andersen/pxe_boot_alma
1
0 Fork 0
mirror of https://git.valherun.com/valherun/pxe_boot_alma.git synced 2026-10-14 18:22:03 -04:00
Code Issues Packages Projects Releases Wiki Activity

Use proxied Git clones for bootstrap

Browse Source
This commit is contained in:
andersen committed 2026-03-08 11:39:19 -04:00
1 parent 230004ad55
commit fe82d242b0
4 files changed
+8 -50
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

README.md
+2 -2
View File
@@ -62,9 +62,9 @@ The wrapper script is [`scripts/post-install-bootstrap.sh`](/usr/local/valherun/
- `tools/bin/install_codex_access.sh` with the preferred `codex` public key explicitly passed in
- `tools/bin/update_sshd_config.sh`
For unattended lab installs, the bootstrap script can pull `kickstart` and `tools` from local tarballs served by `server1` at `/bootstrap/kickstart.tar.gz` and `/bootstrap/tools.tar.gz`, then fall back to Git URLs if those archives are not present.
The bootstrap script pulls `kickstart` and `tools` directly from Gitea over HTTPS, using the proxy on `server1` for the isolated PXE subnet.
This avoids relying on `kickstart.sh --all` for unattended installs, avoids the interactive `passwd` prompt in `kickstart/bin/create_valherun.sh`, and avoids authenticated Git or `sshd` reload dependencies inside the Anaconda `%post` chroot.
This avoids relying on `kickstart.sh --all` for unattended installs and avoids the interactive `passwd` prompt in `kickstart/bin/create_valherun.sh`.
## First Files To Edit
docs/replication.md
+3 -6
View File
@@ -109,9 +109,6 @@ Copy the Kickstart file into the HTTP root:
```bash
sudo cp kickstarts/alma10-auto.ks /var/www/html/kickstarts/alma10-auto.ks
sudo cp scripts/post-install-bootstrap.sh /var/www/html/kickstarts/post-install-bootstrap.sh
sudo install -d -m 755 /var/www/html/bootstrap
sudo tar -C /usr/local/valherun/kickstart -czf /var/www/html/bootstrap/kickstart.tar.gz .
sudo tar -C /usr/local/valherun/tools -czf /var/www/html/bootstrap/tools.tar.gz .
```
The sample Kickstart expects to be reachable at:
@@ -251,8 +248,8 @@ The sample Kickstart calls [`scripts/post-install-bootstrap.sh`](/usr/local/valh
That script:
1. installs `git`, `curl`, `sudo`, and related basics if missing
2. downloads `/bootstrap/kickstart.tar.gz` from `server1` when available, otherwise clones your `kickstart` repo to `/usr/local/valherun/kickstart`
3. downloads `/bootstrap/tools.tar.gz` from `server1` when available, otherwise clones your `tools` repo to `/usr/local/valherun/tools`
2. clones your `kickstart` repo to `/usr/local/valherun/kickstart`
3. clones your `tools` repo to `/usr/local/valherun/tools`
4. optionally runs:
- a local non-interactive `valherun` account bootstrap that mirrors your current SSH keys, sudo policy, and a committed salted password hash
- `kickstart/bash_profiles.sh --adduser`
@@ -263,7 +260,7 @@ This gives you a second-stage bootstrap after the base OS install is complete.
The `valherun` step is handled locally in this repo instead of calling `kickstart/bin/create_valherun.sh` because that upstream helper runs `passwd valherun`, which blocks unattended Kickstart `%post`. The local helper sets `valherun` with a salted SHA-512 password hash and the expected SSH keys. The SSH helpers are run with `--no-reload` so the install does not depend on reloading `sshd` inside the installer chroot.
The PXE bootstrap also pins the preferred `codex` public key directly in [`scripts/post-install-bootstrap.sh`](/usr/local/valherun/pxe_boot_alma/scripts/post-install-bootstrap.sh) so unattended installs do not inherit the fallback key embedded in the shared `tools` helper.
The PXE bootstrap also pins the preferred `codex` public key directly in [`scripts/post-install-bootstrap.sh`](/usr/local/valherun/pxe_boot_alma/scripts/post-install-bootstrap.sh) so unattended installs do not inherit the fallback key embedded in the shared `tools` helper. Those clones run over HTTPS through the proxy on `server1`, so no local tarball mirror is required.
