From cb0fa4a0a2e66048622928c9a6a658dd951ac233 Mon Sep 17 00:00:00 2001
From: meiserloh <matthias.eiserloh@cloudogu.com>
Date: Thu, 24 Jul 2025 09:08:03 +0200
Subject: [PATCH 1/9] #52 - wip

---
 resources/post-upgrade.sh | 90 +++++++++++++++++++++++++++++++++++++--
 resources/pre-upgrade.sh  |  9 ++++
 resources/startup.sh      | 87 ++++++++++++++-----------------------
 resources/util.sh         | 31 ++++++++++++++
 4 files changed, 160 insertions(+), 57 deletions(-)
 create mode 100644 resources/util.sh

diff --git a/resources/post-upgrade.sh b/resources/post-upgrade.sh
index cee6695..19b6392 100755
--- a/resources/post-upgrade.sh
+++ b/resources/post-upgrade.sh
@@ -3,6 +3,9 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
+# shellcheck disable=SC1091
+source util.sh
+
 FROM_VERSION="${1}"
 TO_VERSION="${2}"
 
@@ -64,19 +67,25 @@ function versionXLessOrEqualThanY() {
 }
 
 function migrateConstraintsOnPartitionedTables() {
+  echo "#######7.1"
     while ! pg_isready >/dev/null; do
       # Postgres is not ready yet to accept connections
+echo "#######7.2"
       sleep 0.1
     done
+    echo "#######7.3"
     # get all tables
     psql -U postgres -c "SELECT d.datname as \"Name\" FROM pg_catalog.pg_database d;" -X > databases
     # there are four lines of sql result information (two at the start, two at the end)
+    echo "#######7.4"
     for i in $(seq 3 $(($(wc -l < databases) - 2 )));
     do
+      echo "#######7.5"
         DATABASE_NAME=$(sed "${i}!d" databases | xargs)
         # skip postgres default tables
         if [ "${DATABASE_NAME}" != "template0" ] && [ "${DATABASE_NAME}" != "template1" ] && [ "${DATABASE_NAME}" != "postgres" ]; then
             # https://www.postgresql.org/docs/14/release-14-14.html#:~:text=Fix%20updates%20of,perform%20each%20step.
+           echo "#######7.6"
             QUERY="SELECT conrelid::pg_catalog.regclass AS \"constrained table\",
                                               conname AS constraint,
                                               confrelid::pg_catalog.regclass AS \"references\",
@@ -93,79 +102,154 @@ function migrateConstraintsOnPartitionedTables() {
                                            WHERE (i.inhparent = c.conrelid OR i.inhparent = c.confrelid) AND
                                              EXISTS (SELECT 1 FROM pg_catalog.pg_partitioned_table
                                                      WHERE partrelid = i.inhparent));"
+             echo "#######7.7"
             psql -U postgres -c "${QUERY}"  -d "${DATABASE_NAME}" > result_queries
             # Do not run migration if result is empty
+            echo "#######7.7"
             if ! grep -q "0 rows" result_queries; then
+              echo "#######7.8"
                     echo "Found constraints on partitioned tables in database ${DATABASE_NAME} while performing the upgrade."
                     echo "Migrating ${DATABASE_NAME} now"
                     AMOUNT=$(wc -l < result_queries)
                     for (( i = 3; i < ((AMOUNT - 1)); i++ )); do
+                      echo "#######7.9"
                         IFS='|' read -ra ADDR <<< "$(sed "$((i))q;d" result_queries)"
                         echo "Migrating entry $((i - 2))/$(((AMOUNT - 4))) in table${ADDR[1]}"
                         # drop constraint query
                         psql -U postgres -c "${ADDR[3]}" -d "${DATABASE_NAME}" >> /dev/null
                         # readd constraint querysql_queries_test
+                        echo "#######7.10"
                         psql -U postgres -c "${ADDR[4]}" -d "${DATABASE_NAME}" >> /dev/null
                     done
             fi
         fi
     done
     # set config key so migration is only done once
+    echo "#######7.11"
     doguctl config migrated_database_constraints true
 }
 
 # see https://www.postgresql.org/docs/14/release-14-12.html#:~:text=Restrict%20visibility%20of,WITH%20ALLOW_CONNECTIONS%20false%3B for more information
 function restrictStatVisibility() {
+  echo "#######2.1"
     if [ ! -f /usr/share/postgresql/fix-CVE-2024-4317.sql ]; then
         return 0
     fi
 
+echo "#######2.2"
     while ! pg_isready >/dev/null; do
         # Postgres is not ready yet to accept connections
         sleep 0.1
     done
+    echo "#######2.3"
     # temporarily accept connections on template0
     psql -U postgres -c "ALTER DATABASE template0 WITH ALLOW_CONNECTIONS true;"
 
     # get all tables
+    echo "#######2.4"
     psql -U postgres -c "SELECT d.datname as \"Name\" FROM pg_catalog.pg_database d;" -X > databases
     # there are four lines of sql result information (two at the start, two at the end)
+    echo "#######2.5"
     for i in $(seq 3 $(($(wc -l < databases) - 2 ))); do
+      echo "#######2.6"
+      echo "####### i: ${i}"
         DATABASE_NAME=$(sed "${i}!d" databases | xargs)
+        echo "####### Database name: ${DATABASE_NAME}"
         psql -U postgres -d "${DATABASE_NAME}" -c "\i /usr/share/postgresql/fix-CVE-2024-4317.sql"
     done
-
+echo "#######2.7"
     # disable connections on template0
     psql -U postgres -c "ALTER DATABASE template0 WITH ALLOW_CONNECTIONS false;"
-
+echo "#######2.8"
     doguctl config restricted_stat_visibility true
 }
 
 function reindexAllDatabases() {
+    echo "#######5.1"
     while ! pg_isready >/dev/null; do
+      echo "#######5.2"
         # Postgres is not ready yet to accept connections
         sleep 0.1
     done
+    echo "#######5.3"
     reindexdb -U postgres --verbose --all
 }
+function startPostgresql() {
+    echo "start postgresql"
+    gosu postgres postgres &
+    PID=$!
+
+    while ! pg_isready >/dev/null; do
+      # Postgres is not ready yet to accept connections
+      sleep 0.1
+    done
+}
+
+function killPostgresql() {
+      # Kill postgres
+      pkill -P ${PID}
+      kill ${PID}
+
+      while pgrep -x postgres >/dev/null; do
+        # Postgres is still running
+        sleep 0.1
+      done
+      echo "postgresql successfully killed"
+}
+
+echo "#######1"
+isBackupAvailable=false
+if [ -e "${PGDATA}"/postgresqlFullBackup.dump ]; then
+    isBackupAvailable=true
+    # Moving backup and emptying PGDATA directory
+    mv "${PGDATA}"/postgresqlFullBackup.dump /tmp/postgresqlFullBackup.dump
+    # New PostgreSQL version requires completely empty folder
+
+    rm -rf "${PGDATA:?}"/.??*
+    rm -rf "${PGDATA:?}"/*
+
+    initializePostgreSQL
+fi
+
+startPostgresql
+
+if [ "${isBackupAvailable}" = "true" ]; then
+    echo "Restoring database dump..."
+    psql -U postgres -f /tmp/postgresqlFullBackup.dump postgres
+    rm /tmp/postgresqlFullBackup.dump
+    echo "Restoring database dump...complete!"
+fi
 
 if [[ $(doguctl config --default "false" restricted_stat_visibility) != "true" ]] ; then
     # Postgres 14.12 (Dogu Version 14.15-2) fixed an issue with the visibility of hidden statistics
     # since this fix comes after the version was released, always execute it if it was not executed before
     echo "Postgresql stats might be visible outside of their intended scope. Restricting stat visibility..."
+    echo "#######2"
     restrictStatVisibility
 fi
-
+echo "#######3"
 if [ "${FROM_VERSION}" = "${TO_VERSION}" ]; then
+    echo "#######4"
     echo "FROM and TO versions are the same; Exiting..."
+    doguctl config --rm "local_state"
     exit 0
 else
+  echo "#######5"
     echo "Postgresql version changed. Reindexing all databases..."
     reindexAllDatabases
 fi
 
