Two-NIC standard: pin imaging and GE NICs by MAC everywhere
Every server has an imaging NIC (static, the only one that serves DHCP/TFTP/HTTP boot/SMB) and a GE corporate NIC (DHCP client, SSH and the webapp on 9009). The playbook guessed the PXE NIC and the installer put 172.16.9.1/24 on every en* NIC, so a two-NIC box could answer on the GE network. - New per-site vars pxe_nic_mac / corp_nic_mac (required, from playbook/site-vars.yml or -e; template site-vars.example.yml), stable names pxe_nic_name / corp_nic_name (default pxe0 / corp0, overridable), pxe_server_ip, pxe_subnet, DHCP range. pxe_imaging_mac / pxe_ge_mac are derived from them. The play stops before touching anything if a MAC is unset, malformed, duplicated or not on the box (lists the box's NICs). - Heuristic NIC detection and the single-NIC netplan task replaced by a two-NIC netplan template (match macaddress + set-name), installed by pxe-netplan-apply.sh: validate in a scratch root, back up, generate, rename, apply, restore the previous config on any failure. cloud-init network config disabled so it cannot rewrite it. - dnsmasq: /etc/dnsmasq.d/pxe-nic-only.conf from the vars (interface=, except-interface=, no-dhcp-interface=); dnsmasq.conf IP/range from vars. - UFW per interface: imaging NIC 22, 67/udp, 69/udp, 80, 4433, 445, 139, 137/udp, 138/udp, 9009; GE NIC 22 and 9009 only. Old any-interface rules and the stale 9011 rule removed after the new ones are in. - sysctl drop-in: IPv4/IPv6 forwarding off; ip_nonlocal_bind so Apache can bind the imaging IP before the address is up. - Samba [global]: interfaces = 127.0.0.0/8 <imaging NIC>, bind interfaces only. Apache 80 and 4433 on the imaging IP only; 9009 stays on all (TODO: the webapp has no auth). - autoinstall: DHCP only on en*, no static 172.16.9.1; apt geoip off and offline-install fallback now that the corp NIC may have a lease. - Blancco UEFI/Secure Boot: blancco_kver (7.0.0-34-generic) drives the kernel, initramfs and modules builds instead of the running kernel; outputs vmlinuz-ubuntu-70, kexec-initrd-70.img, kmod-<kver>.tar.gz as the menu and blancco-init.sh expect; creates: guards keyed on the full kver. Ubuntu's shimx64.efi.signed published as blancco/shimx64.efi. download-packages.sh adds shim-signed, linux-generic-hwe-24.04 and the pinned linux-image/modules/modules-extra for BLANCCO_KVER. Rendered with the live MACs and names, netplan generate output is identical to the live config; pxe-nic-only.conf and the Samba binding match live directive for directive.
This commit is contained in:
cproudlock
@@ -6,6 +6,18 @@
|
||||
gather_facts: yes
|
||||
|
||||
pre_tasks:
|
||||
# Per-site values (NIC MACs first of all). Optional file next to this
|
||||
# playbook; -e still wins over it.
|
||||
- name: "Look for per-site vars (playbook/site-vars.yml)"
|
||||
stat:
|
||||
path: "{{ playbook_dir }}/site-vars.yml"
|
||||
register: site_vars_file
|
||||
|
||||
- name: "Load per-site vars"
|
||||
include_vars:
|
||||
file: "{{ playbook_dir }}/site-vars.yml"
|
||||
when: site_vars_file.stat.exists
|
||||
|
||||
- name: "Verify required packages are installed (pre-installed from offline .debs)"
|
||||
command: dpkg -s {{ item }}
|
||||
loop:
|
||||
@@ -22,6 +34,7 @@
|
||||
- p7zip-full # 7z: Dell driver packs, catalog cabs, Blancco ISO
|
||||
- zip # driver zips PESetup unpacks
|
||||
- curl # Updates page downloads
|
||||
- shim-signed # shimx64.efi.signed: Blancco with Secure Boot on
|
||||
register: pkg_check
|
||||
failed_when: false
|
||||
changed_when: false
|
||||
@@ -55,13 +68,40 @@
|
||||
# _media/<pctype> links the base image's entries, so also look in the
|
||||
# image roots (on a rebuild the _media views may not exist yet).
|
||||
zscaler_ca_share_glob: "{{ samba_share }}/_media/*/Deploy/Applications/ZscalerCommercialCertificate-2048-SHA256.crt {{ samba_share }}/gea-*/Deploy/Applications/ZscalerCommercialCertificate-2048-SHA256.crt"
|
||||
# --- The two NICs (site standard) ---
|
||||
# Every server has two NICs: the imaging NIC (isolated imaging LAN,
|
||||
# static pxe_server_ip, the ONLY NIC that serves DHCP/TFTP/HTTP boot/SMB)
|
||||
# and the GE corporate NIC (DHCP client; SSH and the webapp on 9009 for
|
||||
# admins, outbound updates through Zscaler). Both MACs are REQUIRED:
|
||||
# set them in playbook/site-vars.yml on the USB (copy
|
||||
# site-vars.example.yml) or with -e. The playbook stops before it
|
||||
# touches anything if either is unset or not on this box. Read them
|
||||
# with: ip -br link
|
||||
pxe_nic_mac: ""
|
||||
corp_nic_mac: ""
