{{- /*
Fedora kickstart (family-level template: matches any "fedoraNN" platform slug
via the catalog family match). Kept close to the AlmaLinux template so the two
stay comparable; the differences are the install-tree layout (releases/.../
Everything) and the puppet release RPM. Install source + boot images come from
the artifactapi fedora remote via the distro catalog.
*/ -}}
{{- $mirror := .DistroVars.mirror -}}
#version=F{{ default "" .OSVersion }}
# Rendered by bootapi for {{ .FQDN }} (platform {{ .Platform }})
text
firstboot --disable
reboot

# --- install source (artifactapi fedora remote, from the distro catalog) ---
url --url={{ $mirror }}/{{ .Arch }}/os/

keyboard --xlayouts='us'
lang en_AU.UTF-8
timezone Australia/Sydney --utc

{{ if .RootPasswordHash -}}
rootpw --iscrypted {{ .RootPasswordHash }}
{{- else -}}
rootpw --lock
{{- end }}
selinux --enforcing
firewall --enabled --service=ssh

# --- networking (static, from NetBox) ---
{{- $primary := .PrimaryInterface }}
{{- range .Interfaces }}
{{- if .IP }}
network --bootproto=static --device={{ .MAC }} --ip={{ .IP }} --netmask={{ .Netmask }}{{ if .Gateway }} --gateway={{ .Gateway }}{{ end }}{{ range $.Nameservers }} --nameserver={{ . }}{{ end }}{{ if and $primary (eq .MAC $primary.MAC) }} --hostname={{ $.FQDN }}{{ end }} --activate --onboot=on --noipv6
{{- end }}
{{- end }}

# --- storage ---
ignoredisk --only-use=sda
clearpart --all --initlabel --drives=sda
bootloader --location=mbr --boot-drive=sda
autopart --type=lvm --nohome

%packages --ignoremissing
@^minimal-environment
openssh-server
chrony
git
%end

%post --log=/root/bootapi-post.log
set -x
systemctl enable chronyd sshd
{{ if .SSHAuthorizedKeys -}}
install -d -m0700 /root/.ssh
cat > /root/.ssh/authorized_keys <<'EOF'
{{ range .SSHAuthorizedKeys }}{{ . }}
{{ end }}EOF
chmod 0600 /root/.ssh/authorized_keys
{{- end }}
dnf install -y "https://yum.puppet.com/puppet8-release-fedora-{{ default "40" .OSVersion }}.noarch.rpm" || true
dnf install -y puppet-agent
PUPPET_BIN=/opt/puppetlabs/bin/puppet
"$PUPPET_BIN" config set --section main certname  "{{ .FQDN }}"
"$PUPPET_BIN" config set --section main server    "{{ .PuppetServer }}"
"$PUPPET_BIN" config set --section main ca_server "{{ .PuppetCAServer }}"

install -d -m0755 /etc/sysconfig
cat > /etc/sysconfig/puppet-initial <<'EOF'
PUPPETCA_URL={{ .PuppetCAURL }}
EOF

systemctl enable puppet

{{ if and .ProvisionToken .CallbackURL -}}
curl -fsS -m 15 -X POST \
  -H "Authorization: Bearer {{ .ProvisionToken }}" \
  "{{ .CallbackURL }}" || echo "bootapi: provisioned callback failed (non-fatal)"
{{- end }}
%end