Moving /app tree in ignition to gzipped file

.terraform.lock.hcl

@@ -0,0 +1,96 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/cloudflare/cloudflare" {
+  version     = "5.8.2"
+  constraints = "5.8.2"
+  hashes = [
+    "h1:q9p622Nl/BMW9QUlnGIgFaYF7O94u7bfif48OQ0H9HE=",
+    "zh:92d133a074a8a95143861960508501711a95e0b267c60dbc722eec0a68053e08",
+    "zh:95b1f349c59d226d9005c49b5ac61e856492f75d8be3ca30954a91512f2ebecf",
+    "zh:a439ebd2e21dd6a4cd782563de372dbbac9853a713ba4e90fb3d317764374c2f",
+    "zh:b0a2313cdb113e8ecc058052bcbadaa312a6d093820e69ed97ed96725ad5fd8f",
+    "zh:c14e2790827a78f0e5274ec47f56e4fff41b76db01caf915fb73d5082c75c645",
+    "zh:ef135fce7d3925988fa2675287788da233a1630c23652ae160a1d6c2a9e8ebce",
+    "zh:f01d39efcb3aa7fa8634394caad10ca68abd694d75d2c8b3875516859d8df9b4",
+    "zh:f03391264e01749c17ead5a8ba33a96a568490a8212424c5ae6e113ad50bfc9f",
+    "zh:f809ab383cca0a5f83072981c64208cbd7fa67e986a86ee02dd2c82333221e32",
+  ]
+}
+
+provider "registry.terraform.io/digitalocean/digitalocean" {
+  version     = "2.62.0"
+  constraints = "2.62.0"
+  hashes = [
+    "h1:MPWqSuVPLh6SNduEpKYZHOXDkW4CCtfEOcZMSjKrGnA=",
+    "zh:1004bd408d8982471a7b0971fb2c47ccb3e9b8b3261422a6c8942151e6624713",
+    "zh:173059dd17ab6cb471dd45ee0e2a01db9c2e7d31ac30e33eb3b6269cfca68bbb",
+    "zh:209e8092f3cfcb28406df19386064e31ab89152dc70555db2e252dc1ea9e5703",
+    "zh:2c45405951b64ca3606d4360463eee4745af361520f9a8e28b5e6e784010dc4b",
+    "zh:3b07459b33e56d2cfe2429dc499eb33e83969f75847dcab9a65b8de8cdefebcc",
+    "zh:486277719db85e0062a7a0014bfd0c9a2eda0c2955d9c77020a35f004bc4025f",
+    "zh:7487b77f0e0d33ca460f27cf8eeae08cce50bb4d64a693601cd76ca865d3eb78",
+    "zh:7ac4818386b45253b2e3f8b2794fb0a0837878a37bf03ace4e7a6c7f69345abc",
+    "zh:9a8ad3875867cb707ab50bf0c10fe23abdf95740f0fd48ee8575586aaf9e9817",
+    "zh:9b39578e77688b367f5f99ae4227cf76edb598263937983652b0e7052fad6b65",
+    "zh:a72723121d4548f17cfba7cc14d2cf9cc3ce066c1c81121ceac7dee42eeb84ee",
+    "zh:af2cf2b807af245c4259cd4e9980fe6633e9a3703e114b4997f8ee8a56188674",
+    "zh:b547d28e1e2de2c03ffde90eeb2d301331520b890c219e84aa876263ebf6e4fd",
+    "zh:baa2e3c085de1154fdef4922bc6c27aa62f0dba60535ec80e10017909ea93e2d",
+    "zh:c8425a8cfcba3ee408d9b75586f02f5c9af9c9d01817227731078662720e932f",
+    "zh:dfdfb75ff50d79de30164873c3977dce376ffc09ce5610aeb581f885b3f8b942",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/null" {
+  version     = "3.2.4"
+  constraints = "3.2.4"
+  hashes = [
+    "h1:wTNrZnwQdOOT/TW9pa+7GgJeFK2OvTvDmx78VmUmZXM=",
+    "zh:59f6b52ab4ff35739647f9509ee6d93d7c032985d9f8c6237d1f8a59471bbbe2",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:795c897119ff082133150121d39ff26cb5f89a730a2c8c26f3a9c1abf81a9c43",
+    "zh:7b9c7b16f118fbc2b05a983817b8ce2f86df125857966ad356353baf4bff5c0a",
+    "zh:85e33ab43e0e1726e5f97a874b8e24820b6565ff8076523cc2922ba671492991",
+    "zh:9d32ac3619cfc93eb3c4f423492a8e0f79db05fec58e449dee9b2d5873d5f69f",
+    "zh:9e15c3c9dd8e0d1e3731841d44c34571b6c97f5b95e8296a45318b94e5287a6e",
+    "zh:b4c2ab35d1b7696c30b64bf2c0f3a62329107bd1a9121ce70683dec58af19615",
+    "zh:c43723e8cc65bcdf5e0c92581dcbbdcbdcf18b8d2037406a5f2033b1e22de442",
+    "zh:ceb5495d9c31bfb299d246ab333f08c7fb0d67a4f82681fbf47f2a21c3e11ab5",
+    "zh:e171026b3659305c558d9804062762d168f50ba02b88b231d20ec99578a6233f",
+    "zh:ed0fe2acdb61330b01841fa790be00ec6beaac91d41f311fb8254f74eb6a711f",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/time" {
+  version     = "0.13.1"
+  constraints = "0.13.1"
+  hashes = [
+    "h1:P9h9GNlrWPECzIvIFjHOhF+HVzpxk0eCcdy1G0fWSHw=",
+    "zh:02cb9aab1002f0f2a94a4f85acec8893297dc75915f7404c165983f720a54b74",
+    "zh:04429b2b31a492d19e5ecf999b116d396dac0b24bba0d0fb19ecaefe193fdb8f",
+    "zh:26f8e51bb7c275c404ba6028c1b530312066009194db721a8427a7bc5cdbc83a",
+    "zh:772ff8dbdbef968651ab3ae76d04afd355c32f8a868d03244db3f8496e462690",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:898db5d2b6bd6ca5457dccb52eedbc7c5b1a71e4a4658381bcbb38cedbbda328",
+    "zh:8de913bf09a3fa7bedc29fec18c47c571d0c7a3d0644322c46f3aa648cf30cd8",
+    "zh:9402102c86a87bdfe7e501ffbb9c685c32bbcefcfcf897fd7d53df414c36877b",
+    "zh:b18b9bb1726bb8cfbefc0a29cf3657c82578001f514bcf4c079839b6776c47f0",
+    "zh:b9d31fdc4faecb909d7c5ce41d2479dd0536862a963df434be4b16e8e4edc94d",
+    "zh:c951e9f39cca3446c060bd63933ebb89cedde9523904813973fbc3d11863ba75",
+    "zh:e5b773c0d07e962291be0e9b413c7a22c044b8c7b58c76e8aa91d1659990dfb5",
+  ]
+}
+
+provider "registry.terraform.io/poseidon/ct" {
+  version     = "0.13.0"
+  constraints = "0.13.0"
+  hashes = [
+    "h1:sTtlmMjbYiIuaad/23wVrOCSlihKaurcf2668M3ZWio=",
+    "zh:24d86adcba92ad0f13870d5e0d217c395aa90ff1e9234fe0c9b7c6eb65abb3a8",
+    "zh:317eeadf92d220fe546be624a9002190edeb623ac76ae7f6a93abd9fe1be65fd",
+    "zh:361dbff802ccbd94b87c9d77c0d9db9bdf4d5d408f8cf05e4dae203e60b310ca",
+    "zh:3b25cb8a0327886aa30c273561ecea3315cc4d729677cd6528ed1339486475da",
+    "zh:63455a68fee4ba0c9b131eb7e267eb17707184c55a5feb9e2bad2d9de5889d6a",
+  ]
+}

