7572692b84
KB: Part 4 step 5 (Tools > Share accounts), the Upload-Image password prompt, the new site-vars rows and example, share sign-in without the shipped password, and that a re-run keeps the webapp's share passwords. site-vars examples and SITE-CUSTOMIZATION.md list the new keys. Upload-Image.ps1 lost its CRLF line endings in fa79f76; restored.
71 lines
3.5 KiB
YAML
71 lines
3.5 KiB
YAML
---
|
|
# Per-site values for pxe_server_setup.yml. Copy to playbook/site-vars.yml
|
|
# (next to the playbook, so it rides on the USB) and fill in. The playbook
|
|
# loads it on first boot; -e on the command line still overrides it.
|
|
# site-vars.yml is git-ignored: each site's MACs stay with that site.
|
|
#
|
|
# The NICs, by MAC (ip -br link on the box, or the label). Both optional:
|
|
# pxe_nic_mac imaging NIC = cable to the isolated imaging switch (serves
|
|
# DHCP/PXE/SMB). Empty: the first boot picks the one wired
|
|
# port with a link, if pxe-nic-check calls it isolated, and
|
|
# pins it. So during the install plug in ONLY the imaging
|
|
# switch. If it cannot tell, the console says to log in and
|
|
# run: sudo pxe-pick-nic (pull the imaging cable, plug it in).
|
|
# corp_nic_mac GE corporate NIC (SSH + webapp 9009). Empty: every other
|
|
# wired port is a DHCP client, so GE can be plugged into any
|
|
# of them, now or later. Set: only that port, named corp0.
|
|
pxe_nic_mac: "" # e.g. "34:c8:d6:b1:10:10"
|
|
corp_nic_mac: "" # e.g. "20:88:10:af:0d:e5"
|
|
|
|
# Optional: stable interface names (default pxe0 / corp0). With corp_nic_mac
|
|
# empty, pxe_nic_name must not start with en or eth. With both MACs set a
|
|
# box may keep its existing names, e.g. on the WJ server:
|
|
# pxe_nic_name: enx34c8d6b11010
|
|
# corp_nic_name: enp0s31f6
|
|
|
|
# Recommended: who may reach SSH and the webapp (9009) on the corp NIC.
|
|
# Empty = all of GE (a warning every run). See docs/SITE-CUSTOMIZATION.md.
|
|
# corp_admin_cidrs: ["10.12.34.0/24"]
|
|
# Keys only from the GE side (needs ~pxe/.ssh/authorized_keys first):
|
|
# corp_ssh_password_auth: false
|
|
|
|
# Optional: imaging LAN addressing (defaults shown). 172.16.9.1 is also
|
|
# hard-coded in the iPXE menu, startnet.cmd, blancco-preferences.xml and the
|
|
# unattend files; see docs/SITE-CUSTOMIZATION.md before changing it.
|
|
# pxe_server_ip: "172.16.9.1"
|
|
# pxe_subnet: "172.16.9.0/24"
|
|
# pxe_dhcp_start: "172.16.9.10"
|
|
# pxe_dhcp_end: "172.16.9.100"
|
|
# pxe_dhcp_lease: "12h"
|
|
|
|
# Optional: kernel the Blancco UEFI entries boot (must be installed; see
|
|
# scripts/download-packages.sh BLANCCO_KVER).
|
|
# blancco_kver: "7.0.0-34-generic"
|
|
|
|
# Recommended: the password of the Samba account "clonezilla", which can
|
|
# open only the [clonezilla] share (Clonezilla back up / restore by machine
|
|
# number). The iPXE menu carries it, so treat it as an imaging-LAN secret,
|
|
# not a real one. 8-64 characters from A-Z a-z 0-9 . _ ~ - (default
|
|
# "clonezilla-backup").
|
|
# clonezilla_smb_password: "change-me-per-site"
|
|
|
|
# Required: the password of the server's own login pxe (console, SSH and
|
|
# sudo), 8-128 characters. The install stops while the box still has the
|
|
# shipped "pxe"; every run sets it when it differs.
|
|
pxe_admin_password: ""
|
|
|
|
# Recommended: the passwords of the share logins pxe-upload (WinPE and Shop
|
|
# Floor setup on every PC, Upload-Image.ps1) and blancco (erasure reports).
|
|
# Same rules as clonezilla_smb_password. These three only seed the webapp
|
|
# (Tools > Share accounts) for an account it does not hold yet; after that a
|
|
# change goes through the webapp page, and a re-run keeps what it holds.
|
|
# pxe_upload_password: "change-me-per-site"
|
|
# blancco_smb_password: "change-me-per-site"
|
|
|
|
# Recommended: the site name stamped on Blancco erasure reports and the
|
|
# monthly CMMC evidence packs (empty: "Unnamed site"). Letters, digits,
|
|
# spaces and . , - ( ) & / only.
|
|
# site_name: "Example Site"
|
|
# Optional: time zone of the server clock and the webapp (tz database name).
|
|
# site_timezone: "America/New_York"
|