Share accounts: per-site Samba passwords from the webapp

Tools > Share accounts sets the pxe-upload, blancco and clonezilla Samba
passwords. Saving one runs smbpasswd and writes it everywhere it is used:
startnet.cmd in boot.wim (pxe-upload), the served Blancco preferences and
the live config.img (blancco), the iPXE menu's Clonezilla entries
(clonezilla). Refused while a PC is imaging unless forced. Stored 0600 in
UPDATES_DIR/shares/accounts.json, never shown back.

- The stored values are the authority: the playbook only creates the
  Samba accounts, seeds the store from site-vars (pxe_upload_password,
  blancco_smb_password, clonezilla_smb_password) for accounts it does not
  hold, and runs "share_accounts apply" at the end of every run.
- Every startnet save re-pins SHAREPASS, so a restored snapshot cannot
  bring an old password back; new menu blocks use %SHAREUSER%/%SHAREPASS%.
- Shop floor unattend Order 4 reads the login from fetch-source.txt;
  Invoke-PostPpkg deletes that file once the PPKG is applied.
- Upload-Image.ps1 asks for the password unless -Pass is given.
- pxe_admin_password: the Linux pxe login. Required while the box still
  has the shipped "pxe"; set with chpasswd when it differs.
- Blancco site settings now also reach the live config.img (BIOS path).

scripts/diagnostics/Capture-LockdownState.ps1

@@ -474,6 +474,6 @@ Write-Host ""
 Write-Host "Snapshot complete: $out"
 Write-Host ""
 Write-Host "Next: copy that folder to the workstation. Easiest:"
-Write-Host "  net use Z: \\172.16.9.1\image-upload /user:pxe-upload pxe /persistent:no"
+Write-Host "  net use Z: \\172.16.9.1\image-upload /user:pxe-upload <password> /persistent:no"
 Write-Host "  robocopy `"$out`" `"Z:\state-$Stage-$stamp`" /E /NFL /NDL /NJH /NJS"
 Write-Host "  net use Z: /delete /y"

scripts/download-drivers.py

@@ -33,7 +33,7 @@ from pathlib import Path
 REPO_DIR = Path(__file__).resolve().parent
 PXE_HOST = "172.16.9.1"
 PXE_USER = "pxe"
-PXE_PASS = "pxe"
+PXE_PASS = os.environ.get("PXE_PASS") or "pxe"  # the site's pxe_admin_password
 UPLOAD_DEST = "/home/pxe/image-upload"
 IMAGE_BASE = "/srv/samba/winpeapps"
 

scripts/preflight.py

@@ -37,7 +37,7 @@ REPO = os.path.dirname(HERE)
 
 PXE_HOST = "172.16.9.1"
 PXE_USER = "pxe"
-PXE_PASS = "pxe"
+PXE_PASS = os.environ.get("PXE_PASS") or "pxe"  # the site's pxe_admin_password
 MODELS_TXT = "/srv/samba/winpeapps/_shared/BIOS/models.txt"
 IMAGE_BASE = "/srv/samba/winpeapps"
 

scripts/share-drift.py

@@ -40,7 +40,7 @@ import sys
 REPO = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
 PXE_HOST = "172.16.9.1"
 PXE_USER = "pxe"
-PXE_PASS = "pxe"
+PXE_PASS = os.environ.get("PXE_PASS") or "pxe"  # the site's pxe_admin_password
 
 GIT_OWNED, UNRECONCILED = "git-owned", "unreconciled"