Engineer image: upload the Engineering Layer from the web app
New Engineering Layer tab on the engineer image page. A site uploads Engineering_Install_v<ver>.exe (keeps prereqs) or a .zip of the whole extra_engineering payload. The upload is streamed to disk, checked (MZ header, no unsafe zip paths) and swapped in; the replaced payload is archived (two kept) with a Restore button. Install-EngineeringLayer.ps1 stays repo-owned and now installs the newest Engineering_Install_v*.exe. KB: Part 4 becomes Site Content (enrollment package, Engineering Layer, Blancco site settings, Shop Floor apps) plus a new Adding Shop Floor Apps section for preinstall.json/postppkg.json. WJ examples removed.
This commit is contained in:
cproudlock
@@ -420,7 +420,7 @@
|
||||
}
|
||||
|
||||
.checkbox-list li::before {
|
||||
content: "☐";
|
||||
content: "\2610";
|
||||
position: absolute;
|
||||
left: 0;
|
||||
color: var(--ge-blue-primary);
|
||||
@@ -548,9 +548,10 @@
|
||||
<li><a href="#usb">Part 1 - Build the Installer USB</a></li>
|
||||
<li><a href="#install">Part 2 - Install the Server</a></li>
|
||||
<li><a href="#images">Part 3 - Load the Images</a></li>
|
||||
<li><a href="#enroll">Part 4 - Enrollment Package</a></li>
|
||||
<li><a href="#enroll">Part 4 - Site Content</a></li>
|
||||
<li><a href="#test">Part 5 - Image a Test PC</a></li>
|
||||
<li><a href="#sitevars">Site Settings</a></li>
|
||||
<li><a href="#apps">Adding Shop Floor Apps</a></li>
|
||||
<li><a href="#options">Script Options</a></li>
|
||||
<li><a href="#troubleshooting">Troubleshooting</a></li>
|
||||
</ul>
|
||||
@@ -713,8 +714,41 @@ powershell -ExecutionPolicy Bypass -File .\scripts\Build-PxeUsb.ps1 -Interactive
|
||||
<hr class="section-divider">
|
||||
|
||||
<!-- PART 4 -->
|
||||
<h2 id="enroll">Part 4 - Enrollment Package</h2>
|
||||
<p>Shop Floor PCs enroll with a provisioning package. Open <strong>Tools > Enrollment packages</strong>, click <strong>Upload SFLD package</strong> and upload the current <span class="command-inline">GCCH_Prod_SFLD_v<version>.ppkg</span>. The package you upload becomes the active one (shown on that page); upload a newer version the same way when one is released.</p>
|
||||
<h2 id="enroll">Part 4 - Site Content</h2>
|
||||
<p>The build folder carries no site content. Add these in the web interface; each one can be replaced later the same way.</p>
|
||||
<div class="step">
|
||||
<span class="step-number">Step 1</span>
|
||||
<h3>Enrollment package (Shop Floor)</h3>
|
||||
<p>Shop Floor PCs enroll with a provisioning package. Open <strong>Tools > Enrollment packages</strong>, click <strong>Upload SFLD package</strong> and upload the current <span class="command-inline">GCCH_Prod_SFLD_v<version>.ppkg</span>. The package you upload becomes the active one (shown on that page); upload a newer version the same way when one is released.</p>
|
||||
</div>
|
||||
|
||||
<div class="step">
|
||||
<span class="step-number">Step 2</span>
|
||||
<h3>Engineering Layer (Engineer)</h3>
|
||||
<p>Engineer PCs install the Engineering Layer at first logon. Without it they still image, but with no engineering applications. Open <strong>Images > Engineer</strong>, tab <strong>Engineering Layer</strong>, and upload one of:</p>
|
||||
<ul>
|
||||
<li>the whole payload as a <span class="command-inline">.zip</span>, with the folders <span class="command-inline">engineering_layer\</span> (holding <span class="command-inline">Engineering_Install_v<version>.exe</span>) and <span class="command-inline">prereqs\</span> (VC++ and .NET 3.5) at its top, or inside one <span class="command-inline">extra_engineering\</span> folder. Use this the first time.</li>
|
||||
<li>only a newer <span class="command-inline">Engineering_Install_v<version>.exe</span>. It replaces the installer and keeps the prerequisites.</li>
