End-to-end fixes for Blancco Drive Eraser PXE flow uncovered by chasing
"reports never reach SMB share" across two air-gapped sites:
playbook/blancco-init.sh:
* Drop silent || true on wget of preferences.xml + config.xml. Fail
loud with shell-drop if download or marker grep fails. Background:
airootfs /opt/scripts/validate_preferences.sh restores
/albus/preferences.save (factory defaults, empty network_share) if
xmllint fails. wget failure made every report silently land nowhere.
* Clobber /albus/preferences.save with the same served file so even if
the validator fallback fires, the SMB target survives.
* Bind-mount /dev/null over /sys/power/{state,disk,mem_sleep,autosleep}
before switch_root. Albus's license-retry path writes /sys/power/state
directly (bypassing systemd targets); this is the last-line block.
* /dev/null symlinks for sleep/suspend/hibernate systemd targets in the
airootfs overlay + logind drop-in with IdleAction/Handle*=ignore.
Three independent layers because cmdline systemd.mask alone is bypassed
by direct /sys/power/state writes.
* xinitrc.d/00-no-screen-blank.sh runs xset s off -dpms + setterm
-blank 0 -powerdown 0 so the Blancco GUI doesn't blank during long
erasures.
* Removed the 20-failsafeDriver.conf "modesetting" pin. modesetting
needs DRM/KMS which we disable on kernel cmdline; "vesa" also failed
on NVIDIA. With the pin gone Xorg auto-picks fbdev which uses the
kernel framebuffer from vga=normal - works across Intel, AMD, and
older NVIDIA without nouveau.
playbook/pxe_server_setup.yml:
* dnsmasq.conf: explicit empty-value dhcp-option=3 + dhcp-option=6.
Without them, dnsmasq defaults to sending its own IP as router AND
DNS. Commenting the configured-value lines did NOT disable the push
(root cause of "wired keeps picking up 10.9.100.1 as gateway").
* Split the Blancco config.img extraction and preferences.xml deploy
into separate tasks. The previous shell-with-creates: gate caused
playbook re-runs to skip the prefs deploy entirely after first run.
* Added a validation task that runs python3 xml parse + grep on the
deployed preferences.xml to fail the playbook at deploy time if the
SMB markers are missing.
* Added Environment=TZ=America/New_York to the pxe-webapp systemd
service so report mtimes and audit log render in Eastern time even
if the Python process is started before timedatectl converges.
webapp:
* services/blancco_report.py: parse Blancco's XML report format
(recursive <entries name="..."> walker) into a friendly dict.
* templates/report_view.html: Bootstrap "Drive Erasure Certificate"
layout - hero summary, customer + system cards, per-drive cards with
step-by-step erasure timeline, document signing footer with
integrity hash detail.