+echo "#######6"
 if versionXLessOrEqualThanY "0.14.15-1" "0.${TO_VERSION}" && [[ $(doguctl config --default "false" migrated_database_constraints) != "true" ]] ; then
     # Postgres 14.14 (Dogu Version 14.15.x) fixed an issue with constraints on partitioned tables
     # If any partitioned tables have constraints on them, this migration removes and readds them
+    echo "#######7"
     migrateConstraintsOnPartitionedTables
 fi
+
+killPostgresql
+
+echo "Set registry flag so startup script can start afterwards..."
+doguctl config --rm "local_state"
+
+echo "Postgresql post-upgrade done"
diff --git a/resources/pre-upgrade.sh b/resources/pre-upgrade.sh
index caffd44..29030ce 100755
--- a/resources/pre-upgrade.sh
+++ b/resources/pre-upgrade.sh
@@ -14,3 +14,12 @@ if [[ "${TO_MAJOR_VERSION}" -gt "${FROM_MAJOR_VERSION}" ]]; then
     pg_dumpall -U postgres -f "${PGDATA}"/postgresqlFullBackup.dump
     echo "Finished dumping database"
 fi
+
+if [ "${FROM_VERSION}" = "${TO_VERSION}" ]; then
+  echo "FROM and TO versions are the same; Exiting..."
+  exit 0
+fi
+
+echo "Set registry flag so startup script waits for post-upgrade to finish..."
+doguctl config "local_state" "upgrading"
+
diff --git a/resources/startup.sh b/resources/startup.sh
index ce82657..85b7193 100755
--- a/resources/startup.sh
+++ b/resources/startup.sh
@@ -3,6 +3,9 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
+# shellcheck disable=SC1091
+source util.sh
+
 function mask2cidr() {
   local storedIFS="${IFS}"
   NBITS=0
@@ -77,32 +80,6 @@ function write_pg_hba_conf() {
   create_hba >"${PGDATA}"/pg_hba.conf
 }
 
-function initializePostgreSQL() {
-  # set stage for health check
-  doguctl state installing
-
-  # install database
-  gosu postgres initdb
-
-  # postgres user
-  POSTGRES_USER="postgres"
-
-  # store the user
-  doguctl config user "${POSTGRES_USER}"
-
-  # create random password
-  POSTGRES_PASSWORD=$(doguctl random)
-
-  # store the password encrypted
-  doguctl config -e password "${POSTGRES_PASSWORD}"
-
-  # open port
-  sed -ri "s/^#(listen_addresses\s*=\s*)\S+/\1'*'/" "$PGDATA"/postgresql.conf
-
-  # set generated password
-  echo "ALTER USER ${POSTGRES_USER} WITH SUPERUSER PASSWORD '${POSTGRES_PASSWORD}';" | gosu 2>/dev/null 1>&2 postgres postgres --single -jE
-}
-
 function waitForPostgreSQLStartup() {
   while ! pg_isready >/dev/null; do
     # Postgres is not ready yet to accept connections
@@ -149,38 +126,40 @@ function runMain() {
   mkdir -p /run/postgresql
   chown postgres:postgres /run/postgresql
 
-  if [ -z "$(ls -A "$PGDATA")" ]; then
-    initializePostgreSQL
-    write_pg_hba_conf
-  elif [ -e "${PGDATA}"/postgresqlFullBackup.dump ]; then
-    # Moving backup and emptying PGDATA directory
-    mv "${PGDATA}"/postgresqlFullBackup.dump /tmp/postgresqlFullBackup.dump
-    # New PostgreSQL version requires completely empty folder
-
-    rm -rf "${PGDATA:?}"/.??*
-    rm -rf "${PGDATA:?}"/*
+  # check whether post-upgrade script is still running
+  while [[ "$(doguctl config "local_state" -d "empty")" == "upgrading" ]]; do
+    echo "Upgrade script is running. Waiting..."
+    sleep 3
+  done
 
+  if [ -z "$(ls -A "$PGDATA")" ]; then
     initializePostgreSQL
-
-    echo "Restoring database dump..."
-    # Start postgres to restore backup
-    gosu postgres postgres &
-    PID=$!
-    waitForPostgreSQLStartup
-    # Restore backup
-    psql -U postgres -f /tmp/postgresqlFullBackup.dump postgres
-    rm /tmp/postgresqlFullBackup.dump
-    # Kill postgres
-    pkill -P ${PID}
-    kill ${PID}
-    waitForPostgreSQLShutdown
-    echo "Database dump successfully restored"
-
-    write_pg_hba_conf
-  else
-    write_pg_hba_conf
+#  elif [ -e "${PGDATA}"/postgresqlFullBackup.dump ]; then
+#    # Moving backup and emptying PGDATA directory
+#    mv "${PGDATA}"/postgresqlFullBackup.dump /tmp/postgresqlFullBackup.dump
+#    # New PostgreSQL version requires completely empty folder
+#
+#    rm -rf "${PGDATA:?}"/.??*
+#    rm -rf "${PGDATA:?}"/*
+#
+#    initializePostgreSQL
+#
+#    echo "Restoring database dump..."
+#    # Start postgres to restore backup
+#    gosu postgres postgres &
+#    PID=$!
+#    waitForPostgreSQLStartup
+#    # Restore backup
+#    psql -U postgres -f /tmp/postgresqlFullBackup.dump postgres
+#    rm /tmp/postgresqlFullBackup.dump
+#    # Kill postgres
+#    pkill -P ${PID}
+#    kill ${PID}
+#    waitForPostgreSQLShutdown
+#    echo "Database dump successfully restored"
   fi
 
+  write_pg_hba_conf
   setDoguLogLevel
 
   # set stage for health check
diff --git a/resources/util.sh b/resources/util.sh
new file mode 100644
index 0000000..10e83c5
--- /dev/null
+++ b/resources/util.sh
@@ -0,0 +1,31 @@
+#!/bin/bash
+set -o errexit
+set -o nounset
+set -o pipefail
+
+
+function initializePostgreSQL() {
+  # set stage for health check
+  doguctl state installing
+
+  # install database
+  gosu postgres initdb
+
+  # postgres user
+  POSTGRES_USER="postgres"
+
+  # store the user
+  doguctl config user "${POSTGRES_USER}"
+
+  # create random password
+  POSTGRES_PASSWORD=$(doguctl random)
+
+  # store the password encrypted
+  doguctl config -e password "${POSTGRES_PASSWORD}"
+
+  # open port
+  sed -ri "s/^#(listen_addresses\s*=\s*)\S+/\1'*'/" "$PGDATA"/postgresql.conf
+
+  # set generated password
+  echo "ALTER USER ${POSTGRES_USER} WITH SUPERUSER PASSWORD '${POSTGRES_PASSWORD}';" | gosu 2>/dev/null 1>&2 postgres postgres --single -jE
+}
\ No newline at end of file

From 921e3b87559600e2556ed2903f1a414d5a654cb2 Mon Sep 17 00:00:00 2001
From: Robert Auer <robert.auer@cloudogu.com>
Date: Thu, 24 Jul 2025 11:23:22 +0200
Subject: [PATCH 2/9] Remove debug output; #52

