ead3314f58
Every server has an imaging NIC (static, the only one that serves DHCP/TFTP/HTTP boot/SMB) and a GE corporate NIC (DHCP client, SSH and the webapp on 9009). The playbook guessed the PXE NIC and the installer put 172.16.9.1/24 on every en* NIC, so a two-NIC box could answer on the GE network. - New per-site vars pxe_nic_mac / corp_nic_mac (required, from playbook/site-vars.yml or -e; template site-vars.example.yml), stable names pxe_nic_name / corp_nic_name (default pxe0 / corp0, overridable), pxe_server_ip, pxe_subnet, DHCP range. pxe_imaging_mac / pxe_ge_mac are derived from them. The play stops before touching anything if a MAC is unset, malformed, duplicated or not on the box (lists the box's NICs). - Heuristic NIC detection and the single-NIC netplan task replaced by a two-NIC netplan template (match macaddress + set-name), installed by pxe-netplan-apply.sh: validate in a scratch root, back up, generate, rename, apply, restore the previous config on any failure. cloud-init network config disabled so it cannot rewrite it. - dnsmasq: /etc/dnsmasq.d/pxe-nic-only.conf from the vars (interface=, except-interface=, no-dhcp-interface=); dnsmasq.conf IP/range from vars. - UFW per interface: imaging NIC 22, 67/udp, 69/udp, 80, 4433, 445, 139, 137/udp, 138/udp, 9009; GE NIC 22 and 9009 only. Old any-interface rules and the stale 9011 rule removed after the new ones are in. - sysctl drop-in: IPv4/IPv6 forwarding off; ip_nonlocal_bind so Apache can bind the imaging IP before the address is up. - Samba [global]: interfaces = 127.0.0.0/8 <imaging NIC>, bind interfaces only. Apache 80 and 4433 on the imaging IP only; 9009 stays on all (TODO: the webapp has no auth). - autoinstall: DHCP only on en*, no static 172.16.9.1; apt geoip off and offline-install fallback now that the corp NIC may have a lease. - Blancco UEFI/Secure Boot: blancco_kver (7.0.0-34-generic) drives the kernel, initramfs and modules builds instead of the running kernel; outputs vmlinuz-ubuntu-70, kexec-initrd-70.img, kmod-<kver>.tar.gz as the menu and blancco-init.sh expect; creates: guards keyed on the full kver. Ubuntu's shimx64.efi.signed published as blancco/shimx64.efi. download-packages.sh adds shim-signed, linux-generic-hwe-24.04 and the pinned linux-image/modules/modules-extra for BLANCCO_KVER. Rendered with the live MACs and names, netplan generate output is identical to the live config; pxe-nic-only.conf and the Samba binding match live directive for directive.
32 lines
1.4 KiB
YAML
32 lines
1.4 KiB
YAML
---
|
|
# Per-site values for pxe_server_setup.yml. Copy to playbook/site-vars.yml
|
|
# (next to the playbook, so it rides on the USB) and fill in. The playbook
|
|
# loads it on first boot; -e on the command line still overrides it.
|
|
# site-vars.yml is git-ignored: each site's MACs stay with that site.
|
|
#
|
|
# REQUIRED: the two NICs, by MAC (ip -br link on the box, or the label).
|
|
# imaging NIC = cable to the isolated imaging switch (serves DHCP/PXE/SMB)
|
|
# corp NIC = cable to the GE corporate network (SSH + webapp 9009 only)
|
|
# The playbook changes nothing on the network until both are set, differ,
|
|
# and are both present on the box.
|
|
pxe_nic_mac: "" # e.g. "34:c8:d6:b1:10:10"
|
|
corp_nic_mac: "" # e.g. "20:88:10:af:0d:e5"
|
|
|
|
# Optional: stable interface names (default pxe0 / corp0). Keep a box's
|
|
# existing names instead, e.g. on the WJ server:
|
|
# pxe_nic_name: enx34c8d6b11010
|
|
# corp_nic_name: enp0s31f6
|
|
|
|
# Optional: imaging LAN addressing (defaults shown). 172.16.9.1 is also
|
|
# hard-coded in the iPXE menu, startnet.cmd, blancco-preferences.xml and the
|
|
# unattend files; see docs/SITE-CUSTOMIZATION.md before changing it.
|
|
# pxe_server_ip: "172.16.9.1"
|
|
# pxe_subnet: "172.16.9.0/24"
|
|
# pxe_dhcp_start: "172.16.9.10"
|
|
# pxe_dhcp_end: "172.16.9.100"
|
|
# pxe_dhcp_lease: "12h"
|
|
|
|
# Optional: kernel the Blancco UEFI entries boot (must be installed; see
|
|
# scripts/download-packages.sh BLANCCO_KVER).
|
|
# blancco_kver: "7.0.0-34-generic"
|