Initial bootapi: NetBox-driven PXE/kickstart boot service

bootapi replaces Cobbler's PXE/kickstart side. It resolves a PXE-booting host
from NetBox (by MAC or hostname), renders an iPXE boot script and a kickstart
from Go text/templates, and serves them over HTTP. The ENC half already moved to
encapi; this covers the provisioning/boot half.

What's here:
- cmd/bootapi + internal/{config,model,netbox,render,server}; embedded default
  templates under templates/ (AlmaLinux 9 + Fedora kickstarts, iPXE boot +
  unknown-MAC fallbacks) ported from Cobbler's boot/bootstrap contract.
- NetBox client (v4.x API) behind a Resolver interface with a short-TTL cache;
  tested against httptest fixtures using real NetBox JSON shapes.
- chi HTTP server: /ipxe/{mac}, /boot/ipxe?mac=, /ks/{ident}, healthz/readyz,
  Prometheus /metrics. Unknown MAC -> safe fallback iPXE (200), unknown KS -> 404.
- Secrets (root pw hash, ssh keys) injected at render time from env/Vault, never
  NetBox. Config is env-based per estate convention.
- Makefile (build/test/lint/docker + patch/minor/major), Dockerfile (distroless),
  .woodpecker (pre-commit, golangci-lint v2 + go test -race, docker build on PR;
  image push + Gitea binary release on v* tag), docs/ and example config.

go build/vet clean, go test -race green, golangci-lint v2 clean, pre-commit clean.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

templates/kickstart/almalinux9.ks.tmpl

@@ -0,0 +1,96 @@
+{{- /*
+AlmaLinux 9 kickstart, ported from the Cobbler default.ks contract.
+
+Rendered by bootapi from NetBox data + render-time secrets. The %post hands off
+to the existing Puppet firstrun bootstrap: it installs the agent, points it at
+the Consul-discovered puppet servers, and triggers the first run. Autosign
+(*.main.unkin.net + the PXE subnets) and the `profiles::firstrun` class do the
+rest, exactly as they did under Cobbler.
+
+Data model: see docs/data-model.md. `.RootPasswordHash` comes from Vault at
+render time, never from NetBox.
+*/ -}}
+#version=RHEL9
+# Rendered by bootapi for {{ .FQDN }} (platform {{ .Platform }}, role {{ default "none" .Role }})
+text
+eula --agreed
+firstboot --disable
+reboot
+
+# --- install source (served by bootapi's configured mirror) ---
+url --url={{ .BootBaseURL }}/BaseOS/{{ .Arch }}/os/
+repo --name=AppStream --baseurl={{ .BootBaseURL }}/AppStream/{{ .Arch }}/os/
+
+# --- localization ---
+keyboard --xlayouts='us'
+lang en_AU.UTF-8
+timezone Australia/Sydney --utc
+
+# --- security ---
+{{ if .RootPasswordHash -}}
+rootpw --iscrypted {{ .RootPasswordHash }}
+{{- else -}}
+rootpw --lock
+{{- end }}
+selinux --enforcing
+firewall --enabled --service=ssh
+authselect select sssd with-mkhomedir --force
+
+# --- networking (static, from NetBox) ---
+{{- $primary := .PrimaryInterface }}
+{{- range .Interfaces }}
+{{- if .IP }}
+network --bootproto=static --device={{ .MAC }} --ip={{ .IP }} --netmask={{ .Netmask }}{{ if .Gateway }} --gateway={{ .Gateway }}{{ end }}{{ range $.Nameservers }} --nameserver={{ . }}{{ end }}{{ if and $primary (eq .MAC $primary.MAC) }} --hostname={{ $.FQDN }}{{ end }} --activate --onboot=on --noipv6
+{{- end }}
+{{- end }}
+
+# --- storage ---
+ignoredisk --only-use=sda
+clearpart --all --initlabel --drives=sda
+bootloader --location=mbr --boot-drive=sda --append="crashkernel=auto"
+autopart --type=lvm --nohome
+
+# --- packages ---
+%packages --ignoremissing --excludedocs
+@^minimal-environment
+openssh-server
+chrony
+vim-minimal
+tmux
+git
+-iwl*-firmware
+%end
+
+# --- bootstrap: hand off to Puppet firstrun ---
+%post --log=/root/bootapi-post.log
+set -x
+
+# chrony: keep time sane before any cert work.
+systemctl enable chronyd
+
+{{ if .SSHAuthorizedKeys -}}
+# root authorized_keys (from render-time config, not NetBox).
+install -d -m0700 /root/.ssh
+cat > /root/.ssh/authorized_keys <<'EOF'
+{{ range .SSHAuthorizedKeys }}{{ . }}
+{{ end }}EOF
+chmod 0600 /root/.ssh/authorized_keys
+{{- end }}
+
+# Install the Puppet 8 agent from the puppet platform repo.
+rpm -q puppet-agent >/dev/null 2>&1 || \
+  dnf install -y https://yum.puppet.com/puppet8-release-el-9.noarch.rpm
+dnf install -y puppet-agent
+
+# Point the agent at the Consul-discovered servers (matches the pre-bootapi
+# Cobbler kickstart + hieradata/roles/infra/puppet).
+PUPPET_BIN=/opt/puppetlabs/bin/puppet
+"$PUPPET_BIN" config set --section main certname   "{{ .FQDN }}"
+"$PUPPET_BIN" config set --section main server     "{{ .PuppetServer }}"
+"$PUPPET_BIN" config set --section main ca_server  "{{ .PuppetCAServer }}"
+"$PUPPET_BIN" config set --section main report_server "{{ .PuppetServer }}"
+"$PUPPET_BIN" config set --section main environment production
+
+# Enable the agent; the first boot triggers firstrun (autosign handles the CSR).
+systemctl enable puppet
+%end