---
 resources/post-upgrade.sh | 34 +---------------------------------
 resources/startup.sh      | 23 -----------------------
 2 files changed, 1 insertion(+), 56 deletions(-)

diff --git a/resources/post-upgrade.sh b/resources/post-upgrade.sh
index 19b6392..755bb49 100755
--- a/resources/post-upgrade.sh
+++ b/resources/post-upgrade.sh
@@ -67,25 +67,19 @@ function versionXLessOrEqualThanY() {
 }
 
 function migrateConstraintsOnPartitionedTables() {
-  echo "#######7.1"
     while ! pg_isready >/dev/null; do
       # Postgres is not ready yet to accept connections
-echo "#######7.2"
       sleep 0.1
     done
-    echo "#######7.3"
     # get all tables
     psql -U postgres -c "SELECT d.datname as \"Name\" FROM pg_catalog.pg_database d;" -X > databases
     # there are four lines of sql result information (two at the start, two at the end)
-    echo "#######7.4"
     for i in $(seq 3 $(($(wc -l < databases) - 2 )));
     do
-      echo "#######7.5"
         DATABASE_NAME=$(sed "${i}!d" databases | xargs)
         # skip postgres default tables
         if [ "${DATABASE_NAME}" != "template0" ] && [ "${DATABASE_NAME}" != "template1" ] && [ "${DATABASE_NAME}" != "postgres" ]; then
             # https://www.postgresql.org/docs/14/release-14-14.html#:~:text=Fix%20updates%20of,perform%20each%20step.
-           echo "#######7.6"
             QUERY="SELECT conrelid::pg_catalog.regclass AS \"constrained table\",
                                               conname AS constraint,
                                               confrelid::pg_catalog.regclass AS \"references\",
@@ -102,76 +96,57 @@ echo "#######7.2"
                                            WHERE (i.inhparent = c.conrelid OR i.inhparent = c.confrelid) AND
                                              EXISTS (SELECT 1 FROM pg_catalog.pg_partitioned_table
                                                      WHERE partrelid = i.inhparent));"
-             echo "#######7.7"
             psql -U postgres -c "${QUERY}"  -d "${DATABASE_NAME}" > result_queries
             # Do not run migration if result is empty
-            echo "#######7.7"
             if ! grep -q "0 rows" result_queries; then
-              echo "#######7.8"
                     echo "Found constraints on partitioned tables in database ${DATABASE_NAME} while performing the upgrade."
                     echo "Migrating ${DATABASE_NAME} now"
                     AMOUNT=$(wc -l < result_queries)
                     for (( i = 3; i < ((AMOUNT - 1)); i++ )); do
-                      echo "#######7.9"
                         IFS='|' read -ra ADDR <<< "$(sed "$((i))q;d" result_queries)"
                         echo "Migrating entry $((i - 2))/$(((AMOUNT - 4))) in table${ADDR[1]}"
                         # drop constraint query
                         psql -U postgres -c "${ADDR[3]}" -d "${DATABASE_NAME}" >> /dev/null
                         # readd constraint querysql_queries_test
-                        echo "#######7.10"
                         psql -U postgres -c "${ADDR[4]}" -d "${DATABASE_NAME}" >> /dev/null
                     done
             fi
         fi
     done
     # set config key so migration is only done once
-    echo "#######7.11"
     doguctl config migrated_database_constraints true
 }
 
 # see https://www.postgresql.org/docs/14/release-14-12.html#:~:text=Restrict%20visibility%20of,WITH%20ALLOW_CONNECTIONS%20false%3B for more information
 function restrictStatVisibility() {
-  echo "#######2.1"
     if [ ! -f /usr/share/postgresql/fix-CVE-2024-4317.sql ]; then
         return 0
     fi
 
-echo "#######2.2"
     while ! pg_isready >/dev/null; do
         # Postgres is not ready yet to accept connections
         sleep 0.1
     done
-    echo "#######2.3"
     # temporarily accept connections on template0
     psql -U postgres -c "ALTER DATABASE template0 WITH ALLOW_CONNECTIONS true;"
 
     # get all tables
-    echo "#######2.4"
     psql -U postgres -c "SELECT d.datname as \"Name\" FROM pg_catalog.pg_database d;" -X > databases
     # there are four lines of sql result information (two at the start, two at the end)
-    echo "#######2.5"
     for i in $(seq 3 $(($(wc -l < databases) - 2 ))); do
-      echo "#######2.6"
-      echo "####### i: ${i}"
         DATABASE_NAME=$(sed "${i}!d" databases | xargs)
-        echo "####### Database name: ${DATABASE_NAME}"
         psql -U postgres -d "${DATABASE_NAME}" -c "\i /usr/share/postgresql/fix-CVE-2024-4317.sql"
     done
-echo "#######2.7"
     # disable connections on template0
     psql -U postgres -c "ALTER DATABASE template0 WITH ALLOW_CONNECTIONS false;"
-echo "#######2.8"
     doguctl config restricted_stat_visibility true
 }
 
 function reindexAllDatabases() {
-    echo "#######5.1"
     while ! pg_isready >/dev/null; do
-      echo "#######5.2"
         # Postgres is not ready yet to accept connections
         sleep 0.1
     done
-    echo "#######5.3"
     reindexdb -U postgres --verbose --all
 }
 function startPostgresql() {
@@ -197,14 +172,13 @@ function killPostgresql() {
       echo "postgresql successfully killed"
 }
 
-echo "#######1"
 isBackupAvailable=false
 if [ -e "${PGDATA}"/postgresqlFullBackup.dump ]; then
     isBackupAvailable=true
     # Moving backup and emptying PGDATA directory
     mv "${PGDATA}"/postgresqlFullBackup.dump /tmp/postgresqlFullBackup.dump
-    # New PostgreSQL version requires completely empty folder
 
+    # New PostgreSQL version requires completely empty folder
     rm -rf "${PGDATA:?}"/.??*
     rm -rf "${PGDATA:?}"/*
 
@@ -224,26 +198,20 @@ if [[ $(doguctl config --default "false" restricted_stat_visibility) != "true" ]
     # Postgres 14.12 (Dogu Version 14.15-2) fixed an issue with the visibility of hidden statistics
     # since this fix comes after the version was released, always execute it if it was not executed before
     echo "Postgresql stats might be visible outside of their intended scope. Restricting stat visibility..."
-    echo "#######2"
     restrictStatVisibility
 fi
-echo "#######3"
 if [ "${FROM_VERSION}" = "${TO_VERSION}" ]; then
-    echo "#######4"
     echo "FROM and TO versions are the same; Exiting..."
     doguctl config --rm "local_state"
     exit 0
 else
-  echo "#######5"
     echo "Postgresql version changed. Reindexing all databases..."
     reindexAllDatabases
 fi
 
