bootapi/cmd/bootapi/main.go

// Command bootapi is the PXE/kickstart boot service: it renders kickstart files
// and iPXE boot scripts from NetBox device data and serves them to PXE-booting
// hosts, replacing Cobbler's provisioning side.
package main

import (
	"context"
	"fmt"
	"log/slog"
	"os"
	"os/signal"
	"path/filepath"
	"syscall"

	"git.unkin.net/unkin/bootapi/internal/config"
	"git.unkin.net/unkin/bootapi/internal/gitsync"
	"git.unkin.net/unkin/bootapi/internal/netbox"
	"git.unkin.net/unkin/bootapi/internal/render"
	"git.unkin.net/unkin/bootapi/internal/server"
	"git.unkin.net/unkin/bootapi/templates"
)

var version = "dev"

func main() {
	// `bootapi validate [dir]` checks a template/catalog set (used by the
	// bootapi-templates repo CI) and exits without starting the server.
	if len(os.Args) > 1 && os.Args[1] == "validate" {
		dir := "."
		if len(os.Args) > 2 {
			dir = os.Args[2]
		}
		os.Exit(runValidate(dir))
	}

	slog.SetDefault(slog.New(slog.NewJSONHandler(os.Stdout, nil)))
	slog.Info("starting bootapi", "version", version)

	cfg, err := config.Load()
	if err != nil {
		slog.Error("load config", "err", err)
		os.Exit(1)
	}
	if cfg.NetBoxURL == "" {
		slog.Warn("BOOTAPI_NETBOX_URL is empty; every host lookup will fail and iPXE will serve the fallback")
	}
	if cfg.NetBoxToken == "" {
		slog.Warn("no NetBox token set (BOOTAPI_NETBOX_TOKEN/_FILE); NetBox reads will likely be denied")
	}
	if cfg.ProvisionToken == "" {
		slog.Warn("no BOOTAPI_PROVISION_TOKEN set; the /provisioned callback is disabled (pxe_enabled will not auto-clear)")
	}

	rcfg := render.RenderConfig{
		PuppetServer:      cfg.PuppetServer,
		PuppetCAServer:    cfg.PuppetCAServer,
		PuppetCAURL:       cfg.PuppetCAURL,
		BaseURL:           cfg.BaseURL,
		CallbackBaseURL:   cfg.CallbackBaseURL,
		ArtifactBase:      cfg.ArtifactBaseURL,
		BootBaseURL:       cfg.BootBaseURL,
		ProvisionToken:    cfg.ProvisionToken,
		DefaultDomain:     cfg.Domain,
		DefaultNS:         cfg.Nameservers,
		RootPasswordHash:  cfg.RootPasswordHash,
		SSHAuthorizedKeys: cfg.SSHAuthorizedKeys,
		DefaultTemplate:   cfg.DefaultTemplate,
	}

	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
	defer stop()

	engine, syncer, err := buildEngine(ctx, cfg, rcfg)
	if err != nil {
		slog.Error("load templates", "err", err)
		os.Exit(1)
	}
	if syncer != nil {
		go syncer.Run(ctx)
	}

	nb := netbox.New(netbox.Options{
		BaseURL:  cfg.NetBoxURL,
		Token:    cfg.NetBoxToken,
		Timeout:  cfg.NetBoxTimeout,
		Insecure: cfg.NetBoxInsecure,
	})
	cache := netbox.NewCache(nb, cfg.CacheTTL)

	opts := server.Options{
		NetBox:             cache,
		Engine:             engine,
		Cache:              cache,
		UnknownMACFallback: cfg.UnknownMACFallback,
		ProvisionToken:     cfg.ProvisionToken,
		TLSAddr:            cfg.TLSListenAddr,
		TLSCertFile:        cfg.TLSCertFile,
		TLSKeyFile:         cfg.TLSKeyFile,
	}
	if syncer != nil {
		opts.GitStats = syncer
	}
	srv := server.New(opts)

	if err := srv.ListenAndServe(ctx, cfg.ListenAddr); err != nil {
		slog.Error("server", "err", err)
		os.Exit(1)
	}
}

// runValidate loads a template/catalog dir over the embedded defaults and
// renders every catalog distro, returning a process exit code.
func runValidate(dir string) int {
	set, err := render.BuildSet(templates.FS, os.DirFS(dir))
	if err != nil {
		fmt.Fprintf(os.Stderr, "bootapi validate: %v\n", err)
		return 1
	}
	// Fixture render-time config: concrete enough that every field resolves.
	eng := render.NewEngine(render.RenderConfig{
		PuppetServer: "puppet.k8s.syd1.au.unkin.net", PuppetCAServer: "puppetca.k8s.syd1.au.unkin.net",
		PuppetCAURL: "puppetca.k8s.syd1.au.unkin.net",
		BaseURL:     "http://bootapi.example.net", CallbackBaseURL: "http://bootapi.example.net",
		ArtifactBase: "https://artifactapi.example.net/api/v1/remote", ProvisionToken: "validate-token",
		DefaultDomain: "example.net", DefaultNS: []string{"10.0.0.1"},
		RootPasswordHash: "$6$fixture$hash", DefaultTemplate: "almalinux9",
	}, set)
	if err := eng.Validate(); err != nil {
		fmt.Fprintf(os.Stderr, "bootapi validate: %v\n", err)
		return 1
	}
	fmt.Printf("bootapi validate: OK (%s + embedded defaults)\n", dir)
	return 0
}

// buildEngine constructs the render Engine and, when a templates git repo is
// configured, a Syncer that reloads it periodically. Precedence: git repo →
// local override dir → embedded defaults only. Git/dir failures degrade to the
// embedded defaults rather than failing startup.
func buildEngine(ctx context.Context, cfg *config.Config, rcfg render.RenderConfig) (*render.Engine, *gitsync.Syncer, error) {
	switch {
	case cfg.TemplateGitURL != "":
		syncer := gitsync.New(gitsync.Options{
			URL:      cfg.TemplateGitURL,
			Branch:   cfg.TemplateGitBranch,
			Token:    cfg.TemplateGitToken,
			Interval: cfg.TemplateGitInterval,
			WorkDir:  filepath.Join(os.TempDir(), "bootapi-templates"),
		}, templates.FS)
		set, gerr := syncer.Bootstrap(ctx)
		if gerr != nil {
			slog.Warn("template git bootstrap degraded to embedded defaults", "err", gerr)
		}
		engine := render.NewEngine(rcfg, set)
		syncer.SetEngine(engine)
		return engine, syncer, nil

	case cfg.TemplateDir != "":
		set, err := render.BuildSet(templates.FS, os.DirFS(cfg.TemplateDir))
		if err != nil {
			return nil, nil, err
		}
		return render.NewEngine(rcfg, set), nil, nil

	default:
		set, err := render.BuildSet(templates.FS, nil)
		if err != nil {
			return nil, nil, err
		}
		return render.NewEngine(rcfg, set), nil, nil
	}
}