|
||||
# Stable names, set by netplan (match macaddress + set-name). dnsmasq,
|
||||
# UFW and Samba refer to these. A site may keep its existing names
|
||||
# (e.g. pxe_nic_name: enx34c8d6b11010, corp_nic_name: enp0s31f6).
|
||||
pxe_nic_name: "pxe0"
|
||||
corp_nic_name: "corp0"
|
||||
# Imaging LAN addressing. NOTE: 172.16.9.1 is also hard-coded in the
|
||||
# iPXE menu, startnet.cmd, blancco-preferences.xml and the unattend
|
||||
# files (see docs/SITE-CUSTOMIZATION.md); change those together.
|
||||
pxe_server_ip: "172.16.9.1"
|
||||
pxe_subnet: "172.16.9.0/24"
|
||||
pxe_prefix: "{{ pxe_subnet.split('/')[1] }}"
|
||||
pxe_dhcp_start: "172.16.9.10"
|
||||
pxe_dhcp_end: "172.16.9.100"
|
||||
pxe_dhcp_lease: "12h"
|
||||
# Route metric for the corp NIC's DHCP default route.
|
||||
corp_route_metric: 100
|
||||
# NIC guard (pxe-nic-check): dnsmasq must never serve DHCP/PXE on the GE
|
||||
# corporate network. Pin the two NICs by MAC (ip -br link); left blank,
|
||||
# the imaging NIC is the interface= of /etc/dnsmasq.d/pxe-nic-only.conf
|
||||
# or the holder of 172.16.9.1, and the GE NIC is the one with a DHCP
|
||||
# lease. A MAC of a bridge port resolves to the bridge (br-pxe).
|
||||
pxe_imaging_mac: ""
|
||||
pxe_ge_mac: ""
|
||||
# corporate network. These are derived from pxe_nic_mac / corp_nic_mac
|
||||
# (one source of truth) and written to /etc/pxe-server/nic.conf; do not
|
||||
# set them separately (the playbook fails if they disagree). A MAC of a
|
||||
# bridge port resolves to the bridge.
|
||||
pxe_imaging_mac: "{{ pxe_nic_mac }}"
|
||||
pxe_ge_mac: "{{ corp_nic_mac }}"
|
||||
# A foreign DHCP server handing out one of these domains (whole labels:
|
||||
# wjs.geaerospace.net matches, notgeaerospace.net does not) = GE network.
|
||||
pxe_corp_domain_suffixes: "geaerospace.net, ge.com"
|
||||
@@ -69,6 +109,35 @@
|
||||
# LLDP system name / CDP device id / chassis MAC, comma separated, so
|
||||
# it does not count as a corporate switch. 802.1X always counts.
|
||||
pxe_nic_allowed_switches: ""
|
||||
# UFW, per interface (see the UFW tasks). Imaging NIC: SSH, DHCP, TFTP,
|
||||
# HTTP boot, iPXE menu, SMB (+ NetBIOS for older clients), webapp.
|
||||
ufw_pxe_rules:
|
||||
- { port: "22", proto: tcp }
|
||||
- { port: "67", proto: udp }
|
||||
- { port: "69", proto: udp }
|
||||
- { port: "80", proto: tcp }
|
||||
- { port: "4433", proto: tcp }
|
||||
- { port: "445", proto: tcp }
|
||||
- { port: "139", proto: tcp }
|
||||
- { port: "137", proto: udp }
|
||||
- { port: "138", proto: udp }
|
||||
- { port: "9009", proto: tcp }
|
||||
# GE corporate NIC: SSH and the webapp, nothing else.
|
||||
ufw_corp_rules:
|
||||
- { port: "22", proto: tcp }
|
||||
- { port: "9009", proto: tcp }
|
||||
# --- Blancco UEFI / Secure Boot path ---
|
||||
# Blancco's UEFI entries boot a Canonical-signed Ubuntu HWE kernel
|
||||
# (through Ubuntu's shim when Secure Boot is on), then switch_root into
|
||||
# the Blancco rootfs. The kernel, its modules and the initramfs are
|
||||
# built from this version, which must be installed on the box
|
||||
# (linux-generic-hwe-24.04 from the offline packages; see
|
||||
# scripts/download-packages.sh BLANCCO_KVER). The file suffix is
|
||||
# major+minor ("7.0.0-34-generic" -> "70"), as GetPxeScript.aspx expects:
|
||||
# vmlinuz-ubuntu-70, kexec-initrd-70.img; modules are
|
||||
# kmod-<blancco_kver>.tar.gz (blancco-init.sh fetches kmod-$(uname -r)).
|
||||
blancco_kver: "7.0.0-34-generic"
|
||||
blancco_ksuffix: "{{ blancco_kver.split('.')[0] }}{{ blancco_kver.split('.')[1] }}"
|
||||
image_types:
|
||||
- gea-standard
|
||||
- gea-engineer
|
||||
@@ -91,50 +160,107 @@
|
||||
- Tools
|
||||
|
||||
tasks:
|
||||
- name: "Gather minimal network facts"
|
||||
ansible.builtin.setup:
|
||||
filter:
