280744ce0c
What: - bound CLAWDINATOR image artifact retention with S3 lifecycle, AMI pruning, and import provenance tags - reduce the AWS fleet to Babelfish-only and make GitHub credentials opt-in per host - disable the AMI build, nix-openclaw bump, and release workflows by moving them out of .github/workflows/ - update operator docs for the new explicit build and deploy model Why: - stop unbounded S3 and snapshot growth from image builds - remove unattended resurrection paths and shut down the unused t3.large instances - keep the remaining Babelfish host running without GitHub App credentials or sync timers Tests: - `nix shell nixpkgs#shellcheck nixpkgs#shfmt -c bash scripts/lint-shell.sh` (pass) - `nix build .#nixosConfigurations.clawdinator-babelfish.config.system.build.toplevel .#nixosConfigurations.clawdinator-1.config.system.build.toplevel .#nixosConfigurations.clawdinator-2.config.system.build.toplevel` (pass) - `AWS_PROFILE=homelab-admin TF_VAR_aws_region=eu-central-1 TF_VAR_ami_id=ami-0a9abe17feeee0079 TF_VAR_ssh_public_key="$(cat ~/.ssh/id_ed25519.pub)" nix shell nixpkgs#opentofu -c sh -lc 'tofu fmt -check && tofu validate'` (pass) - live AWS apply: destroyed `clawdinator-1` and `clawdinator-2`, replaced Babelfish, and verified only `Fleet Deploy` remains active in GitHub Actions
54 lines
1.7 KiB
Bash
Executable File
54 lines
1.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
instances_file="${INSTANCES_FILE:-nix/instances.json}"
|
|
secrets_dir="${SECRETS_DIR:-nix/age-secrets}"
|
|
age_key_file="${AGE_KEY_FILE:-nix/keys/clawdinator.agekey}"
|
|
repo_seeds_dir="${REPO_SEEDS_DIR:-repo-seeds}"
|
|
|
|
if [ ! -f "${instances_file}" ]; then
|
|
echo "Missing instances file: ${instances_file}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
workdir="$(mktemp -d)"
|
|
cleanup() {
|
|
rm -rf "${workdir}"
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
while IFS= read -r instance_name; do
|
|
bootstrap_prefix="$(jq -r --arg name "${instance_name}" '.[$name].bootstrapPrefix' "${instances_file}")"
|
|
token_secret="$(jq -r --arg name "${instance_name}" '.[$name].discordTokenSecret' "${instances_file}")"
|
|
|
|
if [ -z "${bootstrap_prefix}" ] || [ "${bootstrap_prefix}" = "null" ]; then
|
|
echo "Missing bootstrapPrefix for ${instance_name}" >&2
|
|
exit 1
|
|
fi
|
|
if [ -z "${token_secret}" ] || [ "${token_secret}" = "null" ]; then
|
|
echo "Missing discordTokenSecret for ${instance_name}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
instance_secrets="${workdir}/${instance_name}/secrets"
|
|
mkdir -p "${instance_secrets}"
|
|
|
|
rsync -a \
|
|
--exclude 'clawdinator-discord-token-*.age' \
|
|
--exclude 'clawdinator-github-app.pem.age' \
|
|
"${secrets_dir}/" "${instance_secrets}/"
|
|
|
|
if [ ! -f "${secrets_dir}/${token_secret}.age" ]; then
|
|
echo "Missing instance token ${secrets_dir}/${token_secret}.age" >&2
|
|
exit 1
|
|
fi
|
|
cp "${secrets_dir}/${token_secret}.age" "${instance_secrets}/${token_secret}.age"
|
|
|
|
BOOTSTRAP_PREFIX="${bootstrap_prefix}" \
|
|
SECRETS_DIR="${instance_secrets}" \
|
|
AGE_KEY_FILE="${age_key_file}" \
|
|
REPO_SEEDS_DIR="${repo_seeds_dir}" \
|
|
bash scripts/upload-bootstrap.sh
|
|
|
|
done < <(jq -r 'keys[]' "${instances_file}")
|