Seed bootapi templates + distro catalog

Initial content for bootapi's git-synced template set: the kickstart and iPXE
templates and the distro catalog (almalinux9, fedora) ported from bootapi's
embedded defaults, plus CI that validates every template/catalog renders for
every distro (bootapi validate) and shellchecks the %post blocks.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

kickstart/almalinux9.ks.tmpl

@@ -0,0 +1,113 @@
+{{- /*
+AlmaLinux 9 kickstart, ported from the Cobbler default.ks contract.
+
+Rendered by bootapi from NetBox data + render-time secrets + the distro catalog.
+Install source comes from the artifactapi almalinux remote (via the catalog
+mirror var). The %post installs the Puppet agent and points it at the k8s
+puppetserver (puppet.k8s.syd1.au.unkin.net / puppetca.k8s...), writes the
+puppet-initial PUPPETCA_URL env file, then posts back to bootapi so pxe_enabled
+flips off (Cobbler's netboot_enabled flow).
+
+Data model: see docs/data-model.md. `.RootPasswordHash` and `.ProvisionToken`
+come from Vault/env at render time, never from NetBox.
+*/ -}}
+{{- $mirror := .DistroVars.mirror -}}
+#version=RHEL9
+# Rendered by bootapi for {{ .FQDN }} (platform {{ .Platform }}, role {{ default "none" .Role }})
+text
+eula --agreed
+firstboot --disable
+reboot
+
+# --- install source (artifactapi almalinux remote, from the distro catalog) ---
+url --url={{ $mirror }}/BaseOS/{{ .Arch }}/os/
+repo --name=AppStream --baseurl={{ $mirror }}/AppStream/{{ .Arch }}/os/
+
+# --- localization ---
+keyboard --xlayouts='us'
+lang en_AU.UTF-8
+timezone Australia/Sydney --utc
+
+# --- security ---
+{{ if .RootPasswordHash -}}
+rootpw --iscrypted {{ .RootPasswordHash }}
+{{- else -}}
+rootpw --lock
+{{- end }}
+selinux --enforcing
+firewall --enabled --service=ssh
+authselect select sssd with-mkhomedir --force
+
+# --- networking (static, from NetBox) ---
+{{- $primary := .PrimaryInterface }}
+{{- range .Interfaces }}
+{{- if .IP }}
+network --bootproto=static --device={{ .MAC }} --ip={{ .IP }} --netmask={{ .Netmask }}{{ if .Gateway }} --gateway={{ .Gateway }}{{ end }}{{ range $.Nameservers }} --nameserver={{ . }}{{ end }}{{ if and $primary (eq .MAC $primary.MAC) }} --hostname={{ $.FQDN }}{{ end }} --activate --onboot=on --noipv6
+{{- end }}
+{{- end }}
+
+# --- storage ---
+ignoredisk --only-use=sda
+clearpart --all --initlabel --drives=sda
+bootloader --location=mbr --boot-drive=sda --append="crashkernel=auto"
+autopart --type=lvm --nohome
+
+# --- packages ---
+%packages --ignoremissing --excludedocs
+@^minimal-environment
+openssh-server
+chrony
+vim-minimal
+tmux
+git
+-iwl*-firmware
+%end
+
+# --- bootstrap: puppet (k8s) + end-of-install callback ---
+%post --log=/root/bootapi-post.log
+set -x
+
+# chrony: keep time sane before any cert work.
+systemctl enable chronyd
+
+{{ if .SSHAuthorizedKeys -}}
+# root authorized_keys (from render-time config, not NetBox).
+install -d -m0700 /root/.ssh
+cat > /root/.ssh/authorized_keys <<'EOF'
+{{ range .SSHAuthorizedKeys }}{{ . }}
+{{ end }}EOF
+chmod 0600 /root/.ssh/authorized_keys
+{{- end }}
+
+# Install the Puppet 8 agent from the puppet platform repo.
+rpm -q puppet-agent >/dev/null 2>&1 || \
+  dnf install -y https://yum.puppet.com/puppet8-release-el-9.noarch.rpm
+dnf install -y puppet-agent
+
+# Point the agent at the k8s puppetserver / CA.
+PUPPET_BIN=/opt/puppetlabs/bin/puppet
+"$PUPPET_BIN" config set --section main certname      "{{ .FQDN }}"
+"$PUPPET_BIN" config set --section main server        "{{ .PuppetServer }}"
+"$PUPPET_BIN" config set --section main ca_server     "{{ .PuppetCAServer }}"
+"$PUPPET_BIN" config set --section main report_server "{{ .PuppetServer }}"
+"$PUPPET_BIN" config set --section main environment   production
+
+# puppet-initial bootstrap unit reads PUPPETCA_URL from this EnvironmentFile.
+install -d -m0755 /etc/sysconfig
+cat > /etc/sysconfig/puppet-initial <<'EOF'
+PUPPETCA_URL={{ .PuppetCAURL }}
+EOF
+
+# Enable the agent; first boot triggers firstrun (autosign handles the CSR).
+systemctl enable puppet
+
+{{ if and .ProvisionToken .CallbackURL -}}
+# Tell bootapi the install is done so it clears pxe_enabled in NetBox and the
+# next PXE boots local disk. Runs over plain HTTP (no internal CA trust yet);
+# the token authenticates the call. Non-fatal if it fails (the local-disk
+# fallback still protects a re-provisioned host on the following boot).
+curl -fsS -m 15 -X POST \
+  -H "Authorization: Bearer {{ .ProvisionToken }}" \
+  "{{ .CallbackURL }}" || echo "bootapi: provisioned callback failed (non-fatal)"
+{{- end }}
+%end