|
||||
</ul>
|
||||
<p>The page shows the installer version in use and the status <span class="highlight">Ready</span> once both parts are present. The two previous uploads are kept under <strong>Previous versions</strong>, with a <strong>Restore</strong> button. The Engineer image must be imported (Part 3) first.</p>
|
||||
</div>
|
||||
|
||||
<div class="step">
|
||||
<span class="step-number">Step 3</span>
|
||||
<h3>Blancco site settings</h3>
|
||||
<p>Open <strong>Updates > Blancco releases</strong> and fill in <strong>Site settings</strong>:</p>
|
||||
<ul>
|
||||
<li><strong>Business location</strong>: your site, as it should appear on every erasure report.</li>
|
||||
<li><strong>Wi-Fi network (SSID)</strong> and <strong>Wi-Fi password</strong>: the internet-only Wi-Fi Blancco joins to license each erasure in the GE Blancco cloud. Usually <span class="command-inline">INTERNETACCESS</span>; the password differs between sites, so get yours from the site network team.</li>
|
||||
</ul>
|
||||
<p>Click <strong>Save</strong>. The settings go into the active Blancco release at once and into every release staged later.</p>
|
||||
</div>
|
||||
|
||||
<div class="step">
|
||||
<span class="step-number">Step 4</span>
|
||||
<h3>Shop Floor apps (optional)</h3>
|
||||
<p>A Shop Floor PC gets the provisioning package and the ShopFloor auto-logon and lockdown, and nothing else. To install your own applications on it, see <a href="#apps">Adding Shop Floor Apps</a>.</p>
|
||||
</div>
|
||||
<hr class="section-divider">
|
||||
|
||||
<!-- PART 5 -->
|
||||
@@ -749,7 +783,7 @@ powershell -ExecutionPolicy Bypass -File .\scripts\Build-PxeUsb.ps1 -Interactive
|
||||
<h3>Follow the format</h3>
|
||||
<ul>
|
||||
<li>One setting per line: <span class="command-inline">name: value</span>, with a space after the colon.</li>
|
||||
<li>Put text in double quotes: <span class="command-inline">site_name: "West Jefferson"</span>.</li>
|
||||
<li>Put text in double quotes: <span class="command-inline">site_name: "Example Site"</span>.</li>
|
||||
<li>Lists go in square brackets: <span class="command-inline">corp_admin_cidrs: ["10.12.34.0/24", "10.12.40.0/24"]</span>.</li>
|
||||
<li>A line starting with <span class="command-inline">#</span> is a note and is ignored. Remove the <span class="command-inline">#</span> to turn a setting on.</li>
|
||||
<li>Start every setting at the beginning of the line. No tabs.</li>
|
||||
@@ -765,9 +799,9 @@ powershell -ExecutionPolicy Bypass -File .\scripts\Build-PxeUsb.ps1 -Interactive
|
||||
<h3>The settings</h3>
|
||||
<table>
|
||||
<tr><th>Setting</th><th>What it does</th><th>When to set it</th><th>Example</th></tr>
|
||||
<tr><td><span class="command-inline">site_name</span></td><td>The site name stamped on Blancco erasure reports and the monthly CMMC evidence packs. Not set: <em>Unnamed site</em>. Letters, digits, spaces and . , - ( ) & / only.</td><td><strong>Always</strong></td><td><span class="command-inline">"West Jefferson"</span></td></tr>
|
||||
<tr><td><span class="command-inline">site_name</span></td><td>The site name stamped on Blancco erasure reports and the monthly CMMC evidence packs. Not set: <em>Unnamed site</em>. Letters, digits, spaces and . , - ( ) & / only.</td><td><strong>Always</strong></td><td><span class="command-inline">"Example Site"</span></td></tr>
|
||||
<tr><td><span class="command-inline">site_timezone</span></td><td>Time zone of the server clock, of every time in the web interface, and of the evidence-pack month boundaries.</td><td>If the site is not on US Eastern time</td><td><span class="command-inline">"America/Chicago"</span></td></tr>
|
||||
