Fudge apparmor

.devcontainer/setup-ha.sh

@@ -343,17 +343,11 @@ configure_and_start_postgres() {
   local postgres_slug="$1"
 
   log "Configuring PostgreSQL addon..."
-  # POSTGRES_INITDB_ARGS=--no-sync makes first-boot initdb skip the recursive
-  # fsync of the data directory. That fsync is the dominant cost of first-time
-  # initialisation and on slow CI storage it pushes startup past the postgres
-  # add-on's hard 2-minute "Postgres did not start" timeout. --no-sync is the
-  # documented, test-oriented option and is safe here because this is an
-  # ephemeral dev/CI database where durability does not matter.
   local options_json
   options_json=$(jq -n \
     --arg pw "$POSTGRES_PASSWORD" \
     --arg db "$POSTGRES_DB" \
-    '{options: {POSTGRES_PASSWORD: $pw, POSTGRES_DB: $db, POSTGRES_INITDB_ARGS: "--no-sync", env_vars: []}}')
+    '{options: {POSTGRES_PASSWORD: $pw, POSTGRES_DB: $db, env_vars: []}}')
 
   supervisor_api_post "/addons/${postgres_slug}/options" \
     "${options_json}" > /dev/null

.github/workflows/integration-test.yaml

@@ -48,10 +48,20 @@ jobs:
             fi
             echo "::endgroup::" >&2
             echo "::group::Start Supervisor" >&2
+            # AppArmor profile enforcement on add-on containers makes the
+            # PostgreSQL add-on's first-boot initdb file I/O so slow it blows
+            # past that add-on's hard 2-minute startup timeout on GitHub Actions
+            # runners. SUPERVISOR_UNCONFINED only unconfines the Supervisor
+            # itself, not the add-ons it launches, so instead stub apparmor_parser
+            # to a no-op and mount it into the Supervisor's privileged container.
+            # Add-on profiles are then never loaded and add-ons run effectively
+            # unconfined (matches the proven ha-addon-ghostfolio CI setup).
+            printf '#!/bin/sh\nexit 0\n' | sudo tee /usr/sbin/apparmor_parser > /dev/null && sudo chmod +x /usr/sbin/apparmor_parser
+            sudo sed -i 's|docker run --rm --privileged|docker run --rm --privileged -v /usr/sbin/apparmor_parser:/usr/sbin/apparmor_parser:ro|' /usr/bin/supervisor_run
             if [ -n "${DEBUG:-}" ]; then
-              SUPERVISOR_UNCONFINED=1 supervisor_run &
+              supervisor_run &
             else
-              SUPERVISOR_UNCONFINED=1 supervisor_run > /dev/null 2>&1 &
+              supervisor_run > /dev/null 2>&1 &
             fi
             echo "::endgroup::" >&2
             bash .devcontainer/setup-ha.sh