Air-gapped

#!/usr/bin/env bash # # Build an offline PostgreSQL install bundle for an air-gapped host. # # Dependency resolution: apt resolves the FULL closure as if nothing were # installed (Dir::State::status -> an empty file), so the bundle is complete # regardless of what's on this build host - the apt equivalent of dnf's # --alldeps. The real system is never touched (download-only + a throwaway # status file). set -euo pipefail # ---- configuration --------------------------------------------------------- PG_VERSION="${PG_VERSION:-16}" # PostgreSQL major version INCLUDE_RECOMMENDS="${INCLUDE_RECOMMENDS:-yes}" # yes = bundle Recommends too PACKAGES=("postgresql-${PG_VERSION}" "postgresql-contrib") ARCH="$(dpkg --print-architecture)" . /etc/os-release CODENAME="${VERSION_CODENAME:?cannot detect release codename}" OUTDIR="$(pwd)/postgresql-offline" # Empty status file = "nothing is installed" -> apt downloads every dependency. EMPTY_STATUS="$(mktemp)" trap 'rm -f "$EMPTY_STATUS"' EXIT echo ">> target: PostgreSQL ${PG_VERSION} | ${ID:-?} ${CODENAME} | ${ARCH}" # ---- host tooling ---------------------------------------------------------- sudo apt-get update sudo apt-get install -y --no-install-recommends \ postgresql-common dpkg-dev ca-certificates # ---- PGDG repository (key + sources, configured once) ---------------------- # The official script configures BOTH the signing key and the deb822 sources # file for the right codename/arch. Don't also hand-write sources.list - doing # both is what causes "duplicate source" and key-mismatch errors. echo "" | sudo /usr/share/postgresql-common/pgdg/apt.postgresql.org.sh sudo apt-get update # ---- download packages + full dependency closure --------------------------- rm -rf "$OUTDIR" mkdir -p "$OUTDIR/partial" REC_FLAG="--no-install-recommends" [ "$INCLUDE_RECOMMENDS" = "yes" ] && REC_FLAG="--install-recommends" # Preview the complete closure (every .deb, base libs included). echo ">> resolving full dependency closure..." apt-get install --print-uris -y $REC_FLAG \ -o Dir::State::status="$EMPTY_STATUS" \ "${PACKAGES[@]}" \ | grep -oP "(?<=')[^']*\.deb" > "$OUTDIR/manifest.txt" || true echo ">> $(wc -l < "$OUTDIR/manifest.txt") package file(s) to download" # Download them. download-only + the empty status file means the real system # is never modified, but every dependency is fetched into the bundle. sudo apt-get install -y --download-only $REC_FLAG \ -o Dir::State::status="$EMPTY_STATUS" \ -o Dir::Cache::archives="$OUTDIR" \ "${PACKAGES[@]}" # apt leaves lock/partial artifacts behind - drop them and fix ownership. sudo rm -rf "$OUTDIR/partial" "$OUTDIR/lock" sudo chown -R "$(id -u):$(id -g)" "$OUTDIR" # ---- turn the folder into a local apt repo --------------------------------- # So the air-gapped install becomes a clean `apt-get install` that pulls only # what the target actually needs (far safer than `dpkg -i *.deb`). ( cd "$OUTDIR" \ && dpkg-scanpackages -m . /dev/null > Packages \ && gzip -9c Packages > Packages.gz ) # ---- integrity manifest ---------------------------------------------------- ( cd "$OUTDIR" && sha256sum *.deb > SHA256SUMS ) echo echo ">> done." echo ">> bundle: $OUTDIR" echo ">> files: $(ls "$OUTDIR"/*.deb | wc -l) .deb" echo ">> size: $(du -sh "$OUTDIR" | cut -f1)"

chmod +x prepare_postgresql.sh ./prepare_postgresql.sh

sudo cp -r postgresql-offline /opt/postgresql-offline

# Verify integrity: cd /opt/postgresql-offline && sha256sum -c SHA256SUMS # Register it as a local apt repo: echo "deb [trusted=yes] file:/opt/postgresql-offline ./" \ | sudo tee /etc/apt/sources.list.d/pg-offline.list # Update using ONLY this source sudo apt-get -o Dir::Etc::sourcelist="sources.list.d/pg-offline.list" \ -o Dir::Etc::sourceparts="/dev/null" update # Install sudo apt-get install -y postgresql-16 # Configures PostgreSQL to start automatically whenever the system boots sudo systemctl enable --now postgresql # Setup login password sudo -u postgres psql -c "ALTER USER postgres WITH PASSWORD '<your_password>';"

