Timothy J. Aveni
46 lines
1.3 KiB
Markdown
46 lines
1.3 KiB
Markdown
# NixOS ZFS EC2 AMI Builder
|
|
|
|
This project publishes a matched EC2 AMI artifact:
|
|
|
|
- root volume: bootable NixOS EC2 image
|
|
- secondary volume: preseeded ZFS pool mounted at `/nix`
|
|
|
|
The root snapshot and `/nix` snapshot are registered together in one AMI block
|
|
device mapping. Runtime deployments should consume the AMI ID directly and
|
|
should not independently choose a `/nix` snapshot.
|
|
|
|
The image is intentionally project-agnostic. It provides NixOS, ZFS, SSM,
|
|
flakes, and systemd ordering so the Nix daemon waits for `/nix`.
|
|
|
|
## Publish
|
|
|
|
The smallest supported flow is:
|
|
|
|
```bash
|
|
cd tofu/ami-builder
|
|
nix build .#packages.aarch64-linux.rootImage
|
|
./publish-ami.sh --bucket s3://my-vm-import-bucket
|
|
```
|
|
|
|
`publish-ami.sh` builds/imports the declarative NixOS root image, boots a
|
|
temporary seeder instance once to create/export the ZFS `/nix` volume, creates
|
|
the final AMI from the stopped instance, and writes `artifact.json`.
|
|
|
|
The OpenTofu project in this directory owns only the final AMI registration
|
|
metadata. Its state is separate from any runtime Quixos deployment state.
|
|
|
|
## Artifact Metadata
|
|
|
|
The final AMI is tagged with:
|
|
|
|
- `Architecture`
|
|
- `InputHash`
|
|
- `BuilderGitRev`
|
|
- `FlakeLockRev`
|
|
- `RootSnapshotId`
|
|
- `NixSnapshotId`
|
|
- `NixosSystemClosure`
|
|
|
|
Do not deregister the AMI or delete either snapshot while runtime deployments
|
|
use it.
|