-echo "#######6"
 if versionXLessOrEqualThanY "0.14.15-1" "0.${TO_VERSION}" && [[ $(doguctl config --default "false" migrated_database_constraints) != "true" ]] ; then
     # Postgres 14.14 (Dogu Version 14.15.x) fixed an issue with constraints on partitioned tables
     # If any partitioned tables have constraints on them, this migration removes and readds them
-    echo "#######7"
     migrateConstraintsOnPartitionedTables
 fi
 
diff --git a/resources/startup.sh b/resources/startup.sh
index 85b7193..93069f0 100755
--- a/resources/startup.sh
+++ b/resources/startup.sh
@@ -134,29 +134,6 @@ function runMain() {
 
   if [ -z "$(ls -A "$PGDATA")" ]; then
     initializePostgreSQL
-#  elif [ -e "${PGDATA}"/postgresqlFullBackup.dump ]; then
-#    # Moving backup and emptying PGDATA directory
-#    mv "${PGDATA}"/postgresqlFullBackup.dump /tmp/postgresqlFullBackup.dump
-#    # New PostgreSQL version requires completely empty folder
-#
-#    rm -rf "${PGDATA:?}"/.??*
-#    rm -rf "${PGDATA:?}"/*
-#
-#    initializePostgreSQL
-#
-#    echo "Restoring database dump..."
-#    # Start postgres to restore backup
-#    gosu postgres postgres &
-#    PID=$!
-#    waitForPostgreSQLStartup
-#    # Restore backup
-#    psql -U postgres -f /tmp/postgresqlFullBackup.dump postgres
-#    rm /tmp/postgresqlFullBackup.dump
-#    # Kill postgres
-#    pkill -P ${PID}
-#    kill ${PID}
-#    waitForPostgreSQLShutdown
-#    echo "Database dump successfully restored"
   fi
 
   write_pg_hba_conf

From 527f9c2bb867af5850e653ced12cff347d817561 Mon Sep 17 00:00:00 2001
From: Robert Auer <robert.auer@cloudogu.com>
Date: Thu, 24 Jul 2025 11:43:33 +0200
Subject: [PATCH 3/9] Fix wording; #52

---
 resources/post-upgrade.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/resources/post-upgrade.sh b/resources/post-upgrade.sh
index 755bb49..fb61c7d 100755
--- a/resources/post-upgrade.sh
+++ b/resources/post-upgrade.sh
@@ -217,7 +217,7 @@ fi
 
 killPostgresql
 
-echo "Set registry flag so startup script can start afterwards..."
+echo "Removing local_state registry flag so startup script can start afterwards..."
 doguctl config --rm "local_state"
 
 echo "Postgresql post-upgrade done"

From a70c86cc8f0f27960d464d0ce45356a8a5b5676d Mon Sep 17 00:00:00 2001
From: Robert Auer <robert.auer@cloudogu.com>
Date: Thu, 24 Jul 2025 11:56:25 +0200
Subject: [PATCH 4/9] Add yq dependency for bats test make target

---
 Makefile           | 3 ++-
 build/make/bats.mk | 4 ++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/Makefile b/Makefile
index e74bdd7..1415548 100644
--- a/Makefile
+++ b/Makefile
@@ -5,6 +5,7 @@ MAKEFILES_VERSION=9.5.0
 include build/make/variables.mk
 include build/make/self-update.mk
 include build/make/release.mk
+include build/make/k8s.mk
 include build/make/bats.mk
 include build/make/k8s-dogu.mk
-include build/make/prerelease.mk
\ No newline at end of file
+include build/make/prerelease.mk
diff --git a/build/make/bats.mk b/build/make/bats.mk
index 7e73553..912f819 100644
--- a/build/make/bats.mk
+++ b/build/make/bats.mk
@@ -34,7 +34,7 @@ $(BASH_SRC):
 ${BASH_TEST_REPORT_DIR}: $(TARGET_DIR)
 	@mkdir -p $(BASH_TEST_REPORT_DIR)
 
-unit-test-shell-ci: $(BASH_SRC) $(BASH_TEST_REPORT_DIR) $(BATS_ASSERT) $(BATS_MOCK) $(BATS_SUPPORT) $(BATS_FILE)
+unit-test-shell-ci: ${BINARY_YQ} $(BASH_SRC) $(BASH_TEST_REPORT_DIR) $(BATS_ASSERT) $(BATS_MOCK) $(BATS_SUPPORT) $(BATS_FILE)
 	@echo "Test shell units on CI server"
 	@make unit-test-shell-generic
 
@@ -61,4 +61,4 @@ buildTestImage:
 		--build-arg=BATS_BASE_IMAGE=${BATS_BASE_IMAGE} \
 		--build-arg=BATS_TAG=${BATS_TAG} \
 		-t ${BATS_CUSTOM_IMAGE}:${BATS_TAG} \
-		.
\ No newline at end of file
+		.

From ef675f58d2212fbfa3d86db0c83af73ffd32ac84 Mon Sep 17 00:00:00 2001
From: Robert Auer <robert.auer@cloudogu.com>
Date: Thu, 24 Jul 2025 12:14:01 +0200
Subject: [PATCH 5/9] Revert "Add yq dependency for bats test make target"

This did not fix the bats test errors.

This reverts commit a70c86cc8f0f27960d464d0ce45356a8a5b5676d.
---
 Makefile           | 3 +--
 build/make/bats.mk | 4 ++--
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/Makefile b/Makefile
index 1415548..e74bdd7 100644
--- a/Makefile
+++ b/Makefile
@@ -5,7 +5,6 @@ MAKEFILES_VERSION=9.5.0
 include build/make/variables.mk
 include build/make/self-update.mk
 include build/make/release.mk
-include build/make/k8s.mk
 include build/make/bats.mk
 include build/make/k8s-dogu.mk
-include build/make/prerelease.mk
+include build/make/prerelease.mk
\ No newline at end of file
diff --git a/build/make/bats.mk b/build/make/bats.mk
index 912f819..7e73553 100644
--- a/build/make/bats.mk
+++ b/build/make/bats.mk
@@ -34,7 +34,7 @@ $(BASH_SRC):
 ${BASH_TEST_REPORT_DIR}: $(TARGET_DIR)
 	@mkdir -p $(BASH_TEST_REPORT_DIR)
 
-unit-test-shell-ci: ${BINARY_YQ} $(BASH_SRC) $(BASH_TEST_REPORT_DIR) $(BATS_ASSERT) $(BATS_MOCK) $(BATS_SUPPORT) $(BATS_FILE)
+unit-test-shell-ci: $(BASH_SRC) $(BASH_TEST_REPORT_DIR) $(BATS_ASSERT) $(BATS_MOCK) $(BATS_SUPPORT) $(BATS_FILE)
 	@echo "Test shell units on CI server"
 	@make unit-test-shell-generic
 
@@ -61,4 +61,4 @@ buildTestImage:
 		--build-arg=BATS_BASE_IMAGE=${BATS_BASE_IMAGE} \
 		--build-arg=BATS_TAG=${BATS_TAG} \
 		-t ${BATS_CUSTOM_IMAGE}:${BATS_TAG} \
-		.
+		.
\ No newline at end of file

From 47809c4866d147921be4587172dbc8f8b4b32c59 Mon Sep 17 00:00:00 2001
From: meiserloh <matthias.eiserloh@cloudogu.com>
Date: Thu, 24 Jul 2025 13:58:55 +0200
Subject: [PATCH 6/9] #52 - fix bats tests

---
 resources/post-upgrade.sh | 8 ++++----
 resources/startup.sh      | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/resources/post-upgrade.sh b/resources/post-upgrade.sh
index 19b6392..3701d65 100755
--- a/resources/post-upgrade.sh
+++ b/resources/post-upgrade.sh
@@ -4,7 +4,7 @@ set -o nounset
 set -o pipefail
 
 # shellcheck disable=SC1091
-source util.sh
+source "$(dirname "${BASH_SOURCE[0]}")/util.sh"
 
 FROM_VERSION="${1}"
 TO_VERSION="${2}"
@@ -157,10 +157,10 @@ echo "#######2.2"
         echo "####### Database name: ${DATABASE_NAME}"
         psql -U postgres -d "${DATABASE_NAME}" -c "\i /usr/share/postgresql/fix-CVE-2024-4317.sql"
     done
-echo "#######2.7"
+    echo "#######2.7"
     # disable connections on template0
     psql -U postgres -c "ALTER DATABASE template0 WITH ALLOW_CONNECTIONS false;"
-echo "#######2.8"
+    echo "#######2.8"
     doguctl config restricted_stat_visibility true
 }
 
