Skip to content

refactor(ami): share provisioning steps between qemu and ami builds #2567

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
brainrake wants to merge 3 commits into
base: develop
Choose a base branch
from
+225 −298
Draft

refactor(ami): share provisioning steps between qemu and ami builds #2567

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
fbce703
refactor(ami): share provisioning steps between qemu and ami builds
brainrake Oct 16, 2026
b1d068b
refactor(ami): share stage 1 and cleanup steps between builds
brainrake Oct 16, 2026
7602213
fix(ami): set vector-readable wal-g log modes on the ami
brainrake Oct 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions amazon-amd64-nix.pkr.hcl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -188,6 +188,11 @@ build {
destination = "/tmp/70-ec2-nvme-devices.rules"
}

provisioner "file" {
source = "ebssurrogate/scripts/provision-common.sh"
destination = "/tmp/provision-common.sh"
}

provisioner "file" {
source = "ebssurrogate/scripts/chroot-bootstrap-nix.sh"
destination = "/tmp/chroot-bootstrap-nix.sh"
Expand Down
5 changes: 5 additions & 0 deletions amazon-arm64-nix.pkr.hcl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -188,6 +188,11 @@ build {
destination = "/tmp/70-ec2-nvme-devices.rules"
}

provisioner "file" {
source = "ebssurrogate/scripts/provision-common.sh"
destination = "/tmp/provision-common.sh"
}

provisioner "file" {
source = "ebssurrogate/scripts/chroot-bootstrap-nix.sh"
destination = "/tmp/chroot-bootstrap-nix.sh"
Expand Down
35 changes: 3 additions & 32 deletions ebssurrogate/scripts/chroot-bootstrap-nix.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,9 @@ set -o errexit
set -o pipefail
set -o xtrace

# shellcheck source=/dev/null
source /tmp/provision-common.sh

function setup_apt {
export DEBIAN_FRONTEND=noninteractive
}
Expand Down Expand Up @@ -92,31 +95,6 @@ function install_initial_packages {
fi
}

function setup_locale {
cat >>/etc/locale.gen <<-EOF
en_US.UTF-8 UTF-8
EOF
cat >/etc/default/locale <<-EOF
LANG="C.UTF-8"
LC_CTYPE="C.UTF-8"
EOF
locale-gen en_US.UTF-8
}

function setup_postgesql_env {
# Create the directory if it doesn't exist
mkdir -p /etc/environment.d

# Define the contents of the PostgreSQL environment file
tee /etc/environment.d/postgresql.env >/dev/null <<-EOF
LOCALE_ARCHIVE=/usr/lib/locale/locale-archive
LANG="en_US.UTF-8"
LANGUAGE="en_US.UTF-8"
LC_ALL="en_US.UTF-8"
LC_CTYPE="en_US.UTF-8"
EOF
}

function setup_apparmor {
# Copy apparmor profiles
cp -rv /tmp/apparmor_profiles/* /etc/apparmor.d/
Expand Down Expand Up @@ -179,13 +157,6 @@ function setup_eth0_interface {
chmod 600 /etc/netplan/eth0.yaml
}

function disable_sshd_passwd_auth {
sed -i -E \
-e 's/^#?\s*PasswordAuthentication\s+(yes|no)\s*$/PasswordAuthentication no/g' \
-e 's/^#?\s*ChallengeResponseAuthentication\s+(yes|no)\s*$/ChallengeResponseAuthentication no/g' \
/etc/ssh/sshd_config
}

function create_admin_account {
groupadd admin
}
Expand Down
34 changes: 8 additions & 26 deletions ebssurrogate/scripts/cleanup-qemu.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,13 +6,13 @@

set -ex

# shellcheck source=/dev/null
source /tmp/provision-common.sh

# Ensure /tmp exists and has the proper permissions before
# checking for security updates
# https://github.com/digitalocean/marketplace-partners/issues/94
if [[ ! -d /tmp ]]; then
mkdir /tmp
fi
chmod 1777 /tmp
ensure_tmp_dir

# Cleanup more packages
packages=(
Expand Down Expand Up @@ -117,31 +117,13 @@ systemctl disable getty@tty1.service
systemctl mask getty@tty1.service
systemctl mask graphical.target

rm -rf /tmp/* /var/tmp/*
history -c
cat /dev/null >/root/.bash_history
unset HISTFILE
scrub_history

journalctl --rotate
journalctl --vacuum-time=1s
find /var/log -mtime -1 -type f -exec truncate -s 0 {} \;
rm -rf /var/log/*.gz /var/log/*.[0-9] /var/log/*-????????
rm -rf /var/lib/cloud/instances/*
rm -f /root/.ssh/authorized_keys /etc/ssh/*key*
touch /etc/ssh/revoked_keys
chmod 600 /etc/ssh/revoked_keys

cat /dev/null >/var/log/lastlog
cat /dev/null >/var/log/wtmp
scrub_logs_and_keys

dd if=/dev/zero of=/zerofile &
PID=$!
while [ -d /proc/$PID ]; do
printf "."
sleep 5
done
sync
rm /zerofile
sync
zero_free_space
empty_login_records

fstrim /
33 changes: 8 additions & 25 deletions ebssurrogate/scripts/cleanup.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,13 +6,13 @@

set -ex

# shellcheck source=/dev/null
source /tmp/provision-common.sh

# Ensure /tmp exists and has the proper permissions before
# checking for security updates
# https://github.com/digitalocean/marketplace-partners/issues/94
if [[ ! -d /tmp ]]; then
mkdir /tmp
fi
chmod 1777 /tmp
ensure_tmp_dir