|
||||
- ansible_interfaces
|
||||
- ansible_default_ipv4
|
||||
# --- The two NICs: validate, then pin by MAC (netplan) ---
|
||||
# Replaces the old guess (first en* without 172.16.9.1 / the default
|
||||
# route), which on a two-NIC box could pick the GE NIC.
|
||||
- name: "NICs: check the per-site NIC vars"
|
||||
assert:
|
||||
that:
|
||||
- pxe_nic_mac | length > 0
|
||||
- corp_nic_mac | length > 0
|
||||
- pxe_nic_mac is match('^([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}$')
|
||||
- corp_nic_mac is match('^([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}$')
|
||||
- pxe_nic_mac | lower != corp_nic_mac | lower
|
||||
- pxe_imaging_mac | lower == pxe_nic_mac | lower
|
||||
- pxe_ge_mac | lower == corp_nic_mac | lower
|
||||
- pxe_nic_name | length > 0 and pxe_nic_name | length <= 15
|
||||
- corp_nic_name | length > 0 and corp_nic_name | length <= 15
|
||||
- pxe_nic_name != corp_nic_name
|
||||
fail_msg: >-
|
||||
Set pxe_nic_mac (imaging NIC) and corp_nic_mac (GE corporate NIC)
|
||||
to two different MACs (aa:bb:cc:dd:ee:ff) in playbook/site-vars.yml
|
||||
(copy site-vars.example.yml) or with -e, then re-run. Do not set
|
||||
pxe_imaging_mac / pxe_ge_mac yourself; they follow these. Names
|
||||
(pxe_nic_name, corp_nic_name) must differ and be 1-15 chars.
|
||||
Now: pxe_nic_mac='{{ pxe_nic_mac }}' corp_nic_mac='{{ corp_nic_mac }}'.
|
||||
quiet: yes
|
||||
|
||||
- name: "Bring up all ethernet-like interfaces"
|
||||
command: ip link set dev {{ item }} up
|
||||
loop: "{{ ansible_interfaces | select('match','^e(th|n)') | list }}"
|
||||
ignore_errors: yes
|
||||
- name: "NICs: list the physical NICs on this box"
|
||||
shell: |
|
||||
for d in /sys/class/net/*; do
|
||||
[ -e "$d/device" ] || continue
|
||||
echo "$(basename "$d") $(cat "$d/address")"
|
||||
done
|
||||
register: nic_list
|
||||
changed_when: false
|
||||
|
||||
- name: "Find interface with 172.16.9.1 already configured"
|
||||
set_fact:
|
||||
preconfigured_iface: >-
|
||||
{{ ansible_interfaces
|
||||
| select('match','^e(th|n)')
|
||||
| map('regex_replace','^(.*)$','ansible_\1')
|
||||
| map('extract', hostvars[inventory_hostname])
|
||||
| selectattr('ipv4','defined')
|
||||
| selectattr('ipv4.address','equalto','172.16.9.1')
|
||||
| map(attribute='device')
|
||||
| list
|
||||
| first
|
||||
| default('') }}
|
||||
ignore_errors: yes
|
||||
- name: "NICs: both MACs must be on this box"
|
||||
vars:
|
||||
box_macs: "{{ nic_list.stdout_lines | map('regex_replace', '^.* ', '') | map('lower') | list }}"
|
||||
assert:
|
||||
that:
|
||||
- pxe_nic_mac | lower in box_macs
|
||||
- corp_nic_mac | lower in box_macs
|
||||
fail_msg: >-
|
||||
{{ 'pxe_nic_mac ' ~ pxe_nic_mac ~ ' is not on this box. ' if pxe_nic_mac | lower not in box_macs else '' }}{{ 'corp_nic_mac ' ~ corp_nic_mac ~ ' is not on this box. ' if corp_nic_mac | lower not in box_macs else '' }}Nothing was changed (the network config would have left that NIC
|
||||
unconfigured). Physical NICs here (name MAC):
|
||||
{{ nic_list.stdout_lines | join('; ') }}.
|
||||
Fix playbook/site-vars.yml and re-run.
|
||||
quiet: yes
|
||||
|
||||
- name: "Determine PXE interface"
|
||||
set_fact:
|
||||
pxe_iface: >-
|
||||
{{ preconfigured_iface | default('',true)
|
||||
or (ansible_interfaces
|
||||
| select('match','^e(th|n)')
|
||||
| reject('equalto','lo')
|
||||
| reject('equalto', ansible_default_ipv4.interface | default(''))
|
||||
| list
|
||||
)
|
||||
| first
|
||||
| default(ansible_default_ipv4.interface | default(
|
||||
ansible_interfaces | select('match','^e(th|n)') | first | default('eth0')
|
||||
)) }}
|
||||
- name: "NICs: stop cloud-init from rewriting the network config"
|
||||
copy:
|
||||
dest: /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg
|
||||
mode: '0644'
