Automate immutable production deployments

infra/opentofu/cloud-init.yaml.tftpl

@@ -50,36 +50,45 @@ write_files:
       set -euo pipefail
 
       mount_path="/srv/watermaps-data"
+      device="/dev/disk/by-id/scsi-0HC_Volume_${routing_volume_id}"
+      allow_initial_format="${initialize_empty_routing_volume}"
       install -d -m 0755 "$mount_path"
 
-      if ! mountpoint -q "$mount_path"; then
-        device=""
-        for attempt in $(seq 1 120); do
-          device="$(lsblk -dnpo NAME,MODEL | awk '$2 == "Volume" { print $1; exit }')"
-          if [ -n "$device" ] && [ -b "$device" ]; then
-            break
-          fi
-          device=""
-          sleep 5
-        done
+      for attempt in $(seq 1 120); do
+        if [ -b "$device" ]; then
+          break
+        fi
+        sleep 5
+      done
 
-        if [ -z "$device" ]; then
-          echo "Kein angehängtes Hetzner Cloud Volume gefunden." >&2
+      if [ ! -b "$device" ]; then
+        echo "Hetzner Cloud Volume ${routing_volume_id} wurde nicht unter $device gefunden." >&2
+        exit 1
+      fi
+
+      filesystem="$(blkid -o value -s TYPE "$device" || true)"
+      if [ -z "$filesystem" ]; then
+        signatures="$(wipefs --no-act --output TYPE --noheadings "$device" | tr -d '[:space:]')"
+        if [ -n "$signatures" ]; then
+          echo "Volume enthält unbekannte Signaturen und wird nicht verändert." >&2
           exit 1
         fi
-
-        filesystem="$(blkid -o value -s TYPE "$device" || true)"
-        if [ -z "$filesystem" ]; then
+        if [ "$allow_initial_format" = "true" ]; then
           mkfs.ext4 -F "$device"
           filesystem="ext4"
-        fi
-
-        if [ "$filesystem" != "ext4" ]; then
-          echo "Unerwartetes Dateisystem auf $device: $filesystem" >&2
+        else
+          echo "Volume hat kein lesbares Dateisystem; automatische Formatierung ist deaktiviert." >&2
           exit 1
         fi
+      fi
 
-        uuid="$(blkid -o value -s UUID "$device")"
+      if [ "$filesystem" != "ext4" ]; then
+        echo "Unerwartetes Dateisystem auf $device: $filesystem" >&2
+        exit 1
+      fi
+
+      uuid="$(blkid -o value -s UUID "$device")"
+      if ! mountpoint -q "$mount_path"; then
         if ! grep -q "^UUID=$uuid " /etc/fstab; then
           printf '%s\n' \
             "UUID=$uuid $mount_path ext4 defaults,nofail,x-systemd.device-timeout=30 0 2" \
@@ -89,6 +98,13 @@ write_files:
         mount "$mount_path"
       fi
 
+      mounted_source="$(findmnt --noheadings --output SOURCE --target "$mount_path")"
+      mounted_uuid="$(blkid -o value -s UUID "$mounted_source" || true)"
+      if [ "$mounted_uuid" != "$uuid" ]; then
+        echo "Unter $mount_path ist nicht das erwartete Volume ${routing_volume_id} eingehängt." >&2
+        exit 1
+      fi
+
       install -d -m 0755 -o ${deploy_user} -g ${deploy_user} \
         "$mount_path/geofabrik" \
         "$mount_path/local" \