# Cleanup more packages
packages=(
Expand All @@ -39,16 +39,8 @@ apt-get --yes autoclean
apt-get --yes update
apt-get --yes upgrade

rm -rf /tmp/* /var/tmp/*
history -c
cat /dev/null >/root/.bash_history
unset HISTFILE
find /var/log -mtime -1 -type f -exec truncate -s 0 {} \;
rm -rf /var/log/*.gz /var/log/*.[0-9] /var/log/*-????????
rm -rf /var/lib/cloud/instances/*
rm -f /root/.ssh/authorized_keys /etc/ssh/*key*
touch /etc/ssh/revoked_keys
chmod 600 /etc/ssh/revoked_keys
scrub_history
scrub_logs_and_keys

# Securely erase the unused portion of the filesystem
cat <<-EOF
Expand All @@ -59,14 +51,5 @@ cat <<-EOF
Beginning secure erase now
EOF

dd if=/dev/zero of=/zerofile &
PID=$!
while [ -d /proc/$PID ]; do
printf "."
sleep 5
done
sync
rm /zerofile
sync
cat /dev/null >/var/log/lastlog
cat /dev/null >/var/log/wtmp
zero_free_space
empty_login_records
65 changes: 5 additions & 60 deletions ebssurrogate/scripts/nix-provision.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,94 +5,39 @@ set -o errexit
set -o pipefail
set -o xtrace

# shellcheck source=/dev/null
source /tmp/provision-common.sh

exec 1>&2

function setup_apt {
export DEBIAN_FRONTEND=noninteractive
}

function cleanup_apt {
apt-get clean
apt-get autoremove --purge --yes
rm -rf /var/lib/apt/lists/*
}

function update_and_upgrade_apt {
apt-get update --yes
apt-get dist-upgrade --yes
}

function install_packages {
apt-get install -y ansible
ansible-galaxy collection install community.general
}

function install_nix() {
curl -L https://releases.nixos.org/nix/nix-2.34.6/install | sh -s -- --yes --daemon --nix-extra-conf-file <(
cat <<-EOF
extra-experimental-features = nix-command flakes
extra-substituters = https://nix-postgres-artifacts.s3.amazonaws.com
extra-trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI=
EOF
)

#shellcheck disable=SC1091
. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
nix --version
}

function execute_stage2_playbook {
echo "POSTGRES_MAJOR_VERSION: $POSTGRES_MAJOR_VERSION"
echo "GIT_SHA: $GIT_SHA"
mkdir -p /etc/ansible
tee /etc/ansible/ansible.cfg <<-EOF
[defaults]
callbacks_enabled = timer, profile_tasks, profile_roles
EOF
sed -i 's/- hosts: all/- hosts: localhost/' /tmp/ansible-playbook/ansible/playbook.yml

# Run Ansible playbook
export ANSIBLE_LOG_PATH=/tmp/ansible.log
export ANSIBLE_REMOTE_TEMP=/tmp

# shellcheck disable=SC2086
ansible-playbook /tmp/ansible-playbook/ansible/playbook.yml \
--extra-vars '{"stage2":true, "qemu":false}' \
--extra-vars "git_commit_sha=$GIT_SHA" \
--extra-vars "psql_version=psql_$POSTGRES_MAJOR_VERSION" \
--extra-vars "postgresql_version=postgresql_$POSTGRES_MAJOR_VERSION" \
--extra-vars "postgresql_major_version=$POSTGRES_MAJOR_VERSION" \
$ARGS
run_playbook /tmp/ansible-playbook/ansible/playbook.yml /tmp true false $ARGS
}

function cleanup_packages {
apt-get remove --purge --yes ansible
}

function cleanup_nix {
nix-collect-garbage -d
nix-store --optimise -v
}

function report_packages {
# shellcheck disable=SC2016
dpkg-query -W -f='${Package}\t${Version}\t${Architecture}\n' | LC_COLLATE=C.UTF-8 sort
find /nix/store -maxdepth 1 | LC_COLLATE=C.UTF-8 sort -t- -k2
}

function report_disk_usage {
read -r dub _ < <(du -sx -B1 /)
read -r duh _ < <(du -sx -h /)
printf '::notice::disk_usage bytes=%s human=%s\n' "$dub" "$duh" | tee -a /tmp/ansible.log
}

setup_apt
update_and_upgrade_apt
install_packages
install_nix
execute_stage2_playbook
cleanup_packages
cleanup_nix
clean_nix
update_and_upgrade_apt
cleanup_apt
report_packages
Expand Down
Loading
Loading