Build AMIs on temporary EC2 builders

README.md

@@ -14,20 +14,33 @@ flakes, and systemd ordering so the Nix daemon waits for `/nix`.
 
 ## Publish
 
-The smallest supported flow is:
+The normal flow builds on a temporary EC2 instance, so your local machine does
+not need to be the same architecture as the target AMI:
 
 ```bash
 cd tofu/ami-builder
-nix build .#packages.aarch64-linux.rootImage
-./publish-ami.sh --bucket s3://my-vm-import-bucket
+./publish-ami.sh --builder-instance-type t4g.large
 ```
 
-`publish-ami.sh` builds/imports the declarative NixOS root image, boots a
-temporary seeder instance once to create/export the ZFS `/nix` volume, creates
-the final AMI from the stopped instance, and writes `artifact.json`.
+`publish-ami.sh` applies this OpenTofu project to create a temporary builder
+instance and `/nix` volume. The builder user data installs a ZFS-capable NixOS
+boot generation, reboots once, seeds the ZFS `/nix` volume, installs the final
+boot generation that expects `/nix`, and powers off.
 
-The OpenTofu project in this directory owns only the final AMI registration
-metadata. Its state is separate from any runtime Quixos deployment state.
+After the instance is stopped, `publish-ami.sh` creates the final AMI from the
+stopped instance, tags the AMI and snapshots, and writes `artifact.json`.
+
+The OpenTofu state in this directory owns only temporary builder resources.
+The published AMI and its snapshots are created by the script and are not in
+OpenTofu state, so `tofu destroy` here can clean up the builder without
+deregistering the AMI.
+
+Pass extra OpenTofu variables after `--`:
+
+```bash
+./publish-ami.sh --builder-instance-type t4g.large -- \
+  -var base_nixos_ami_id=ami-...
+```
 
 ## Artifact Metadata