Merge branch 'nic-guard' into pxe-webapp-redesign

playbook/pxe-server-helpers/dnsmasq.service.d/nic-guard.conf

@@ -0,0 +1,18 @@
+# dnsmasq drop-in: refuse to start DHCP/PXE unless the imaging NIC is on
+# the isolated imaging network.
+#
+# Installed as /etc/systemd/system/dnsmasq.service.d/nic-guard.conf by
+# pxe_server_setup.yml. pxe-nic-check --guard listens on the imaging NIC
+# for 5 s and sends one DHCPDISCOVER (~6 s total), then exits:
+#   0  safe to serve (isolated, no link, or the check itself broke - it
+#      fails open on bugs and says so loudly in the journal)
+#   1  DO NOT serve: a foreign DHCP server or a managed/corporate switch
+#      (LLDP, CDP, 802.1X) is on the imaging NIC. dnsmasq does not start.
+#
+# Why did dnsmasq not start?   journalctl -u dnsmasq -b | grep pxe-nic-check
+# Full picture:                pxe-nic-check        (or the webapp status page)
+# Guard does not run on "systemctl reload"; every start/restart runs it,
+# including the @reboot cron restart.
+
+[Service]
+ExecStartPre=/usr/local/sbin/pxe-nic-check --guard

playbook/pxe-server-helpers/pxe-nic-check.service

@@ -0,0 +1,16 @@
+# Periodic imaging-NIC watch (pxe-nic-check.timer runs this every 5 min).
+# Listens 60 s on each NIC, probes the imaging NIC for foreign DHCP, writes
+# /run/pxe-nic-status.json for the webapp, and STOPS dnsmasq if the imaging
+# NIC turns out to be on the GE network or next to another DHCP server.
+# It never starts dnsmasq: after fixing the cabling, start it by hand
+# (systemctl start dnsmasq), which re-runs the guard.
+
+[Unit]
+Description=PXE NIC watch: keep dnsmasq off the GE corporate network
+After=network.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/pxe-nic-check --watch
+TimeoutStartSec=180
+Nice=5

playbook/pxe-server-helpers/pxe-nic-check.timer

@@ -0,0 +1,11 @@
+[Unit]
+Description=PXE NIC watch every 5 minutes
+
+[Timer]
+OnBootSec=2min
+OnActiveSec=1min
+OnUnitActiveSec=5min
+AccuracySec=15s
+
+[Install]
+WantedBy=timers.target