Makefile

@@ -66,6 +66,12 @@ restic-env: $(apps_config) make-restic-generated.sh
 restic-password: $(apps_config) make-restic-password.sh
 	./make-restic-password.sh $(apps_config) > restic-password
 
+app.tar.gz: app/.dirstamp \
+app/.env \
+app/lb/lb.env \
+app/lb/Caddyfile
+	tar cfz app.tar.gz app/
+
 ignition.json: cl.yaml app/.dirstamp \
 $(IMAGE_DEPS) \
 app/lb/lb.env \
@@ -75,7 +81,8 @@ restic-password \
 restic-restore.sh \
 restic-snapshot.sh \
 app/.env \
-$(config_dir)ssh-keys
+$(config_dir)ssh-keys \
+app.tar.gz
 	cat cl.yaml | docker run --rm --volume $(config_dir)/ssh-keys:/pwd/ssh-keys --volume ${PWD}:/pwd --workdir /pwd -i quay.io/coreos/butane:latest -d /pwd > ignition.json
 
 generated.tfvars: $(apps_config) make-generated.sh

cl.yaml

@@ -80,6 +80,18 @@ systemd:
         [Install]
         WantedBy=multi-user.target
 
+    - name: unpack-app.service
+      enabled: true
+      contents: |
+        [Unit]
+        Description=Unpack /app
+        Before=app.service
+        [Service]
+        Type=oneshot
+        ExecStart=/unpack-app
+        [Install]
+        WantedBy=multi-user.target
+
     ### docker-compose sysext
     ### https://flatcar.github.io/sysext-bakery/docker_compose/
     - name: systemd-sysupdate.timer
@@ -117,10 +129,14 @@ storage:
     - device: /dev/disk/by-partlabel/appstorage
       format: ext4
       wipe_filesystem: false
-  trees:
+  # trees:
-    - path: /app
+  #   - path: /app
-      local: app
+  #     local: app
   files:
+    - path: /app.tar.gz
+      mode: 0600
+      contents:
+        local: app.tar.gz
     - path: /restic-password
       contents:
         local: restic-password
@@ -143,6 +159,15 @@ storage:
         inline: |
           PermitRootLogin no
           AllowUsers core
+    - path: /unpack-app
+      mode: 0755
+      contents:
+        inline: |
+          #!/bin/sh
+          set -e
+          mkdir /app
+          tar -xzf /app.tar.gz -C /
+          rm /app.tar.gz
     ### docker-compose sysext
     ### https://flatcar.github.io/sysext-bakery/docker_compose/
     - path: /opt/extensions/docker-compose/docker-compose-5.1.4-x86-64.raw