005/006: mount /dev/sdb at /var/lib/postgresql + install PostgreSQL 17 on it

README.md

@@ -45,9 +45,10 @@ For a private repo you need an auth strategy:
 | 002 | disable-networkd-dispatcher| reclaim ~27MB RAM                             |
 | 003 | purge-exim4                | reclaim ~21MB RAM (package removed)           |
 | 004 | purge-haveged              | reclaim ~8MB RAM (package removed)            |
+| 005 | mount-pgdata               | /dev/sdb (20G) -> /var/lib/postgresql, fstab  |
+| 006 | install-postgres           | PG 17 cluster on the dedicated disk           |
 
 ## Roadmap
 
-- `005-install-postgres` - install PostgreSQL + create cluster
 - `010-tune-postgres` - 1GB tuning (shared_buffers=128MB, work_mem=4MB,
   max_connections=30, ...)

migrations/005-mount-pgdata.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# 005-mount-pgdata - Mount the dedicated 20G data disk (/dev/sdb, ext4)
+# at /var/lib/postgresql so the PostgreSQL cluster lives on its own disk.
+# Mounted by UUID (stable across device reordering), noatime for DB workload.
+# up:   fstab entry + mount (idempotent; refuses if mountpoint holds data)
+# down: unmount + remove fstab entry (data on the disk is preserved)
+set -euo pipefail
+
+DISK_UUID=d44ad362-947a-46de-acbf-5530f83e4506
+MOUNTPOINT=/var/lib/postgresql
+FSTAB_LINE="UUID=$DISK_UUID $MOUNTPOINT ext4 defaults,noatime 0 2"
+
+case "${1:-}" in
+  up)
+    if findmnt -rn "$MOUNTPOINT" >/dev/null; then
+      echo "    $MOUNTPOINT already mounted - skipping"
+      exit 0
+    fi
+    dev=$(findfs UUID="$DISK_UUID") || {
+      echo "disk with UUID=$DISK_UUID not found - is /dev/sdb attached?" >&2
+      exit 1
+    }
+    # Never mount over existing data - it would be silently hidden
+    if [[ -d $MOUNTPOINT ]] && find "$MOUNTPOINT" -mindepth 1 -print -quit | grep -q .; then
+      echo "refusing to mount: $MOUNTPOINT exists and is not empty" >&2
+      exit 1
+    fi
+    mkdir -p "$MOUNTPOINT"
+    grep -q "^UUID=$DISK_UUID" /etc/fstab || echo "$FSTAB_LINE" >> /etc/fstab
+    mount "$MOUNTPOINT"   # via fstab entry - also validates it
+    echo "    $dev mounted at $MOUNTPOINT (noatime, fstab entry added)"
+    ;;
+  down)
+    # sysmig rolls back in reverse order, so 006 (postgres) is already down
+    if findmnt -rn "$MOUNTPOINT" >/dev/null; then umount "$MOUNTPOINT"; fi
+    sed -i "\|^UUID=$DISK_UUID|d" /etc/fstab
+    rmdir "$MOUNTPOINT" 2>/dev/null || true   # keep dir if data remains
+    echo "    $MOUNTPOINT unmounted + fstab entry removed (disk data kept)"
+    ;;
+esac

migrations/006-install-postgres.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# 006-install-postgres - Install PostgreSQL (Debian 13 -> PG 17).
+# Must run after 005: with /var/lib/postgresql already being the dedicated
+# disk, the Debian installer creates the cluster directly on it - no
+# data_directory changes needed.
+# up:   apt install postgresql + contrib, cluster started/enabled
+# down: stop + purge packages and /etc/postgresql; data on disk is kept
+set -euo pipefail
+
+export DEBIAN_FRONTEND=noninteractive
+PGROOT=/var/lib/postgresql
+
+case "${1:-}" in
+  up)
+    if command -v pg_lsclusters >/dev/null 2>&1 && pg_lsclusters --no-header | grep -q .; then
+      echo "    postgres cluster already present - skipping"
+      exit 0
+    fi
+    apt-get update -qq
+    apt-get install -y postgresql postgresql-contrib >/dev/null
+    chown postgres:postgres "$PGROOT"
+    systemctl enable --now postgresql >/dev/null
+    pg_isready -q
+    pg_lsclusters --no-header | while read -r _ _ _ _ _ datadir _; do
+      if findmnt -rn "$datadir" >/dev/null; then
+        echo "    cluster data on dedicated disk: $datadir"
+      else
+        echo "    WARNING: $datadir is NOT on the dedicated disk" >&2
+      fi
+    done
+    pg_lsclusters --no-header
+    ;;
+  down)
+    { pg_lsclusters --no-header 2>/dev/null || true; } | while read -r ver name _; do
+      pg_ctlcluster "$ver" "$name" stop 2>/dev/null || true
+    done
+    apt-get purge -y 'postgresql*' >/dev/null
+    apt-get autoremove --purge -y >/dev/null
+    rm -rf /etc/postgresql
+    echo "    postgres stopped + packages purged (data kept under $PGROOT)"
+    ;;
+esac