diff --git a/playbook/ipxe/GetPxeScript.aspx b/playbook/ipxe/GetPxeScript.aspx new file mode 100644 index 0000000..908a8ed --- /dev/null +++ b/playbook/ipxe/GetPxeScript.aspx @@ -0,0 +1,115 @@ +#!ipxe + +set server 172.16.9.1 + +:menu +menu GE Aerospace PXE Boot Menu +item --gap -- ---- Windows Deployment ---- +item winpe Windows PE (Image Deployment) +item --gap -- ---- Drive Erase ---- +item blancco Blancco Drive Eraser +item blancco_debug Blancco Drive Eraser (debug / SSH) +item --gap -- ---- Utilities (Secure Boot must be DISABLED) ---- +item clonezilla Clonezilla Live (Disk Imaging) +item memtest Memtest86+ (Memory Diagnostics) +item --gap -- ---- +item reboot Reboot +item exit Exit to BIOS +choose --default winpe --timeout 30000 target && goto ${target} + +:winpe +# iPXE 2.0 reads the firmware variable; older iPXE cannot (empty), so it +# warns as before. Secure Boot confirmed on: no warning, no wait. +iseq ${efi/SecureBoot:uint8} 1 && goto winpe_boot || +echo +echo Secure Boot is OFF on this PC (or this iPXE cannot tell). +echo Windows deployment requires Secure Boot to be ENABLED. +echo If you disabled it for Clonezilla/Memtest, re-enable it now. +echo +prompt --timeout 5000 Press any key to continue (auto-boot in 5s)... && goto winpe_boot || goto winpe_boot + +:winpe_boot +kernel http://${server}/win11/wimboot gui +initrd http://${server}/win11/EFI/Microsoft/Boot/boot.stl EFI/Microsoft/Boot/Boot.stl +initrd http://${server}/win11/EFI/Microsoft/Boot/BCD EFI/Microsoft/Boot/BCD +initrd http://${server}/win11/EFI/Boot/bootx64.efi EFI/Boot/bootx64.efi +initrd http://${server}/win11/Boot/boot.sdi Boot/boot.sdi +initrd http://${server}/win11/sources/boot.wim sources/boot.wim +boot + +:clonezilla +set base http://${server}/clonezilla +kernel ${base}/vmlinuz boot=live username=user union=overlay config components noswap edd=on nomodeset nodmraid locales= keyboard-layouts= ocs_live_run="ocs-live-general" ocs_live_extra_param="" ocs_live_batch=no net.ifnames=0 nosplash noprompt fetch=${base}/filesystem.squashfs || goto secureboot_warn +initrd ${base}/initrd.img +boot + +:blancco +iseq ${platform} pcbios && goto blancco_bios || goto blancco_efi + +:blancco_bios +echo Loading Blancco for legacy BIOS (canonical)... +kernel http://${server}/blancco/vmlinuz-bde-linux initrd=initramfs-bde-linux.img,config.img,intel-ucode.img,amd-ucode.img quiet loglevel=3 archisobasedir=arch archiso_http_srv=http://${server}/blancco/ copytoram=y cow_spacesize=50% memtest=00 vmalloc=400M ip=dhcp libata.allow_tpm=1 modprobe.blacklist=btusb rd.udev.timeout=10 systemd.battery-check=0 || goto blancco_bios_failed +initrd --name intel-ucode.img http://${server}/blancco/intel-ucode.img || goto blancco_bios_failed +initrd --name amd-ucode.img http://${server}/blancco/amd-ucode.img || goto blancco_bios_failed +initrd --name config.img http://${server}/blancco/config.img || goto blancco_bios_failed +initrd --name initramfs-bde-linux.img http://${server}/blancco/initramfs-bde-linux.img || goto blancco_bios_failed +boot +:blancco_bios_failed +echo +echo Blancco BIOS boot FAILED. +prompt Press any key to return to menu... && goto menu + +:blancco_debug +iseq ${platform} pcbios && goto blancco_bios || +echo Loading Blancco UEFI (debug: verbose, SSH for root)... +kernel http://${server}/blancco/vmlinuz-ubuntu-70 initrd=kexec-initrd-70.img ip=dhcp nomodeset vga=normal console=tty0 i915.modeset=0 nouveau.modeset=0 modprobe.blacklist=nouveau,nvidiafb,nvidia,nvidia_drm,mei_me,btusb,dcdbas libata.allow_tpm=1 rd.udev.timeout=10 efi=noruntime usbcore.autosuspend=-1 pcie_aspm=off e1000e.IntMode=0 e1000e.eee_enable=0 consoleblank=0 systemd.battery-check=0 systemd.mask=suspend.target,sleep.target,hibernate.target,hybrid-sleep.target no_console_suspend mem_sleep_default=s2idle blancco.debug=1 || goto blancco_efi_grub +initrd --name intel-ucode.img http://${server}/blancco/intel-ucode.img || goto