006: PostgreSQL 18 from official PGDG repo instead of Debian's PG 17

Per https://www.postgresql.org/download/linux/debian/ (manual configuration):
GPG key + deb822 sources (codename-pgdg) + postgresql-18. Skip-check now
requires an 18 cluster. Down also removes the PGDG repo.

README.md

@@ -46,7 +46,7 @@ For a private repo you need an auth strategy:
 | 003 | purge-exim4                | reclaim ~21MB RAM (package removed)           |
 | 004 | purge-haveged              | reclaim ~8MB RAM (package removed)            |
 | 005 | mount-pgdata               | /dev/sdb (20G) -> /var/lib/postgresql, fstab  |
-| 006 | install-postgres           | PG 17 cluster on the dedicated disk           |
+| 006 | install-postgres           | PG 18 via PGDG repo, cluster on the disk     |
 
 ## Roadmap
 

migrations/006-install-postgres.sh

@@ -1,33 +1,53 @@
 #!/usr/bin/env bash
-# 006-install-postgres - Install PostgreSQL (Debian 13 -> PG 17).
+# 006-install-postgres - PostgreSQL 18 from the official PGDG apt repository
+# (https://www.postgresql.org/download/linux/debian/ - "Manual configuration").
+# Debian 13's own repo only ships PG 17, hence the PGDG repo.
 # Must run after 005: with /var/lib/postgresql already being the dedicated
-# disk, the Debian installer creates the cluster directly on it - no
-# data_directory changes needed.
-# up:   apt install postgresql + contrib, cluster started/enabled
-# down: stop + purge packages and /etc/postgresql; data on disk is kept
+# disk, the 18/main cluster is created directly on it - no data_directory
+# changes needed. (Contrib modules ship in the server package since PG 10.)
+# up:   add PGDG repo (GPG key + deb822 sources) + install postgresql-18
+# down: stop + purge packages/config + remove PGDG repo; disk data is kept
 set -euo pipefail
 
 export DEBIAN_FRONTEND=noninteractive
 PGROOT=/var/lib/postgresql
+PGVER=18
+KEY=/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc
+SRC=/etc/apt/sources.list.d/pgdg.sources
 
 case "${1:-}" in
   up)
-    if command -v pg_lsclusters >/dev/null 2>&1 && pg_lsclusters --no-header | grep -q .; then
-      echo "    postgres cluster already present - skipping"
+    if command -v pg_lsclusters >/dev/null 2>&1 \
+       && pg_lsclusters --no-header | awk -v v="$PGVER" '$1==v' | grep -q .; then
+      echo "    postgres $PGVER cluster already present - skipping"
       exit 0
     fi
+    # --- PGDG repository: official "Manual configuration" steps ---
     apt-get update -qq
-    apt-get install -y postgresql postgresql-contrib >/dev/null
+    apt-get install -y curl ca-certificates postgresql-common >/dev/null
+    install -d "$(dirname "$KEY")"
+    curl --fail -o "$KEY" https://www.postgresql.org/media/keys/ACCC4CF8.asc
+    . /etc/os-release
+    cat > "$SRC" <<EOF
+Types: deb
+URIs: https://apt.postgresql.org/pub/repos/apt
+Suites: ${VERSION_CODENAME}-pgdg
+Components: main
+Signed-By: $KEY
+EOF
+    apt-get update -qq
+    # --- install: package creates 18/main directly on the dedicated disk ---
+    apt-get install -y "postgresql-$PGVER" >/dev/null
     chown postgres:postgres "$PGROOT"
     systemctl enable --now postgresql >/dev/null
     pg_isready -q
-    pg_lsclusters --no-header | while read -r _ _ _ _ _ datadir _; do
+    datadir=$(pg_lsclusters --no-header | awk -v v="$PGVER" '$1==v {print $6; exit}')
     if [[ $(findmnt -rn -o TARGET -T "$datadir") == "$PGROOT" ]]; then
       echo "    cluster data on dedicated disk: $datadir"
     else
-        echo "    WARNING: $datadir is NOT on the dedicated disk" >&2
+      echo "FATAL: $datadir is NOT on the dedicated disk - aborting" >&2
+      exit 1
     fi
-    done
     pg_lsclusters --no-header
     ;;
   down)
@@ -37,6 +57,7 @@ case "${1:-}" in
     apt-get purge -y 'postgresql*' >/dev/null
     apt-get autoremove --purge -y >/dev/null
     rm -rf /etc/postgresql
-    echo "    postgres stopped + packages purged (data kept under $PGROOT)"
+    rm -f "$SRC" "$KEY"
+    echo "    postgres stopped + packages purged + PGDG repo removed (data kept under $PGROOT)"
     ;;
 esac