Initial bootapi: NetBox-driven PXE/kickstart boot service
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful

bootapi replaces Cobbler's PXE/kickstart side. It resolves a PXE-booting host
from NetBox (by MAC or hostname), renders an iPXE boot script and a kickstart
from Go text/templates, and serves them over HTTP. The ENC half already moved to
encapi; this covers the provisioning/boot half.

What's here:
- cmd/bootapi + internal/{config,model,netbox,render,server}; embedded default
  templates under templates/ (AlmaLinux 9 + Fedora kickstarts, iPXE boot +
  unknown-MAC fallbacks) ported from Cobbler's boot/bootstrap contract.
- NetBox client (v4.x API) behind a Resolver interface with a short-TTL cache;
  tested against httptest fixtures using real NetBox JSON shapes.
- chi HTTP server: /ipxe/{mac}, /boot/ipxe?mac=, /ks/{ident}, healthz/readyz,
  Prometheus /metrics. Unknown MAC -> safe fallback iPXE (200), unknown KS -> 404.
- Secrets (root pw hash, ssh keys) injected at render time from env/Vault, never
  NetBox. Config is env-based per estate convention.
- Makefile (build/test/lint/docker + patch/minor/major), Dockerfile (distroless),
  .woodpecker (pre-commit, golangci-lint v2 + go test -race, docker build on PR;
  image push + Gitea binary release on v* tag), docs/ and example config.

