Build/playbook re-run safety: corp access, netplan rollback, first-boot retry
H1 corp_admin_cidrs (UFW 22/9009 on the corp NIC from these only; refuses
when it would lock out the current SSH client) and corp_ssh_password_auth
(sshd drop-in, passwords only from the imaging subnet). Defaults keep the
current behaviour and print a loud warning.
H2 pxe-netplan-apply.sh: pre-flight refusal (pxe-MAC NIC holds the default
route, a DHCP lease or the route to an SSH client), run from the USB
before anything changes; post-apply checks (names, imaging IPv4, corp
IPv4 back within 30 s, SSH route) and a 120 s systemd-run auto-revert.
H3 restore() puts the previous NIC names back (two-phase rename via
temporary names, so swaps work) before generate + apply.
H4 a failed rename is fatal (restore + exit 1); the play drops the old
any-interface UFW rules only after verifying both NICs and their
per-interface SSH rules.
H5 first-boot checks the playbook exit code, retries at next boot (max 5),
writes /var/lib/pxe-firstboot.failed and /etc/issue + /etc/motd banners.
M1 build-usb.sh verifies iPXE files against the playbook pins, every wheel
against its own package's hashes, drops the unpinned pip fallback,
requires --site-vars or --no-site-vars.
M2 webapp restarts when the code, wheels or unit changed.
M3 ignore-carrier on the imaging NIC; ip_nonlocal_bind kept for the
apache/networkd boot race.
M4 menu suffix must match blancco_kver; missing kernel with no earlier
build is fatal; a live menu with the staged Blancco test entry is not
overwritten.
M5 build-proxmox-iso.sh is unsupported (hard exit); use build-usb --image.
M6 deploy-unattend.sh: password via SSHPASS env and sudo stdin only,
%q-quoted remote args, sha256 check of the live file; lint-unattend.py
reads PXE_SERVER/PXE_USER/PXE_PASS and uses sshpass -e.
M7 the playbook lints the unattend files before the force: yes copies
(lint-unattend.py ships on CIDATA as scripts/); pre-commit ACMR.
M8 Blancco initramfs build: no ignore_errors, pipefail, trap cleanup.
Also: Send-ImagingStage.ps1 deploy, carrier hook install tasks
(pxe-nic-carrier, networkd-dispatcher), L1 imaging-active hold
(allow_disruptive) and no iPXE downgrade below an Updates-page install,
L2 iso-volid, L3 kver pin read from the playbook, L4 cp -rL, L5 refuse
>= 4 GiB WinPE files, L6 PIP_DIR wipe guard, L7 per-package wheel hashes,
no online fallback, L8 check-updates.py (apt_pkg/cached compare, all
components, exit 2 on no debs / bad answers).
This commit is contained in:
cproudlock
33
SETUP.md
33
SETUP.md
@@ -89,22 +89,29 @@ Extracts boot files for Blancco, Clonezilla, and Memtest86+ into the `boot-tools
|
||||
### Step 3: Build the USB
|
||||
|
||||
```bash
|
||||
# Basic — server only (import WinPE images later)
|
||||
sudo ./scripts/build-usb.sh /dev/sdX /path/to/ubuntu-24.04-live-server-amd64.iso
|
||||
# Basic — server only (import WinPE images later). site-vars.yml holds the
|
||||
# two NIC MACs (copy playbook/site-vars.example.yml); --site-vars or
|
||||
# --no-site-vars is required.
|
||||
sudo ./scripts/build-usb.sh --site-vars site-vars.yml /dev/sdX /path/to/ubuntu-24.04-live-server-amd64.iso
|
||||
|
||||
# With WinPE images bundled (single USB, larger drive needed)
|
||||
sudo ./scripts/build-usb.sh /dev/sdX /path/to/ubuntu-24.04.iso /path/to/winpe-images
|
||||
# With WinPE images bundled (single USB, larger drive needed; no file may
|
||||
# be 4 GiB or more, FAT32)
|
||||
sudo ./scripts/build-usb.sh --site-vars site-vars.yml /dev/sdX /path/to/ubuntu-24.04.iso /path/to/winpe-images
