pxe_boot_alma/homelab

pxe_boot_alma

AlmaLinux 10 PXE boot and unattended Kickstart deployment for a two-server setup:

• server1: PXE host that provides DHCP/TFTP/HTTP boot assets with dnsmasq
• server2: target host that boots from the network and installs AlmaLinux automatically

This repo is the source of truth for:

• dnsmasq configuration
• PXE boot menus
• AlmaLinux Kickstart files
• helper scripts to build and sync boot assets
• replication documentation

Goal

Boot server2 from the network, point it at an AlmaLinux 10 install tree hosted by server1, and complete installation with a Kickstart file that can also bootstrap your existing kickstart and tools repos in %post.

Repo Layout

• dnsmasq/: sample dnsmasq config
• boot/grub2/: UEFI GRUB menu example
• boot/pxelinux.cfg/: BIOS PXELINUX menu example
• kickstarts/: AlmaLinux Kickstart templates
• scripts/: helper scripts for ISO extraction and post-install bootstrap
• docs/: replication and operating notes

Current Lab

Current virtual lab values:

• server1 management NIC: libvirt default NAT network
• server1 PXE NIC: 192.168.50.1/24
• host access to pxe-lab: virbr1 on 192.168.50.254/24
• PXE DHCP range: 192.168.50.100-192.168.50.150
• TFTP root: /var/lib/tftpboot
• HTTP root: /var/www/html

High-Level Flow

1. Put the AlmaLinux ISO in this repo root or another local path.
2. Use scripts/sync_alma_tree.sh to copy the ISO contents into an HTTP-served tree on server1.
3. Copy vmlinuz and initrd.img from the Alma tree into your TFTP directory.
4. Install the sample dnsmasq config from dnsmasq/dnsmasq.conf.example and adjust interface/IP/path values.
5. Use the sample PXE menu files from boot/grub2/grub.cfg and boot/pxelinux.cfg/default.
6. Customize kickstarts/alma10-auto.ks.
7. Boot server2 with disk first and PXE second.

The sample Kickstart stores only a salted password hash for root, not a plaintext password.

Existing Repo Integration

The starter Kickstart includes a %post phase that can call your current repos:

• /usr/local/valherun/kickstart
• /usr/local/valherun/tools

The wrapper script is scripts/post-install-bootstrap.sh. It now prefers calling kickstart.sh --nounraid --all after cloning the repos, while exporting the committed password hashes and preferred CODEX_PUBKEY, so the installed Alma host inherits the same reusable bootstrap flow as your normal host setup:

• committed SHA-512 password hashes for both root and valherun
• Docker Engine installation from Docker's official repository
• valherun and codex membership in the docker group
• kickstart/bash_profiles.sh deployment for root and valherun when present
• tools/bin/install_codex_access.sh with the preferred codex public key
• tools/bin/update_sshd_config.sh
• optional tools/bin/configure_package_caches.sh via kickstart.sh --package-cache-url

The Kickstart %packages list and %post bootstrap now also seed the same practical host baseline used by the main kickstart repo:

• admin shell tools like git, curl, wget, sudo, bash-completion, tmux
• archive and file helpers like rsync, tree, zip, unzip
• search and editing tools like vim, jq, ripgrep
• network and storage helpers like DNS tools, net-tools, parted, growpart/LVM utilities, and acl
• light build/runtime tools like gcc, make, and python3-pip

The bootstrap script pulls kickstart and tools directly from Gitea over HTTPS, using the proxy on server1 for the isolated PXE subnet.

To enroll the installed host into apt-cacher-ng during %post, export:

PACKAGE_CACHE_URL=http://your-cache-host:3142
PACKAGE_CACHE_INSTALL_CRON=false

This now relies on the updated non-interactive kickstart.sh --nounraid --all path instead of duplicating the older interactive passwd behavior.

Current Validation Status

The current virtual lab has completed a full unattended install and reboot for server2.

Verified working:

• UEFI PXE with Secure Boot enabled
• server2 boot order set to hd first, network second
• post-install clone/bootstrap of:
  • /usr/local/valherun/kickstart
  • /usr/local/valherun/tools
• direct host access to server2 over pxe-lab
• direct SSH as codex with passwordless sudo
• direct SSH as valherun

Current caveats:

• valherun sudo still prompts for a password
• the installed hostname is still the generic alma10-auto

First Files To Edit

Before using this in production, update:

• dnsmasq/dnsmasq.conf.example
• boot/grub2/grub.cfg
• boot/pxelinux.cfg/default
• kickstarts/alma10-auto.ks
• scripts/post-install-bootstrap.sh if you want different bootstrap behavior

Documentation

• General rebuild guide: docs/replication.md
• Exact VM lab steps used on this host: docs/virtual-lab.md