Clean up AMI builders by default

README.md

@@ -31,7 +31,8 @@ boot generation, reboots once, seeds the ZFS `/nix` volume, installs the final
 boot generation that expects `/nix`, and powers off.
 
 After the instance is stopped, `publish-ami.sh` creates the final AMI from the
-stopped instance, tags the AMI and snapshots, and writes `artifact.json`.
+stopped instance, tags the AMI and snapshots, writes `artifact.json`, and then
+destroys the temporary builder resources. Use `--keep-builder` when debugging.
 
 The OpenTofu state in this directory owns only temporary builder resources.
 The published AMI and its snapshots are created by the script and are not in

publish-ami.sh

@@ -5,7 +5,7 @@ aws_region="${AWS_REGION:-us-west-2}"
 system="aarch64-linux"
 builder_instance_type="t4g.large"
 name="nixos-zfs-ec2"
-destroy_builder=false
+keep_builder=false
 extra_tofu_args=()
 
 usage() {
@@ -18,7 +18,7 @@ Options:
   --aws-region <region>       AWS region (default: AWS_REGION or us-west-2)
   --builder-instance-type <t> Temporary builder EC2 type (default: t4g.large)
   --name <name>               AMI name prefix
-  --destroy-builder           Destroy temporary builder resources after publish
+  --keep-builder              Keep temporary builder resources after publish
   -h, --help                  Show this help
 
 Any arguments after `--` are passed through to `tofu apply`.
@@ -46,8 +46,8 @@ while [ "$#" -gt 0 ]; do
       name="$2"
       shift 2
       ;;
-    --destroy-builder)
+    --keep-builder)
-      destroy_builder=true
+      keep_builder=true
       shift
       ;;
     --)
@@ -298,7 +298,7 @@ jq -n \
     nixPool: $nixPool
   }' > artifact.json
 
-if [ "$destroy_builder" = true ]; then
+if [ "$keep_builder" = false ]; then
   tofu destroy \
     -var "aws_region=$aws_region" \
     -var "name=$name" \