{{- /*
AlmaLinux 9 kickstart, ported from the Cobbler default.ks contract.

Rendered by bootapi from NetBox data + render-time secrets + the distro catalog.
Install source comes from the artifactapi almalinux remote (via the catalog
mirror var). The %post installs the Puppet agent and points it at the k8s
puppetserver (puppet.k8s.syd1.au.unkin.net / puppetca.k8s...), writes the
puppet-initial PUPPETCA_URL env file, then posts back to bootapi so pxe_enabled
flips off (Cobbler's netboot_enabled flow).

Data model: see docs/data-model.md. `.RootPasswordHash` and `.ProvisionToken`
come from Vault/env at render time, never from NetBox.
*/ -}}
{{- $mirror := .DistroVars.mirror -}}
#version=RHEL9
# Rendered by bootapi for {{ .FQDN }} (platform {{ .Platform }}, role {{ default "none" .Role }})
text
eula --agreed
firstboot --disable
reboot

# --- install source (artifactapi almalinux remote, from the distro catalog) ---
url --url={{ $mirror }}/BaseOS/{{ .Arch }}/os/
repo --name=AppStream --baseurl={{ $mirror }}/AppStream/{{ .Arch }}/os/

# --- localization ---
keyboard --xlayouts='us'
lang en_AU.UTF-8
timezone Australia/Sydney --utc

# --- security ---
{{ if .RootPasswordHash -}}
rootpw --iscrypted {{ .RootPasswordHash }}
{{- else -}}
rootpw --lock
{{- end }}
selinux --enforcing
firewall --enabled --service=ssh
authselect select sssd with-mkhomedir --force

# --- networking (static, from NetBox) ---
{{- $primary := .PrimaryInterface }}
{{- range .Interfaces }}
{{- if .IP }}
network --bootproto=static --device={{ .MAC }} --ip={{ .IP }} --netmask={{ .Netmask }}{{ if .Gateway }} --gateway={{ .Gateway }}{{ end }}{{ range $.Nameservers }} --nameserver={{ . }}{{ end }}{{ if and $primary (eq .MAC $primary.MAC) }} --hostname={{ $.FQDN }}{{ end }} --activate --onboot=on --noipv6
{{- end }}
{{- end }}

# --- storage ---
ignoredisk --only-use=sda
clearpart --all --initlabel --drives=sda
bootloader --location=mbr --boot-drive=sda --append="crashkernel=auto"
autopart --type=lvm --nohome

# --- packages ---
%packages --ignoremissing --excludedocs
@^minimal-environment
openssh-server
chrony
vim-minimal
tmux
git
-iwl*-firmware
%end

# --- bootstrap: puppet (k8s) + end-of-install callback ---
%post --log=/root/bootapi-post.log
set -x

# chrony: keep time sane before any cert work.
systemctl enable chronyd

{{ if .SSHAuthorizedKeys -}}
# root authorized_keys (from render-time config, not NetBox).
install -d -m0700 /root/.ssh
cat > /root/.ssh/authorized_keys <<'EOF'
{{ range .SSHAuthorizedKeys }}{{ . }}
{{ end }}EOF
chmod 0600 /root/.ssh/authorized_keys
{{- end }}

# Install the Puppet 8 agent from the puppet platform repo.
rpm -q puppet-agent >/dev/null 2>&1 || \
  dnf install -y https://yum.puppet.com/puppet8-release-el-9.noarch.rpm
dnf install -y puppet-agent

# Point the agent at the k8s puppetserver / CA.
PUPPET_BIN=/opt/puppetlabs/bin/puppet
"$PUPPET_BIN" config set --section main certname      "{{ .FQDN }}"
"$PUPPET_BIN" config set --section main server        "{{ .PuppetServer }}"
"$PUPPET_BIN" config set --section main ca_server     "{{ .PuppetCAServer }}"
"$PUPPET_BIN" config set --section main report_server "{{ .PuppetServer }}"
"$PUPPET_BIN" config set --section main environment   production

# puppet-initial bootstrap unit reads PUPPETCA_URL from this EnvironmentFile.
install -d -m0755 /etc/sysconfig
cat > /etc/sysconfig/puppet-initial <<'EOF'
PUPPETCA_URL={{ .PuppetCAURL }}
EOF

# Enable the agent; first boot triggers firstrun (autosign handles the CSR).
systemctl enable puppet

{{ if and .ProvisionToken .CallbackURL -}}
# Tell bootapi the install is done so it clears pxe_enabled in NetBox and the
# next PXE boots local disk. Runs over plain HTTP (no internal CA trust yet);
# the token authenticates the call. Non-fatal if it fails (the local-disk
# fallback still protects a re-provisioned host on the following boot).
curl -fsS -m 15 -X POST \
  -H "Authorization: Bearer {{ .ProvisionToken }}" \
  "{{ .CallbackURL }}" || echo "bootapi: provisioned callback failed (non-fatal)"
{{- end }}
%end