|
||||
|
||||
# Same layout into a disk-image file, no root (dd it to a stick later, or
|
||||
# boot it in a VM: see tests/vm/README.md). SIZE is e.g. 16G or "auto".
|
||||
./scripts/build-usb.sh --image pxe-usb.img auto /path/to/ubuntu-24.04.iso
|
||||
# boot it in a VM: see tests/vm/README.md; on Proxmox: qm importdisk).
|
||||
# SIZE is e.g. 16G or "auto".
|
||||
./scripts/build-usb.sh --site-vars site-vars.yml --image pxe-usb.img auto /path/to/ubuntu-24.04.iso
|
||||
```
|
||||
|
||||
Options: `--payload-root DIR` takes offline-packages/, pip-wheels/,
|
||||
boot-files/, boot-tools/, enrollment/, bios-staging/ and drivers-staging/
|
||||
from another checkout; `--skip-enrollment`, `--skip-bios`,
|
||||
`--skip-drivers`, `--skip-boot-tools` leave those out; `--yes` skips the
|
||||
prompt. The ISO volume label and El Torito load sizes are read from the
|
||||
prompt. The build refuses payloads that do not match their pins: the iPXE
|
||||
files against the playbook's `ipxe_*_sha256`, each wheel against its own
|
||||
package's hashes in `webapp/requirements.txt` (no PyPI fallback), and the
|
||||
ISO against the volume id `offline-packages/iso-volid` was resolved for. The ISO volume label and El Torito load sizes are read from the
|
||||
ISO, so any 24.04.x point release works.
|
||||
|
||||
This creates a bootable USB with:
|
||||
@@ -116,13 +123,19 @@ This creates a bootable USB with:
|
||||
1. Insert the USB into the target machine
|
||||
2. Press F12 (or vendor boot key) and select the USB
|
||||
3. Ubuntu auto-installs — no interaction needed
|
||||
4. After reboot, the first-boot script installs all .deb packages and runs the Ansible playbook
|
||||
4. After reboot, the first-boot script runs the Ansible playbook (the .debs
|
||||
were installed by the installer); it pins the two NICs by MAC
|
||||
5. PXE services (dnsmasq, Apache, Samba) are configured automatically
|
||||
6. Flask webapp starts on port 9009
|
||||
7. If the playbook fails, `/var/lib/pxe-firstboot.failed` and a banner on
|
||||
the console and at SSH login point at `/var/log/first-boot.log`; first
|
||||
boot retries at the next reboot (5 attempts)
|
||||
|
||||
### Step 5: Connect to Isolated Network
|
||||
|
||||
Move the server's wired NIC to the isolated switch for PXE clients.
|
||||
Both NICs are cabled before the install: the imaging NIC (`pxe_nic_mac`)
|
||||
to the isolated switch for PXE clients, the corp NIC (`corp_nic_mac`) to
|
||||
the GE network. Nothing needs to move after the install.
|
||||
|
||||
### Step 6: Import WinPE Content (if not bundled in Step 3)
|
||||
|
||||
@@ -217,7 +230,7 @@ pxe-server/
|
||||
├── bios-staging/ # Dell BIOS update binaries (gitignored)
|
||||
├── scripts/ # Build, deploy, and helper scripts
|
||||
│ ├── build-usb.sh # Builds the 2-partition installer USB
|
||||
│ ├── build-proxmox-iso.sh # Builds self-contained Proxmox installer ISO
|
||||
│ ├── build-proxmox-iso.sh # UNSUPPORTED (use build-usb.sh --image)
|
||||
│ ├── prepare-boot-tools.sh # Extracts/patches boot tools from ISOs
|
||||
│ ├── download-packages.sh # Downloads all offline packages
|
||||
│ ├── download-drivers.py # Downloads Dell drivers from dell.com
|
||||
|
||||
Reference in New Issue
Block a user