}"                    # PostgreSQL major version

INCLUDE_RECOMMENDS="${INCLUDE_RECOMMENDS:-yes}"   # yes = bundle Recommends too

PACKAGES=("postgresql-${PG_VERSION}" "postgresql-contrib")

ARCH="$(dpkg --print-architecture)"

. /etc/os-release

CODENAME="${VERSION_CODENAME:?cannot detect release codename}"

OUTDIR="$(pwd)/postgresql-offline"

# Empty status file = "nothing is installed" -> apt downloads every dependency.

EMPTY_STATUS="$(mktemp)"

trap 'rm -f "$EMPTY_STATUS"' EXIT

echo ">> target: PostgreSQL ${PG_VERSION} | ${ID:-?} ${CODENAME} | ${ARCH}"

# ---- host tooling ----------------------------------------------------------

sudo apt-get update

sudo apt-get install -y --no-install-recommends \

  postgresql-common dpkg-dev ca-certificates

# ---- PGDG repository (key + sources, configured once) ----------------------

# The official script configures BOTH the signing key and the deb822 sources

# file for the right codename/arch. Don't also hand-write sources.list - doing

# both is what causes "duplicate source" and key-mismatch errors.

echo "" | sudo /usr/share/postgresql-common/pgdg/apt.postgresql.org.sh

sudo apt-get update

# ---- download packages + full dependency closure ---------------------------

rm -rf "$OUTDIR"

mkdir -p "$OUTDIR/partial"

REC_FLAG="--no-install-recommends"

[ "$INCLUDE_RECOMMENDS" = "yes" ] && REC_FLAG="--install-recommends"

# Preview the complete closure (every .deb, base libs included).

echo ">> resolving full dependency closure..."

apt-get install --print-uris -y $REC_FLAG \

  -o Dir::State::status="$EMPTY_STATUS" \

  "${PACKAGES[@]}" \

  | grep -oP "(?<=')[^']*\.deb" > "$OUTDIR/manifest.txt" || true

echo ">> $(wc -l < "$OUTDIR/manifest.txt") package file(s) to download"

# Download them. download-only + the empty status file means the real system

# is never modified, but every dependency is fetched into the bundle.

sudo apt-get install -y --download-only $REC_FLAG \

  -o Dir::State::status="$EMPTY_STATUS" \

  -o Dir::Cache::archives="$OUTDIR" \

  "${PACKAGES[@]}"

# apt leaves lock/partial artifacts behind - drop them and fix ownership.

sudo rm -rf "$OUTDIR/partial" "$OUTDIR/lock"

sudo chown -R "$(id -u):$(id -g)" "$OUTDIR"

# ---- turn the folder into a local apt repo ---------------------------------

# So the air-gapped install becomes a clean `apt-get install` that pulls only

# what the target actually needs (far safer than `dpkg -i *.deb`).

( cd "$OUTDIR" \

    && dpkg-scanpackages -m . /dev/null > Packages \

    && gzip -9c Packages > Packages.gz )

# ---- integrity manifest ----------------------------------------------------

( cd "$OUTDIR" && sha256sum *.deb > SHA256SUMS )

echo

echo ">> done."

echo ">> bundle: $OUTDIR"

echo ">> files:  $(ls "$OUTDIR"/*.deb | wc -l) .deb"

echo ">> size:   $(du -sh "$OUTDIR" | cut -f1)"

chmod +x prepare_postgresql.sh

./prepare_postgresql.sh

sudo cp -r postgresql-offline /opt/postgresql-offline

# Verify integrity:

cd /opt/postgresql-offline && sha256sum -c SHA256SUMS

# Register it as a local apt repo:

echo "deb [trusted=yes] file:/opt/postgresql-offline ./" \

   | sudo tee /etc/apt/sources.list.d/pg-offline.list

# Update using ONLY this source

sudo apt-get -o Dir::Etc::sourcelist="sources.list.d/pg-offline.list" \

             -o Dir::Etc::sourceparts="/dev/null" update

# Install

sudo apt-get install -y postgresql-16

# Configures PostgreSQL to start automatically whenever the system boots

sudo systemctl enable --now postgresql

# Setup login password

sudo -u postgres psql -c "ALTER USER postgres WITH PASSWORD '<your_password>';"

/etc/postgresql/16/main/

listen_addresses = '*'

hostssl    all             all             0.0.0.0/0            scram-sha-256

sudo systemctl restart postgresql

chmod +x prepare_postgresql.sh

./prepare_postgresql.sh

sudo cp -r postgresql-offline /opt/postgresql-offline

# Verify integrity:

cd /opt/postgresql-offline && sha256sum -c SHA256SUMS

# Disable the built-in module here too (it conflicts with PGDG)

sudo dnf -qy module disable postgresql

# Install

sudo dnf install -y \

       --disablerepo='*' \

       --repofrompath=pgoffline,/opt/postgresql-offline \

       --setopt=pgoffline.gpgcheck=0 \

       postgresql16-server postgresql16-contrib

# Configures PostgreSQL to start automatically whenever the system boots

sudo /usr/pgsql-16/bin/postgresql-16-setup initdb

# Configures PostgreSQL to start automatically whenever the system boots

sudo systemctl enable --now postgresql-16

# Setup login password

sudo -u postgres psql -c "ALTER USER postgres WITH PASSWORD '<your_password>';"

/var/lib/pgsql/16/data

listen_addresses = '*'

host    all             all             0.0.0.0/0            scram-sha-256

sudo systemctl restart postgresql-16