ead3314f58
Every server has an imaging NIC (static, the only one that serves DHCP/TFTP/HTTP boot/SMB) and a GE corporate NIC (DHCP client, SSH and the webapp on 9009). The playbook guessed the PXE NIC and the installer put 172.16.9.1/24 on every en* NIC, so a two-NIC box could answer on the GE network. - New per-site vars pxe_nic_mac / corp_nic_mac (required, from playbook/site-vars.yml or -e; template site-vars.example.yml), stable names pxe_nic_name / corp_nic_name (default pxe0 / corp0, overridable), pxe_server_ip, pxe_subnet, DHCP range. pxe_imaging_mac / pxe_ge_mac are derived from them. The play stops before touching anything if a MAC is unset, malformed, duplicated or not on the box (lists the box's NICs). - Heuristic NIC detection and the single-NIC netplan task replaced by a two-NIC netplan template (match macaddress + set-name), installed by pxe-netplan-apply.sh: validate in a scratch root, back up, generate, rename, apply, restore the previous config on any failure. cloud-init network config disabled so it cannot rewrite it. - dnsmasq: /etc/dnsmasq.d/pxe-nic-only.conf from the vars (interface=, except-interface=, no-dhcp-interface=); dnsmasq.conf IP/range from vars. - UFW per interface: imaging NIC 22, 67/udp, 69/udp, 80, 4433, 445, 139, 137/udp, 138/udp, 9009; GE NIC 22 and 9009 only. Old any-interface rules and the stale 9011 rule removed after the new ones are in. - sysctl drop-in: IPv4/IPv6 forwarding off; ip_nonlocal_bind so Apache can bind the imaging IP before the address is up. - Samba [global]: interfaces = 127.0.0.0/8 <imaging NIC>, bind interfaces only. Apache 80 and 4433 on the imaging IP only; 9009 stays on all (TODO: the webapp has no auth). - autoinstall: DHCP only on en*, no static 172.16.9.1; apt geoip off and offline-install fallback now that the corp NIC may have a lease. - Blancco UEFI/Secure Boot: blancco_kver (7.0.0-34-generic) drives the kernel, initramfs and modules builds instead of the running kernel; outputs vmlinuz-ubuntu-70, kexec-initrd-70.img, kmod-<kver>.tar.gz as the menu and blancco-init.sh expect; creates: guards keyed on the full kver. Ubuntu's shimx64.efi.signed published as blancco/shimx64.efi. download-packages.sh adds shim-signed, linux-generic-hwe-24.04 and the pinned linux-image/modules/modules-extra for BLANCCO_KVER. Rendered with the live MACs and names, netplan generate output is identical to the live config; pxe-nic-only.conf and the Samba binding match live directive for directive.