kickstart/fedora.ks.tmpl

@@ -0,0 +1,80 @@
+{{- /*
+Fedora kickstart (family-level template: matches any "fedoraNN" platform slug
+via the catalog family match). Kept close to the AlmaLinux template so the two
+stay comparable; the differences are the install-tree layout (releases/.../
+Everything) and the puppet release RPM. Install source + boot images come from
+the artifactapi fedora remote via the distro catalog.
+*/ -}}
+{{- $mirror := .DistroVars.mirror -}}
+#version=F{{ default "" .OSVersion }}
+# Rendered by bootapi for {{ .FQDN }} (platform {{ .Platform }})
+text
+firstboot --disable
+reboot
+
+# --- install source (artifactapi fedora remote, from the distro catalog) ---
+url --url={{ $mirror }}/{{ .Arch }}/os/
+
+keyboard --xlayouts='us'
+lang en_AU.UTF-8
+timezone Australia/Sydney --utc
+
+{{ if .RootPasswordHash -}}
+rootpw --iscrypted {{ .RootPasswordHash }}
+{{- else -}}
+rootpw --lock
+{{- end }}
+selinux --enforcing
+firewall --enabled --service=ssh
+
+# --- networking (static, from NetBox) ---
+{{- $primary := .PrimaryInterface }}
+{{- range .Interfaces }}
+{{- if .IP }}
+network --bootproto=static --device={{ .MAC }} --ip={{ .IP }} --netmask={{ .Netmask }}{{ if .Gateway }} --gateway={{ .Gateway }}{{ end }}{{ range $.Nameservers }} --nameserver={{ . }}{{ end }}{{ if and $primary (eq .MAC $primary.MAC) }} --hostname={{ $.FQDN }}{{ end }} --activate --onboot=on --noipv6
+{{- end }}
+{{- end }}
+
+# --- storage ---
+ignoredisk --only-use=sda
+clearpart --all --initlabel --drives=sda
+bootloader --location=mbr --boot-drive=sda
+autopart --type=lvm --nohome
+
+%packages --ignoremissing
+@^minimal-environment
+openssh-server
+chrony
+git
+%end
+
+%post --log=/root/bootapi-post.log
+set -x
+systemctl enable chronyd sshd
+{{ if .SSHAuthorizedKeys -}}
+install -d -m0700 /root/.ssh
+cat > /root/.ssh/authorized_keys <<'EOF'
+{{ range .SSHAuthorizedKeys }}{{ . }}
+{{ end }}EOF
+chmod 0600 /root/.ssh/authorized_keys
+{{- end }}
+dnf install -y "https://yum.puppet.com/puppet8-release-fedora-{{ default "40" .OSVersion }}.noarch.rpm" || true
+dnf install -y puppet-agent
+PUPPET_BIN=/opt/puppetlabs/bin/puppet
+"$PUPPET_BIN" config set --section main certname  "{{ .FQDN }}"
+"$PUPPET_BIN" config set --section main server    "{{ .PuppetServer }}"
+"$PUPPET_BIN" config set --section main ca_server "{{ .PuppetCAServer }}"
+
+install -d -m0755 /etc/sysconfig
+cat > /etc/sysconfig/puppet-initial <<'EOF'
+PUPPETCA_URL={{ .PuppetCAURL }}
+EOF
+
+systemctl enable puppet
+
+{{ if and .ProvisionToken .CallbackURL -}}
+curl -fsS -m 15 -X POST \
+  -H "Authorization: Bearer {{ .ProvisionToken }}" \
+  "{{ .CallbackURL }}" || echo "bootapi: provisioned callback failed (non-fatal)"
+{{- end }}
+%end