go build/vet clean, go test -race green, golangci-lint v2 clean, pre-commit clean.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
This commit is contained in:
2026-07-28 17:20:06 +10:00
parent 98e69d2fcb
commit 274c480b09
37 changed files with 3290 additions and 1 deletions
+11
View File
@@ -0,0 +1,11 @@
// Package templates embeds bootapi's default kickstart and iPXE templates.
// These are the built-in fallback set; an operator can override any of them by
// mounting a ConfigMap at BOOTAPI_TEMPLATE_DIR (see docs/deployment.md).
package templates
import "embed"
// FS holds the default template tree: kickstart/*.ks.tmpl and ipxe/*.ipxe.tmpl.
//
//go:embed kickstart ipxe
var FS embed.FS
+20
View File
@@ -0,0 +1,20 @@
{{- /*
iPXE boot script for a known host. Chains the OS installer kernel+initrd and
points inst.ks= back at bootapi's /ks/<hostname> endpoint, mirroring how Cobbler
generated a per-MAC gPXE script that carried inst.ks=.
Requires BOOTAPI_BOOT_BASE_URL (KernelURL/InitrdURL) and BOOTAPI_BASE_URL
(KickstartURL) to be configured.
*/ -}}
#!ipxe
echo bootapi: provisioning {{ .FQDN }} ({{ .Platform }})
{{ if and .KernelURL .InitrdURL -}}
kernel {{ .KernelURL }} initrd=initrd.img inst.repo={{ .BootBaseURL }} inst.ks={{ .KickstartURL }} inst.text ip=dhcp net.ifnames=0
initrd {{ .InitrdURL }}
boot
{{- else -}}
echo bootapi: BOOTAPI_BOOT_BASE_URL not configured; cannot build a boot line
echo Falling back to local disk in 5s
sleep 5
exit
{{- end }}
+10
View File
@@ -0,0 +1,10 @@
{{- /*
Safe default for an UNKNOWN MAC (NetBox has no matching device). We deliberately
do NOT start an installer for a machine we can't identify — that could wipe a
production box that PXE-booted by accident. Instead we boot from local disk, so
an already-installed host just continues, and a brand-new host loops back to PXE
on its next attempt (by which point NetBox should know it).
*/ -}}
#!ipxe
echo bootapi: unknown MAC ${net0/mac}; not provisioning. Booting local disk.
sanboot --no-describe --drive 0x80 || exit
+10
View File
@@ -0,0 +1,10 @@
{{- /*
Debug fallback for an unknown MAC (opt in via BOOTAPI_UNKNOWN_MAC_FALLBACK=shell).
Drops to an interactive iPXE shell instead of booting anything, so an operator
racking a new box can inspect ${net0/mac} and register it in NetBox. Not the
default because it halts the boot and is unsafe for an accidental PXE of a prod
host.
*/ -}}
#!ipxe
echo bootapi: unknown MAC ${net0/mac}; dropping to iPXE shell for debugging.
shell
+96
View File
@@ -0,0 +1,96 @@
{{- /*
AlmaLinux 9 kickstart, ported from the Cobbler default.ks contract.
Rendered by bootapi from NetBox data + render-time secrets. The %post hands off
to the existing Puppet firstrun bootstrap: it installs the agent, points it at
the Consul-discovered puppet servers, and triggers the first run. Autosign
(*.main.unkin.net + the PXE subnets) and the `profiles::firstrun` class do the
rest, exactly as they did under Cobbler.
Data model: see docs/data-model.md. `.RootPasswordHash` comes from Vault at
render time, never from NetBox.
*/ -}}
#version=RHEL9
# Rendered by bootapi for {{ .FQDN }} (platform {{ .Platform }}, role {{ default "none" .Role }})
text
eula --agreed
firstboot --disable
reboot
# --- install source (served by bootapi's configured mirror) ---
url --url={{ .BootBaseURL }}/BaseOS/{{ .Arch }}/os/
repo --name=AppStream --baseurl={{ .BootBaseURL }}/AppStream/{{ .Arch }}/os/
# --- localization ---
keyboard --xlayouts='us'
lang en_AU.UTF-8
timezone Australia/Sydney --utc
# --- security ---
{{ if .RootPasswordHash -}}
rootpw --iscrypted {{ .RootPasswordHash }}
{{- else -}}
rootpw --lock
{{- end }}
selinux --enforcing
firewall --enabled --service=ssh
authselect select sssd with-mkhomedir --force
# --- networking (static, from NetBox) ---
{{- $primary := .PrimaryInterface }}
{{- range .Interfaces }}
{{- if .IP }}
network --bootproto=static --device={{ .MAC }} --ip={{ .IP }} --netmask={{ .Netmask }}{{ if .Gateway }} --gateway={{ .Gateway }}{{ end }}{{ range $.Nameservers }} --nameserver={{ . }}{{ end }}{{ if and $primary (eq .MAC $primary.MAC) }} --hostname={{ $.FQDN }}{{ end }} --activate --onboot=on --noipv6
{{- end }}
{{- end }}
# --- storage ---
ignoredisk --only-use=sda
clearpart --all --initlabel --drives=sda
bootloader --location=mbr --boot-drive=sda --append="crashkernel=auto"
autopart --type=lvm --nohome
# --- packages ---
%packages --ignoremissing --excludedocs
@^minimal-environment
openssh-server
chrony
vim-minimal
tmux
git
-iwl*-firmware
%end
# --- bootstrap: hand off to Puppet firstrun ---
%post --log=/root/bootapi-post.log
set -x
# chrony: keep time sane before any cert work.
systemctl enable chronyd
{{ if .SSHAuthorizedKeys -}}
# root authorized_keys (from render-time config, not NetBox).
install -d -m0700 /root/.ssh
cat > /root/.ssh/authorized_keys <<'EOF'
{{ range .SSHAuthorizedKeys }}{{ . }}
{{ end }}EOF
chmod 0600 /root/.ssh/authorized_keys
{{- end }}
# Install the Puppet 8 agent from the puppet platform repo.
rpm -q puppet-agent >/dev/null 2>&1 || \
dnf install -y https://yum.puppet.com/puppet8-release-el-9.noarch.rpm
dnf install -y puppet-agent
# Point the agent at the Consul-discovered servers (matches the pre-bootapi
# Cobbler kickstart + hieradata/roles/infra/puppet).
PUPPET_BIN=/opt/puppetlabs/bin/puppet
"$PUPPET_BIN" config set --section main certname "{{ .FQDN }}"
"$PUPPET_BIN" config set --section main server "{{ .PuppetServer }}"
"$PUPPET_BIN" config set --section main ca_server "{{ .PuppetCAServer }}"
"$PUPPET_BIN" config set --section main report_server "{{ .PuppetServer }}"
"$PUPPET_BIN" config set --section main environment production
# Enable the agent; the first boot triggers firstrun (autosign handles the CSR).
systemctl enable puppet
%end
+66
View File
@@ -0,0 +1,66 @@
{{- /*
Fedora kickstart (family-level template: matches any "fedoraNN" platform slug
via the OS-family selection fallback). Kept close to the AlmaLinux template so
the two stay comparable; the differences are the install tree layout and that
Fedora ships a recent-enough dnf/agent story out of the box.
*/ -}}
#version=F{{ default "" .OSVersion }}
# Rendered by bootapi for {{ .FQDN }} (platform {{ .Platform }})
text
firstboot --disable
reboot
# --- install source ---
url --url={{ .BootBaseURL }}/releases/{{ default "rawhide" .OSVersion }}/Everything/{{ .Arch }}/os/
keyboard --xlayouts='us'
lang en_AU.UTF-8
timezone Australia/Sydney --utc
{{ if .RootPasswordHash -}}
rootpw --iscrypted {{ .RootPasswordHash }}
{{- else -}}
rootpw --lock
{{- end }}
selinux --enforcing
firewall --enabled --service=ssh
# --- networking (static, from NetBox) ---
{{- $primary := .PrimaryInterface }}
{{- range .Interfaces }}
{{- if .IP }}
network --bootproto=static --device={{ .MAC }} --ip={{ .IP }} --netmask={{ .Netmask }}{{ if .Gateway }} --gateway={{ .Gateway }}{{ end }}{{ range $.Nameservers }} --nameserver={{ . }}{{ end }}{{ if and $primary (eq .MAC $primary.MAC) }} --hostname={{ $.FQDN }}{{ end }} --activate --onboot=on --noipv6
{{- end }}
{{- end }}
# --- storage ---
ignoredisk --only-use=sda
clearpart --all --initlabel --drives=sda
bootloader --location=mbr --boot-drive=sda
autopart --type=lvm --nohome
%packages --ignoremissing
@^minimal-environment
openssh-server
chrony
git
%end
%post --log=/root/bootapi-post.log
set -x
systemctl enable chronyd sshd
{{ if .SSHAuthorizedKeys -}}
install -d -m0700 /root/.ssh
cat > /root/.ssh/authorized_keys <<'EOF'
{{ range .SSHAuthorizedKeys }}{{ . }}
{{ end }}EOF
chmod 0600 /root/.ssh/authorized_keys
{{- end }}
dnf install -y https://yum.puppet.com/puppet8-release-fedora-{{ default "40" .OSVersion }}.noarch.rpm || true
dnf install -y puppet-agent
PUPPET_BIN=/opt/puppetlabs/bin/puppet
"$PUPPET_BIN" config set --section main certname "{{ .FQDN }}"
"$PUPPET_BIN" config set --section main server "{{ .PuppetServer }}"
"$PUPPET_BIN" config set --section main ca_server "{{ .PuppetCAServer }}"
systemctl enable puppet
%end