Add image-based provisioning (liveimg) + shared storage partial

Adds a fast, reproducible install path that unpacks a prebuilt AlmaLinux 9 node
rootfs onto the disk instead of resolving packages, with per-host networking
still templated after the unpack. Storage reuses the OptiPlex model vars so
image and package installs lay disks out identically.

- kickstart/image.ks.tmpl: liveimg --url={{ .DistroVars.rootfs_tarball }};
  %post renders per-host NetworkManager keyfiles from NetBox interface data
  (the image is generic and liveimg clobbers /etc), sets hostname, the
  puppet-initial PUPPETCA_URL env, and the provisioned callback.
- kickstart/_storage.ks.tmpl: shared storage-block/storage-pre partials
  (storage_mode / vg_grow); almalinux9.ks.tmpl now uses them too (no behaviour
  change) so both installs share one storage layout.
- catalog/almalinux9-image.yaml (generic autopart) + optiplex-7080-image.yaml
  (auto-nvme + vg_grow) point liveimg at the artifactapi rootfs-images repo.
- .woodpecker/build-image.yaml: builds the rootfs via dnf --installroot,
  tars almalinux9-node-<ver>.tar.zst, uploads to the rootfs-images local repo
  on tag node-image-<ver>.

Validated with bootapi validate + shellcheck; no bootapi code change (DistroVars
+ existing interface data suffice).

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

kickstart/image.ks.tmpl

@@ -0,0 +1,131 @@
+{{- /*
+Image-based AlmaLinux 9 kickstart. Anaconda `liveimg` unpacks a prebuilt rootfs
+tarball (catalog var rootfs_tarball, on the artifactapi rootfs-images local repo)
+onto the disk instead of resolving+installing packages: it formats the KS-defined
+filesystems, untars the rootfs, installs grub and regenerates the initramfs. The
+package set (kernel, grub2, openssh, chrony, puppet-agent, ...) is baked into the
+tarball by .woodpecker/build-image.yaml.
+
+The image is GENERIC (no per-host identity). liveimg overwrites /etc with the
+tarball, so all per-host config is applied in %post AFTER the unpack: static
+NetworkManager keyfiles from the SAME NetBox interface data the classic template
+uses, the hostname, the puppet-initial env, and the provisioned callback.
+
+Storage reuses the shared _storage.ks.tmpl partials (storage_mode / vg_grow), so
+image and package installs land on disk identically (VM autopart, OptiPlex NVMe).
+Select via a device's provision_template custom field (e.g. almalinux9-image).
+*/ -}}
+#version=RHEL9
+# Rendered by bootapi (image install) for {{ .FQDN }} (platform {{ .Platform }})
+text
+firstboot --disable
+reboot
+
+# --- payload: unpack the prebuilt rootfs tarball ---
+liveimg --url={{ .DistroVars.rootfs_tarball }}
+
+# --- localization ---
+keyboard --xlayouts='au'
+lang en_AU.UTF-8
+timezone Australia/Sydney --utc
+
+# --- security ---
+{{ if .RootPasswordHash -}}
+rootpw --iscrypted {{ .RootPasswordHash }}
+{{- else -}}
+rootpw --lock
+{{- end }}
+selinux --enforcing
+firewall --enabled --service=ssh
+
+# --- install-time networking (primary NIC only, so Anaconda can fetch the
+# tarball). The installed system's network is written authoritatively in %post
+# below, because the liveimg unpack overwrites whatever Anaconda configures. ---
+{{- $primary := .PrimaryInterface }}
+{{- if and $primary $primary.IP }}
+network --bootproto=static --device={{ $primary.MAC }} --ip={{ $primary.IP }} --netmask={{ $primary.Netmask }}{{ if $primary.Gateway }} --gateway={{ $primary.Gateway }}{{ end }}{{ range .Nameservers }} --nameserver={{ . }}{{ end }} --hostname={{ $.FQDN }} --activate --onboot=on --noipv6
+{{- else }}
+network --bootproto=dhcp --hostname={{ .FQDN }} --activate
+{{- end }}
+
+# --- storage (model-aware; shared with almalinux9.ks.tmpl via _storage.ks.tmpl) ---
+{{ template "storage-block" . }}
+
+# kdump: reserve crash memory (kexec-tools is baked into the image).
+%addon com_redhat_kdump --enable --reserve-mb='auto'
+%end
+{{ template "storage-pre" . }}
+
+# NOTE: no %packages section - liveimg provides the package set from the tarball.
+
+# --- %post: apply per-host config AFTER the generic image is unpacked ---
+%post --log=/root/bootapi-post.log
+set -x
+
+# Hostname (the image is generic).
+echo "{{ .FQDN }}" > /etc/hostname
+
+# Static per-host networking as NetworkManager keyfiles, from NetBox interface
+# data. Written here (not via `network`) because the liveimg unpack clobbers
+# /etc. Match on MAC so NIC renaming can't misapply an address.
+install -d -m0755 /etc/NetworkManager/system-connections
+rm -f /etc/NetworkManager/system-connections/*.nmconnection
+{{- range .Interfaces }}
+{{- if .IP }}
+cat > "/etc/NetworkManager/system-connections/{{ .Name }}.nmconnection" <<'EOF'
+[connection]
+id={{ .Name }}
+type=ethernet
+interface-name={{ .Name }}
+autoconnect=true
+
+[ethernet]
+mac-address={{ .MAC }}
+
+[ipv4]
+method=manual
+address1={{ .IP }}/{{ .PrefixLen }}{{ if .Gateway }},{{ .Gateway }}{{ end }}
+dns={{ range $.Nameservers }}{{ . }};{{ end }}
+may-fail=false
+
+[ipv6]
+method=disabled
+EOF
+{{- end }}
+{{- end }}
+chmod 600 /etc/NetworkManager/system-connections/*.nmconnection
+
+# chrony + ssh + NetworkManager come from the image; ensure they're enabled.
+systemctl enable chronyd sshd NetworkManager
+
+{{ if .SSHAuthorizedKeys -}}
+install -d -m0700 /root/.ssh
+cat > /root/.ssh/authorized_keys <<'EOF'
+{{ range .SSHAuthorizedKeys }}{{ . }}
+{{ end }}EOF
+chmod 0600 /root/.ssh/authorized_keys
+{{- end }}
+
+# Puppet agent is baked into the image; just point it at the k8s server/CA.
+PUPPET_BIN=/opt/puppetlabs/bin/puppet
+"$PUPPET_BIN" config set --section main certname      "{{ .FQDN }}"
+"$PUPPET_BIN" config set --section main server        "{{ .PuppetServer }}"
+"$PUPPET_BIN" config set --section main ca_server     "{{ .PuppetCAServer }}"
+"$PUPPET_BIN" config set --section main report_server "{{ .PuppetServer }}"
+"$PUPPET_BIN" config set --section main environment   production
+
+install -d -m0755 /etc/sysconfig
+cat > /etc/sysconfig/puppet-initial <<'EOF'
+PUPPETCA_URL={{ .PuppetCAURL }}
+EOF
+
+systemctl enable puppet
+
+{{ if and .ProvisionToken .CallbackURL -}}
+# Clear pxe_enabled in NetBox so the next PXE boots local disk (plain HTTP; the
+# token authenticates). Non-fatal on failure.
+curl -fsS -m 15 -X POST \
+  -H "Authorization: Bearer {{ .ProvisionToken }}" \
+  "{{ .CallbackURL }}" || echo "bootapi: provisioned callback failed (non-fatal)"
+{{- end }}
+%end