diff --git a/README.md b/README.md index c262ffb..50a3f81 100644 --- a/README.md +++ b/README.md @@ -62,9 +62,9 @@ The wrapper script is [`scripts/post-install-bootstrap.sh`](/usr/local/valherun/ - `tools/bin/install_codex_access.sh` with the preferred `codex` public key explicitly passed in - `tools/bin/update_sshd_config.sh` -For unattended lab installs, the bootstrap script can pull `kickstart` and `tools` from local tarballs served by `server1` at `/bootstrap/kickstart.tar.gz` and `/bootstrap/tools.tar.gz`, then fall back to Git URLs if those archives are not present. +The bootstrap script pulls `kickstart` and `tools` directly from Gitea over HTTPS, using the proxy on `server1` for the isolated PXE subnet. -This avoids relying on `kickstart.sh --all` for unattended installs, avoids the interactive `passwd` prompt in `kickstart/bin/create_valherun.sh`, and avoids authenticated Git or `sshd` reload dependencies inside the Anaconda `%post` chroot. +This avoids relying on `kickstart.sh --all` for unattended installs and avoids the interactive `passwd` prompt in `kickstart/bin/create_valherun.sh`. ## First Files To Edit diff --git a/docs/replication.md b/docs/replication.md index b0f72d2..322d0ab 100644 --- a/docs/replication.md +++ b/docs/replication.md @@ -109,9 +109,6 @@ Copy the Kickstart file into the HTTP root: ```bash sudo cp kickstarts/alma10-auto.ks /var/www/html/kickstarts/alma10-auto.ks sudo cp scripts/post-install-bootstrap.sh /var/www/html/kickstarts/post-install-bootstrap.sh -sudo install -d -m 755 /var/www/html/bootstrap -sudo tar -C /usr/local/valherun/kickstart -czf /var/www/html/bootstrap/kickstart.tar.gz . -sudo tar -C /usr/local/valherun/tools -czf /var/www/html/bootstrap/tools.tar.gz . ``` The sample Kickstart expects to be reachable at: @@ -251,8 +248,8 @@ The sample Kickstart calls [`scripts/post-install-bootstrap.sh`](/usr/local/valh That script: 1. installs `git`, `curl`, `sudo`, and related basics if missing -2. downloads `/bootstrap/kickstart.tar.gz` from `server1` when available, otherwise clones your `kickstart` repo to `/usr/local/valherun/kickstart` -3. downloads `/bootstrap/tools.tar.gz` from `server1` when available, otherwise clones your `tools` repo to `/usr/local/valherun/tools` +2. clones your `kickstart` repo to `/usr/local/valherun/kickstart` +3. clones your `tools` repo to `/usr/local/valherun/tools` 4. optionally runs: - a local non-interactive `valherun` account bootstrap that mirrors your current SSH keys, sudo policy, and a committed salted password hash - `kickstart/bash_profiles.sh --adduser` @@ -263,7 +260,7 @@ This gives you a second-stage bootstrap after the base OS install is complete. The `valherun` step is handled locally in this repo instead of calling `kickstart/bin/create_valherun.sh` because that upstream helper runs `passwd valherun`, which blocks unattended Kickstart `%post`. The local helper sets `valherun` with a salted SHA-512 password hash and the expected SSH keys. The SSH helpers are run with `--no-reload` so the install does not depend on reloading `sshd` inside the installer chroot. -The PXE bootstrap also pins the preferred `codex` public key directly in [`scripts/post-install-bootstrap.sh`](/usr/local/valherun/pxe_boot_alma/scripts/post-install-bootstrap.sh) so unattended installs do not inherit the fallback key embedded in the shared `tools` helper. +The PXE bootstrap also pins the preferred `codex` public key directly in [`scripts/post-install-bootstrap.sh`](/usr/local/valherun/pxe_boot_alma/scripts/post-install-bootstrap.sh) so unattended installs do not inherit the fallback key embedded in the shared `tools` helper. Those clones run over HTTPS through the proxy on `server1`, so no local tarball mirror is required. The post-install bootstrap also exports proxy variables by default: diff --git a/docs/virtual-lab.md b/docs/virtual-lab.md index b2a3d93..fe5e4ca 100644 --- a/docs/virtual-lab.md +++ b/docs/virtual-lab.md @@ -201,16 +201,7 @@ https_proxy=http://192.168.50.1:3128 During the first unattended `server2` attempt, the install hung at `Running post-install scripts`. The cause was `kickstart/bin/create_valherun.sh`, which calls `passwd valherun` interactively. The PXE bootstrap was then changed to create `valherun` locally and non-interactively inside [`scripts/post-install-bootstrap.sh`](/usr/local/valherun/pxe_boot_alma/scripts/post-install-bootstrap.sh), while still cloning the `kickstart` and `tools` repos for the remaining bootstrap steps. -The next hardening step was to make the `%post` bootstrap fully local to `server1`: - -```bash -sudo install -d -m 755 /var/www/html/bootstrap -sudo tar -C /usr/local/valherun/kickstart -czf /var/www/html/bootstrap/kickstart.tar.gz . -sudo tar -C /usr/local/valherun/tools -czf /var/www/html/bootstrap/tools.tar.gz . -sudo install -m 755 /opt/pxe_boot_alma/scripts/post-install-bootstrap.sh /var/www/html/kickstarts/post-install-bootstrap.sh -``` - -With that change, `server2` no longer depends on authenticated Git access during `%post`, and the SSH helpers are run with `--no-reload` so the install does not rely on `systemctl reload sshd` inside the installer chroot. +The final lab flow uses direct HTTPS clones from Gitea through the `squid` proxy on `server1`. That keeps the PXE subnet isolated without maintaining local tarball mirrors for `kickstart` and `tools`. The SSH helpers are run with `--no-reload` so the install does not rely on `systemctl reload sshd` inside the installer chroot. The PXE bootstrap was also updated to pass the preferred `codex` public key explicitly into `tools/bin/install_codex_access.sh`. That avoids the older fallback `codex@valh-mini` key embedded in the shared helper and keeps unattended installs aligned with the preferred Bitwarden-managed `codex` key. diff --git a/scripts/post-install-bootstrap.sh b/scripts/post-install-bootstrap.sh index dcce19a..c2b8fa5 100755 --- a/scripts/post-install-bootstrap.sh +++ b/scripts/post-install-bootstrap.sh @@ -5,8 +5,6 @@ set -euo pipefail REPO_BASE="${REPO_BASE:-/usr/local/valherun}" KICKSTART_REPO_URL="${KICKSTART_REPO_URL:-https://git.valherun.com/valherun/kickstart.git}" TOOLS_REPO_URL="${TOOLS_REPO_URL:-https://git.valherun.com/valherun/tools.git}" -KICKSTART_ARCHIVE_URL="${KICKSTART_ARCHIVE_URL:-http://192.168.50.1/bootstrap/kickstart.tar.gz}" -TOOLS_ARCHIVE_URL="${TOOLS_ARCHIVE_URL:-http://192.168.50.1/bootstrap/tools.tar.gz}" PROXY_URL="${PROXY_URL:-http://192.168.50.1:3128}" CODEX_PUBKEY="${CODEX_PUBKEY:-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDMqVsgYh2b0a13uiEV2AEhuwAEmih11TiJRPPQN4nln codex}" VALHERUN_PASSWORD_HASH="${VALHERUN_PASSWORD_HASH:-$6$anR29lW6xTJ9$QazuABtsZZBU5CgjurY8nwFdy6MtodW3RdRClug9tGlhjytaMWfvKTvwbm26J6edQENEyUNgoYBTAu/MJwiDl0}" @@ -63,34 +61,6 @@ clone_or_update() { git clone "$url" "$dest" } -fetch_or_clone_repo() { - local archive_url="$1" - local repo_url="$2" - local dest="$3" - local tmp_archive="" - local tmp_dir="" - - mkdir -p "$(dirname "$dest")" - - if curl -fsI "$archive_url" >/dev/null 2>&1; then - rm -rf "$dest" - tmp_archive="$(mktemp)" - tmp_dir="$(mktemp -d)" - - curl -fsSL "$archive_url" -o "$tmp_archive" - tar -xzf "$tmp_archive" -C "$tmp_dir" - shopt -s dotglob - mv "$tmp_dir"/* "$dest" - shopt -u dotglob - - rm -f "$tmp_archive" - rmdir "$tmp_dir" - return - fi - - clone_or_update "$repo_url" "$dest" -} - if [[ $EUID -ne 0 ]]; then echo "This script must run as root." >&2 exit 1 @@ -107,8 +77,8 @@ fi ensure_pkg git curl sudo wget bash-completion -fetch_or_clone_repo "$KICKSTART_ARCHIVE_URL" "$KICKSTART_REPO_URL" "$REPO_BASE/kickstart" -fetch_or_clone_repo "$TOOLS_ARCHIVE_URL" "$TOOLS_REPO_URL" "$REPO_BASE/tools" +clone_or_update "$KICKSTART_REPO_URL" "$REPO_BASE/kickstart" +clone_or_update "$TOOLS_REPO_URL" "$REPO_BASE/tools" if [[ "$INSTALL_VALHERUN" == "true" ]]; then create_valherun_noninteractive