From 9d1d41cdef3f4e52a418a36d8709f7a854563c5e Mon Sep 17 00:00:00 2001
From: "Timothy J. Aveni" <tja@berkeley.edu>
Date: Sat, 20 Jun 2026 12:57:40 -0700
Subject: [PATCH] Clean up AMI builders by default

---
 README.md      |  3 ++-
 publish-ami.sh | 10 +++++-----
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/README.md b/README.md
index cac5913..935ce1f 100644
--- a/README.md
+++ b/README.md
@@ -31,7 +31,8 @@ boot generation, reboots once, seeds the ZFS `/nix` volume, installs the final
 boot generation that expects `/nix`, and powers off.
 
 After the instance is stopped, `publish-ami.sh` creates the final AMI from the
-stopped instance, tags the AMI and snapshots, and writes `artifact.json`.
+stopped instance, tags the AMI and snapshots, writes `artifact.json`, and then
+destroys the temporary builder resources. Use `--keep-builder` when debugging.
 
 The OpenTofu state in this directory owns only temporary builder resources.
 The published AMI and its snapshots are created by the script and are not in
diff --git a/publish-ami.sh b/publish-ami.sh
index badc8d5..0dff0ab 100755
--- a/publish-ami.sh
+++ b/publish-ami.sh
@@ -5,7 +5,7 @@ aws_region="${AWS_REGION:-us-west-2}"
 system="aarch64-linux"
 builder_instance_type="t4g.large"
 name="nixos-zfs-ec2"
-destroy_builder=false
+keep_builder=false
 extra_tofu_args=()
 
 usage() {
@@ -18,7 +18,7 @@ Options:
   --aws-region <region>       AWS region (default: AWS_REGION or us-west-2)
   --builder-instance-type <t> Temporary builder EC2 type (default: t4g.large)
   --name <name>               AMI name prefix
-  --destroy-builder           Destroy temporary builder resources after publish
+  --keep-builder              Keep temporary builder resources after publish
   -h, --help                  Show this help
 
 Any arguments after `--` are passed through to `tofu apply`.
@@ -46,8 +46,8 @@ while [ "$#" -gt 0 ]; do
       name="$2"
       shift 2
       ;;
-    --destroy-builder)
-      destroy_builder=true
+    --keep-builder)
+      keep_builder=true
       shift
       ;;
     --)
@@ -298,7 +298,7 @@ jq -n \
     nixPool: $nixPool
   }' > artifact.json
 
-if [ "$destroy_builder" = true ]; then
+if [ "$keep_builder" = false ]; then
   tofu destroy \
     -var "aws_region=$aws_region" \
     -var "name=$name" \