# GE Aerospace PXE Boot Server

Automated, air-gapped PXE boot server for deploying GE Aerospace Windows images. Built on Ubuntu 24.04 Server with zero-touch provisioning via autoinstall and Ansible.

## Overview

This project provides a complete, repeatable build process for a PXE boot server that serves Windows PE images to client machines on an isolated network. Everything runs offline after initial setup — no internet required on the target server.

### Boot Chain

```
Client PXE boot (UEFI Secure Boot)
  -> iPXE (TFTP, Broadcom-signed for Secure Boot)
  -> iPXE boot menu (HTTP, port 4433)
  -> User selects boot option:
     ├── Windows PE  -> wimboot -> boot.wim -> startnet.cmd -> Samba share -> Image deployment
     ├── Clonezilla  -> vmlinuz/initrd -> Disk cloning/imaging
     ├── Blancco     -> vmlinuz/initrd -> NIST 800-88 drive erasure
     └── Memtest86+  -> Memory diagnostics
```

### Services

| Service     | Port      | Purpose                                  |
|-------------|-----------|------------------------------------------|
| dnsmasq     | 67/udp    | DHCP (10.9.100.10-100, 12h lease)        |
| dnsmasq     | 69/udp    | TFTP (serves ipxe.efi)                   |
| Apache      | 80/tcp    | HTTP (wimboot, WinPE boot files, proxy)  |
| Apache      | 4433/tcp  | iPXE boot script (GetPxeScript.aspx)     |
| Samba       | 445/tcp   | Deployment content + Clonezilla + Blancco|
| Flask Webapp| 9009/tcp  | Web management interface                 |

### Network

- **PXE server IP:** `10.9.100.1/24`
- **DHCP range:** `10.9.100.10` - `10.9.100.100`
- **Firewall:** UFW deny-by-default, only service ports open

## Quick Start

### Prerequisites

**On your workstation (internet-connected):**
- Ubuntu 24.04 (or Linux Mint / similar) for downloading packages
- Ubuntu Server 24.04 ISO
- GE Aerospace Media Creator LITE (for WinPE images)
- USB drive >= 8 GB (32+ GB if bundling WinPE images)

**GE Access Packages (MyAccess portal):**
- EPM Rufus Exception Request
- EPM DT Functions
- DLP - Encrypted Removable (USB) Long Term Access

### Step 1: Download Offline Packages

```bash
./download-packages.sh
```

Downloads all .deb packages and Python wheels for offline installation (~140 MB of debs, ~20 MB of wheels).

### Step 2: Prepare Boot Tools (optional)

```bash
./prepare-boot-tools.sh /path/to/blancco.iso /path/to/clonezilla.zip /path/to/memtest.bin
```

Extracts and configures boot tool files (Blancco, Clonezilla, Memtest86+). Automatically patches Blancco's config.img to auto-save erasure reports to the PXE server's Samba share.

### Step 3: Build the USB

```bash
sudo ./build-usb.sh /dev/sdX /path/to/ubuntu-24.04-live-server-amd64.iso
```

Creates a bootable USB with two partitions:
- **Partition 1:** Ubuntu Server installer
- **Partition 2:** CIDATA (autoinstall config, offline .debs, pip wheels, Ansible playbook, webapp, boot tools)

### Step 4: Install on Target Server

1. Insert USB into the target machine
2. Press F12 and boot from USB
3. Ubuntu auto-installs with no interaction
4. After reboot, the first-boot script:
   - Installs all offline .deb packages
   - Runs the Ansible playbook (configures dnsmasq, Apache, Samba, UFW, webapp)
   - Configures static IP `10.9.100.1/24`
5. Move the server's wired NIC to the isolated PXE switch

### Step 5: Access the Web Interface

Open `http://10.9.100.1:9009` from any machine on the isolated network.

## Web Management Interface

The Flask webapp (port 9009) provides a browser-based management UI:

- **Dashboard** — Service status overview, disk usage, connected DHCP clients
- **Image Import** — Import WinPE deployment images from USB drives
- **Unattend Editor** — Edit Windows unattend.xml files per image type (XML syntax highlighting)
- **startnet.cmd Editor** — Modify the startnet.cmd inside boot.wim without Windows (uses wimtools)
- **Clonezilla Backups** — Upload, download, and manage disk backup images
- **Blancco Reports** — View, download, and manage drive erasure reports (auto-collected via Samba)
- **Audit Log** — Activity history for all write operations (imports, edits, deletes)

### Image Types Supported

| Image Type           | Domain          | Description             |
|----------------------|-----------------|-------------------------|
| gea-standard         | geaerospace.com | Standard desktop        |
| gea-engineer         | geaerospace.com | Engineering desktop     |
| gea-shopfloor        | geaerospace.com | Shop floor kiosk        |
| ge-standard          | ge.com          | Standard desktop        |
| ge-engineer          | ge.com          | Engineering desktop     |
| ge-shopfloor-lockdown| ge.com          | Shop floor (locked)     |
| ge-shopfloor-mce     | ge.com          | Shop floor (MCE)        |

## Project Structure

```
pxe-server/
├── autoinstall/
│   ├── user-data                 # Cloud-init autoinstall config + first-boot script
│   └── meta-data                 # Cloud-init metadata (required, empty)
├── playbook/
│   ├── pxe_server_setup.yml      # Ansible playbook: all server configuration
│   └── inventory.ini             # Ansible inventory
├── webapp/
│   ├── app.py                    # Flask application (~900 lines)
│   ├── requirements.txt          # Python deps (flask, lxml)
│   ├── static/
│   │   ├── ge-aerospace-logo.svg # GE Aerospace branding
│   │   ├── favicon.ico           # Browser favicon
│   │   ├── app.js                # Frontend JavaScript
│   │   ├── bootstrap.min.css     # Bootstrap 5 (bundled offline)
│   │   ├── bootstrap.bundle.min.js
│   │   ├── bootstrap-icons.min.css
│   │   └── fonts/                # Icon fonts (woff/woff2)
│   └── templates/
│       ├── base.html             # Layout with GE branding and sidebar nav
│       ├── dashboard.html        # Service status and overview
│       ├── import.html           # USB image import wizard
│       ├── unattend_editor.html  # XML editor for unattend files
│       ├── startnet_editor.html  # startnet.cmd WIM editor
│       ├── backups.html          # Clonezilla backup management
│       ├── reports.html          # Blancco erasure reports
│       └── audit.html            # Activity audit log
├── unattend/
│   └── FlatUnattendW10.xml       # Windows unattend.xml template
├── boot-tools/                   # Extracted boot tool files (gitignored)
│   ├── blancco/                  # Blancco Drive Eraser (Arch Linux-based)
│   ├── clonezilla/               # Clonezilla Live
│   └── memtest/                  # Memtest86+
├── offline-packages/             # .deb files (gitignored, built by download-packages.sh)
├── pip-wheels/                   # Python wheels (gitignored, built by download-packages.sh)
├── download-packages.sh          # Downloads offline .debs + pip wheels
├── build-usb.sh                  # Builds the installer USB (2-partition)
├── prepare-boot-tools.sh         # Extracts and patches boot tool files
├── build-proxmox-iso.sh            # Builds self-contained Proxmox installer ISO
├── test-vm.sh                    # KVM test environment for validation
├── SETUP.md                      # Detailed setup guide
└── setup-guide-original.txt      # Original manual setup notes (reference)
```

## Testing with KVM

A test VM script is included for validating the full provisioning pipeline without dedicated hardware:

```bash
# Download Ubuntu Server ISO
wget -O ~/Downloads/ubuntu-24.04.3-live-server-amd64.iso \
  https://releases.ubuntu.com/noble/ubuntu-24.04.3-live-server-amd64.iso

# Launch test VM (requires libvirt/KVM)
sudo ./test-vm.sh ~/Downloads/ubuntu-24.04.3-live-server-amd64.iso

# Watch install progress
sudo virsh console pxe-test

# Clean up when done
sudo ./test-vm.sh --destroy
```

The test VM creates an isolated libvirt network (10.9.100.0/24) and runs the full autoinstall + Ansible provisioning.

## Proxmox Deployment

A single ISO can be built for deploying the PXE server in a Proxmox VM:

### Build the ISO

```bash
# Prerequisites (on build workstation)
sudo apt install xorriso p7zip-full

# Build the installer ISO
./build-proxmox-iso.sh /path/to/ubuntu-24.04-live-server-amd64.iso
```

This creates `pxe-server-proxmox.iso` containing the Ubuntu installer, autoinstall config, all offline packages, the Ansible playbook, webapp, and boot tools.

### Deploy on Proxmox

1. Upload `pxe-server-proxmox.iso` to Proxmox storage (Datacenter -> Storage -> ISO Images)
2. Create a new VM:
   - **OS:** Linux 6.x kernel
   - **BIOS:** OVMF (UEFI) or SeaBIOS
   - **Memory:** 4096 MB
   - **CPU:** 2+ cores
   - **Disk:** 40+ GB (VirtIO SCSI)
   - **Network:** Bridge connected to your isolated PXE network
3. Attach the ISO as CD-ROM and start the VM
4. Ubuntu auto-installs with zero interaction (~10-15 minutes)
5. After reboot, first-boot configures all PXE services automatically
6. Access the web interface at `http://10.9.100.1:9009`

### Import WinPE Images

After the server is running, import deployment images via the web interface at `http://10.9.100.1:9009/import` or by mounting a USB drive with WinPE content.

## Samba Shares

| Share           | Path                      | Purpose                        |
|-----------------|---------------------------|--------------------------------|
| winpeapps       | /srv/samba/winpeapps      | WinPE deployment images        |
| clonezilla      | /srv/samba/clonezilla     | Clonezilla disk backup images  |
| blancco-reports | /srv/samba/blancco-reports| Blancco erasure reports (auto) |

All shares use guest access (no authentication) for ease of use on the isolated network.

## Blancco Drive Erasure

Blancco Drive Eraser is configured to automatically save XML erasure reports to the PXE server's Samba share (`blancco-reports`). The `prepare-boot-tools.sh` script patches Blancco's `config.img` to set:
- Network share hostname: `10.9.100.1`
- Share path: `blancco-reports`
- Auto-backup: enabled
- Erasure standard: NIST 800-88 Purge

Reports are viewable and downloadable from the web interface at `http://10.9.100.1:9009/reports`.

## Notes

- Run `download-packages.sh` before building USB — it downloads all offline `.deb` packages including wimtools (needed for startnet.cmd editing)
- The webapp uses session-based CSRF tokens on all POST forms and API endpoints

## Commit History

| Commit  | Description                                                        |
|---------|--------------------------------------------------------------------|
| 5791bd1 | Initial project setup: automated PXE server provisioning           |
| cee4ecd | Add web management UI, offline packages, WinPE consolidation       |
| f614596 | Fix unattend.xml path to match actual image structure              |
| e7313c2 | Add multi-boot PXE menu, Clonezilla backups, GE Aerospace branding|
| 89b5834 | Add wimtools and startnet.cmd editor for boot.wim modification     |
| 05dbb7e | Add Blancco erasure reports Samba share and webapp viewer          |
| ef75839 | Auto-patch Blancco config.img for network report storage           |
| 92c9b0f | Fix review findings: offline assets, security, audit logging       |
| 725c8f4 | Change webapp to port 9009, add test VM script                     |