/etc/postgresql/16/main/

listen_addresses = '*'

hostssl all all 0.0.0.0/0 scram-sha-256

sudo systemctl restart postgresql

#!/usr/bin/env bash # # Build an offline PostgreSQL install bundle for an air-gapped Rocky/RHEL host. # # `dnf download --resolve --alldeps` pulls the FULL dependency closure # regardless of what's installed on this build host, so a clean machine is NOT # required for completeness. The cost is a larger bundle (it grabs base libs # too). The local-repo install step keeps that safe: on the target you # `dnf install <name>` and dnf installs only what's missing - it will NOT # force-downgrade your base system. set -euo pipefail # ---- configuration --------------------------------------------------------- PG_VERSION="${PG_VERSION:-16}" # PostgreSQL major version PACKAGES=("postgresql${PG_VERSION}-server" "postgresql${PG_VERSION}-contrib") ARCH="$(uname -m)" EL_VERSION="$(rpm -E %{rhel})" OUTDIR="$(pwd)/postgresql-offline" REPO_RPM="https://download.postgresql.org/pub/repos/yum/reporpms/EL-${EL_VERSION}-${ARCH}/pgdg-redhat-repo-latest.noarch.rpm" echo ">> target: PostgreSQL ${PG_VERSION} | EL${EL_VERSION} | ${ARCH}" # ---- build-host tooling ---------------------------------------------------- sudo dnf install -y dnf-plugins-core createrepo_c # ---- PGDG repository + disable the built-in AppStream module --------------- sudo dnf install -y "$REPO_RPM" sudo dnf -qy module disable postgresql # ---- download packages + full dependency closure --------------------------- # --resolve : also fetch dependencies # --alldeps : fetch them even if already installed here (= complete bundle) # Run as your normal user so the .rpm files aren't root-owned. rm -rf "$OUTDIR" mkdir -p "$OUTDIR" dnf download --resolve --alldeps --downloaddir "$OUTDIR" "${PACKAGES[@]}" # ---- turn the folder into a local dnf repo --------------------------------- # So the air-gapped install is a clean `dnf install <name>` with ordering and # dependency *selection* handled for you. Do NOT `dnf install *.rpm` - that # tries to install every base lib in the bundle and can downgrade the target. createrepo_c "$OUTDIR" # ---- bundle the PGDG GPG key + integrity manifest -------------------------- cp -f /etc/pki/rpm-gpg/*PGDG* "$OUTDIR"/ 2>/dev/null || true ( cd "$OUTDIR" && sha256sum *.rpm > SHA256SUMS ) echo echo ">> done." echo ">> bundle: $OUTDIR" echo ">> files: $(ls "$OUTDIR"/*.rpm | wc -l) .rpm" echo ">> size: $(du -sh "$OUTDIR" | cut -f1)"

chmod +x prepare_postgresql.sh ./prepare_postgresql.sh

sudo cp -r postgresql-offline /opt/postgresql-offline

# Verify integrity: cd /opt/postgresql-offline && sha256sum -c SHA256SUMS # Disable the built-in module here too (it conflicts with PGDG) sudo dnf -qy module disable postgresql # Install sudo dnf install -y \ --disablerepo='*' \ --repofrompath=pgoffline,/opt/postgresql-offline \ --setopt=pgoffline.gpgcheck=0 \ postgresql16-server postgresql16-contrib # Configures PostgreSQL to start automatically whenever the system boots sudo /usr/pgsql-16/bin/postgresql-16-setup initdb # Configures PostgreSQL to start automatically whenever the system boots sudo systemctl enable --now postgresql-16 # Setup login password sudo -u postgres psql -c "ALTER USER postgres WITH PASSWORD '<your_password>';"

/var/lib/pgsql/16/data

listen_addresses = '*'

host all all 0.0.0.0/0 scram-sha-256

sudo systemctl restart postgresql-16