From 8df30017aab9cb86e36c4ef8966f8ac4ba0e15ca Mon Sep 17 00:00:00 2001 From: cproudlock Date: Thu, 23 Jul 2026 09:31:20 -0400 Subject: [PATCH] Playbook: reconcile live dnsmasq/samba/blancco hand-edits back into repo The live PXE server carried working config the playbook would have clobbered on re-run. Committed back: - dnsmasq: BIOS boot chain now the vendorclass PXEClient:Arch:00000 -> ipxe.pxe scheme (plus iPXE userclass HTTP chain), replacing the stale undionly.kpxe client-arch=0 scheme (undionly.kpxe was never staged in tftp-root). Bind by listen-address=172.16.9.1 + bind-dynamic instead of interface=+bind-interfaces. - samba: add 'allow insecure wide links = yes' to the managed symlinks block (modern Samba silently disables wide links without it) and the [winpeapps_bios] read-only share. - blancco iPXE menu: full BIOS/EFI arch split (direct-kernel vmlinuz-bde-linux / vmlinuz-ubuntu with ucode+kexec initrds) with a GRUB chain fallback, replacing the old single-line 'chain grubx64.efi'. startnet.cmd was NOT a commit-back: repo is already ahead of the live boot.wim (deploy-pending). --- playbook/pxe_server_setup.yml | 60 +++++++++++++++++++++++++++++------ 1 file changed, 50 insertions(+), 10 deletions(-) diff --git a/playbook/pxe_server_setup.yml b/playbook/pxe_server_setup.yml index a9351f0..31b0201 100644 --- a/playbook/pxe_server_setup.yml +++ b/playbook/pxe_server_setup.yml @@ -139,8 +139,8 @@ backup: yes content: | port=0 - interface={{ pxe_iface }} - bind-interfaces + listen-address=172.16.9.1 + bind-dynamic dhcp-range=172.16.9.10,172.16.9.100,12h # No default gateway (option 3) and no DNS (option 6) handed out: # the PXE network is isolated and the PXE server does not forward @@ -163,14 +163,18 @@ dhcp-option=6 enable-tftp tftp-root={{ tftp_dir }} - # Arch-aware NBP: legacy BIOS PXE ROMs (client-arch=0) cannot run - # the EFI iPXE binary and report "NBP is too big to fit in free - # base memory" because ipxe.efi (~675KB) exceeds the BIOS PXE - # NBP cap. Serve undionly.kpxe (~70KB, BIOS-mode iPXE) to them - # instead. Everything else (UEFI x86_64 = arch 7 or 9, plus any - # future arches) keeps getting ipxe.efi - default-safe. - dhcp-match=set:bios,option:client-arch,0 - dhcp-boot=tag:bios,undionly.kpxe + # Arch-aware NBP for Blancco/WinPE PXE clients: + # - legacy BIOS (vendorclass PXEClient:Arch:00000) -> ipxe.pxe, a + # BIOS full-feature iPXE build (boot.ipxe.org) with an HTTP/TCP + # stack. The old undionly.kpxe client-arch=0 scheme was stale - + # undionly.kpxe was never staged in tftp-root so it broke BIOS + # boot; this vendorclass+ipxe.pxe scheme is what runs on the box. + # - iPXE-running clients (userclass "iPXE") -> chain to the HTTP menu + # - everything else (UEFI x86_64) -> ipxe.efi + dhcp-vendorclass=set:bios,PXEClient:Arch:00000 + dhcp-userclass=set:ipxe,iPXE + dhcp-boot=tag:bios,tag:!ipxe,ipxe.pxe + dhcp-boot=tag:ipxe,http://172.16.9.1:4433/Altiris/iPXE/GetPxeScript.aspx dhcp-boot=tag:!bios,ipxe.efi log-dhcp # Per-lease state cleanup: flush conntrack + port-445 sockets for @@ -259,6 +263,30 @@ boot :blancco + iseq ${platform} pcbios && goto blancco_bios || goto blancco_efi + + :blancco_bios + echo Loading Blancco for legacy BIOS (canonical)... + kernel http://${server}/blancco/vmlinuz-bde-linux initrd=initramfs-bde-linux.img,config.img,intel-ucode.img,amd-ucode.img archisobasedir=arch archiso_http_srv=http://${server}/blancco/ copytoram=y cow_spacesize=50% memtest=00 vmalloc=400M ip=dhcp libata.allow_tpm=1 modprobe.blacklist=iwlwifi,iwlmvm,btusb rd.udev.timeout=10 systemd.battery-check=0 || goto blancco_bios_failed + initrd --name intel-ucode.img http://${server}/blancco/intel-ucode.img || goto blancco_bios_failed + initrd --name amd-ucode.img http://${server}/blancco/amd-ucode.img || goto blancco_bios_failed + initrd --name config.img http://${server}/blancco/config.img || goto blancco_bios_failed + initrd --name initramfs-bde-linux.img http://${server}/blancco/initramfs-bde-linux.img || goto blancco_bios_failed + boot + :blancco_bios_failed + echo + echo Blancco BIOS boot FAILED. + prompt Press any key to return to menu... && goto menu + + :blancco_efi + echo Loading Blancco UEFI (direct kernel)... + kernel http://${server}/blancco/vmlinuz-ubuntu initrd=kexec-initrd.img ip=dhcp nomodeset vga=normal console=tty0 i915.modeset=0 nouveau.modeset=0 modprobe.blacklist=nouveau,nvidiafb,nvidia,nvidia_drm,mei_me,btusb,dcdbas libata.allow_tpm=1 rd.udev.timeout=10 efi=noruntime usbcore.autosuspend=-1 pcie_aspm=off e1000e.IntMode=0 e1000e.eee_enable=0 consoleblank=0 systemd.battery-check=0 systemd.mask=suspend.target,sleep.target,hibernate.target,hybrid-sleep.target no_console_suspend mem_sleep_default=s2idle || goto blancco_efi_grub + initrd --name intel-ucode.img http://${server}/blancco/intel-ucode.img || goto blancco_efi_grub + initrd --name amd-ucode.img http://${server}/blancco/amd-ucode.img || goto blancco_efi_grub + initrd --name kexec-initrd.img http://${server}/blancco/kexec-initrd.img || goto blancco_efi_grub + boot + :blancco_efi_grub + echo Direct kernel boot failed - trying GRUB chain fallback... chain http://${server}/blancco/grubx64.efi || goto secureboot_warn :memtest @@ -549,6 +577,10 @@ follow symlinks = yes wide links = yes unix extensions = no + # Modern Samba silently disables wide links WITHOUT this. The shared + # image dirs are served via symlinks into _shared, so it is required + # or WinPE clients cannot follow them. + allow insecure wide links = yes - name: "Samba SMB session handling for WinPE re-image robustness" blockinfile: @@ -624,6 +656,14 @@ level2 oplocks = no strict sync = yes + [winpeapps_bios] + path = /srv/samba/winpeapps/_shared/BIOS + browseable = no + read only = yes + guest ok = no + valid users = pxe-upload + comment = Dell BIOS update bundle (read-only, served to WinPE) + - name: "Create Samba users (pxe-upload and blancco)" shell: | id pxe-upload >/dev/null 2>&1 || useradd -M -s /usr/sbin/nologin pxe-upload