@@ -234,7 +234,7 @@ if [ "${FROM_VERSION}" = "${TO_VERSION}" ]; then
     doguctl config --rm "local_state"
     exit 0
 else
-  echo "#######5"
+    echo "#######5"
     echo "Postgresql version changed. Reindexing all databases..."
     reindexAllDatabases
 fi
diff --git a/resources/startup.sh b/resources/startup.sh
index 85b7193..e20e529 100755
--- a/resources/startup.sh
+++ b/resources/startup.sh
@@ -4,7 +4,7 @@ set -o nounset
 set -o pipefail
 
 # shellcheck disable=SC1091
-source util.sh
+source "$(dirname "${BASH_SOURCE[0]}")/util.sh"
 
 function mask2cidr() {
   local storedIFS="${IFS}"

From 5d7f1e9c4bdc41d3616b1dff15fbc57a1596d199 Mon Sep 17 00:00:00 2001
From: meiserloh <matthias.eiserloh@cloudogu.com>
Date: Thu, 24 Jul 2025 14:01:08 +0200
Subject: [PATCH 7/9] #52 - Add changelog

---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e626cc3..3d0d32e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+### Fixed
+- [#53] Fix race condition between startup script and post upgrade script
 
 ## [v14.17-2] - 2025-04-24
 

From 1af8e7224c629c7cda56acfd4b240b0211ada1f8 Mon Sep 17 00:00:00 2001
From: meiserloh <matthias.eiserloh@cloudogu.com>
Date: Thu, 24 Jul 2025 15:42:15 +0200
Subject: [PATCH 8/9] #52 - Add bats tests for pre and post upgrade scripts

---
 batsTests/post-upgrade.bats | 290 ++++++++++++++++++++++++++++++++++++
 batsTests/pre-upgrade.bats  |  64 ++++++++
 resources/post-upgrade.sh   | 198 +++++++++++++-----------
 resources/pre-upgrade.sh    |  38 +++--
 4 files changed, 483 insertions(+), 107 deletions(-)
 create mode 100755 batsTests/post-upgrade.bats
 create mode 100755 batsTests/pre-upgrade.bats

