perf(tuned): activate and configure zswap for postgresql tuned profile

ansible/tasks/setup-tuned.yml

@@ -99,6 +99,54 @@
       when:
         - ansible_facts['processor'][0] is search("GenuineIntel", ignorecase=True)
 
+    - name: tuned - Enable zswap if swap is present
+      when:
+        - ansible_facts['swaptotal_mb'] > 0
+      block:
+        - name: tuned - Decrease the kernel swappiness
+          become: true
+          community.general.ini_file:
+            create: true
+            group: 'root'
+            mode: '0644'
+            no_extra_spaces: true
+            option: 'vm.swappiness'
+            path: '/etc/tuned/profiles/postgresql/tuned.conf'
+            section: 'sysctl'
+            state: 'present'
+            value: 10
+
+        - name: tuned - Load zstd compressor module
+          become: true
+          community.general.modprobe:
+            name: 'zstd'
+            persistent: 'present'
+            state: 'present'
+
+        - name: tuned - Configure and enable zswap
+          ansible.builtin.shell:
+            cmd: "echo {{ zswap_item['value'] }}  > /sys/module/zswap/parameters/{{ zswap_item['param'] }}"
+          loop:
+            - { param: 'compressor',       value: 'zstd' }
+            - { param: 'max_pool_percent', value: '10' }
+            - { param: 'zpool',            value: 'zsmalloc' }
+            - { param: 'enabled',          value: 'Y' }
+          loop_control:
+            loop_var: 'zswap_item'
+
+        - name: tuned - Enable zswap at boot
+          become: true
+          community.general.ini_file:
+            create: true
+            group: 'root'
+            mode: '0644'
+            no_extra_spaces: true
+            option: 'cmdline_zswap'
+            path: '/etc/tuned/profiles/postgresql/tuned.conf'
+            section: 'bootloader'
+            state: 'present'
+            value: 'zswap.enabled=1 zswap.zpool=zsmalloc zswap.compressor=zstd zswap.max_pool_percent=10'
+
     - name: Activate the tuned service
       ansible.builtin.systemd_service:
         daemon_reload: true

ansible/vars.yml

@@ -10,9 +10,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.6.0.050-orioledb"
-  postgres17: "17.6.1.093"
-  postgres15: "15.14.1.093"
+  postgresorioledb-17: "17.6.0.052-orioledb"
+  postgres17: "17.6.1.095"
+  postgres15: "15.14.1.095"
 
 # Non Postgres Extensions
 pgbouncer_release: 1.25.1

audit-specs/baselines/ami-build/kernel-param.yml

@@ -0,0 +1,11 @@
+# kernel-param baseline for AMI build
+# Checks that critical kernel parameters haven't changed
+kernel-param:
+  vm.page-cluster:
+    value: '3'        # kernel default; assert to catch if kernel upgrade changes it
+  kernel.panic:
+    value: '10'       # set by setup-system.yml
+  vm.panic_on_oom:
+    value: '1'        # set by setup-system.yml
+  vm.swappiness:
+    value: '10'       # intentionally lowered from kernel default (60) for DB + zswap