The post-install bootstrap also exports proxy variables by default:
docs/virtual-lab.md
+1 -10
View File
@@ -201,16 +201,7 @@ https_proxy=http://192.168.50.1:3128
During the first unattended `server2` attempt, the install hung at `Running post-install scripts`. The cause was `kickstart/bin/create_valherun.sh`, which calls `passwd valherun` interactively. The PXE bootstrap was then changed to create `valherun` locally and non-interactively inside [`scripts/post-install-bootstrap.sh`](/usr/local/valherun/pxe_boot_alma/scripts/post-install-bootstrap.sh), while still cloning the `kickstart` and `tools` repos for the remaining bootstrap steps.
The next hardening step was to make the `%post` bootstrap fully local to `server1`:
```bash
sudo install -d -m 755 /var/www/html/bootstrap
sudo tar -C /usr/local/valherun/kickstart -czf /var/www/html/bootstrap/kickstart.tar.gz .
sudo tar -C /usr/local/valherun/tools -czf /var/www/html/bootstrap/tools.tar.gz .
sudo install -m 755 /opt/pxe_boot_alma/scripts/post-install-bootstrap.sh /var/www/html/kickstarts/post-install-bootstrap.sh
```
With that change, `server2` no longer depends on authenticated Git access during `%post`, and the SSH helpers are run with `--no-reload` so the install does not rely on `systemctl reload sshd` inside the installer chroot.
The final lab flow uses direct HTTPS clones from Gitea through the `squid` proxy on `server1`. That keeps the PXE subnet isolated without maintaining local tarball mirrors for `kickstart` and `tools`. The SSH helpers are run with `--no-reload` so the install does not rely on `systemctl reload sshd` inside the installer chroot.
The PXE bootstrap was also updated to pass the preferred `codex` public key explicitly into `tools/bin/install_codex_access.sh`. That avoids the older fallback `codex@valh-mini` key embedded in the shared helper and keeps unattended installs aligned with the preferred Bitwarden-managed `codex` key.
scripts/post-install-bootstrap.sh
+2 -32
View File
@@ -5,8 +5,6 @@ set -euo pipefail
REPO_BASE="${REPO_BASE:-/usr/local/valherun}"
KICKSTART_REPO_URL="${KICKSTART_REPO_URL:-https://git.valherun.com/valherun/kickstart.git}"
TOOLS_REPO_URL="${TOOLS_REPO_URL:-https://git.valherun.com/valherun/tools.git}"
KICKSTART_ARCHIVE_URL="${KICKSTART_ARCHIVE_URL:-http://192.168.50.1/bootstrap/kickstart.tar.gz}"
TOOLS_ARCHIVE_URL="${TOOLS_ARCHIVE_URL:-http://192.168.50.1/bootstrap/tools.tar.gz}"
PROXY_URL="${PROXY_URL:-http://192.168.50.1:3128}"
CODEX_PUBKEY="${CODEX_PUBKEY:-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDMqVsgYh2b0a13uiEV2AEhuwAEmih11TiJRPPQN4nln codex}"
VALHERUN_PASSWORD_HASH="${VALHERUN_PASSWORD_HASH:-$6$anR29lW6xTJ9$QazuABtsZZBU5CgjurY8nwFdy6MtodW3RdRClug9tGlhjytaMWfvKTvwbm26J6edQENEyUNgoYBTAu/MJwiDl0}"
@@ -63,34 +61,6 @@ clone_or_update() {
git clone "$url" "$dest"
}
fetch_or_clone_repo() {
local archive_url="$1"
local repo_url="$2"
local dest="$3"
local tmp_archive=""
local tmp_dir=""
mkdir -p "$(dirname "$dest")"
if curl -fsI "$archive_url" >/dev/null 2>&1; then
rm -rf "$dest"
tmp_archive="$(mktemp)"
tmp_dir="$(mktemp -d)"
curl -fsSL "$archive_url" -o "$tmp_archive"
tar -xzf "$tmp_archive" -C "$tmp_dir"
shopt -s dotglob
mv "$tmp_dir"/* "$dest"
shopt -u dotglob
rm -f "$tmp_archive"
rmdir "$tmp_dir"
return
fi
clone_or_update "$repo_url" "$dest"
}
if [[ $EUID -ne 0 ]]; then
echo "This script must run as root." >&2
exit 1
@@ -107,8 +77,8 @@ fi
ensure_pkg git curl sudo wget bash-completion
fetch_or_clone_repo "$KICKSTART_ARCHIVE_URL" "$KICKSTART_REPO_URL" "$REPO_BASE/kickstart"
fetch_or_clone_repo "$TOOLS_ARCHIVE_URL" "$TOOLS_REPO_URL" "$REPO_BASE/tools"
clone_or_update "$KICKSTART_REPO_URL" "$REPO_BASE/kickstart"
clone_or_update "$TOOLS_REPO_URL" "$REPO_BASE/tools"
if [[ "$INSTALL_VALHERUN" == "true" ]]; then
create_valherun_noninteractive