diff --git a/batsTests/post-upgrade.bats b/batsTests/post-upgrade.bats
new file mode 100755
index 0000000..43f7415
--- /dev/null
+++ b/batsTests/post-upgrade.bats
@@ -0,0 +1,290 @@
+#! /bin/bash
+# Bind an unbound BATS variables that fail all tests when combined with 'set -o nounset'
+export BATS_TEST_START_TIME="0"
+export BATSLIB_FILE_PATH_REM=""
+export BATSLIB_FILE_PATH_ADD=""
+
+load '/workspace/target/bats_libs/bats-support/load.bash'
+load '/workspace/target/bats_libs/bats-assert/load.bash'
+load '/workspace/target/bats_libs/bats-mock/load.bash'
+load '/workspace/target/bats_libs/bats-file/load.bash'
+
+setup() {
+  doguctl="$(mock_create)"
+  export doguctl
+  export PATH="${BATS_TMPDIR}:${PATH}"
+  mkdir ${BATS_TMPDIR}/postgresql_bats
+  export PGDATA="${BATS_TMPDIR}/postgresql_bats"
+
+  ln -s "${doguctl}" "${BATS_TMPDIR}/doguctl"
+}
+
+teardown() {
+  /bin/rm "${BATS_TMPDIR}/doguctl"
+  /bin/rm -r "${BATS_TMPDIR}/postgresql_bats"
+}
+
+@test "versionXLessOrEqualThanY() should return true for versions less than or equal to another" {
+  source /workspace/resources/post-upgrade.sh
+
+  run versionXLessOrEqualThanY "1.0.0-1" "1.0.0-1"
+  assert_success
+  run versionXLessOrEqualThanY "1.0.0-1" "1.0.0-2"
+  assert_success
+  run versionXLessOrEqualThanY "1.0.0-1" "1.1.0-2"
+  assert_success
+  run versionXLessOrEqualThanY "1.0.0-1" "1.0.2-2"
+  assert_success
+  run versionXLessOrEqualThanY "1.0.0-1" "1.0.0-2"
+  assert_success
+  run versionXLessOrEqualThanY "1.1.0-1" "1.1.0-2"
+  assert_success
+  run versionXLessOrEqualThanY "1.0.2-1" "1.0.2-2"
+  assert_success
+  run versionXLessOrEqualThanY "1.2.3-4" "1.2.3-4"
+  assert_success
+  run versionXLessOrEqualThanY "1.2.3-4" "1.2.3-5"
+  assert_success
+
+  run versionXLessOrEqualThanY "1.0.0-1" "2.0.0-1"
+  assert_success
+  run versionXLessOrEqualThanY "1.0.0-1" "2.1.0-1"
+  assert_success
+  run versionXLessOrEqualThanY "1.0.0-1" "2.0.1-1"
+  assert_success
+  run versionXLessOrEqualThanY "1.0.0-1" "2.1.1-1"
+  assert_success
+  run versionXLessOrEqualThanY "5.1.3-1" "5.1.3-1"
+  assert_success
+}
+
+@test "versionXLessOrEqualThanY() should return false for versions greater than another" {
+  source /workspace/resources/post-upgrade.sh
+
+  run versionXLessOrEqualThanY "0.0.0-10" "0.0.0-9"
+  assert_failure
+  run versionXLessOrEqualThanY "1.0.0-1" "0.0.0-9"
+  assert_failure
+  run versionXLessOrEqualThanY "1.0.0-1" "0.0.9-9"
+  assert_failure
+  run versionXLessOrEqualThanY "1.0.0-1" "0.9.9-9"
+  assert_failure
+  run versionXLessOrEqualThanY "1.0.0-0" "0.9.9-9"
+  assert_failure
+  run versionXLessOrEqualThanY "1.1.0-1" "0.0.0-9"
+  assert_failure
+  run versionXLessOrEqualThanY "1.0.0-1" "0.0.9-9"
+  assert_failure
+  run versionXLessOrEqualThanY "1.0.0-1" "0.9.9-9"
+  assert_failure
+  run versionXLessOrEqualThanY "1.0.0-0" "0.9.9-9"
+  assert_failure
+
+  run versionXLessOrEqualThanY "1.2.3-4" "0.1.2-3"
+  assert_failure
+  run versionXLessOrEqualThanY "1.2.3-5" "0.1.2-3"
+  assert_failure
+
+  run versionXLessOrEqualThanY "2.0.0-1" "1.0.0-1"
+  assert_failure
+  run versionXLessOrEqualThanY "2.1.0-1" "1.0.0-1"
+  assert_failure
+  run versionXLessOrEqualThanY "2.0.1-1" "1.0.0-1"
+  assert_failure
+  run versionXLessOrEqualThanY "2.1.1-1" "1.0.0-1"
+  assert_failure
+}
+
+@test "runPostUpgrade should exit early if no version change" {
+  source /workspace/resources/post-upgrade.sh
+
+  # Mock the functions
+  startPostgresql() {
+    echo "startPostgresql is mocked"
+  }
+
+  mock_set_output "${doguctl}" "true" 1
+  mock_set_status "${doguctl}" 0 2
+  run runPostUpgrade "1.0.0-1" "1.0.0-1"
+
+  assert_success
+  assert_equal "$(mock_get_call_num "${doguctl}")" "2"
+  assert_line "startPostgresql is mocked"
+  assert_line "FROM and TO versions are the same; Exiting..."
+}
+
+@test "runPostUpgrade should also restrict stat visibility if no version change" {
+  source /workspace/resources/post-upgrade.sh
+
+  # Mock the functions
+  startPostgresql() {
+    echo "startPostgresql is mocked"
+  }
+  restrictStatVisibility() {
+    echo "restrictStatVisibility is mocked"
+  }
+
+  mock_set_output "${doguctl}" "false" 1
+  mock_set_status "${doguctl}" 0 2
+  run runPostUpgrade "1.0.0-1" "1.0.0-1"
+
+  assert_success
+  assert_equal "$(mock_get_call_num "${doguctl}")" "2"
+  assert_line "startPostgresql is mocked"
+  assert_line "Postgresql stats might be visible outside of their intended scope. Restricting stat visibility..."
+  assert_line "restrictStatVisibility is mocked"
+  assert_line "FROM and TO versions are the same; Exiting..."
+}
+
+@test "runPostUpgrade should reindexAllDatabases on version upgrade" {
+  source /workspace/resources/post-upgrade.sh
+
+  # Mock the functions
+  startPostgresql() {
+    echo "startPostgresql is mocked"
+  }
+  reindexAllDatabases() {
+    echo "reindexAllDatabases is mocked"
+  }
+  versionXLessOrEqualThanY() {
+    echo "versionXLessOrEqualThanY is mocked"
+    return 0
+  }
+  killPostgresql() {
+    echo "killPostgresql is mocked"
+  }
+
+  mock_set_output "${doguctl}" "true" 1
+  mock_set_output "${doguctl}" "true" 2
+  mock_set_status "${doguctl}" 0 3
+  run runPostUpgrade "1.0.0-1" "2.0.0-1"
+
+  assert_success
+  assert_equal "$(mock_get_call_num "${doguctl}")" "3"
+  assert_line "startPostgresql is mocked"
+  assert_line "Postgresql version changed. Reindexing all databases..."
+  assert_line "reindexAllDatabases is mocked"
+  assert_line "versionXLessOrEqualThanY is mocked"
+  assert_line "killPostgresql is mocked"
+}
+
+@test "runPostUpgrade should restrict stats visibility if not already restricted" {
+  source /workspace/resources/post-upgrade.sh
+
+  # Mock the functions
+  startPostgresql() {
+    echo "startPostgresql is mocked"
+  }
+  restrictStatVisibility() {
+    echo "restrictStatVisibility is mocked"
+  }
+  reindexAllDatabases() {
+    echo "reindexAllDatabases is mocked"
+  }
+  versionXLessOrEqualThanY() {
+    echo "versionXLessOrEqualThanY is mocked"
+    return 0
+  }
+  killPostgresql() {
+    echo "killPostgresql is mocked"
+  }
+
+  # stats not yet restricted
+  mock_set_output "${doguctl}" "false" 1
+  mock_set_output "${doguctl}" "true" 2
+  mock_set_status "${doguctl}" 0 3
+  run runPostUpgrade "1.0.0-1" "2.0.0-1"
+
+  assert_success
+  assert_equal "$(mock_get_call_num "${doguctl}")" "3"
+  assert_line "startPostgresql is mocked"
+  assert_line "Postgresql stats might be visible outside of their intended scope. Restricting stat visibility..."
+  assert_line "restrictStatVisibility is mocked"
+  assert_line "reindexAllDatabases is mocked"
+  assert_line "versionXLessOrEqualThanY is mocked"
+  assert_line "killPostgresql is mocked"
+}
+
+@test "runPostUpgrade should restore db dump if dump file exists" {
+  source /workspace/resources/post-upgrade.sh
+
+  # Mock the functions
+  prepareForBackup() {
+    echo "prepareForBackup is mocked"
+    isBackupAvailable=true
+  }
+  startPostgresql() {
+    echo "startPostgresql is mocked"
+  }
+  restoreBackup() {
+    echo "restoreBackup is mocked"
+  }
+  reindexAllDatabases() {
+    echo "reindexAllDatabases is mocked"
+  }
+  versionXLessOrEqualThanY() {
+    echo "versionXLessOrEqualThanY is mocked"
+    return 0
+  }
+  killPostgresql() {
+    echo "killPostgresql is mocked"
+  }
+
+  tmpfile="${PGDATA}/postgresqlFullBackup.dump"
+  touch "$tmpfile"  # Create the file
+
+
+  # stats not yet restricted
+  mock_set_output "${doguctl}" "true" 1
+  mock_set_output "${doguctl}" "true" 2
+  mock_set_status "${doguctl}" 0 3
+  run runPostUpgrade "1.0.0-1" "2.0.0-1"
+
+  assert_success
+  assert_equal "$(mock_get_call_num "${doguctl}")" "3"
+  assert_line "prepareForBackup is mocked"
+  assert_line "startPostgresql is mocked"
+  assert_line "restoreBackup is mocked"
+  assert_line "reindexAllDatabases is mocked"
+  assert_line "versionXLessOrEqualThanY is mocked"
+  assert_line "killPostgresql is mocked"
+
+  # Cleanup: Remove the file
+  rm "$tmpfile"
+}
+
+@test "runPostUpgrade should migrateConstraintsOnPartitionedTables if not yet migrated" {
+  source /workspace/resources/post-upgrade.sh
+
+  # Mock the functions
+  startPostgresql() {
+    echo "startPostgresql is mocked"
+  }
+  reindexAllDatabases() {
+    echo "reindexAllDatabases is mocked"
+  }
+  versionXLessOrEqualThanY() {
+    echo "versionXLessOrEqualThanY is mocked"
+    return 0
+  }
+  migrateConstraintsOnPartitionedTables() {
+    echo "migrateConstraintsOnPartitionedTables is mocked"
+  }
+  killPostgresql() {
+    echo "killPostgresql is mocked"
+  }
+
+  mock_set_output "${doguctl}" "true" 1
+  mock_set_output "${doguctl}" "false" 2
+  mock_set_status "${doguctl}" 0 3
+  run runPostUpgrade "1.0.0-1" "2.0.0-1"
+
+  assert_success
+  assert_equal "$(mock_get_call_num "${doguctl}")" "3"
+  assert_line "startPostgresql is mocked"
+  assert_line "Postgresql version changed. Reindexing all databases..."
+  assert_line "reindexAllDatabases is mocked"
+  assert_line "versionXLessOrEqualThanY is mocked"
+  assert_line "migrateConstraintsOnPartitionedTables is mocked"
+  assert_line "killPostgresql is mocked"
+}
diff --git a/batsTests/pre-upgrade.bats b/batsTests/pre-upgrade.bats
new file mode 100755
index 0000000..3261a60
--- /dev/null
+++ b/batsTests/pre-upgrade.bats
@@ -0,0 +1,64 @@
+#! /bin/bash
+# Bind an unbound BATS variables that fail all tests when combined with 'set -o nounset'
+export BATS_TEST_START_TIME="0"
+export BATSLIB_FILE_PATH_REM=""
+export BATSLIB_FILE_PATH_ADD=""
+
+load '/workspace/target/bats_libs/bats-support/load.bash'
+load '/workspace/target/bats_libs/bats-assert/load.bash'
+load '/workspace/target/bats_libs/bats-mock/load.bash'
+load '/workspace/target/bats_libs/bats-file/load.bash'
+
+setup() {
+  pg_dumpall="$(mock_create)"
+  doguctl="$(mock_create)"
+  export pg_dumpall
+  export doguctl
+  export PATH="${BATS_TMPDIR}:${PATH}"
+  export PGDATA="/var/lib/postgresql"
+  ln -s "${pg_dumpall}" "${BATS_TMPDIR}/pg_dumpall"
+  ln -s "${doguctl}" "${BATS_TMPDIR}/doguctl"
+}
+
+teardown() {
+  rm "${BATS_TMPDIR}/pg_dumpall"
+  rm "${BATS_TMPDIR}/doguctl"
+}
+
+@test "runPreUpgrade should do nothing on equal versions" {
+  source /workspace/resources/pre-upgrade.sh
+
+  run runPreUpgrade "1.0.0-1" "1.0.0-1"
+
+  assert_success
+  assert_equal "$(mock_get_call_num "${pg_dumpall}")" "0"
+  assert_equal "$(mock_get_call_num "${doguctl}")" "0"
+  assert_line 'FROM and TO versions are the same; Exiting...'
+}
+
+@test "runPreUpgrade should just set local_state on minor upgrade" {
+  source /workspace/resources/pre-upgrade.sh
+  mock_set_status "${doguctl}" 0
+
+  run runPreUpgrade "1.0.0-1" "1.1.0-1"
+
+  assert_success
+  assert_equal "$(mock_get_call_num "${pg_dumpall}")" "0"
+  assert_equal "$(mock_get_call_num "${doguctl}")" "1"
+  assert_line 'Set registry flag so startup script waits for post-upgrade to finish...'
+}
+
+@test "runPreUpgrade should set local_state and save dump on major upgrade" {
+  source /workspace/resources/pre-upgrade.sh
+  mock_set_status "${doguctl}" 0
+  mock_set_status "${pg_dumpall}" 0
+
+  run runPreUpgrade "1.0.0-1" "2.0.0-1"
+
+  assert_success
+  assert_equal "$(mock_get_call_num "${pg_dumpall}")" "1"
+  assert_equal "$(mock_get_call_num "${doguctl}")" "1"
+  assert_line "Dumping database to /var/lib/postgresql/postgresqlFullBackup.dump..."
+  assert_line "Finished dumping database"
+  assert_line 'Set registry flag so startup script waits for post-upgrade to finish...'
+}
diff --git a/resources/post-upgrade.sh b/resources/post-upgrade.sh
index 9fb3db7..9e36b27 100755
--- a/resources/post-upgrade.sh
+++ b/resources/post-upgrade.sh
@@ -6,8 +6,68 @@ set -o pipefail
 # shellcheck disable=SC1091
 source "$(dirname "${BASH_SOURCE[0]}")/util.sh"
 