<tr><td><span class="command-inline">clonezilla_smb_password</span></td><td>Password of the share Clonezilla backs up to and restores from. The boot menu carries it, so it protects the share on the imaging network only. 8-64 characters from A-Z a-z 0-9 . _ ~ -</td><td><strong>Always</strong> (the default is the same at every site)</td><td><span class="command-inline">"WJ-Clone-2026"</span></td></tr>
|
||||
<tr><td><span class="command-inline">clonezilla_smb_password</span></td><td>Password of the share Clonezilla backs up to and restores from. The boot menu carries it, so it protects the share on the imaging network only. 8-64 characters from A-Z a-z 0-9 . _ ~ -</td><td><strong>Always</strong> (the default is the same at every site)</td><td><span class="command-inline">"ExSite-Clone-2026"</span></td></tr>
|
||||
<tr><td><span class="command-inline">corp_admin_cidrs</span></td><td>The GE subnets allowed to reach the web interface (port 9009) and SSH. Not set: all of GE. The imaging network always has access.</td><td>Recommended once the server is on the GE network</td><td><span class="command-inline">["10.12.34.0/24"]</span></td></tr>
|
||||
<tr><td><span class="command-inline">pxe_nic_mac</span><br><span class="command-inline">corp_nic_mac</span></td><td>Pin the imaging port and the GE port by MAC address instead of picking the imaging port at install. Then both cables may be in from the start.</td><td>Only if the automatic pick is not wanted</td><td><span class="command-inline">"34:c8:d6:b1:10:10"</span></td></tr>
|
||||
<tr><td><span class="command-inline">pxe_nic_allowed_switches</span></td><td>A <em>managed</em> imaging switch sends LLDP/CDP like a GE switch, and the server would refuse to serve on it. Its name (or MAC) here marks it as the imaging switch. Comma separated.</td><td>Only if the imaging switch is managed</td><td><span class="command-inline">"IMG-SW-01"</span></td></tr>
|
||||
@@ -829,6 +863,79 @@ clonezilla_smb_password: "ExSite-Clone-2026"
|
||||
|
||||
<hr class="section-divider">
|
||||
|
||||
<h2 id="apps">Adding Shop Floor Apps</h2>
|
||||
<p>A Shop Floor PC installs two app lists, both empty when the server is installed:</p>
|
||||
<table>
|
||||
<tr><th>List</th><th>When it installs</th><th>Use it for</th></tr>
|
||||
<tr><td><span class="command-inline">preinstall.json</span></td><td>At first logon, in the same run as the provisioning package, before the PC restarts</td><td>Apps that must be present before the PC enrolls</td></tr>
|
||||
<tr><td><span class="command-inline">postppkg.json</span></td><td>Once, after the restart that follows the provisioning package (as SYSTEM)</td><td>Everything else</td></tr>
|
||||
</table>
|
||||
<p>Both are in the <span class="command-inline">pre-install</span> folder of the enrollment share. The first list shows as a step on <strong>Operate > Imaging floor</strong>; each PC keeps its logs in <span class="command-inline">C:\Logs\PreInstall\install.log</span> and <span class="command-inline">C:\Logs\PostPpkg\install.log</span>.</p>
|
||||
|
||||
<div class="step">
|
||||
<span class="step-number">Step 1</span>
|
||||
<h3>Open the share</h3>
|
||||
<p>From a PC on the imaging switch, open <span class="command-inline">\\172.16.9.1\enrollment\pre-install</span> and sign in as <span class="command-inline">pxe-upload</span> (password <span class="command-inline">pxe</span>, the account <span class="command-inline">Upload-Image.ps1</span> uses).</p>
|
||||
</div>
|
||||
|
||||
<div class="step">
|
||||
<span class="step-number">Step 2</span>
|
||||
<h3>Copy the installer</h3>
|
||||
<p>Make a folder per app under <span class="command-inline">installers\</span> and copy the installer into it, for example <span class="command-inline">installers\exampleapp\ExampleApp.msi</span>.</p>
|
||||
</div>
|
||||
|
||||
<div class="step">
|
||||
<span class="step-number">Step 3</span>
|
||||
<h3>Add it to a list</h3>
|
||||
