From 458ad8ae85f6cd55963939a52afb634b8a59c373 Mon Sep 17 00:00:00 2001
From: "Timothy J. Aveni" <tja@berkeley.edu>
Date: Tue, 30 Jun 2026 19:14:38 -0700
Subject: [PATCH] Auto approve AMI builder apply

---
 README.md      |  4 ++--
 publish-ami.sh | 34 ++++++++++++++++++----------------
 2 files changed, 20 insertions(+), 18 deletions(-)

diff --git a/README.md b/README.md
index e090d6b..154ad70 100644
--- a/README.md
+++ b/README.md
@@ -21,7 +21,7 @@ The normal flow builds on a temporary EC2 instance, so your local machine does
 not need to be the same architecture as the target AMI:
 
 ```bash
-nix run ./tofu/ami-builder#publish-ami -- --builder-instance-type t4g.large
+nix run ./tofu/ami-builder#publish-ami
 ```
 
 `publish-ami.sh` applies this OpenTofu project to create a temporary builder
@@ -42,7 +42,7 @@ deregistering the AMI.
 Pass extra OpenTofu variables after `--`:
 
 ```bash
-nix run ./tofu/ami-builder#publish-ami -- --builder-instance-type t4g.large -- \
+nix run ./tofu/ami-builder#publish-ami -- -- \
   -var base_nixos_ami_id=ami-...
 ```
 
diff --git a/publish-ami.sh b/publish-ami.sh
index 61e57a7..1123967 100755
--- a/publish-ami.sh
+++ b/publish-ami.sh
@@ -3,7 +3,7 @@ set -euo pipefail
 
 aws_region="${AWS_REGION:-us-west-2}"
 system="aarch64-linux"
-builder_instance_type="t4g.large"
+builder_instance_type=""
 name="nixos-zfs-ec2"
 keep_builder=false
 extra_tofu_args=()
@@ -16,7 +16,7 @@ Options:
   --system <aarch64-linux|x86_64-linux>
                               Target NixOS system (default: aarch64-linux)
   --aws-region <region>       AWS region (default: AWS_REGION or us-west-2)
-  --builder-instance-type <t> Temporary builder EC2 type (default: t4g.large)
+  --builder-instance-type <t> Temporary builder EC2 type (default: Terraform chooses per architecture)
   --name <name>               AMI name prefix
   --keep-builder              Keep temporary builder resources after publish
   -h, --help                  Show this help
@@ -104,15 +104,23 @@ flake_lock_rev="$(jq -r '.nodes.nixpkgs.locked.rev // .nodes.nixpkgs.locked.narH
 input_hash="$(printf '%s\n%s\n%s\n' "$builder_git_rev" "$flake_lock_rev" "$system" | sha256sum | awk '{ print $1 }')"
 ami_name="${name}-${architecture}-${input_hash:0:12}"
 
+common_tofu_vars=(
+  -var "aws_region=$aws_region"
+  -var "name=$name"
+  -var "system=$system"
+  -var "input_hash=$input_hash"
+  -var "builder_git_rev=$builder_git_rev"
+  -var "flake_lock_rev=$flake_lock_rev"
+)
+
+if [ -n "$builder_instance_type" ]; then
+  common_tofu_vars+=(-var "builder_instance_type=$builder_instance_type")
+fi
+
 tofu init
 tofu apply \
-  -var "aws_region=$aws_region" \
-  -var "name=$name" \
-  -var "system=$system" \
-  -var "builder_instance_type=$builder_instance_type" \
-  -var "input_hash=$input_hash" \
-  -var "builder_git_rev=$builder_git_rev" \
-  -var "flake_lock_rev=$flake_lock_rev" \
+  -auto-approve \
+  "${common_tofu_vars[@]}" \
   "${extra_tofu_args[@]}"
 
 builder_instance_id="$(tofu output -raw builder_instance_id)"
@@ -318,13 +326,7 @@ jq -n \
 if [ "$keep_builder" = false ]; then
   tofu destroy \
     -auto-approve \
-    -var "aws_region=$aws_region" \
-    -var "name=$name" \
-    -var "system=$system" \
-    -var "builder_instance_type=$builder_instance_type" \
-    -var "input_hash=$input_hash" \
-    -var "builder_git_rev=$builder_git_rev" \
-    -var "flake_lock_rev=$flake_lock_rev" \
+    "${common_tofu_vars[@]}" \
     "${extra_tofu_args[@]}"
 fi