unkinben
274c480b09
bootapi replaces Cobbler's PXE/kickstart side. It resolves a PXE-booting host
from NetBox (by MAC or hostname), renders an iPXE boot script and a kickstart
from Go text/templates, and serves them over HTTP. The ENC half already moved to
encapi; this covers the provisioning/boot half.
What's here:
- cmd/bootapi + internal/{config,model,netbox,render,server}; embedded default
templates under templates/ (AlmaLinux 9 + Fedora kickstarts, iPXE boot +
unknown-MAC fallbacks) ported from Cobbler's boot/bootstrap contract.
- NetBox client (v4.x API) behind a Resolver interface with a short-TTL cache;
tested against httptest fixtures using real NetBox JSON shapes.
- chi HTTP server: /ipxe/{mac}, /boot/ipxe?mac=, /ks/{ident}, healthz/readyz,
Prometheus /metrics. Unknown MAC -> safe fallback iPXE (200), unknown KS -> 404.
- Secrets (root pw hash, ssh keys) injected at render time from env/Vault, never
NetBox. Config is env-based per estate convention.
- Makefile (build/test/lint/docker + patch/minor/major), Dockerfile (distroless),
.woodpecker (pre-commit, golangci-lint v2 + go test -race, docker build on PR;
image push + Gitea binary release on v* tag), docs/ and example config.
go build/vet clean, go test -race green, golangci-lint v2 clean, pre-commit clean.
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
80 lines
2.7 KiB
YAML
80 lines
2.7 KiB
YAML
when:
|
|
- event: tag
|
|
ref: refs/tags/v*
|
|
|
|
# Cuts a Gitea release with cross-compiled bootapi binaries attached. The
|
|
# container image is built+pushed separately by docker.yaml.
|
|
steps:
|
|
- name: test
|
|
image: golang:1.25
|
|
commands:
|
|
- go test -race ./...
|
|
backend_options:
|
|
kubernetes:
|
|
serviceAccountName: default
|
|
resources:
|
|
requests:
|
|
memory: 512Mi
|
|
cpu: 1
|
|
limits:
|
|
memory: 2Gi
|
|
cpu: 2
|
|
|
|
- name: build
|
|
image: git.unkin.net/unkin/almalinux9-gobuilder:20260606
|
|
commands:
|
|
- make release-binaries VERSION=${CI_COMMIT_TAG}
|
|
depends_on: [test]
|
|
backend_options:
|
|
kubernetes:
|
|
serviceAccountName: default
|
|
resources:
|
|
requests:
|
|
memory: 512Mi
|
|
cpu: 1
|
|
limits:
|
|
memory: 2Gi
|
|
cpu: 2
|
|
|
|
- name: release
|
|
image: git.unkin.net/unkin/almalinux9-base:20260606
|
|
environment:
|
|
RELEASER_TOKEN:
|
|
from_secret: RELEASER_TOKEN
|
|
commands:
|
|
- |
|
|
curl --output /usr/local/bin/tea https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/gitea-dl/tea/0.12.0/tea-0.12.0-linux-amd64 && chmod +x /usr/local/bin/tea
|
|
tea logins add --name gitea --url https://git.unkin.net --token "$${RELEASER_TOKEN}" --no-version-check
|
|
# $$ escapes shell vars so Woodpecker doesn't substitute them at parse
|
|
# time; ${CI_COMMIT_TAG}/${CI_REPO} are real Woodpecker vars.
|
|
CUR_SHA=$$(git rev-list -n1 "${CI_COMMIT_TAG}")
|
|
PREV_TAG=""
|
|
for t in $$(git tag --sort=-v:refname); do
|
|
[ "$$t" = "${CI_COMMIT_TAG}" ] && continue
|
|
[ "$$(git rev-list -n1 "$$t")" = "$$CUR_SHA" ] && continue
|
|
if git merge-base --is-ancestor "$$t" "${CI_COMMIT_TAG}" 2>/dev/null; then
|
|
PREV_TAG="$$t"; break
|
|
fi
|
|
done
|
|
if [ -n "$$PREV_TAG" ]; then
|
|
NOTES=$$(git log "$${PREV_TAG}..${CI_COMMIT_TAG}" --pretty=format:"- %s")
|
|
else
|
|
NOTES=$$(git log --pretty=format:"- %s")
|
|
fi
|
|
tea releases create --tag "${CI_COMMIT_TAG}" --title "${CI_COMMIT_TAG}" --note "$${NOTES}" --login gitea --repo "${CI_REPO}"
|
|
ASSETS="dist/bootapi-linux-amd64 dist/bootapi-linux-arm64 dist/bootapi-darwin-amd64 dist/bootapi-darwin-arm64"
|
|
sha256sum $$ASSETS > dist/sha256sums.txt
|
|
tea releases assets create "${CI_COMMIT_TAG}" $$ASSETS dist/sha256sums.txt \
|
|
--login gitea --repo "${CI_REPO}"
|
|
depends_on: [build]
|
|
backend_options:
|
|
kubernetes:
|
|
serviceAccountName: default
|
|
resources:
|
|
requests:
|
|
memory: 128Mi
|
|
cpu: 100m
|
|
limits:
|
|
memory: 512Mi
|
|
cpu: 500m
|