Playbook: reconcile live dnsmasq/samba/blancco hand-edits back into repo
The live PXE server carried working config the playbook would have clobbered on re-run. Committed back: - dnsmasq: BIOS boot chain now the vendorclass PXEClient:Arch:00000 -> ipxe.pxe scheme (plus iPXE userclass HTTP chain), replacing the stale undionly.kpxe client-arch=0 scheme (undionly.kpxe was never staged in tftp-root). Bind by listen-address=172.16.9.1 + bind-dynamic instead of interface=+bind-interfaces. - samba: add 'allow insecure wide links = yes' to the managed symlinks block (modern Samba silently disables wide links without it) and the [winpeapps_bios] read-only share. - blancco iPXE menu: full BIOS/EFI arch split (direct-kernel vmlinuz-bde-linux / vmlinuz-ubuntu with ucode+kexec initrds) with a GRUB chain fallback, replacing the old single-line 'chain grubx64.efi'. startnet.cmd was NOT a commit-back: repo is already ahead of the live boot.wim (deploy-pending).
This commit is contained in:
cproudlock
@@ -139,8 +139,8 @@
|
||||
backup: yes
|
||||
content: |
|
||||
port=0
|
||||
interface={{ pxe_iface }}
|
||||
bind-interfaces
|
||||
listen-address=172.16.9.1
|
||||
bind-dynamic
|
||||
dhcp-range=172.16.9.10,172.16.9.100,12h
|
||||
# No default gateway (option 3) and no DNS (option 6) handed out:
|
||||
# the PXE network is isolated and the PXE server does not forward
|
||||
@@ -163,14 +163,18 @@
|
||||
dhcp-option=6
|
||||
enable-tftp
|
||||
tftp-root={{ tftp_dir }}
|
||||
# Arch-aware NBP: legacy BIOS PXE ROMs (client-arch=0) cannot run
|
||||
# the EFI iPXE binary and report "NBP is too big to fit in free
|
||||
# base memory" because ipxe.efi (~675KB) exceeds the BIOS PXE
|
||||
# NBP cap. Serve undionly.kpxe (~70KB, BIOS-mode iPXE) to them
|
||||
# instead. Everything else (UEFI x86_64 = arch 7 or 9, plus any
|
||||
# future arches) keeps getting ipxe.efi - default-safe.
|
||||
dhcp-match=set:bios,option:client-arch,0
|
||||
dhcp-boot=tag:bios,undionly.kpxe
|
||||
# Arch-aware NBP for Blancco/WinPE PXE clients:
|
||||
# - legacy BIOS (vendorclass PXEClient:Arch:00000) -> ipxe.pxe, a
|
||||
# BIOS full-feature iPXE build (boot.ipxe.org) with an HTTP/TCP
|
||||
# stack. The old undionly.kpxe client-arch=0 scheme was stale -
|
||||
# undionly.kpxe was never staged in tftp-root so it broke BIOS
|
||||
# boot; this vendorclass+ipxe.pxe scheme is what runs on the box.
|
||||
# - iPXE-running clients (userclass "iPXE") -> chain to the HTTP menu
|
||||
# - everything else (UEFI x86_64) -> ipxe.efi
|
||||
dhcp-vendorclass=set:bios,PXEClient:Arch:00000
|
||||
dhcp-userclass=set:ipxe,iPXE
|
||||
dhcp-boot=tag:bios,tag:!ipxe,ipxe.pxe
|
||||
dhcp-boot=tag:ipxe,http://172.16.9.1:4433/Altiris/iPXE/GetPxeScript.aspx
|
||||
dhcp-boot=tag:!bios,ipxe.efi
|
||||
log-dhcp
|
||||
# Per-lease state cleanup: flush conntrack + port-445 sockets for
|
||||
@@ -259,6 +263,30 @@
|
||||
boot
|
||||
|
||||
:blancco
|
||||
iseq ${platform} pcbios && goto blancco_bios || goto blancco_efi
|
||||
|
||||
:blancco_bios
|
||||
echo Loading Blancco for legacy BIOS (canonical)...
|
||||
kernel http://${server}/blancco/vmlinuz-bde-linux initrd=initramfs-bde-linux.img,config.img,intel-ucode.img,amd-ucode.img archisobasedir=arch archiso_http_srv=http://${server}/blancco/ copytoram=y cow_spacesize=50% memtest=00 vmalloc=400M ip=dhcp libata.allow_tpm=1 modprobe.blacklist=iwlwifi,iwlmvm,btusb rd.udev.timeout=10 systemd.battery-check=0 || goto blancco_bios_failed
|
||||
initrd --name intel-ucode.img http://${server}/blancco/intel-ucode.img || goto blancco_bios_failed
|
||||
initrd --name amd-ucode.img http://${server}/blancco/amd-ucode.img || goto blancco_bios_failed
|
||||
initrd --name config.img http://${server}/blancco/config.img || goto blancco_bios_failed
|
||||
initrd --name initramfs-bde-linux.img http://${server}/blancco/initramfs-bde-linux.img || goto blancco_bios_failed
|
||||
boot
|
||||
:blancco_bios_failed
|
||||
echo
|
||||
echo Blancco BIOS boot FAILED.
|
||||
prompt Press any key to return to menu... && goto menu
|
||||
|
||||
:blancco_efi
|
||||
echo Loading Blancco UEFI (direct kernel)...
|
||||
kernel http://${server}/blancco/vmlinuz-ubuntu initrd=kexec-initrd.img ip=dhcp nomodeset vga=normal console=tty0 i915.modeset=0 nouveau.modeset=0 modprobe.blacklist=nouveau,nvidiafb,nvidia,nvidia_drm,mei_me,btusb,dcdbas libata.allow_tpm=1 rd.udev.timeout=10 efi=noruntime usbcore.autosuspend=-1 pcie_aspm=off e1000e.IntMode=0 e1000e.eee_enable=0 consoleblank=0 systemd.battery-check=0 systemd.mask=suspend.target,sleep.target,hibernate.target,hybrid-sleep.target no_console_suspend mem_sleep_default=s2idle || goto blancco_efi_grub
|
||||
initrd --name intel-ucode.img http://${server}/blancco/intel-ucode.img || goto blancco_efi_grub
|
||||
initrd --name amd-ucode.img http://${server}/blancco/amd-ucode.img || goto blancco_efi_grub
|
||||
initrd --name kexec-initrd.img http://${server}/blancco/kexec-initrd.img || goto blancco_efi_grub
|
||||
boot
|
||||
:blancco_efi_grub
|
||||
echo Direct kernel boot failed - trying GRUB chain fallback...
|
||||
chain http://${server}/blancco/grubx64.efi || goto secureboot_warn
|
||||
|
||||
:memtest
|
||||
@@ -549,6 +577,10 @@
|
||||
follow symlinks = yes
|
||||
wide links = yes
|
||||
unix extensions = no
|
||||
# Modern Samba silently disables wide links WITHOUT this. The shared
|
||||
# image dirs are served via symlinks into _shared, so it is required
|
||||
# or WinPE clients cannot follow them.
|
||||
allow insecure wide links = yes
|
||||
|
||||
- name: "Samba SMB session handling for WinPE re-image robustness"
|
||||
blockinfile:
|
||||
@@ -624,6 +656,14 @@
|
||||
level2 oplocks = no
|
||||
strict sync = yes
|
||||
|
||||
[winpeapps_bios]
|
||||
path = /srv/samba/winpeapps/_shared/BIOS
|
||||
browseable = no
|
||||
read only = yes
|
||||
guest ok = no
|
||||
valid users = pxe-upload
|
||||
comment = Dell BIOS update bundle (read-only, served to WinPE)
|
||||
|
||||
- name: "Create Samba users (pxe-upload and blancco)"
|
||||
shell: |
|
||||
id pxe-upload >/dev/null 2>&1 || useradd -M -s /usr/sbin/nologin pxe-upload
|
||||
|
||||
Reference in New Issue
Block a user