132 lines
3.9 KiB
Plaintext
132 lines
3.9 KiB
Plaintext
# Large binary files — download/build these, don't commit them
|
|
*.deb
|
|
*.zip
|
|
*.wim
|
|
*.iso
|
|
*.efi
|
|
*.sdi
|
|
|
|
# OneDrive download artifacts
|
|
OneDrive_*/
|
|
|
|
# Error folders from OneDrive download
|
|
__*/
|
|
___*.txt
|
|
|
|
# Original OneDrive folder structure (reorganized into autoinstall/ and playbook/)
|
|
WestJeff*/
|
|
|
|
# Duplicate at root (canonical copy in unattend/)
|
|
/FlatUnattendW10.xml
|
|
|
|
# Offline packages (built by download-packages.sh)
|
|
offline-packages/
|
|
|
|
# Boot tool binaries (built by prepare-boot-tools.sh)
|
|
boot-tools/
|
|
# Track the Blancco GRUB config as source-of-truth for grubx64.efi rebuilds.
|
|
# prepare-boot-tools.sh rebuilds grubx64.efi from this file via grub-mkstandalone.
|
|
!boot-tools/blancco/grub-blancco.cfg
|
|
|
|
# WinPE boot files (wimboot, boot.wim, BCD, ipxe.efi, etc.)
|
|
boot-files/
|
|
# Exception: track undionly.kpxe (open-source iPXE BIOS-mode NBP for
|
|
# legacy PXE clients, ~70KB, from boot.ipxe.org). Makes air-gapped USB
|
|
# build self-contained without a separate fetch step.
|
|
!boot-files/undionly.kpxe
|
|
|
|
# Python wheels for offline install (built by download-packages.sh)
|
|
pip-wheels/
|
|
|
|
# Deployment images (imported via webapp or USB)
|
|
geastandardpbr/
|
|
|
|
# OS files
|
|
.DS_Store
|
|
Thumbs.db
|
|
|
|
# Python
|
|
__pycache__/
|
|
*.pyc
|
|
*.pyo
|
|
venv/
|
|
|
|
# MOK Secure Boot signing keys (contains private key)
|
|
mok-keys/
|
|
|
|
# Secrets
|
|
secrets.md
|
|
**/eMxInfo*.txt
|
|
*.ppkg
|
|
enrollment/
|
|
drivers-staging/
|
|
bios-staging/
|
|
.claude/
|
|
|
|
# Secrets and credentials (defensive)
|
|
.env
|
|
.env.*
|
|
!.env.example
|
|
!.env.*.example
|
|
*.pem
|
|
*.key
|
|
id_rsa
|
|
id_rsa.*
|
|
*.ppk
|
|
*.p12
|
|
*.pfx
|
|
secrets.json
|
|
secrets.yaml
|
|
secrets.yml
|
|
*_secret
|
|
*_secrets
|
|
credentials.json
|
|
|
|
# GE-internal WiFi / 802.1X profiles - contain SSID + trusted-root thumbprint.
|
|
# Staged on PXE share at /srv/samba/enrollment/MachineAuth/ and copied to
|
|
# bays during imaging. Never check these into git.
|
|
AESFMA.xml
|
|
8021x.xml
|
|
BLUESSO.xml
|
|
WiFi-Profile.xml
|
|
*.wlanprofile
|
|
*.lanprofile
|
|
|
|
# Pre-staged binary (142 MB) - track via LFS or stage on PXE server, not in regular git
|
|
playbook/shopfloor-setup/Shopfloor/PrinterInstallerMap.exe
|
|
|
|
# Keyence VR-6000 InstallShield payload (560 MB). InstallShield MSIs split
|
|
# the compressed payload into Data1.cab; without it next to the MSI, msiexec
|
|
# exits 1603 with "SECREPAIR: Failed to open Data1.cab" (see
|
|
# /home/camp/pxe-images/keyence/Logs/Keyence/install.log for the signature).
|
|
# Canonical source on the GE-Enforce SFLD share:
|
|
# tsgwp00525\sfld$\v2\shared\dt\shopfloor\gea-shopfloor-keyence\apps\Data1.cab
|
|
# before building the USB image.
|
|
playbook/shopfloor-setup/gea-shopfloor-waxtrace/captured-binary/
|
|
|
|
# Keyence per-model installer payloads - too big for git, staged via sync-keyence.sh
|
|
playbook/shopfloor-setup/gea-shopfloor-keyence/vr3000/installers/Data*.cab
|
|
playbook/shopfloor-setup/gea-shopfloor-keyence/vr3000/installers/*.msi
|
|
playbook/shopfloor-setup/gea-shopfloor-keyence/vr5000/installers/Data*.cab
|
|
playbook/shopfloor-setup/gea-shopfloor-keyence/vr5000/installers/*.msi
|
|
playbook/shopfloor-setup/gea-shopfloor-keyence/vr6000/installers/Data1.cab
|
|
|
|
# Part Marker (Telesis) utility password - secret, deployed via the enrollment
|
|
# share from the working tree, never committed.
|
|
playbook/shopfloor-setup/gea-shopfloor-partmarker/PartMarker/Mark/utilpassword.txt
|
|
|
|
# HeatTreat per-machine DNC .reg exports (6601-6604) - contain DNC FtpPasswd
|
|
# credentials. Deployed via the enrollment share from the working tree.
|
|
playbook/shopfloor-setup/gea-shopfloor-heattreat/reg/*.reg
|
|
|
|
# SIC e10 controller config files carry the programmer/supervisor password
|
|
# in cleartext. Never commit them. See reference/e10/README.md
|
|
reference/e10/**/ConfigCtrl*
|
|
reference/e10/**/*.kind1
|
|
# GE part programs carry part numbers and marking content. Keep them out of
|
|
# git; they live in ~/pxe-images/e10-testing/partprograms/
|
|
reference/e10/partprograms/
|
|
|
|
# Per-site playbook values (NIC MACs); template: playbook/site-vars.example.yml
|
|
playbook/site-vars.yml
|