templates/kickstart/fedora.ks.tmpl

@@ -0,0 +1,66 @@
+{{- /*
+Fedora kickstart (family-level template: matches any "fedoraNN" platform slug
+via the OS-family selection fallback). Kept close to the AlmaLinux template so
+the two stay comparable; the differences are the install tree layout and that
+Fedora ships a recent-enough dnf/agent story out of the box.
+*/ -}}
+#version=F{{ default "" .OSVersion }}
+# Rendered by bootapi for {{ .FQDN }} (platform {{ .Platform }})
+text
+firstboot --disable
+reboot
+
+# --- install source ---
+url --url={{ .BootBaseURL }}/releases/{{ default "rawhide" .OSVersion }}/Everything/{{ .Arch }}/os/
+
+keyboard --xlayouts='us'
+lang en_AU.UTF-8
+timezone Australia/Sydney --utc
+
+{{ if .RootPasswordHash -}}
+rootpw --iscrypted {{ .RootPasswordHash }}
+{{- else -}}
+rootpw --lock
+{{- end }}
+selinux --enforcing
+firewall --enabled --service=ssh
+
+# --- networking (static, from NetBox) ---
+{{- $primary := .PrimaryInterface }}
+{{- range .Interfaces }}
+{{- if .IP }}
+network --bootproto=static --device={{ .MAC }} --ip={{ .IP }} --netmask={{ .Netmask }}{{ if .Gateway }} --gateway={{ .Gateway }}{{ end }}{{ range $.Nameservers }} --nameserver={{ . }}{{ end }}{{ if and $primary (eq .MAC $primary.MAC) }} --hostname={{ $.FQDN }}{{ end }} --activate --onboot=on --noipv6
+{{- end }}
+{{- end }}
+
+# --- storage ---
+ignoredisk --only-use=sda
+clearpart --all --initlabel --drives=sda
+bootloader --location=mbr --boot-drive=sda
+autopart --type=lvm --nohome
+
+%packages --ignoremissing
+@^minimal-environment
+openssh-server
+chrony
+git
+%end
+
+%post --log=/root/bootapi-post.log
+set -x
+systemctl enable chronyd sshd
+{{ if .SSHAuthorizedKeys -}}
+install -d -m0700 /root/.ssh
+cat > /root/.ssh/authorized_keys <<'EOF'
+{{ range .SSHAuthorizedKeys }}{{ . }}
+{{ end }}EOF
+chmod 0600 /root/.ssh/authorized_keys
+{{- end }}
+dnf install -y https://yum.puppet.com/puppet8-release-fedora-{{ default "40" .OSVersion }}.noarch.rpm || true
+dnf install -y puppet-agent
+PUPPET_BIN=/opt/puppetlabs/bin/puppet
+"$PUPPET_BIN" config set --section main certname  "{{ .FQDN }}"
+"$PUPPET_BIN" config set --section main server    "{{ .PuppetServer }}"
+"$PUPPET_BIN" config set --section main ca_server "{{ .PuppetCAServer }}"
+systemctl enable puppet
+%end