|
||||
content: |
|
||||
# Managed by pxe_server_setup.yml: /etc/netplan/50-cloud-init.yaml
|
||||
# is the playbook's two-NIC config, not cloud-init's.
|
||||
network: {config: disabled}
|
||||
|
||||
- name: "Debug: final pxe_iface choice"
|
||||
- name: "NICs: deploy the netplan apply helper"
|
||||
copy:
|
||||
src: "{{ usb_mount }}/pxe-server-helpers/pxe-netplan-apply.sh"
|
||||
dest: /usr/local/sbin/pxe-netplan-apply.sh
|
||||
mode: '0755'
|
||||
|
||||
- name: "NICs: stage the two-NIC netplan config"
|
||||
template:
|
||||
src: templates/netplan-pxe.yaml.j2
|
||||
dest: /etc/pxe-server-netplan.yaml
|
||||
mode: '0600'
|
||||
|
||||
- name: "NICs: validate, install and apply netplan (rolls back on failure)"
|
||||
command: >-
|
||||
/usr/local/sbin/pxe-netplan-apply.sh /etc/pxe-server-netplan.yaml
|
||||
{{ pxe_nic_name }} {{ pxe_nic_mac | lower }}
|
||||
{{ corp_nic_name }} {{ corp_nic_mac | lower }}
|
||||
register: netplan_apply
|
||||
changed_when: netplan_apply.stdout_lines | last | default('') == 'CHANGED'
|
||||
|
||||
- name: "NICs: result"
|
||||
debug:
|
||||
msg: "Using {{ pxe_iface }} for DHCP/TFTP"
|
||||
msg: "{{ netplan_apply.stdout_lines }}"
|
||||
|
||||
- name: "Pin IP forwarding off (the imaging LAN is never routed)"
|
||||
copy:
|
||||
dest: /etc/sysctl.d/99-pxe-net.conf
|
||||
mode: '0644'
|
||||
content: |
|
||||
# Managed by pxe_server_setup.yml. The server never routes between
|
||||
# the imaging LAN and the GE corporate network.
|
||||
net.ipv4.ip_forward = 0
|
||||
net.ipv6.conf.all.forwarding = 0
|
||||
net.ipv6.conf.default.forwarding = 0
|
||||
# Apache listens on {{ pxe_server_ip }} only (ports 80/4433). Let it
|
||||
# bind before networkd has put the address on {{ pxe_nic_name }} (no
|
||||
# carrier at boot, or apache starting first), or apache2 fails to
|
||||
# start and takes the webapp on 9009 down with it.
|
||||
net.ipv4.ip_nonlocal_bind = 1
|
||||
register: pxe_net_sysctl
|
||||
|
||||
- name: "Apply the network sysctls now (Apache restarts before the handlers)"
|
||||
command: sysctl -p /etc/sysctl.d/99-pxe-net.conf
|
||||
when: pxe_net_sysctl is changed
|
||||
|
||||
- name: "Expand root partition and filesystem to use full disk"
|
||||
args:
|
||||
@@ -175,9 +301,11 @@
|
||||
backup: yes
|
||||
content: |
|
||||
port=0
|
||||
listen-address=172.16.9.1
|
||||
listen-address={{ pxe_server_ip }}
|
||||
bind-dynamic
|
||||
dhcp-range=172.16.9.10,172.16.9.100,12h
|
||||
# Interface pinning (serve {{ pxe_nic_name }} only, never
|
||||
# {{ corp_nic_name }}) is in /etc/dnsmasq.d/pxe-nic-only.conf.
|
||||
dhcp-range={{ pxe_dhcp_start }},{{ pxe_dhcp_end }},{{ pxe_dhcp_lease }}
|
||||
# No default gateway (option 3) and no DNS (option 6) handed out:
|
||||
# the PXE network is isolated and the PXE server does not forward
|
||||
# internet traffic. Previously we set both, which made imaged PCs
|
||||
@@ -193,7 +321,7 @@
|
||||
# Important: dnsmasq DEFAULTS to sending its own listening address as
|
||||
# both router and DNS when these options are unset. Commenting them
|
||||
# out is NOT the same as disabling - imaged PCs (and Blancco PXE
|
||||
# clients) end up with 172.16.9.1 as gateway. The empty-value form
|
||||
# clients) end up with {{ pxe_server_ip }} as gateway. The empty-value form
|
||||
# below explicitly suppresses both options.
|
||||
dhcp-option=3
|
||||
dhcp-option=6
|
||||
@@ -211,7 +339,7 @@
|
||||
dhcp-vendorclass=set:bios,PXEClient:Arch:00000
|
||||
dhcp-userclass=set:ipxe,iPXE
|
||||
dhcp-boot=tag:bios,tag:!ipxe,ipxe.pxe
|
||||
dhcp-boot=tag:ipxe,http://172.16.9.1:4433/Altiris/iPXE/GetPxeScript.aspx
|
||||
dhcp-boot=tag:ipxe,http://{{ pxe_server_ip }}:4433/Altiris/iPXE/GetPxeScript.aspx
|
||||
dhcp-boot=tag:!bios,tag:!ipxe,ipxe-shim.efi
|
||||
log-dhcp
|
||||
# Per-lease state cleanup: flush conntrack + port-445 sockets for
|
||||
@@ -225,6 +353,13 @@
|
||||
# firmware / iPXE requests.
|
||||
script-on-renewal
|
||||
|
||||
- name: "Pin dnsmasq to the imaging NIC (never DHCP/PXE on the GE NIC)"
|
||||
template:
|
||||
src: templates/dnsmasq-pxe-nic-only.conf.j2
|
||||
dest: /etc/dnsmasq.d/pxe-nic-only.conf
|
||||
mode: '0644'
|
||||
backup: yes
|
||||
|
||||
# --- NIC guard: keep dnsmasq off the GE corporate network ---
|
||||
# pxe-nic-check classifies each NIC from what it hears (LLDP/CDP/802.1X
|
||||
# from managed switches, foreign DHCP offers and their domain). The
|
||||
@@ -250,22 +385,14 @@
|
||||
dest: /etc/pxe-server/nic.conf
|
||||
mode: '0644'
|
||||
content: |
|
||||
# Managed by pxe_server_setup.yml (vars pxe_imaging_mac, pxe_ge_mac,
|
||||
# pxe_corp_domain_suffixes). Read by /usr/local/sbin/pxe-nic-check.
|
||||
# Managed by pxe_server_setup.yml (vars pxe_nic_mac, corp_nic_mac,
|
||||
# pxe_server_ip, pxe_corp_domain_suffixes). Read by
|
||||
# /usr/local/sbin/pxe-nic-check.
|
||||
[nic]
|
||||
{% if pxe_imaging_mac %}
|
||||
imaging_mac = {{ pxe_imaging_mac | lower }}
|
||||
{% else %}
|
||||
# imaging_mac unset: falls back to interface= in
|
||||
# /etc/dnsmasq.d/pxe-nic-only.conf, then the holder of own_ip
|
||||
{% endif %}
|
||||
{% if pxe_ge_mac %}
|
||||
ge_mac = {{ pxe_ge_mac | lower }}
|
||||
{% else %}
|
||||
# ge_mac unset: falls back to the interface holding a DHCP lease
|
||||
{% endif %}
|
||||
corp_domain_suffixes = {{ pxe_corp_domain_suffixes }}
|
||||
own_ip = 172.16.9.1
|
||||
own_ip = {{ pxe_server_ip }}
|
||||
allowed_switches = {{ pxe_nic_allowed_switches }}
|
||||
|
||||
- name: "NIC guard: create dnsmasq drop-in directory"
|
||||
@@ -344,10 +471,22 @@
|
||||
mode: '0644'
|
||||
backup: yes
|
||||
|
||||
- name: "Ensure Apache listens on port 4433"
|
||||
# Boot files (80) and the iPXE menu (4433) are served on the imaging IP
|
||||
# only, never on the GE NIC. 9009 (webapp) stays on all addresses: admins
|
||||
# reach it from the GE side (see pxe-server.conf below).
|
||||
- name: "Apache: serve port 80 on the imaging IP only"
|
||||
lineinfile:
|
||||
path: /etc/apache2/ports.conf
|
||||
line: "Listen 4433"
|
||||
regexp: '^\s*Listen\s+(\S+:)?80\s*$'
|
||||
line: "Listen {{ pxe_server_ip }}:80"
|
||||
backup: yes
|
||||
state: present
|
||||
|
||||
- name: "Apache: serve port 4433 (iPXE menu) on the imaging IP only"
|
||||
lineinfile:
|
||||
path: /etc/apache2/ports.conf
|
||||
regexp: '^\s*Listen\s+(\S+:)?4433\s*$'
|
||||
line: "Listen {{ pxe_server_ip }}:4433"
|
||||
backup: yes
|
||||
state: present
|
||||
|
||||
@@ -619,6 +758,23 @@
|
||||
# or WinPE clients cannot follow them.
|
||||
allow insecure wide links = yes
|
||||
|
||||
# Runs after the symlinks block so it lands first under [global], as on
|
||||
# the live server.
|
||||
- name: "Bind Samba to the imaging NIC only"
|
||||
blockinfile:
|
||||
path: /etc/samba/smb.conf
|
||||
backup: yes
|
||||
marker: "# {mark} MANAGED - PXE NIC BIND"
|
||||
insertafter: '\[global\]'
|
||||
block: |
|
||||
# Bind Samba to the PXE LAN only. The second NIC reaches the GE corporate
|
||||
# network, and these shares (blancco-reports, enrollment, image-upload,
|
||||
# clonezilla) use shared, well-known imaging passwords and are writable by
|
||||
# design. Without this they are offered to the corporate network the moment
|
||||
# the cable is plugged in.
|
||||
interfaces = 127.0.0.0/8 {{ pxe_nic_name }}
|
||||
bind interfaces only = yes
|
||||
|
||||
- name: "Samba SMB session handling for WinPE re-image robustness"
|
||||
blockinfile:
|
||||
path: /etc/samba/smb.conf
|
||||
@@ -876,8 +1032,37 @@
|
||||
# --- Blancco PXE boot via Ubuntu kernel + switch_root ---
|
||||
# Blancco's own kernel freezes on Dell Precision towers. Workaround:
|
||||
# Boot Ubuntu kernel, download Blancco rootfs, overlay mount, switch_root.
|
||||
# Kernel, modules and initramfs all come from blancco_kver (the HWE
|
||||
# kernel), not the server's running kernel: the server may run 6.8 while
|
||||
# Blancco boots 7.0. Output names carry the version so a changed
|
||||
# blancco_kver rebuilds instead of being skipped by the creates: guards.
|
||||
|
||||
- name: "Build Blancco PXE initramfs"
|
||||
- name: "Blancco: is the Blancco kernel ({{ blancco_kver }}) installed?"
|
||||
stat:
|
||||
path: "{{ item }}"
|
||||
loop:
|
||||
- "/boot/vmlinuz-{{ blancco_kver }}"
|
||||
- "/lib/modules/{{ blancco_kver }}/modules.dep"
|
||||
register: blancco_kernel_files
|
||||
|
||||
- name: "Blancco: kernel check result"
|
||||
set_fact:
|
||||
blancco_kernel_ok: "{{ blancco_kernel_files.results | map(attribute='stat.exists') | min }}"
|
||||
|
||||
- name: "Blancco: warn when the Blancco kernel is missing"
|
||||
debug:
|
||||
msg: >-
|
||||
WARNING: /boot/vmlinuz-{{ blancco_kver }} or
|
||||
/lib/modules/{{ blancco_kver }} is missing, so the Blancco UEFI
|
||||
files (vmlinuz-ubuntu-{{ blancco_ksuffix }},
|
||||
kexec-initrd-{{ blancco_ksuffix }}.img,
|
||||
kmod-{{ blancco_kver }}.tar.gz) are NOT built. Install
|
||||
linux-image-{{ blancco_kver }} + linux-modules-extra-{{ blancco_kver }}
|
||||
(scripts/download-packages.sh, BLANCCO_KVER) or set blancco_kver
|
||||
to an installed version (ls /lib/modules), then re-run.
|
||||
when: not blancco_kernel_ok
|
||||
|
||||
- name: "Build Blancco PXE initramfs (kexec-initrd-{{ blancco_ksuffix }}.img)"
|
||||
# The narrow hand-picked NIC driver list used before 2026-04-22 produced
|
||||
# a 2 MB initramfs that hung on "waiting for network interface" for any
|
||||
# hardware outside e1000e/igb/tg3/bnx2/bnxt_en/b44. This rewrite sweeps
|
||||
@@ -889,11 +1074,15 @@
|
||||
# the narrow build cost us when a NIC was unsupported.
|
||||
args:
|
||||
executable: /bin/bash
|
||||
creates: "{{ web_root }}/blancco/kexec-initrd.img"
|
||||
# Stamp named after the full version: 7.0.0-34 -> 7.0.0-40 keeps the
|
||||
# file name (suffix 70) but must rebuild.
|
||||
creates: "{{ web_root }}/blancco/.kexec-initrd-{{ blancco_ksuffix }}.{{ blancco_kver }}.built"
|
||||
when: blancco_kernel_ok
|
||||
shell: |
|
||||
set -e
|
||||
WORK=$(mktemp -d)
|
||||
KVER=$(uname -r)
|
||||
KVER="{{ blancco_kver }}"
|
||||
OUT="{{ web_root }}/blancco/kexec-initrd-{{ blancco_ksuffix }}.img"
|
||||
mkdir -p "$WORK"/{bin,lib/modules/$KVER/kernel,lib64,sbin,usr/share/udhcpc,etc,run,proc,sys,dev}
|
||||
|
||||
# Busybox (static) - bundled on USB at playbook/busybox-static
|
||||
@@ -979,18 +1168,47 @@
|
||||
|
||||
# Build CPIO
|
||||
cd "$WORK"
|
||||
find . | cpio -o -H newc --quiet | gzip -1 > "{{ web_root }}/blancco/kexec-initrd.img"
|
||||
# Build beside the target and rename: a PC may be booting the old one.
|
||||
find . | cpio -o -H newc --quiet | gzip -1 > "$OUT.tmp"
|
||||
mv -f "$OUT.tmp" "$OUT"
|
||||
cd /
|
||||
rm -rf "$WORK"
|
||||
echo "Built kexec-initrd.img: $(stat -c %s '{{ web_root }}/blancco/kexec-initrd.img') bytes"
|
||||
rm -f "{{ web_root }}"/blancco/.kexec-initrd-{{ blancco_ksuffix }}.*.built
|
||||
touch "{{ web_root }}/blancco/.kexec-initrd-{{ blancco_ksuffix }}.{{ blancco_kver }}.built"
|
||||
echo "Built $(basename "$OUT") for $KVER: $(stat -c %s "$OUT") bytes"
|
||||
ignore_errors: yes
|
||||
|
||||
- name: "Copy Ubuntu kernel for Blancco PXE boot"
|
||||
- name: "Copy Ubuntu kernel for Blancco PXE boot (vmlinuz-ubuntu-{{ blancco_ksuffix }})"
|
||||
copy:
|
||||
src: "/boot/vmlinuz-{{ ansible_kernel }}"
|
||||
dest: "{{ web_root }}/blancco/vmlinuz-ubuntu"
|
||||
src: "/boot/vmlinuz-{{ blancco_kver }}"
|
||||
dest: "{{ web_root }}/blancco/vmlinuz-ubuntu-{{ blancco_ksuffix }}"
|
||||
remote_src: yes
|
||||
mode: '0644'
|
||||
when: blancco_kernel_ok
|
||||
|
||||
# Secure Boot on: iPXE 2.0 starts the Canonical-signed kernel above
|
||||
# through Ubuntu's Microsoft-signed shim (GetPxeScript.aspx: shim
|
||||
# http://${server}/blancco/shimx64.efi). From the shim-signed package.
|
||||
- name: "Blancco: find Ubuntu's signed shim"
|
||||
stat:
|
||||
path: /usr/lib/shim/shimx64.efi.signed
|
||||
register: ubuntu_shim
|
||||
|
||||
- name: "Blancco: publish Ubuntu's signed shim as blancco/shimx64.efi"
|
||||
copy:
|
||||
src: /usr/lib/shim/shimx64.efi.signed
|
||||
dest: "{{ web_root }}/blancco/shimx64.efi"
|
||||
remote_src: yes
|
||||
mode: '0644'
|
||||
when: ubuntu_shim.stat.exists
|
||||
|
||||
- name: "Blancco: warn when the signed shim is missing"
|
||||
debug:
|
||||
msg: >-
|
||||
WARNING: /usr/lib/shim/shimx64.efi.signed not found (package
|
||||
shim-signed). Blancco with Secure Boot ON will not start; with
|
||||
Secure Boot off it still boots (the menu's shim line fails over).
|
||||
when: not ubuntu_shim.stat.exists
|
||||
|
||||
- name: "Create TFTP blancco directory"
|
||||
file:
|
||||
@@ -1015,10 +1233,12 @@
|
||||
- amd-ucode.img
|
||||
- config.img
|
||||
|
||||
- name: "Build Ubuntu kernel modules tarball for Blancco"
|
||||
- name: "Build Ubuntu kernel modules tarball for Blancco (kmod-{{ blancco_kver }}.tar.gz)"
|
||||
when: blancco_kernel_ok
|
||||
shell: |
|
||||
set -e
|
||||
KVER=$(uname -r)
|
||||
KVER="{{ blancco_kver }}"
|
||||
OUT="{{ web_root }}/blancco/kmod-$KVER.tar.gz"
|
||||
# Ship the host's iwlwifi firmware with its modules. The UEFI path
|
||||
# runs this Ubuntu kernel on Blancco's rootfs, and Blancco 7.20 only
|
||||
# carries API 89 ucode for AX201/AX210/AX211, which the 6.8 iwlwifi
|
||||
@@ -1026,10 +1246,12 @@
|
||||
# only, no lib/ entry: on the Blancco rootfs lib is a symlink to
|
||||
# usr/lib and a directory entry would replace it.
|
||||
cd /
|
||||
tar czf "{{ web_root }}/blancco/kmod.tar.gz" -C / "lib/modules/$KVER" $(ls -d lib/firmware/iwlwifi-*)
|
||||
echo "Built kmod.tar.gz: $(du -h '{{ web_root }}/blancco/kmod.tar.gz' | cut -f1)"
|
||||
# blancco-init.sh fetches kmod-$(uname -r).tar.gz (the booted kernel).
|
||||
tar czf "$OUT.tmp" -C / "lib/modules/$KVER" $(ls -d lib/firmware/iwlwifi-*)
|
||||
mv -f "$OUT.tmp" "$OUT"
|
||||
echo "Built $(basename "$OUT"): $(du -h "$OUT" | cut -f1)"
|
||||
args:
|
||||
creates: "{{ web_root }}/blancco/kmod.tar.gz"
|
||||
creates: "{{ web_root }}/blancco/kmod-{{ blancco_kver }}.tar.gz"
|
||||
|
||||
- name: "Extract config-clean.xml from config.img (strip null bytes)"
|
||||
shell: |
|
||||
@@ -1068,7 +1290,7 @@
|
||||
shell: |
|
||||
set -e
|
||||
python3 -c 'import xml.etree.ElementTree as ET; ET.parse("{{ web_root }}/blancco/preferences.xml")'
|
||||
grep -q '<hostname>172.16.9.1</hostname>' "{{ web_root }}/blancco/preferences.xml"
|
||||
grep -q '<hostname>{{ pxe_server_ip }}</hostname>' "{{ web_root }}/blancco/preferences.xml"
|
||||
grep -q '<path>blancco-reports</path>' "{{ web_root }}/blancco/preferences.xml"
|
||||
changed_when: false
|
||||
|
||||
@@ -1099,19 +1321,56 @@
|
||||
- apache2
|
||||
- smbd
|
||||
|
||||
- name: "Allow necessary firewall ports (UFW)"
|
||||
# Firewall per interface. Imaging NIC: everything imaging needs. GE
|
||||
# corporate NIC: SSH and the webapp only. New rules go in first, then the
|
||||
# old any-interface rules are removed, so SSH is never closed mid-run.
|
||||
- name: "UFW: allow imaging services on the imaging NIC only"
|
||||
ufw:
|
||||
rule: allow
|
||||
port: "{{ item }}"
|
||||
proto: "{{ 'udp' if item in ['67','69'] else 'tcp' }}"
|
||||
direction: in
|
||||
interface: "{{ pxe_nic_name }}"
|
||||
port: "{{ item.port }}"
|
||||
proto: "{{ item.proto }}"
|
||||
loop: "{{ ufw_pxe_rules }}"
|
||||
loop_control:
|
||||
label: "{{ pxe_nic_name }} {{ item.port }}/{{ item.proto }}"
|
||||
|
||||
- name: "UFW: allow SSH and the webapp on the GE corporate NIC"
|
||||
ufw:
|
||||
rule: allow
|
||||
direction: in
|
||||
interface: "{{ corp_nic_name }}"
|
||||
port: "{{ item.port }}"
|
||||
proto: "{{ item.proto }}"
|
||||
loop: "{{ ufw_corp_rules }}"
|
||||
loop_control:
|
||||
label: "{{ corp_nic_name }} {{ item.port }}/{{ item.proto }}"
|
||||
|
||||
- name: "UFW: remove the old any-interface rules"
|
||||
ufw:
|
||||
rule: allow
|
||||
port: "{{ item.port }}"
|
||||
proto: "{{ item.proto }}"
|
||||
delete: yes
|
||||
loop:
|
||||
- "22"
|
||||
- "67"
|
||||
- "69"
|
||||
- "80"
|
||||
- "4433"
|
||||
- "445"
|
||||
- "9009"
|
||||
- { port: "22", proto: tcp }
|
||||
- { port: "67", proto: udp }
|
||||
- { port: "69", proto: udp }
|
||||
- { port: "80", proto: tcp }
|
||||
- { port: "4433", proto: tcp }
|
||||
- { port: "445", proto: tcp }
|
||||
- { port: "9009", proto: tcp }
|
||||
loop_control:
|
||||
label: "any {{ item.port }}/{{ item.proto }}"
|
||||
|
||||
- name: "UFW: remove the stale 9011 rule (old webapp port)"
|
||||
ufw:
|
||||
rule: allow
|
||||
direction: in
|
||||
interface: "{{ pxe_nic_name }}"
|
||||
port: "9011"
|
||||
proto: tcp
|
||||
delete: yes
|
||||
|
||||
- name: "Enable UFW firewall"
|
||||
ufw:
|
||||
@@ -1302,6 +1561,10 @@
|
||||
copy:
|
||||
dest: /etc/apache2/sites-available/pxe-server.conf
|
||||
content: |
|
||||
# 9009 listens on every address: admins use the webapp from the GE
|
||||
# corporate NIC. TODO: the webapp has NO authentication; anyone on
|
||||
# the GE network who can reach this box can drive it. Add auth (or
|
||||
# restrict 9009 on the corp NIC to an admin subnet in UFW).
|
||||
Listen 9009
|
||||
<VirtualHost *:80>
|
||||
DocumentRoot {{ web_root }}
|
||||
@@ -1346,46 +1609,11 @@
|
||||
name: apache2
|
||||
state: reloaded
|
||||
|
||||
# Single-NIC fresh-deploy default. Boxes that need higher throughput
|
||||
# (e.g. WJF prod uses a USB-C 5 Gbps NIC) override this with a bridge
|
||||
# config bonding the USB NIC + onboard NIC into br-pxe. Live override
|
||||
# currently deployed on 172.16.9.1 (do NOT re-run this task there
|
||||
# without first reviewing /etc/netplan/50-cloud-init.yaml.pre-gold-swap):
|
||||
#
|
||||
# network:
|
||||
# version: 2
|
||||
# renderer: networkd
|
||||
# ethernets:
|
||||
# enp128s31f6: { dhcp4: no }
|
||||
# enx34c8d6b11010: { dhcp4: no }
|
||||
# bridges:
|
||||
# br-pxe:
|
||||
# interfaces: [enp128s31f6, enx34c8d6b11010]
|
||||
# addresses: [172.16.9.1/24]
|
||||
# parameters:
|
||||
# stp: false
|
||||
#
|
||||
# Re-running THIS task on a box already using the bridge config will
|
||||
# replace the bridge with a single-iface flat config and likely break
|
||||
# the PXE LAN. Skip this task or restore the .pre-gold-swap backup
|
||||
# before applying.
|
||||
- name: "Configure static IP for PXE interface"
|
||||
copy:
|
||||
dest: /etc/netplan/50-cloud-init.yaml
|
||||
backup: yes
|
||||
content: |
|
||||
network:
|
||||
version: 2
|
||||
renderer: networkd
|
||||
ethernets:
|
||||
{{ pxe_iface }}:
|
||||
dhcp4: no
|
||||
addresses: [172.16.9.1/24]
|
||||
notify: "Apply netplan"
|
||||
# The network config (two NICs pinned by MAC) is applied near the top of
|
||||
# the play, "NICs: ..." tasks, so dnsmasq/UFW/Samba see the final names.
|
||||
# The old br-pxe bridge layout (onboard + USB NIC bonded) is gone: one NIC
|
||||
# per network, see templates/netplan-pxe.yaml.j2.
|
||||
|
||||
handlers:
|
||||
- name: "Apply netplan"
|
||||
command: netplan apply
|
||||
|
||||
- name: "reload sysctl"
|
||||
command: sysctl --system
|
||||
|
||||
Reference in New Issue
Block a user