fix(staging): gzip cloud-init user_data; mktemp templates that work on macOS #31

Merged

jfraeys merged 2 commits from jfraeys/fix/cloud-init-gzip into main

2026-10-09 20:50:49 -04:00

jfraeys commented

2026-10-09 20:23:57 -04:00

Owner

Two fixes found by running ./setup --workspace linode-staging under SOPS (P2).

terraform: base64gzip for cloud-init user_data. The rendered services
cloud-init exceeded Linode's 16384-byte decoded limit and failed every staging
provision (template 11.9 KB -> ~4.5 KB gzipped). metadata is already in
ignore_changes on both instance resources, so existing nodes are not replaced.
cloud-init decompresses gzip user_data natively.
setup: mktemp templates in scripts/lib/setup/staging.sh had a suffix after the
Xs. BSD/macOS mktemp then creates a literal file, so every run after the first
got an empty path and the ephemeral Tailscale key mint failed
("cat: : No such file or directory"). Xs now last, 7 places.

Verified on a staging run: provision, cloud-init, web/services validation, the
Tailscale key mint and the apt step passed; all "secret is missing" role checks
passed with the SOPS vault. The run still stops at staging-environment limits
(no real DNS/TLS for Authelia/ACME, no app deployed on web), which are not
covered here.

🤖 Generated with Claude Code

Two fixes found by running ./setup --workspace linode-staging under SOPS (P2). - terraform: base64gzip for cloud-init user_data. The rendered services cloud-init exceeded Linode's 16384-byte decoded limit and failed every staging provision (template 11.9 KB -> ~4.5 KB gzipped). metadata is already in ignore_changes on both instance resources, so existing nodes are not replaced. cloud-init decompresses gzip user_data natively. - setup: mktemp templates in scripts/lib/setup/staging.sh had a suffix after the Xs. BSD/macOS mktemp then creates a literal file, so every run after the first got an empty path and the ephemeral Tailscale key mint failed ("cat: : No such file or directory"). Xs now last, 7 places. Verified on a staging run: provision, cloud-init, web/services validation, the Tailscale key mint and the apt step passed; all "secret is missing" role checks passed with the SOPS vault. The run still stops at staging-environment limits (no real DNS/TLS for Authelia/ACME, no app deployed on web), which are not covered here. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jfraeys added 2 commits

2026-10-09 20:23:57 -04:00

fix(terraform): gzip cloud-init user_data to stay under Linode's 16 KiB limit 01681eda30

The rendered services cloud-init (11.9 KB template plus Docker GPG key,
Cloudflare IPs, SSH key) exceeded the 16384-byte decoded user_data limit,
failing every staging provision. base64gzip drops it to ~4.5 KB; cloud-init
decompresses gzip user_data natively. metadata is already in ignore_changes
on both instance resources, so existing nodes are not replaced.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

fix(setup): put mktemp's Xs last so staging temp files work on macOS

Lint / lint (pull_request) Successful in 1m53s

Details

Terraform Plan / plan (pull_request) Failing after 4s

Details

739af494c3

BSD mktemp doesn't substitute XXXXXX when a suffix follows, so it created a
literal staging_tailscale_key.XXXXXX.err and every later run failed with an
empty path ("cat: : No such file"), aborting the ephemeral Tailscale key mint.
Drop the .log/.err suffixes in all seven templates.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

jfraeys merged commit 052aba8b52 into main

2026-10-09 20:50:49 -04:00

jfraeys referenced this pull request from a commit

2026-10-09 20:50:52 -04:00

Merge pull request 'fix(staging): gzip cloud-init user_data; mktemp templates that work on macOS' (#31) from jfraeys/fix/cloud-init-gzip into main

jfraeys referenced this pull request

2026-10-09 20:52:35 -04:00

fix(ci): pass state backend settings to every tofu-init workflow #33