* /reports/view/<filename> route + View button on the reports list
(XML reports only; PDFs still download).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
116 lines
4.2 KiB
HTML
116 lines
4.2 KiB
HTML
{% extends "base.html" %}
|
|
{% block title %}Blancco Reports - PXE Server Manager{% endblock %}
|
|
|
|
{% block content %}
|
|
<div class="d-flex justify-content-between align-items-center mb-4">
|
|
<h2 class="mb-0">Blancco Erasure Reports</h2>
|
|
<span class="badge bg-secondary fs-6">{{ reports|length }} report{{ 's' if reports|length != 1 }}</span>
|
|
</div>
|
|
|
|
<div class="card">
|
|
<div class="card-header d-flex align-items-center">
|
|
Drive Erasure Certificates
|
|
</div>
|
|
<div class="card-body p-0">
|
|
{% if reports %}
|
|
<table class="table table-hover mb-0">
|
|
<thead class="table-light">
|
|
<tr>
|
|
<th>Filename</th>
|
|
<th>Type</th>
|
|
<th>Size</th>
|
|
<th>Date</th>
|
|
<th class="text-end">Actions</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
{% for r in reports %}
|
|
<tr>
|
|
<td><code>{{ r.filename }}</code></td>
|
|
<td><span class="badge bg-info text-dark">{{ r.type }}</span></td>
|
|
<td>
|
|
{% if r.size > 1048576 %}
|
|
{{ "%.1f"|format(r.size / 1048576) }} MB
|
|
{% else %}
|
|
{{ "%.1f"|format(r.size / 1024) }} KB
|
|
{% endif %}
|
|
</td>
|
|
<td>{{ r.modified | timestamp_fmt }}</td>
|
|
<td class="text-end text-nowrap">
|
|
{% if r.filename.lower().endswith('.xml') %}
|
|
<a href="{{ url_for('blancco_view_report', filename=r.filename) }}"
|
|
class="btn btn-sm btn-outline-success" title="View formatted report">
|
|
View
|
|
</a>
|
|
{% endif %}
|
|
<a href="{{ url_for('blancco_download_report', filename=r.filename) }}"
|
|
class="btn btn-sm btn-outline-primary" title="Download">
|
|
Download
|
|
</a>
|
|
<button type="button" class="btn btn-sm btn-outline-danger"
|
|
data-bs-toggle="modal" data-bs-target="#deleteModal"
|
|
data-filename="{{ r.filename }}" title="Delete">
|
|
Delete
|
|
</button>
|
|
</td>
|
|
</tr>
|
|
{% endfor %}
|
|
</tbody>
|
|
</table>
|
|
{% else %}
|
|
<div class="text-center text-muted py-5">
|
|
<p class="mt-2">No erasure reports yet.</p>
|
|
<p class="small">Reports will appear here after Blancco Drive Eraser completes a wipe.</p>
|
|
</div>
|
|
{% endif %}
|
|
</div>
|
|
</div>
|
|
|
|
<div class="card mt-3">
|
|
<div class="card-body">
|
|
<h6 class="card-title">Report Storage</h6>
|
|
<p class="card-text mb-1">
|
|
Blancco Drive Eraser saves erasure certificates to the network share
|
|
<code>\\10.9.100.1\blancco-reports</code>.
|
|
</p>
|
|
<p class="card-text mb-0 text-muted">
|
|
Reports are generated automatically after each drive wipe and contain proof of erasure for compliance and audit purposes.
|
|
</p>
|
|
</div>
|
|
</div>
|
|
|
|
<!-- Delete Confirmation Modal -->
|
|
<div class="modal fade" id="deleteModal" tabindex="-1">
|
|
<div class="modal-dialog">
|
|
<div class="modal-content">
|
|
<form id="deleteForm" method="post">
|
|
<input type="hidden" name="_csrf_token" value="{{ csrf_token() }}">
|
|
<div class="modal-header">
|
|
<h5 class="modal-title">Confirm Delete</h5>
|
|
<button type="button" class="btn-close" data-bs-dismiss="modal"></button>
|
|
</div>
|
|
<div class="modal-body">
|
|
<p>Are you sure you want to delete <strong id="deleteFilename"></strong>?</p>
|
|
<p class="text-muted mb-0">Erasure reports may be needed for compliance audits. This action cannot be undone.</p>
|
|
</div>
|
|
<div class="modal-footer">
|
|
<button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
|
|
<button type="submit" class="btn btn-danger">Delete</button>
|
|
</div>
|
|
</form>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
{% endblock %}
|
|
|
|
{% block extra_scripts %}
|
|
<script>
|
|
document.getElementById('deleteModal').addEventListener('show.bs.modal', function (event) {
|
|
var btn = event.relatedTarget;
|
|
var filename = btn.getAttribute('data-filename');
|
|
document.getElementById('deleteFilename').textContent = filename;
|
|
document.getElementById('deleteForm').action = '/reports/delete/' + encodeURIComponent(filename);
|
|
});
|
|
</script>
|
|
{% endblock %}
|