unkinben
8f356346eb
Implements the six review comments on PR #1: - Per-host PXE-enable gate: read NetBox pxe_enabled custom field; a known host with it false gets the safe local-boot script (Cobbler netboot_enabled). Add a token-guarded POST /provisioned/{ident} callback that clears pxe_enabled in NetBox, plus a %post snippet in the default kickstarts that calls it. - Templates from a git repo: bootapi clones a templates repo and re-pulls every BOOTAPI_TEMPLATE_GIT_INTERVAL (default 3m), atomically swapping the template set (last-good kept on parse failure; embedded defaults are the startup fallback). Metrics for syncs/failures/generation. - Distro catalog (catalog/*.yaml): NetBox host -> boot images/kickstart, so adding an OS is a YAML + template change. Ships almalinux + fedora entries (artifactapi remotes); debian/talos path documented. - Boot images from the artifactapi almalinux/fedora remotes via the catalog. - Bind resolvers, puppet server/CA and PUPPETCA_URL env file now target the k8s services (198.18.200.7; puppet(ca).k8s.syd1.au.unkin.net). - Boot path served over plain HTTP (installers lack CA trust) with an optional parallel HTTPS listener; docs say do not 301 the boot endpoints. New packages: internal/catalog, internal/gitsync. NetBox client gains a pxe_enabled write (token needs that scope - noted in docs). `bootapi validate` subcommand validates a template/catalog set for the templates-repo CI. go build/vet clean, go test -race green, golangci-lint v2 clean, pre-commit clean. Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
81 lines
2.6 KiB
Cheetah
81 lines
2.6 KiB
Cheetah
{{- /*
|
|
Fedora kickstart (family-level template: matches any "fedoraNN" platform slug
|
|
via the catalog family match). Kept close to the AlmaLinux template so the two
|
|
stay comparable; the differences are the install-tree layout (releases/.../
|
|
Everything) and the puppet release RPM. Install source + boot images come from
|
|
the artifactapi fedora remote via the distro catalog.
|
|
*/ -}}
|
|
{{- $mirror := .DistroVars.mirror -}}
|
|
#version=F{{ default "" .OSVersion }}
|
|
# Rendered by bootapi for {{ .FQDN }} (platform {{ .Platform }})
|
|
text
|
|
firstboot --disable
|
|
reboot
|
|
|
|
# --- install source (artifactapi fedora remote, from the distro catalog) ---
|
|
url --url={{ $mirror }}/{{ .Arch }}/os/
|
|
|
|
keyboard --xlayouts='us'
|
|
lang en_AU.UTF-8
|
|
timezone Australia/Sydney --utc
|
|
|
|
{{ if .RootPasswordHash -}}
|
|
rootpw --iscrypted {{ .RootPasswordHash }}
|
|
{{- else -}}
|
|
rootpw --lock
|
|
{{- end }}
|
|
selinux --enforcing
|
|
firewall --enabled --service=ssh
|
|
|
|
# --- networking (static, from NetBox) ---
|
|
{{- $primary := .PrimaryInterface }}
|
|
{{- range .Interfaces }}
|
|
{{- if .IP }}
|
|
network --bootproto=static --device={{ .MAC }} --ip={{ .IP }} --netmask={{ .Netmask }}{{ if .Gateway }} --gateway={{ .Gateway }}{{ end }}{{ range $.Nameservers }} --nameserver={{ . }}{{ end }}{{ if and $primary (eq .MAC $primary.MAC) }} --hostname={{ $.FQDN }}{{ end }} --activate --onboot=on --noipv6
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
# --- storage ---
|
|
ignoredisk --only-use=sda
|
|
clearpart --all --initlabel --drives=sda
|
|
bootloader --location=mbr --boot-drive=sda
|
|
autopart --type=lvm --nohome
|
|
|
|
%packages --ignoremissing
|
|
@^minimal-environment
|
|
openssh-server
|
|
chrony
|
|
git
|
|
%end
|
|
|
|
%post --log=/root/bootapi-post.log
|
|
set -x
|
|
systemctl enable chronyd sshd
|
|
{{ if .SSHAuthorizedKeys -}}
|
|
install -d -m0700 /root/.ssh
|
|
cat > /root/.ssh/authorized_keys <<'EOF'
|
|
{{ range .SSHAuthorizedKeys }}{{ . }}
|
|
{{ end }}EOF
|
|
chmod 0600 /root/.ssh/authorized_keys
|
|
{{- end }}
|
|
dnf install -y "https://yum.puppet.com/puppet8-release-fedora-{{ default "40" .OSVersion }}.noarch.rpm" || true
|
|
dnf install -y puppet-agent
|
|
PUPPET_BIN=/opt/puppetlabs/bin/puppet
|
|
"$PUPPET_BIN" config set --section main certname "{{ .FQDN }}"
|
|
"$PUPPET_BIN" config set --section main server "{{ .PuppetServer }}"
|
|
"$PUPPET_BIN" config set --section main ca_server "{{ .PuppetCAServer }}"
|
|
|
|
install -d -m0755 /etc/sysconfig
|
|
cat > /etc/sysconfig/puppet-initial <<'EOF'
|
|
PUPPETCA_URL={{ .PuppetCAURL }}
|
|
EOF
|
|
|
|
systemctl enable puppet
|
|
|
|
{{ if and .ProvisionToken .CallbackURL -}}
|
|
curl -fsS -m 15 -X POST \
|
|
-H "Authorization: Bearer {{ .ProvisionToken }}" \
|
|
"{{ .CallbackURL }}" || echo "bootapi: provisioned callback failed (non-fatal)"
|
|
{{- end }}
|
|
%end
|