Object	What
`pxetest-imaging`	libvirt network, bridge `virbr-pxetest`. No `<forward>`, no `<ip>`: the host has no address on it and libvirt runs no DHCP there. Only VM taps are on the bridge.
`default`	libvirt NAT, 192.168.122.0/24. Stands in for the GE/corp network.
`pxetest-server`	2 vCPU, 4 GiB, q35 + OVMF Secure Boot (MS keys), 60G thin qcow2 (`vda`, boot 1), the USB image as a USB disk (`sda`, boot 2).
`pxetest-client`	2 vCPU, 2 GiB, OVMF Secure Boot (MS keys), 1G blank disk, network boot first (UEFI IPv4 PXE, virtio-net, OVMF driver, no option ROM).

NIC MACs (fixed):

VM	NIC	MAC	Network	Playbook var
server	GE	`52:54:00:9e:10:01`	`default` NAT	`corp_nic_mac`
server	imaging	`52:54:00:9e:10:02`	`pxetest-imaging`	`pxe_nic_mac`
client	-	`52:54:00:9e:10:03`	`pxetest-imaging`	-

build-image.sh writes $PXETEST_CACHE/site-vars.yml with these two MACs (pxe_nic_mac, corp_nic_mac) and passes it to build-usb.sh --site-vars, so it lands on CIDATA as playbook/site-vars.yml. The installer brings both NICs up with DHCP; the playbook renames them to pxe0 / corp0 and pins pxe0 to 172.16.9.1.

The disk boots before the USB on purpose: a blank disk falls through to the installer, and after the install the server boots its disk instead of re-running autoinstall. CIDATA stays attached for the first-boot playbook.

Never attach a pxetest VM to a physical NIC, a host bridge with physical ports, or macvtap: the server's dnsmasq serves DHCP/PXE as 172.16.9.1. create.sh, start.sh and status.sh check the isolation and refuse to continue if pxetest-imaging ever gains a <forward>, an <ip>, a host IPv4 address or a non-tap bridge port.

Run it

export PXETEST_CACHE=~/.cache/pxetest               # ISO + image (about 10 GB)
export PXETEST_PAYLOAD_ROOT=/home/camp/projects/pxe  # checkout holding offline-packages/, boot-files/, ...

tests/vm/fetch-iso.sh        # Ubuntu 24.04.5 live-server ISO, SHA256SUMS-verified
tests/vm/build-image.sh      # build-usb.sh --image, upload as volume pxetest-usb.img
tests/vm/create.sh           # network, volumes, both VMs (prints the MAC pins)
tests/vm/start.sh server     # autoinstall, reboot, first-boot playbook
tests/vm/status.sh --shot /tmp/pxetest-shots   # states, leases, screenshots
tests/vm/start.sh client     # once the server playbook is done
tests/vm/stop.sh             # ACPI shutdown both, keep them defined
tests/vm/destroy.sh          # remove every pxetest-* object

build-image.sh skips enrollment/, bios-staging/, drivers-staging/ and boot-tools/ by default; --with-enrollment and --with-boot-tools add them back, --size 20G fixes the image size (default auto). If the host has no sfdisk or mtools, the debs are extracted into $PXETEST_CACHE/tools (no install, no root).

Watch the server with virt-viewer -c qemu:///system pxetest-server (VNC on 127.0.0.1) or screenshots. On the installed system, first-boot output goes to /var/log/first-boot.log. Once the GE NIC takes a DHCP lease on the NAT network, status.sh shows its address and ssh pxe@<address> works from the host.

Memory: server 4 GiB + client 2 GiB. Keep other VMs (win11) off while both run, and stop them when done.