Address PR review: PXE gate + callback, git-sync templates, distro catalog, k8s targets, http+https

Implements the six review comments on PR #1:

- Per-host PXE-enable gate: read NetBox pxe_enabled custom field; a known host
  with it false gets the safe local-boot script (Cobbler netboot_enabled). Add a
  token-guarded POST /provisioned/{ident} callback that clears pxe_enabled in
  NetBox, plus a %post snippet in the default kickstarts that calls it.
- Templates from a git repo: bootapi clones a templates repo and re-pulls every
  BOOTAPI_TEMPLATE_GIT_INTERVAL (default 3m), atomically swapping the template
  set (last-good kept on parse failure; embedded defaults are the startup
  fallback). Metrics for syncs/failures/generation.
- Distro catalog (catalog/*.yaml): NetBox host -> boot images/kickstart, so
  adding an OS is a YAML + template change. Ships almalinux + fedora entries
  (artifactapi remotes); debian/talos path documented.
- Boot images from the artifactapi almalinux/fedora remotes via the catalog.
- Bind resolvers, puppet server/CA and PUPPETCA_URL env file now target the k8s
  services (198.18.200.7; puppet(ca).k8s.syd1.au.unkin.net).
- Boot path served over plain HTTP (installers lack CA trust) with an optional
  parallel HTTPS listener; docs say do not 301 the boot endpoints.

New packages: internal/catalog, internal/gitsync. NetBox client gains a
pxe_enabled write (token needs that scope - noted in docs). `bootapi validate`
subcommand validates a template/catalog set for the templates-repo CI.

go build/vet clean, go test -race green, golangci-lint v2 clean, pre-commit clean.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

cmd/bootapi/main.go

@@ -5,12 +5,15 @@ package main
 
 import (
 	"context"
+	"fmt"
 	"log/slog"
 	"os"
 	"os/signal"
+	"path/filepath"
 	"syscall"
 
 	"git.unkin.net/unkin/bootapi/internal/config"
+	"git.unkin.net/unkin/bootapi/internal/gitsync"
 	"git.unkin.net/unkin/bootapi/internal/netbox"
 	"git.unkin.net/unkin/bootapi/internal/render"
 	"git.unkin.net/unkin/bootapi/internal/server"
@@ -20,6 +23,16 @@ import (
 var version = "dev"
 
 func main() {
+	// `bootapi validate [dir]` checks a template/catalog set (used by the
+	// bootapi-templates repo CI) and exits without starting the server.
+	if len(os.Args) > 1 && os.Args[1] == "validate" {
+		dir := "."
+		if len(os.Args) > 2 {
+			dir = os.Args[2]
+		}
+		os.Exit(runValidate(dir))
+	}
+
 	slog.SetDefault(slog.New(slog.NewJSONHandler(os.Stdout, nil)))
 	slog.Info("starting bootapi", "version", version)
 
@@ -34,22 +47,37 @@ func main() {
 	if cfg.NetBoxToken == "" {
 		slog.Warn("no NetBox token set (BOOTAPI_NETBOX_TOKEN/_FILE); NetBox reads will likely be denied")
 	}
+	if cfg.ProvisionToken == "" {
+		slog.Warn("no BOOTAPI_PROVISION_TOKEN set; the /provisioned callback is disabled (pxe_enabled will not auto-clear)")
+	}
 
-	engine, err := render.NewEngine(templates.FS, cfg.TemplateDir, render.RenderConfig{
+	rcfg := render.RenderConfig{
 		PuppetServer:      cfg.PuppetServer,
 		PuppetCAServer:    cfg.PuppetCAServer,
+		PuppetCAURL:       cfg.PuppetCAURL,
 		BaseURL:           cfg.BaseURL,
+		CallbackBaseURL:   cfg.CallbackBaseURL,
+		ArtifactBase:      cfg.ArtifactBaseURL,
 		BootBaseURL:       cfg.BootBaseURL,
+		ProvisionToken:    cfg.ProvisionToken,
 		DefaultDomain:     cfg.Domain,
 		DefaultNS:         cfg.Nameservers,
 		RootPasswordHash:  cfg.RootPasswordHash,
 		SSHAuthorizedKeys: cfg.SSHAuthorizedKeys,
 		DefaultTemplate:   cfg.DefaultTemplate,
-	})
+	}
+
+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+	defer stop()
+
+	engine, syncer, err := buildEngine(ctx, cfg, rcfg)
 	if err != nil {
 		slog.Error("load templates", "err", err)
 		os.Exit(1)
 	}
+	if syncer != nil {
+		go syncer.Run(ctx)
+	}
 
 	nb := netbox.New(netbox.Options{
 		BaseURL:  cfg.NetBoxURL,
@@ -59,18 +87,86 @@ func main() {
 	})
 	cache := netbox.NewCache(nb, cfg.CacheTTL)
 