<p>Open the list in Notepad and add one entry per app to <span class="command-inline">Applications</span>. Each list contains an <span class="command-inline">_example</span> entry to copy; it is ignored. Apps install in list order, and an app already detected on the PC is skipped, so a PC can be re-imaged safely.</p>
|
||||
</div>
|
||||
|
||||
<table>
|
||||
<tr><th>Field</th><th>Meaning</th><th>Required</th></tr>
|
||||
<tr><td><span class="command-inline">Name</span></td><td>Shown in the log</td><td>Yes</td></tr>
|
||||
<tr><td><span class="command-inline">Installer</span></td><td>Path under <span class="command-inline">installers\</span>. In JSON, write every <span class="command-inline">\</span> as <span class="command-inline">\\</span></td><td>Yes</td></tr>
|
||||
<tr><td><span class="command-inline">Type</span></td><td><span class="command-inline">MSI</span> (run with msiexec /i) or <span class="command-inline">EXE</span> (run directly)</td><td>Yes</td></tr>
|
||||
<tr><td><span class="command-inline">InstallArgs</span></td><td>Silent-install switches, e.g. <span class="command-inline">/qn /norestart</span> for an MSI</td><td>Usually</td></tr>
|
||||
<tr><td><span class="command-inline">DetectionMethod</span></td><td><span class="command-inline">Registry</span> (a registry key, optionally one value) or <span class="command-inline">File</span> (a file or folder exists)</td><td>Recommended</td></tr>
|
||||
<tr><td><span class="command-inline">DetectionPath</span></td><td>The registry key (<span class="command-inline">HKLM:\\SOFTWARE\\...</span>) or file path that proves the app is installed</td><td>With DetectionMethod</td></tr>
|
||||
<tr><td><span class="command-inline">DetectionName</span><br><span class="command-inline">DetectionValue</span></td><td>Registry only: a value under the key, and the data it must have</td><td>No</td></tr>
|
||||
<tr><td><span class="command-inline">PCTypes</span></td><td>Limit the app to these PC types, e.g. <span class="command-inline">["gea-shopfloor-standard"]</span>. Not set: every Shop Floor PC</td><td>No</td></tr>
|
||||
<tr><td><span class="command-inline">LogFile</span></td><td>EXE only: the installer's own log, copied into the install log when it fails</td><td>No</td></tr>
|
||||
</table>
|
||||
|
||||
<h3>Example</h3>
|
||||
<div class="code-block">
|
||||
<button class="copy-button" onclick="copyCode(this)">Copy</button>
|
||||
<pre>{
|
||||
"Version": "1.0",
|
||||
"Applications": [
|
||||
{
|
||||
"Name": "Example App 1.2",
|
||||
"Installer": "exampleapp\\ExampleApp.msi",
|
||||
"Type": "MSI",
|
||||
"InstallArgs": "/qn /norestart",
|
||||
"DetectionMethod": "Registry",
|
||||
"DetectionPath": "HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{00000000-0000-0000-0000-000000000000}"
|
||||
},
|
||||
{
|
||||
"Name": "Example Tool 4.0",
|
||||
"Installer": "exampletool\\setup.exe",
|
||||
"Type": "EXE",
|
||||
"InstallArgs": "/S",
|
||||
"DetectionMethod": "File",
|
||||
"DetectionPath": "C:\\Program Files\\Example Tool\\tool.exe"
|
||||
}
|
||||
]
|
||||
}</pre>
|
||||
</div>
|
||||
<div class="alert alert-warning">
|
||||
<strong>Test before the floor:</strong>
|
||||
A broken list or a failed install never stops imaging: it is logged and the PC carries on without that app. Image one test PC after every change and check its install log.
|
||||
</div>
|
||||
<p>Reinstalling the server (<span class="command-inline">sudo /opt/first-boot.sh</span>) keeps both lists and the installers.</p>
|
||||
|
||||
<hr class="section-divider">
|
||||
|
||||
<h2 id="options">Script Options</h2>
|
||||
<p>Only needed for special cases. Run the script from an elevated PowerShell in <span class="command-inline">C:\pxe-usb</span> with options instead of <span class="command-inline">-Interactive</span>:</p>
|
||||
<div class="code-block">
|
||||
|
||||
Reference in New Issue
Block a user