feat(mx): add pg_upgrade script for PostgreSQL 14 → 16 migration

Temporary upgrade script following the official NixOS procedure.
Run `upgrade-pg-cluster --jobs 4 --link` on the server, then switch
the package to postgresql_16 and remove the script.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

systems/x86_64-linux/mx/default.nix

@@ -118,18 +118,6 @@
       };
       wantedBy = [ "default.target" ];
     };
-  };
-
-  systemd.timers = {
-    check_boot = {
-      timerConfig = {
-        OnCalendar = "daily";
-      };
-      wantedBy = [ "timers.target" ];
-    };
-  };
-
-  systemd.services = {
     check_root = {
       serviceConfig = {
         Type = "oneshot";
@@ -140,7 +128,7 @@
             THRESHOLD=85
 
             if [ "$CURRENT" -gt "$THRESHOLD" ] ; then
-                ${pkgs.mailutils}/bin/mail -s '/boot Disk Space Alert' harald << EOF
+                ${pkgs.mailutils}/bin/mail -s '/ Disk Space Alert' harald << EOF
             Your root partition remaining free space is critically low. Used: $CURRENT%
             EOF
             fi
@@ -152,6 +140,12 @@
   };
 
   systemd.timers = {
+    check_boot = {
+      timerConfig = {
+        OnCalendar = "daily";
+      };
+      wantedBy = [ "timers.target" ];
+    };
     check_root = {
       timerConfig = {
         OnCalendar = "daily";

systems/x86_64-linux/mx/mailserver.nix

@@ -242,8 +242,7 @@
     hostName = "webmail.hoyer.xyz";
     plugins = [ "managesieve" ];
     extraConfig = ''
-      # starttls needed for authentication, so the fqdn required to match
-      # the certificate
+      # SSL/TLS needed for authentication, so the fqdn must match the certificate
       $config['smtp_server'] = "ssl://${config.mailserver.fqdn}:465";
       $config['smtp_user'] = "%u";
       $config['smtp_pass'] = "%p";

systems/x86_64-linux/mx/postgresql.nix

@@ -8,4 +8,33 @@
   services.postgresql = {
     package = pkgs.postgresql_14;
   };
+
+  # Temporary: upgrade script for PostgreSQL 14 → 16 migration.
+  # After upgrading, change package above to postgresql_16 and remove this block.
+  environment.systemPackages = [
+    (
+      let
+        newPostgres = pkgs.postgresql_16;
+        cfg = config.services.postgresql;
+      in
+      pkgs.writeScriptBin "upgrade-pg-cluster" ''
+        set -eux
+        systemctl stop postgresql
+
+        export NEWDATA="/var/lib/postgresql/${newPostgres.psqlSchema}"
+        export NEWBIN="${newPostgres}/bin"
+        export OLDDATA="${cfg.dataDir}"
+        export OLDBIN="${cfg.finalPackage}/bin"
+
+        install -d -m 0700 -o postgres -g postgres "$NEWDATA"
+        cd "$NEWDATA"
+        sudo -u postgres "$NEWBIN/initdb" -D "$NEWDATA" ${lib.escapeShellArgs cfg.initdbArgs}
+
+        sudo -u postgres "$NEWBIN/pg_upgrade" \
+          --old-datadir "$OLDDATA" --new-datadir "$NEWDATA" \
+          --old-bindir "$OLDBIN" --new-bindir "$NEWBIN" \
+          "$@"
+      ''
+    )
+  ];
 }