-	srv := server.New(server.Options{
-		Resolver:           cache,
+	opts := server.Options{
+		NetBox:             cache,
 		Engine:             engine,
 		Cache:              cache,
 		UnknownMACFallback: cfg.UnknownMACFallback,
-	})
-
-	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
-	defer stop()
+		ProvisionToken:     cfg.ProvisionToken,
+		TLSAddr:            cfg.TLSListenAddr,
+		TLSCertFile:        cfg.TLSCertFile,
+		TLSKeyFile:         cfg.TLSKeyFile,
+	}
+	if syncer != nil {
+		opts.GitStats = syncer
+	}
+	srv := server.New(opts)
 
 	if err := srv.ListenAndServe(ctx, cfg.ListenAddr); err != nil {
 		slog.Error("server", "err", err)
 		os.Exit(1)
 	}
 }
+
+// runValidate loads a template/catalog dir over the embedded defaults and
+// renders every catalog distro, returning a process exit code.
+func runValidate(dir string) int {
+	set, err := render.BuildSet(templates.FS, os.DirFS(dir))
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "bootapi validate: %v\n", err)
+		return 1
+	}
+	// Fixture render-time config: concrete enough that every field resolves.
+	eng := render.NewEngine(render.RenderConfig{
+		PuppetServer: "puppet.k8s.syd1.au.unkin.net", PuppetCAServer: "puppetca.k8s.syd1.au.unkin.net",
+		PuppetCAURL: "puppetca.k8s.syd1.au.unkin.net",
+		BaseURL:     "http://bootapi.example.net", CallbackBaseURL: "http://bootapi.example.net",
+		ArtifactBase: "https://artifactapi.example.net/api/v1/remote", ProvisionToken: "validate-token",
+		DefaultDomain: "example.net", DefaultNS: []string{"10.0.0.1"},
+		RootPasswordHash: "$6$fixture$hash", DefaultTemplate: "almalinux9",
+	}, set)
+	if err := eng.Validate(); err != nil {
+		fmt.Fprintf(os.Stderr, "bootapi validate: %v\n", err)
+		return 1
+	}
+	fmt.Printf("bootapi validate: OK (%s + embedded defaults)\n", dir)
+	return 0
+}
+
+// buildEngine constructs the render Engine and, when a templates git repo is
+// configured, a Syncer that reloads it periodically. Precedence: git repo →
+// local override dir → embedded defaults only. Git/dir failures degrade to the
+// embedded defaults rather than failing startup.
+func buildEngine(ctx context.Context, cfg *config.Config, rcfg render.RenderConfig) (*render.Engine, *gitsync.Syncer, error) {
+	switch {
+	case cfg.TemplateGitURL != "":
+		syncer := gitsync.New(gitsync.Options{
+			URL:      cfg.TemplateGitURL,
+			Branch:   cfg.TemplateGitBranch,
+			Token:    cfg.TemplateGitToken,
+			Interval: cfg.TemplateGitInterval,
+			WorkDir:  filepath.Join(os.TempDir(), "bootapi-templates"),
+		}, templates.FS)
+		set, gerr := syncer.Bootstrap(ctx)
+		if gerr != nil {
+			slog.Warn("template git bootstrap degraded to embedded defaults", "err", gerr)
+		}
+		engine := render.NewEngine(rcfg, set)
+		syncer.SetEngine(engine)
+		return engine, syncer, nil
+
+	case cfg.TemplateDir != "":
+		set, err := render.BuildSet(templates.FS, os.DirFS(cfg.TemplateDir))
+		if err != nil {
+			return nil, nil, err
+		}
+		return render.NewEngine(rcfg, set), nil, nil
+
+	default:
+		set, err := render.BuildSet(templates.FS, nil)
+		if err != nil {
+			return nil, nil, err
+		}
+		return render.NewEngine(rcfg, set), nil, nil
+	}
+}