From e5e379a38350bea7745ea7df4efaccc55af1dd55 Mon Sep 17 00:00:00 2001
From: Colin Seymour <colin@symr.io>
Date: Mon, 15 Jun 2026 16:09:56 +0000
Subject: [PATCH] Fudge apparmor

---
 .devcontainer/setup-ha.sh               |  8 +-------
 .github/workflows/integration-test.yaml | 14 ++++++++++++--
 2 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/.devcontainer/setup-ha.sh b/.devcontainer/setup-ha.sh
index d1425a5..0a6db63 100755
--- a/.devcontainer/setup-ha.sh
+++ b/.devcontainer/setup-ha.sh
@@ -343,17 +343,11 @@ configure_and_start_postgres() {
   local postgres_slug="$1"
 
   log "Configuring PostgreSQL addon..."
-  # POSTGRES_INITDB_ARGS=--no-sync makes first-boot initdb skip the recursive
-  # fsync of the data directory. That fsync is the dominant cost of first-time
-  # initialisation and on slow CI storage it pushes startup past the postgres
-  # add-on's hard 2-minute "Postgres did not start" timeout. --no-sync is the
-  # documented, test-oriented option and is safe here because this is an
-  # ephemeral dev/CI database where durability does not matter.
   local options_json
   options_json=$(jq -n \
     --arg pw "$POSTGRES_PASSWORD" \
     --arg db "$POSTGRES_DB" \
-    '{options: {POSTGRES_PASSWORD: $pw, POSTGRES_DB: $db, POSTGRES_INITDB_ARGS: "--no-sync", env_vars: []}}')
+    '{options: {POSTGRES_PASSWORD: $pw, POSTGRES_DB: $db, env_vars: []}}')
 
   supervisor_api_post "/addons/${postgres_slug}/options" \
     "${options_json}" > /dev/null
diff --git a/.github/workflows/integration-test.yaml b/.github/workflows/integration-test.yaml
index c539bf8..70245d2 100644
--- a/.github/workflows/integration-test.yaml
+++ b/.github/workflows/integration-test.yaml
@@ -48,10 +48,20 @@ jobs:
             fi
             echo "::endgroup::" >&2
             echo "::group::Start Supervisor" >&2
+            # AppArmor profile enforcement on add-on containers makes the
+            # PostgreSQL add-on's first-boot initdb file I/O so slow it blows
+            # past that add-on's hard 2-minute startup timeout on GitHub Actions
+            # runners. SUPERVISOR_UNCONFINED only unconfines the Supervisor
+            # itself, not the add-ons it launches, so instead stub apparmor_parser
+            # to a no-op and mount it into the Supervisor's privileged container.
+            # Add-on profiles are then never loaded and add-ons run effectively
+            # unconfined (matches the proven ha-addon-ghostfolio CI setup).
+            printf '#!/bin/sh\nexit 0\n' | sudo tee /usr/sbin/apparmor_parser > /dev/null && sudo chmod +x /usr/sbin/apparmor_parser
+            sudo sed -i 's|docker run --rm --privileged|docker run --rm --privileged -v /usr/sbin/apparmor_parser:/usr/sbin/apparmor_parser:ro|' /usr/bin/supervisor_run
             if [ -n "${DEBUG:-}" ]; then
-              SUPERVISOR_UNCONFINED=1 supervisor_run &
+              supervisor_run &
             else
-              SUPERVISOR_UNCONFINED=1 supervisor_run > /dev/null 2>&1 &
+              supervisor_run > /dev/null 2>&1 &
             fi
             echo "::endgroup::" >&2
             bash .devcontainer/setup-ha.sh