04db6d6605
Everything West Jefferson specific moved out to a separate repo (pxe-site-wj): NTLARS/UDC/heat-treat backups keyed by WJ machine numbers, CMM and Wax/Trace bay lists, WJ OpenText profiles, site-config.json, the WJ preinstall list, and the WJ shopfloor PC types (Collections, NoCollections, Common, Keyence, CMM, Genspect, HeatTreat, Wax/Trace, Display, PartMarker) with GE-Enforce, machine numbers and the desktop layout. The part-marker bench tools moved to their own repo. Dead scripts removed: build-proxmox-iso, deploy-bios, sync_hardware_models, mirror-from-gold, pull-bios, startnet-template.cmd. Shopfloor is one generic type, gea-shopfloor-standard, with today's timing: - PPKG at first logon (unattend Order 10, unchanged). - Install-AppList.ps1 runs C:\PreInstall\preinstall.json during setup. - A new SYSTEM task, GE Shopfloor Post-PPKG, runs postppkg.json once after the post-PPKG reboot. It also clears AutoLogonCount after the ShopFloor handover (the Users-level monitor can be denied that HKLM write) and removes the Intune Sync task when done. - Both lists ship empty. A site adds entries and installers. - WinPE choice 3 goes straight to the PPKG menu. Staging, fetch and heal carry only the generic payload. The webapp's shopfloor sub-menu editor is gone, and the imaging tiles name the new stages. - The playbook deploys the empty lists only if missing. It now deploys the PowerShell 7 MSI the shopfloor unattend installs, which it never did before. Blancco site settings move into the webapp (Updates > Blancco releases): business location, licensing Wi-Fi SSID and password. They are rendered into the served preferences.xml and applied to every staged release, and are seeded from site-vars (site_name, blancco_wifi_ssid, blancco_wifi_password) only while none exist. The repo XML carries no site values; the plaintext Wi-Fi password is gone from it. New site_name and site_timezone settings: report and evidence-pack site name, server clock and webapp time zone. No more West Jefferson defaults in webapp/config.py or the dashboard title. Sync-BPRT.ps1 gets the server address filled in at download instead of WJ's GE address. USB on Windows: - scripts/Build-PxeUsb.ps1 runs the same checks as build-usb.sh. It writes one FAT32 CIDATA partition (ISO files plus patched grub.cfg plus payload) with diskpart and reads every file back by SHA-256. - Tested with Windows PowerShell 5.1 in the win11 VM, and the layout installs and first-boots in the pxetest VM. - scripts/stage-usb-share.sh stages the build folder on a share. - site-content/ is optional for both builders. KB docs/kb/How_To_Deploy_PXE_Server_New_Site.html: new-site deployment, Windows only, with a site-vars.yml guide. Checks: webapp tests pass (5 suites); the unattend lint and playbook syntax checks pass; every .ps1 parses; there are no WJ hosts, IPs, names or PC types in playbook/, webapp/, scripts/ or autoinstall/.
58 lines
2.8 KiB
YAML
58 lines
2.8 KiB
YAML
---
|
|
# Per-site values for pxe_server_setup.yml. Copy to playbook/site-vars.yml
|
|
# (next to the playbook, so it rides on the USB) and fill in. The playbook
|
|
# loads it on first boot; -e on the command line still overrides it.
|
|
# site-vars.yml is git-ignored: each site's MACs stay with that site.
|
|
#
|
|
# The NICs, by MAC (ip -br link on the box, or the label). Both optional:
|
|
# pxe_nic_mac imaging NIC = cable to the isolated imaging switch (serves
|
|
# DHCP/PXE/SMB). Empty: the first boot picks the one wired
|
|
# port with a link, if pxe-nic-check calls it isolated, and
|
|
# pins it. So during the install plug in ONLY the imaging
|
|
# switch. If it cannot tell, the console says to log in and
|
|
# run: sudo pxe-pick-nic (pull the imaging cable, plug it in).
|
|
# corp_nic_mac GE corporate NIC (SSH + webapp 9009). Empty: every other
|
|
# wired port is a DHCP client, so GE can be plugged into any
|
|
# of them, now or later. Set: only that port, named corp0.
|
|
pxe_nic_mac: "" # e.g. "34:c8:d6:b1:10:10"
|
|
corp_nic_mac: "" # e.g. "20:88:10:af:0d:e5"
|
|
|
|
# Optional: stable interface names (default pxe0 / corp0). With corp_nic_mac
|
|
# empty, pxe_nic_name must not start with en or eth. With both MACs set a
|
|
# box may keep its existing names, e.g. on the WJ server:
|
|
# pxe_nic_name: enx34c8d6b11010
|
|
# corp_nic_name: enp0s31f6
|
|
|
|
# Recommended: who may reach SSH and the webapp (9009) on the corp NIC.
|
|
# Empty = all of GE (a warning every run). See docs/SITE-CUSTOMIZATION.md.
|
|
# corp_admin_cidrs: ["10.12.34.0/24"]
|
|
# Keys only from the GE side (needs ~pxe/.ssh/authorized_keys first):
|
|
# corp_ssh_password_auth: false
|
|
|
|
# Optional: imaging LAN addressing (defaults shown). 172.16.9.1 is also
|
|
# hard-coded in the iPXE menu, startnet.cmd, blancco-preferences.xml and the
|
|
# unattend files; see docs/SITE-CUSTOMIZATION.md before changing it.
|
|
# pxe_server_ip: "172.16.9.1"
|
|
# pxe_subnet: "172.16.9.0/24"
|
|
# pxe_dhcp_start: "172.16.9.10"
|
|
# pxe_dhcp_end: "172.16.9.100"
|
|
# pxe_dhcp_lease: "12h"
|
|
|
|
# Optional: kernel the Blancco UEFI entries boot (must be installed; see
|
|
# scripts/download-packages.sh BLANCCO_KVER).
|
|
# blancco_kver: "7.0.0-34-generic"
|
|
|
|
# Recommended: the password of the Samba account "clonezilla", which can
|
|
# open only the [clonezilla] share (Clonezilla back up / restore by machine
|
|
# number). The iPXE menu carries it, so treat it as an imaging-LAN secret,
|
|
# not a real one. 8-64 characters from A-Z a-z 0-9 . _ ~ - (default
|
|
# "clonezilla-backup").
|
|
# clonezilla_smb_password: "change-me-per-site"
|
|
|
|
# Recommended: the site name stamped on Blancco erasure reports and the
|
|
# monthly CMMC evidence packs (empty: "Unnamed site"). Letters, digits,
|
|
# spaces and . , - ( ) & / only.
|
|
# site_name: "Example Site"
|
|
# Optional: time zone of the server clock and the webapp (tz database name).
|
|
# site_timezone: "America/New_York"
|