0b1625ed87
H1 corp_admin_cidrs (UFW 22/9009 on the corp NIC from these only; refuses
when it would lock out the current SSH client) and corp_ssh_password_auth
(sshd drop-in, passwords only from the imaging subnet). Defaults keep the
current behaviour and print a loud warning.
H2 pxe-netplan-apply.sh: pre-flight refusal (pxe-MAC NIC holds the default
route, a DHCP lease or the route to an SSH client), run from the USB
before anything changes; post-apply checks (names, imaging IPv4, corp
IPv4 back within 30 s, SSH route) and a 120 s systemd-run auto-revert.
H3 restore() puts the previous NIC names back (two-phase rename via
temporary names, so swaps work) before generate + apply.
H4 a failed rename is fatal (restore + exit 1); the play drops the old
any-interface UFW rules only after verifying both NICs and their
per-interface SSH rules.
H5 first-boot checks the playbook exit code, retries at next boot (max 5),
writes /var/lib/pxe-firstboot.failed and /etc/issue + /etc/motd banners.
M1 build-usb.sh verifies iPXE files against the playbook pins, every wheel
against its own package's hashes, drops the unpinned pip fallback,
requires --site-vars or --no-site-vars.
M2 webapp restarts when the code, wheels or unit changed.
M3 ignore-carrier on the imaging NIC; ip_nonlocal_bind kept for the
apache/networkd boot race.
M4 menu suffix must match blancco_kver; missing kernel with no earlier
build is fatal; a live menu with the staged Blancco test entry is not
overwritten.
M5 build-proxmox-iso.sh is unsupported (hard exit); use build-usb --image.
M6 deploy-unattend.sh: password via SSHPASS env and sudo stdin only,
%q-quoted remote args, sha256 check of the live file; lint-unattend.py
reads PXE_SERVER/PXE_USER/PXE_PASS and uses sshpass -e.
M7 the playbook lints the unattend files before the force: yes copies
(lint-unattend.py ships on CIDATA as scripts/); pre-commit ACMR.
M8 Blancco initramfs build: no ignore_errors, pipefail, trap cleanup.
Also: Send-ImagingStage.ps1 deploy, carrier hook install tasks
(pxe-nic-carrier, networkd-dispatcher), L1 imaging-active hold
(allow_disruptive) and no iPXE downgrade below an Updates-page install,
L2 iso-volid, L3 kver pin read from the playbook, L4 cp -rL, L5 refuse
>= 4 GiB WinPE files, L6 PIP_DIR wipe guard, L7 per-package wheel hashes,
no online fallback, L8 check-updates.py (apt_pkg/cached compare, all
components, exit 2 on no debs / bad answers).
38 lines
1.7 KiB
YAML
38 lines
1.7 KiB
YAML
---
|
|
# Per-site values for pxe_server_setup.yml. Copy to playbook/site-vars.yml
|
|
# (next to the playbook, so it rides on the USB) and fill in. The playbook
|
|
# loads it on first boot; -e on the command line still overrides it.
|
|
# site-vars.yml is git-ignored: each site's MACs stay with that site.
|
|
#
|
|
# REQUIRED: the two NICs, by MAC (ip -br link on the box, or the label).
|
|
# imaging NIC = cable to the isolated imaging switch (serves DHCP/PXE/SMB)
|
|
# corp NIC = cable to the GE corporate network (SSH + webapp 9009 only)
|
|
# The playbook changes nothing on the network until both are set, differ,
|
|
# and are both present on the box.
|
|
pxe_nic_mac: "" # e.g. "34:c8:d6:b1:10:10"
|
|
corp_nic_mac: "" # e.g. "20:88:10:af:0d:e5"
|
|
|
|
# Optional: stable interface names (default pxe0 / corp0). Keep a box's
|
|
# existing names instead, e.g. on the WJ server:
|
|
# pxe_nic_name: enx34c8d6b11010
|
|
# corp_nic_name: enp0s31f6
|
|
|
|
# Recommended: who may reach SSH and the webapp (9009) on the corp NIC.
|
|
# Empty = all of GE (a warning every run). See docs/SITE-CUSTOMIZATION.md.
|
|
# corp_admin_cidrs: ["10.134.48.0/24"]
|
|
# Keys only from the GE side (needs ~pxe/.ssh/authorized_keys first):
|
|
# corp_ssh_password_auth: false
|
|
|
|
# Optional: imaging LAN addressing (defaults shown). 172.16.9.1 is also
|
|
# hard-coded in the iPXE menu, startnet.cmd, blancco-preferences.xml and the
|
|
# unattend files; see docs/SITE-CUSTOMIZATION.md before changing it.
|
|
# pxe_server_ip: "172.16.9.1"
|
|
# pxe_subnet: "172.16.9.0/24"
|
|
# pxe_dhcp_start: "172.16.9.10"
|
|
# pxe_dhcp_end: "172.16.9.100"
|
|
# pxe_dhcp_lease: "12h"
|
|
|
|
# Optional: kernel the Blancco UEFI entries boot (must be installed; see
|
|
# scripts/download-packages.sh BLANCCO_KVER).
|
|
# blancco_kver: "7.0.0-34-generic"
|