-FROM_VERSION="${1}"
-TO_VERSION="${2}"
+function prepareForBackup() {
+    isBackupAvailable=true
+    # Moving backup and emptying PGDATA directory
+    mv "${PGDATA}"/postgresqlFullBackup.dump /tmp/postgresqlFullBackup.dump
+
+    # New PostgreSQL version requires completely empty folder
+    rm -rf "${PGDATA:?}"/.??*
+    rm -rf "${PGDATA:?}"/*
+
+    initializePostgreSQL
+}
+
+function startPostgresql() {
+    echo "start postgresql"
+    gosu postgres postgres &
+    PID=$!
+
+    while ! pg_isready >/dev/null; do
+      # Postgres is not ready yet to accept connections
+      sleep 0.1
+    done
+}
+
+function restoreBackup() {
+    echo "Restoring database dump..."
+    psql -U postgres -f /tmp/postgresqlFullBackup.dump postgres
+    rm /tmp/postgresqlFullBackup.dump
+    echo "Restoring database dump...complete!"
+}
+
+# see https://www.postgresql.org/docs/14/release-14-12.html#:~:text=Restrict%20visibility%20of,WITH%20ALLOW_CONNECTIONS%20false%3B for more information
+function restrictStatVisibility() {
+    if [ ! -f /usr/share/postgresql/fix-CVE-2024-4317.sql ]; then
+        return 0
+    fi
+
+    while ! pg_isready >/dev/null; do
+        # Postgres is not ready yet to accept connections
+        sleep 0.1
+    done
+    # temporarily accept connections on template0
+    psql -U postgres -c "ALTER DATABASE template0 WITH ALLOW_CONNECTIONS true;"
+
+    # get all tables
+    psql -U postgres -c "SELECT d.datname as \"Name\" FROM pg_catalog.pg_database d;" -X > databases
+    # there are four lines of sql result information (two at the start, two at the end)
+    for i in $(seq 3 $(($(wc -l < databases) - 2 ))); do
+        DATABASE_NAME=$(sed "${i}!d" databases | xargs)
+        psql -U postgres -d "${DATABASE_NAME}" -c "\i /usr/share/postgresql/fix-CVE-2024-4317.sql"
+    done
+    # disable connections on template0
+    psql -U postgres -c "ALTER DATABASE template0 WITH ALLOW_CONNECTIONS false;"
+    doguctl config restricted_stat_visibility true
+}
+
+function reindexAllDatabases() {
+    while ! pg_isready >/dev/null; do
+        # Postgres is not ready yet to accept connections
+        sleep 0.1
+    done
+    reindexdb -U postgres --verbose --all
+}
 
 # versionXLessOrEqualThanY returns true if X is less than or equal to Y; otherwise false
 function versionXLessOrEqualThanY() {
@@ -117,107 +177,63 @@ function migrateConstraintsOnPartitionedTables() {
     doguctl config migrated_database_constraints true
 }
 
-# see https://www.postgresql.org/docs/14/release-14-12.html#:~:text=Restrict%20visibility%20of,WITH%20ALLOW_CONNECTIONS%20false%3B for more information
-function restrictStatVisibility() {
-    if [ ! -f /usr/share/postgresql/fix-CVE-2024-4317.sql ]; then
-        return 0
-    fi
-
-    while ! pg_isready >/dev/null; do
-        # Postgres is not ready yet to accept connections
-        sleep 0.1
-    done
-    # temporarily accept connections on template0
-    psql -U postgres -c "ALTER DATABASE template0 WITH ALLOW_CONNECTIONS true;"
-
-    # get all tables
-    psql -U postgres -c "SELECT d.datname as \"Name\" FROM pg_catalog.pg_database d;" -X > databases
-    # there are four lines of sql result information (two at the start, two at the end)
-    for i in $(seq 3 $(($(wc -l < databases) - 2 ))); do
-        DATABASE_NAME=$(sed "${i}!d" databases | xargs)
-        psql -U postgres -d "${DATABASE_NAME}" -c "\i /usr/share/postgresql/fix-CVE-2024-4317.sql"
-    done
-    # disable connections on template0
-    psql -U postgres -c "ALTER DATABASE template0 WITH ALLOW_CONNECTIONS false;"
-    doguctl config restricted_stat_visibility true
-}
-
-function reindexAllDatabases() {
-    while ! pg_isready >/dev/null; do
-        # Postgres is not ready yet to accept connections
-        sleep 0.1
-    done
-    reindexdb -U postgres --verbose --all
-}
-function startPostgresql() {
-    echo "start postgresql"
-    gosu postgres postgres &
-    PID=$!
+function killPostgresql() {
+    # Kill postgres
+    pkill -P ${PID}
+    kill ${PID}
 
-    while ! pg_isready >/dev/null; do
-      # Postgres is not ready yet to accept connections
+    while pgrep -x postgres >/dev/null; do
+      # Postgres is still running
       sleep 0.1
     done
+    echo "postgresql successfully killed"
 }
 