blancco_efi_grub +initrd --name amd-ucode.img http://${server}/blancco/amd-ucode.img || goto blancco_efi_grub +initrd --name kexec-initrd-70.img http://${server}/blancco/kexec-initrd-70.img || goto blancco_efi_grub +# Secure Boot ON: iPXE 2.0 starts the Canonical-signed kernel through +# Ubuntu's Microsoft-signed shim. Older iPXE has no shim command: the +# line fails harmlessly and the kernel boots directly (Secure Boot off). +shim http://${server}/blancco/shimx64.efi || +boot || goto blancco_efi_grub + +:blancco_efi +echo Loading Blancco UEFI (direct kernel)... +kernel http://${server}/blancco/vmlinuz-ubuntu-70 initrd=kexec-initrd-70.img ip=dhcp quiet loglevel=3 nomodeset vga=normal console=tty0 i915.modeset=0 nouveau.modeset=0 modprobe.blacklist=nouveau,nvidiafb,nvidia,nvidia_drm,mei_me,btusb,dcdbas libata.allow_tpm=1 rd.udev.timeout=10 efi=noruntime usbcore.autosuspend=-1 pcie_aspm=off e1000e.IntMode=0 e1000e.eee_enable=0 consoleblank=0 systemd.battery-check=0 systemd.mask=suspend.target,sleep.target,hibernate.target,hybrid-sleep.target no_console_suspend mem_sleep_default=s2idle || goto blancco_efi_grub +initrd --name intel-ucode.img http://${server}/blancco/intel-ucode.img || goto blancco_efi_grub +initrd --name amd-ucode.img http://${server}/blancco/amd-ucode.img || goto blancco_efi_grub +initrd --name kexec-initrd-70.img http://${server}/blancco/kexec-initrd-70.img || goto blancco_efi_grub +# Secure Boot ON: iPXE 2.0 starts the Canonical-signed kernel through +# Ubuntu's Microsoft-signed shim. Older iPXE has no shim command: the +# line fails harmlessly and the kernel boots directly (Secure Boot off). +shim http://${server}/blancco/shimx64.efi || +boot || goto blancco_efi_grub +:blancco_efi_grub +echo Direct kernel boot failed - trying GRUB chain fallback... +chain http://${server}/blancco/grubx64.efi || goto secureboot_warn + +:memtest +kernel http://${server}/memtest/memtest.efi || goto secureboot_warn +boot + +:secureboot_warn +echo +echo ====================================================== +echo This option requires Secure Boot to be DISABLED. +echo +echo 1. Reboot this machine +echo 2. Press F2 / Del to enter BIOS Setup +echo 3. Disable Secure Boot +echo 4. Save and exit BIOS +echo 5. PXE boot again and select this option +echo +echo Re-enable Secure Boot after completing the task. +echo ====================================================== +echo +prompt Press any key to return to menu... +goto menu + +:reboot +reboot + +:exit +exit diff --git a/playbook/pxe_server_setup.yml b/playbook/pxe_server_setup.yml index e5d24af..c36307e 100644 --- a/playbook/pxe_server_setup.yml +++ b/playbook/pxe_server_setup.yml @@ -241,103 +241,18 @@ - blancco - memtest - - name: "Create GetPxeScript.aspx (iPXE boot menu)" + - name: "Install GetPxeScript.aspx (iPXE boot menu)" + # The live menu, tracked as a file (playbook/ipxe/GetPxeScript.aspx). + # WinPE skips the Secure Boot warning when iPXE reads Secure Boot as on + # (iPXE 2.0 ${efi/SecureBoot}); Blancco starts through the Ubuntu shim + # (iPXE shim command) so it runs with Secure Boot on. The Blancco + # Releases page edits this file (test entry), so keep exactly one + # "item blancco" line and the :blancco_efi kernel+initrd block. copy: + src: "{{ usb_mount }}/ipxe/GetPxeScript.aspx" dest: "{{ web_root }}/Altiris/iPXE/GetPxeScript.aspx" + mode: '0644' backup: yes - content: | - #!ipxe - - set server 172.16.9.1 - - :menu - menu GE Aerospace PXE Boot Menu - item --gap -- ---- Windows Deployment ---- - item winpe Windows PE (Image Deployment) - item --gap -- ---- Utilities (Secure Boot must be DISABLED) ---- - item blancco Blancco Drive Eraser - item clonezilla Clonezilla Live (Disk Imaging) - item memtest Memtest86+ (Memory Diagnostics) - item --gap -- ---- - item reboot Reboot - item exit Exit to BIOS - choose --default winpe --timeout 30000 target && goto ${target} - - :winpe - echo - echo Windows deployment requires Secure Boot to be ENABLED. - echo If you disabled it for Blancco/Clonezilla, re-enable it now. - echo - prompt --timeout 5000 Press any key to continue (auto-boot in 5s)... && goto winpe_boot || goto winpe_boot - - :winpe_boot - kernel http://${server}/win11/wimboot gui - initrd http://${server}/win11/EFI/Microsoft/Boot/boot.stl EFI/Microsoft/Boot/Boot.stl - initrd http://${server}/win11/EFI/Microsoft/Boot/BCD EFI/Microsoft/Boot/BCD - initrd http://${server}/win11/EFI/Boot/bootx64.efi EFI/Boot/bootx64.efi - initrd http://${server}/win11/Boot/boot.sdi Boot/boot.sdi - initrd http://${server}/win11/sources/boot.wim sources/boot.wim - boot - - :clonezilla - set base http://${server}/clonezilla - kernel ${base}/vmlinuz boot=live username=user union=overlay config components noswap edd=on nomodeset nodmraid locales= keyboard-layouts= ocs_live_run="ocs-live-general" ocs_live_extra_param="" ocs_live_batch=no net.ifnames=0 nosplash noprompt fetch=${base}/filesystem.squashfs || goto secureboot_warn - initrd ${base}/initrd.img - boot - - :blancco - iseq ${platform} pcbios && goto blancco_bios || goto blancco_efi - - :blancco_bios - echo Loading Blancco for legacy BIOS (canonical)... - kernel http://${server}/blancco/vmlinuz-bde-linux initrd=initramfs-bde-linux.img,config.img,intel-ucode.img,amd-ucode.img quiet loglevel=3 archisobasedir=arch archiso_http_srv=http://${server}/blancco/ copytoram=y cow_spacesize=50% memtest=00 vmalloc=400M ip=dhcp libata.allow_tpm=1 modprobe.blacklist=btusb rd.udev.timeout=10 systemd.battery-check=0 || goto blancco_bios_failed - initrd --name intel-ucode.img http://${server}/blancco/intel-ucode.img || goto blancco_bios_failed - initrd --name amd-ucode.img http://${server}/blancco/amd-ucode.img || goto blancco_bios_failed - initrd --name config.img http://${server}/blancco/config.img || goto blancco_bios_failed - initrd --name initramfs-bde-linux.img http://${server}/blancco/initramfs-bde-linux.img || goto blancco_bios_failed - boot - :blancco_bios_failed - echo - echo Blancco BIOS boot FAILED. - prompt Press any key to return to menu... && goto menu - - :blancco_efi - echo Loading Blancco UEFI (direct kernel)... - kernel http://${server}/blancco/vmlinuz-ubuntu initrd=kexec-initrd.img ip=dhcp quiet loglevel=3 nomodeset vga=normal console=tty0 i915.modeset=0 nouveau.modeset=0 modprobe.blacklist=nouveau,nvidiafb,nvidia,nvidia_drm,mei_me,btusb,dcdbas libata.allow_tpm=1 rd.udev.timeout=10 efi=noruntime usbcore.autosuspend=-1 pcie_aspm=off e1000e.IntMode=0 e1000e.eee_enable=0 consoleblank=0 systemd.battery-check=0 systemd.mask=suspend.target,sleep.target,hibernate.target,hybrid-sleep.target no_console_suspend mem_sleep_default=s2idle || goto blancco_efi_grub - initrd --name intel-ucode.img http://${server}/blancco/intel-ucode.img || goto blancco_efi_grub - initrd --name amd-ucode.img http://${server}/blancco/amd-ucode.img || goto blancco_efi_grub - initrd --name kexec-initrd.img http://${server}/blancco/kexec-initrd.img || goto blancco_efi_grub - boot - :blancco_efi_grub - echo Direct kernel boot failed - trying GRUB chain fallback... - chain http://${server}/blancco/grubx64.efi || goto secureboot_warn - - :memtest - kernel http://${server}/memtest/memtest.efi || goto secureboot_warn - boot - - :secureboot_warn - echo - echo ====================================================== - echo This option requires Secure Boot to be DISABLED. - echo - echo 1. Reboot this machine - echo 2. Press F2 / Del to enter BIOS Setup - echo 3. Disable Secure Boot - echo 4. Save and exit BIOS - echo 5. PXE boot again and select this option - echo - echo Re-enable Secure Boot after completing the task. - echo ====================================================== - echo - prompt Press any key to return to menu... - goto menu - - :reboot - reboot - - :exit - exit - name: "Ensure Apache listens on port 4433" lineinfile: