blancco: fix silent prefs fallback, suspend trap, display blank + add View

End-to-end fixes for Blancco Drive Eraser PXE flow uncovered by chasing
"reports never reach SMB share" across two air-gapped sites:

playbook/blancco-init.sh:
  * Drop silent || true on wget of preferences.xml + config.xml. Fail
    loud with shell-drop if download or marker grep fails. Background:
    airootfs /opt/scripts/validate_preferences.sh restores
    /albus/preferences.save (factory defaults, empty network_share) if
    xmllint fails. wget failure made every report silently land nowhere.
  * Clobber /albus/preferences.save with the same served file so even if
    the validator fallback fires, the SMB target survives.
  * Bind-mount /dev/null over /sys/power/{state,disk,mem_sleep,autosleep}
    before switch_root. Albus's license-retry path writes /sys/power/state
    directly (bypassing systemd targets); this is the last-line block.
  * /dev/null symlinks for sleep/suspend/hibernate systemd targets in the
    airootfs overlay + logind drop-in with IdleAction/Handle*=ignore.
    Three independent layers because cmdline systemd.mask alone is bypassed
    by direct /sys/power/state writes.
  * xinitrc.d/00-no-screen-blank.sh runs xset s off -dpms + setterm
    -blank 0 -powerdown 0 so the Blancco GUI doesn't blank during long
    erasures.
  * Removed the 20-failsafeDriver.conf "modesetting" pin. modesetting
    needs DRM/KMS which we disable on kernel cmdline; "vesa" also failed
    on NVIDIA. With the pin gone Xorg auto-picks fbdev which uses the
    kernel framebuffer from vga=normal - works across Intel, AMD, and
    older NVIDIA without nouveau.

playbook/pxe_server_setup.yml:
  * dnsmasq.conf: explicit empty-value dhcp-option=3 + dhcp-option=6.
    Without them, dnsmasq defaults to sending its own IP as router AND
    DNS. Commenting the configured-value lines did NOT disable the push
    (root cause of "wired keeps picking up 10.9.100.1 as gateway").
  * Split the Blancco config.img extraction and preferences.xml deploy
    into separate tasks. The previous shell-with-creates: gate caused
    playbook re-runs to skip the prefs deploy entirely after first run.
  * Added a validation task that runs python3 xml parse + grep on the
    deployed preferences.xml to fail the playbook at deploy time if the
    SMB markers are missing.
  * Added Environment=TZ=America/New_York to the pxe-webapp systemd
    service so report mtimes and audit log render in Eastern time even
    if the Python process is started before timedatectl converges.

webapp:
  * services/blancco_report.py: parse Blancco's XML report format
    (recursive <entries name="..."> walker) into a friendly dict.
  * templates/report_view.html: Bootstrap "Drive Erasure Certificate"
    layout - hero summary, customer + system cards, per-drive cards with
    step-by-step erasure timeline, document signing footer with
    integrity hash detail.
  * /reports/view/<filename> route + View button on the reports list
    (XML reports only; PDFs still download).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

webapp/templates/report_view.html

@@ -0,0 +1,215 @@
+{% extends "base.html" %}
+{% block title %}{{ filename }} - Blancco Report{% endblock %}
+
+{% set meta = data.meta or {} %}
+{% set company = data.company or {} %}
+{% set hw = data.hardware or {} %}
+{% set sysinfo = hw.system or {} %}
+{% set bios = hw.bios or {} %}
+{% set memsum = hw.memory or {} %}
+
+{# Bytes to human-readable GB / TB string, no decimals at MB scale #}
+{% macro hbytes(n) -%}
+  {%- set n = (n | int) -%}
+  {%- if n >= 1099511627776 -%}
+    {{ "%.2f"|format(n / 1099511627776) }} TB
+  {%- elif n >= 1073741824 -%}
+    {{ "%.2f"|format(n / 1073741824) }} GB
+  {%- elif n >= 1048576 -%}
+    {{ "%.1f"|format(n / 1048576) }} MB
+  {%- else -%}
+    {{ n }} B
+  {%- endif -%}
+{%- endmacro %}
+
+{% block content %}
+
+<div class="d-flex justify-content-between align-items-start mb-3 flex-wrap gap-2">
+  <div>
+    <div class="text-muted small mb-1">
+      <a href="{{ url_for('blancco_reports') }}" class="text-decoration-none">&larr; All reports</a>
+    </div>
+    <h2 class="mb-0">Drive Erasure Certificate</h2>
+    <code class="small text-muted">{{ filename }}</code>
+  </div>
+  <div class="text-end">
+    <a href="{{ url_for('blancco_download_report', filename=filename) }}"
+       class="btn btn-sm btn-outline-primary">Download XML</a>
+  </div>
+</div>
+
+{# Hero summary: state badge + standard + drive count + erasure datetime #}
+{% set first = (data.erasures or [{}])[0] %}
+{% set overall_state = first.state or 'Unknown' %}
+<div class="card border-{{ 'success' if overall_state == 'Successful' else 'danger' if overall_state else 'secondary' }} mb-4">
+  <div class="card-body">
+    <div class="row g-3 align-items-center">
+      <div class="col-md-3">
+        <div class="text-muted small">Overall result</div>
+        <div class="fs-3">
+          <span class="badge bg-{{ 'success' if overall_state == 'Successful' else 'danger' if overall_state else 'secondary' }}">
+            {{ overall_state }}
+          </span>
+        </div>
+      </div>
+      <div class="col-md-3">
+        <div class="text-muted small">Erasure standard</div>
+        <div>{{ first.erasure_standard_name or '-' }}</div>
+      </div>
+      <div class="col-md-2">
+        <div class="text-muted small">Drives erased</div>
+        <div class="fs-5">{{ data.erasures | length }}</div>
+      </div>
+      <div class="col-md-2">
+        <div class="text-muted small">Elapsed time</div>
+        <div class="fs-5"><code>{{ first.elapsed_time or '-' }}</code></div>
+      </div>
+      <div class="col-md-2">
+        <div class="text-muted small">Erased at</div>
+        <div><code class="small">{{ first.timestamp or meta.date or '-' }}</code></div>
+      </div>
+    </div>
+  </div>
+</div>
+
+<div class="row g-3 mb-3">
+  <div class="col-md-6">
+    <div class="card h-100">
+      <div class="card-header">Customer</div>
+      <div class="card-body">
+        <dl class="row mb-0 small">
+          <dt class="col-sm-5">Business name</dt><dd class="col-sm-7">{{ company.business_name or '-' }}</dd>
+          <dt class="col-sm-5">Location</dt>      <dd class="col-sm-7">{{ company.business_location or '-' }}</dd>
+          <dt class="col-sm-5">License holder</dt><dd class="col-sm-7">{{ company.customer_license or '-' }}</dd>
+          {% for k, v in company.items() %}
+            {% if k not in ['business_name','business_location','customer_license'] %}
+              <dt class="col-sm-5">{{ k|replace('_',' ')|title }}</dt><dd class="col-sm-7">{{ v }}</dd>
+            {% endif %}
+          {% endfor %}
+        </dl>
+      </div>
+    </div>
+  </div>
+  <div class="col-md-6">
+    <div class="card h-100">
+      <div class="card-header">System</div>
+      <div class="card-body">
+        <dl class="row mb-0 small">
+          <dt class="col-sm-5">Manufacturer</dt> <dd class="col-sm-7">{{ sysinfo.manufacturer or '-' }}</dd>
+          <dt class="col-sm-5">Model</dt>        <dd class="col-sm-7">{{ sysinfo.model or '-' }}</dd>
+          <dt class="col-sm-5">Serial</dt>       <dd class="col-sm-7"><code>{{ sysinfo.serial or '-' }}</code></dd>
+          <dt class="col-sm-5">Chassis</dt>      <dd class="col-sm-7">{{ sysinfo.chassis_type or '-' }}</dd>
+          <dt class="col-sm-5">BIOS mode</dt>    <dd class="col-sm-7">{{ sysinfo.bios_mode or '-' }} {% if sysinfo.secure_boot_state %}<span class="badge bg-secondary">SecureBoot {{ sysinfo.secure_boot_state }}</span>{% endif %}</dd>
+          <dt class="col-sm-5">BIOS vendor</dt>  <dd class="col-sm-7">{{ bios.vendor or '-' }} {{ bios.version or '' }}</dd>
+        </dl>
+      </div>
+    </div>
+  </div>
+</div>
+
+{# Per-drive cards: target details + step-by-step timeline #}
+{% for er in data.erasures %}
+  {% set t = er.target or {} %}
+  {% set state = er.state or 'Unknown' %}
+  {% set border = 'success' if state == 'Successful' else 'danger' if state else 'secondary' %}
+  {% set steps = (er.steps or {}).step %}
+  {% if steps is not iterable or steps is string or steps is mapping %}
+    {% set steps = [steps] if steps else [] %}
+  {% endif %}
+  <div class="card border-{{ border }} mb-3">
+    <div class="card-header d-flex justify-content-between align-items-center">
+      <div>
+        <strong>Drive #{{ er.erasure_id or loop.index }}:</strong>
+        {{ t.vendor or '' }} {{ t.model or '(unknown drive)' }}
+        <code class="ms-2 small text-muted">{{ t.serial or '-' }}</code>
+      </div>
+      <span class="badge bg-{{ border }}">{{ state }}</span>
+    </div>
+    <div class="card-body">
+      <div class="row g-3 mb-3">
+        <div class="col-md-3">
+          <div class="text-muted small">Interface</div>
+          <div>{{ t.interface_type or '-' }}</div>
+        </div>
+        <div class="col-md-3">
+          <div class="text-muted small">Capacity</div>
+          <div>{{ hbytes(t.capacity or 0) }}</div>
+        </div>
+        <div class="col-md-2">
+          <div class="text-muted small">Health</div>
+          <div>{{ t.health or '-' }}</div>
+        </div>
+        <div class="col-md-2">
+          <div class="text-muted small">Errors</div>
+          <div>{{ er.total_errors or 0 }}</div>
+        </div>
+        <div class="col-md-2">
+          <div class="text-muted small">Sectors</div>
+          <div class="small">{{ er.processed_sectors or '-' }} / {{ t.sectors or '-' }}</div>
+        </div>
+      </div>
+
+      {% if steps %}
+      <div class="table-responsive">
+        <table class="table table-sm table-hover align-middle mb-0">
+          <thead class="table-light">
+            <tr>
+              <th style="width:3rem;">#</th>
+              <th>Step</th>
+              <th>Pattern</th>
+              <th>State</th>
+              <th>Elapsed</th>
+              <th>Errors</th>
+            </tr>
+          </thead>
+          <tbody>
+            {% for s in steps %}
+            <tr>
+              <td>{{ s.number or loop.index }}</td>
+              <td>{{ s.type or '-' }}</td>
+              <td class="small text-muted">{{ s.pattern or '-' }}</td>
+              <td>
+                <span class="badge bg-{{ 'success' if s.state == 'completed' else 'danger' if s.state else 'secondary' }}">
+                  {{ s.state or '-' }}
+                </span>
+              </td>
+              <td><code class="small">{{ s.elapsed_time or '-' }}</code></td>
+              <td>{{ s.errors or 0 }}</td>
+            </tr>
+            {% endfor %}
+          </tbody>
+        </table>
+      </div>
+      {% endif %}
+    </div>
+  </div>
+{% endfor %}
+
+<div class="card mb-3">
+  <div class="card-header">Document signing &amp; provenance</div>
+  <div class="card-body">
+    <dl class="row mb-0 small">
+      <dt class="col-sm-3">Document ID</dt>
+      <dd class="col-sm-9"><code class="text-break">{{ meta.document_id or '-' }}</code></dd>
+      <dt class="col-sm-3">Product</dt>
+      <dd class="col-sm-9">{{ meta.product_name }} {{ meta.product_version }} (rev {{ meta.product_revision }})</dd>
+      <dt class="col-sm-3">Generated</dt>
+      <dd class="col-sm-9"><code>{{ meta.date or '-' }}</code></dd>
+      {% if data.license_consumption_ids %}
+        <dt class="col-sm-3">License consumption ID{{ 's' if data.license_consumption_ids|length > 1 }}</dt>
+        <dd class="col-sm-9">
+          {% for lc in data.license_consumption_ids %}<code class="d-block">{{ lc }}</code>{% endfor %}
+        </dd>
+      {% endif %}
+      <dt class="col-sm-3">Integrity hash</dt>
+      <dd class="col-sm-9">
+        <details>
+          <summary class="text-muted">Show base64 signature ({{ meta.integrity|length if meta.integrity else 0 }} chars)</summary>
+          <code class="text-break small d-block mt-2">{{ meta.integrity }}</code>
+        </details>
+      </dd>
+    </dl>
+  </div>
+</div>
+
+{% endblock %}

webapp/templates/reports.html

@@ -37,6 +37,12 @@
           </td>
           <td>{{ r.modified | timestamp_fmt }}</td>
           <td class="text-end text-nowrap">
+            {% if r.filename.lower().endswith('.xml') %}
+            <a href="{{ url_for('blancco_view_report', filename=r.filename) }}"
+               class="btn btn-sm btn-outline-success" title="View formatted report">
+              View
+            </a>
+            {% endif %}
             <a href="{{ url_for('blancco_download_report', filename=r.filename) }}"
                class="btn btn-sm btn-outline-primary" title="Download">
               Download