-function killPostgresql() {
-      # Kill postgres
-      pkill -P ${PID}
-      kill ${PID}
+function runPostUpgrade() {
+    FROM_VERSION="${1}"
+    TO_VERSION="${2}"
 
-      while pgrep -x postgres >/dev/null; do
-        # Postgres is still running
-        sleep 0.1
-      done
-      echo "postgresql successfully killed"
-}
+    isBackupAvailable=false
+    if [ -e "${PGDATA}"/postgresqlFullBackup.dump ]; then
+        prepareForBackup
+    fi
 
-isBackupAvailable=false
-if [ -e "${PGDATA}"/postgresqlFullBackup.dump ]; then
-    isBackupAvailable=true
-    # Moving backup and emptying PGDATA directory
-    mv "${PGDATA}"/postgresqlFullBackup.dump /tmp/postgresqlFullBackup.dump
+    startPostgresql
 
-    # New PostgreSQL version requires completely empty folder
-    rm -rf "${PGDATA:?}"/.??*
-    rm -rf "${PGDATA:?}"/*
+    if [ "${isBackupAvailable}" = "true" ]; then
+        restoreBackup
+    fi
 
-    initializePostgreSQL
-fi
+    if [[ $(doguctl config --default "false" restricted_stat_visibility) != "true" ]] ; then
+        # Postgres 14.12 (Dogu Version 14.15-2) fixed an issue with the visibility of hidden statistics
+        # since this fix comes after the version was released, always execute it if it was not executed before
+        echo "Postgresql stats might be visible outside of their intended scope. Restricting stat visibility..."
+        restrictStatVisibility
+    fi
+    if [ "${FROM_VERSION}" = "${TO_VERSION}" ]; then
+        echo "FROM and TO versions are the same; Exiting..."
+        doguctl config --rm "local_state"
+        exit 0
+    else
+        echo "Postgresql version changed. Reindexing all databases..."
+        reindexAllDatabases
+    fi
 
-startPostgresql
+    if versionXLessOrEqualThanY "0.14.15-1" "0.${TO_VERSION}" && [[ $(doguctl config --default "false" migrated_database_constraints) != "true" ]] ; then
+        # Postgres 14.14 (Dogu Version 14.15.x) fixed an issue with constraints on partitioned tables
+        # If any partitioned tables have constraints on them, this migration removes and readds them
+        migrateConstraintsOnPartitionedTables
+    fi
 
-if [ "${isBackupAvailable}" = "true" ]; then
-    echo "Restoring database dump..."
-    psql -U postgres -f /tmp/postgresqlFullBackup.dump postgres
-    rm /tmp/postgresqlFullBackup.dump
-    echo "Restoring database dump...complete!"
-fi
+    killPostgresql
 
-if [[ $(doguctl config --default "false" restricted_stat_visibility) != "true" ]] ; then
-    # Postgres 14.12 (Dogu Version 14.15-2) fixed an issue with the visibility of hidden statistics
-    # since this fix comes after the version was released, always execute it if it was not executed before
-    echo "Postgresql stats might be visible outside of their intended scope. Restricting stat visibility..."
-    restrictStatVisibility
-fi
-if [ "${FROM_VERSION}" = "${TO_VERSION}" ]; then
-    echo "FROM and TO versions are the same; Exiting..."
+    echo "Removing local_state registry flag so startup script can start afterwards..."
     doguctl config --rm "local_state"
-    exit 0
-else
-    echo "Postgresql version changed. Reindexing all databases..."
-    reindexAllDatabases
-fi
-
-if versionXLessOrEqualThanY "0.14.15-1" "0.${TO_VERSION}" && [[ $(doguctl config --default "false" migrated_database_constraints) != "true" ]] ; then
-    # Postgres 14.14 (Dogu Version 14.15.x) fixed an issue with constraints on partitioned tables
-    # If any partitioned tables have constraints on them, this migration removes and readds them
-    migrateConstraintsOnPartitionedTables
-fi
 
-killPostgresql
-
-echo "Removing local_state registry flag so startup script can start afterwards..."
-doguctl config --rm "local_state"
+    echo "Postgresql post-upgrade done"
+}
 
-echo "Postgresql post-upgrade done"
+# make the script only run when executed, not when sourced from bats tests
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+    runPostUpgrade "$@"
+fi
diff --git a/resources/pre-upgrade.sh b/resources/pre-upgrade.sh
index 29030ce..3dadfe3 100755
--- a/resources/pre-upgrade.sh
+++ b/resources/pre-upgrade.sh
@@ -3,23 +3,29 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-FROM_VERSION="${1}"
-TO_VERSION="${2}"
-FROM_MAJOR_VERSION=$(echo "${FROM_VERSION}" | cut -d '.' -f1)
-TO_MAJOR_VERSION=$(echo "${TO_VERSION}" | cut -d '.' -f1)
+function runPreUpgrade() {
+  FROM_VERSION="${1}"
+  TO_VERSION="${2}"
+  FROM_MAJOR_VERSION=$(echo "${FROM_VERSION}" | cut -d '.' -f1)
+  TO_MAJOR_VERSION=$(echo "${TO_VERSION}" | cut -d '.' -f1)
 
-# dump database if TO_MAJOR_VERSION is higher than FROM_MAJOR_VERSION
-if [[ "${TO_MAJOR_VERSION}" -gt "${FROM_MAJOR_VERSION}" ]]; then
-    echo "Dumping database to ${PGDATA}/postgresqlFullBackup.dump..."
-    pg_dumpall -U postgres -f "${PGDATA}"/postgresqlFullBackup.dump
-    echo "Finished dumping database"
-fi
+  # dump database if TO_MAJOR_VERSION is higher than FROM_MAJOR_VERSION
+  if [[ "${TO_MAJOR_VERSION}" -gt "${FROM_MAJOR_VERSION}" ]]; then
+      echo "Dumping database to ${PGDATA}/postgresqlFullBackup.dump..."
+      pg_dumpall -U postgres -f "${PGDATA}"/postgresqlFullBackup.dump
+      echo "Finished dumping database"
+  fi
 
-if [ "${FROM_VERSION}" = "${TO_VERSION}" ]; then
-  echo "FROM and TO versions are the same; Exiting..."
-  exit 0
-fi
+  if [ "${FROM_VERSION}" = "${TO_VERSION}" ]; then
+    echo "FROM and TO versions are the same; Exiting..."
+    exit 0
+  fi
 
-echo "Set registry flag so startup script waits for post-upgrade to finish..."
-doguctl config "local_state" "upgrading"
+  echo "Set registry flag so startup script waits for post-upgrade to finish..."
+  doguctl config "local_state" "upgrading"
+}
 
+# make the script only run when executed, not when sourced from bats tests
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+  runPreUpgrade "$@"
+fi

From b84afc11645d18f0e67dc352ee13865e4a9790fd Mon Sep 17 00:00:00 2001
From: meiserloh <matthias.eiserloh@cloudogu.com>
Date: Thu, 24 Jul 2025 15:50:21 +0200
Subject: [PATCH 9/9] #52 - Clarified log output

---
 resources/post-upgrade.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/resources/post-upgrade.sh b/resources/post-upgrade.sh
index 9e36b27..84402e4 100755
--- a/resources/post-upgrade.sh
+++ b/resources/post-upgrade.sh
@@ -186,7 +186,7 @@ function killPostgresql() {
       # Postgres is still running
       sleep 0.1
     done
-    echo "postgresql successfully killed"
+    echo "postgresql successfully killed (this is expected during post upgrade)"
 }
 
 function runPostUpgrade() {