fix(ansible): move pgBackRest spool-path off the 10GB root volume

pgBackRest's spool-path was never set explicitly, so it defaulted to
/var/spool/pgbackrest on the AMI's 10GB root volume instead of /data
(the dedicated EBS volume PGDATA lives on).

Sets spool-path = /data/pgbackrest_spool in the ansible-managed
pgbackrest.conf, and updates the AppArmor profile to allow writes
there.

The AMI-bake-time directory-creation task added here does not create
this directory on any live instance's real /data -- that volume is
always a separately-provisioned EBS volume attached at real instance
launch, never part of the AMI image at any Packer stage. So the config
value and the AppArmor grant here are correct and needed groundwork,
but on their own they do not make archive-async safe to enable
anywhere in the fleet. The real fix is a runtime mechanism, tracked at
INDATA-1153.

Author: hunleyd

ansible/files/pgbackrest_config/pgbackrest.conf

@@ -13,6 +13,8 @@ log-level-console = info
 log-level-file = detail
 log-subprocess = y
 resume = n
+# spool-path shares a filesystem with pg_wal so archive-get can hand off WAL segments via rename instead of copy; only reachable once archive-async is enabled. The matching AppArmor grants live in ansible/files/postgresql_config/sbpostgres_apparmor and the audit exclusion in nix/packages/supascan/internal/config/defaults.go -- keep this path in sync across those, plus the directory-creation loop entry in ansible/tasks/setup-pgbackrest.yml (bake-time only; see INDATA-1153 for why that alone doesn't create this directory on any live instance's real /data).
+spool-path = /data/pgbackrest_spool
 start-fast = y
 # Note: the [supabase] stanza (pg1-path, pg1-socket-path, pg1-user) has been
 # removed from this file. supabase-admin-agent owns that stanza and writes it

ansible/files/postgresql_config/sbpostgres_apparmor

@@ -127,7 +127,9 @@ profile sbpostgres flags=(attach_disconnected) {
         /var/lib/postgresql/data/standby.signal rw,
         /var/lib/pgbackrest rw,
         /etc/pgbackrest/conf.d/** rw,
-        /var/spool/pgbackrest/** rw,
+        # bare-dir grant needed alongside ** (same as /data/pgdata/pg_wal/) since ** doesn't cover the directory inode itself; path must match spool-path in ansible/files/pgbackrest_config/pgbackrest.conf, which has the full cross-file sync note
+        /data/pgbackrest_spool/ rw,
+        /data/pgbackrest_spool/** rw,
         /var/log/pgbackrest/** rw,
         /etc/** r,
         /usr/local/** r,
@@ -190,7 +192,9 @@ profile sbpostgres flags=(attach_disconnected) {
         /var/lib/postgresql/data/standby.signal rw,
         /var/lib/pgbackrest rw,
         /etc/pgbackrest/conf.d/** rw,
-        /var/spool/pgbackrest/** rw,
+        # bare-dir grant needed alongside ** (same as /data/pgdata/pg_wal/) since ** doesn't cover the directory inode itself; path must match spool-path in ansible/files/pgbackrest_config/pgbackrest.conf, which has the full cross-file sync note
+        /data/pgbackrest_spool/ rw,
+        /data/pgbackrest_spool/** rw,
         /var/log/pgbackrest/** rw,
         /etc/** r,
         /usr/local/** r,

ansible/tasks/setup-pgbackrest.yml

@@ -47,7 +47,8 @@
     # (running as the pgbackrest user) cannot read conf files created by adminapi.
     - {dir: /etc/pgbackrest/conf.d, mode: '02770'}
     - {dir: /var/lib/pgbackrest}
-    - {dir: /var/spool/pgbackrest}
+    # setgid (02770), same reason as conf.d above (postgres_shell and pgbackrest_shell both write here per sbpostgres_apparmor); must match spool-path in pgbackrest.conf; bake-time only, see INDATA-1153 for why that alone doesn't create this on any live instance's real /data
+    - {dir: /data/pgbackrest_spool, mode: '02770'}
     - {dir: /var/log/pgbackrest}
   loop_control:
     loop_var: backrest_dir

nix/packages/supascan/internal/config/defaults.go

@@ -63,6 +63,9 @@ var DefaultExclusions = Config{
 		// PostgreSQL data directory - contents are dynamic database state
 		"/data/pgdata",
 
+		// pgBackRest spool - transient WAL archive-get/archive-push queue, not durable state
+		"/data/pgbackrest_spool",
+
 		// Deployment/provisioning tools - internal implementation details
 		"/opt/saltstack",