pxe_boot_alma/homelab/README.md

# pxe_boot_alma

AlmaLinux 10 PXE boot and unattended Kickstart deployment for a two-server setup:

- `server1`: PXE host that provides DHCP/TFTP/HTTP boot assets with `dnsmasq`
- `server2`: target host that boots from the network and installs AlmaLinux automatically

This repo is the source of truth for:

- `dnsmasq` configuration
- PXE boot menus
- AlmaLinux Kickstart files
- helper scripts to build and sync boot assets
- replication documentation

## Goal

Boot `server2` from the network, point it at an AlmaLinux 10 install tree hosted by `server1`, and complete installation with a Kickstart file that can also bootstrap your existing `kickstart` and `tools` repos in `%post`.

## Repo Layout

- `dnsmasq/`: sample `dnsmasq` config
- `boot/grub2/`: UEFI GRUB menu example
- `boot/pxelinux.cfg/`: BIOS PXELINUX menu example
- `kickstarts/`: AlmaLinux Kickstart templates
- `scripts/`: helper scripts for ISO extraction and post-install bootstrap
- `docs/`: replication and operating notes

## Current Lab

Current virtual lab values:

- `server1` management NIC: libvirt `default` NAT network
- `server1` PXE NIC: `192.168.50.1/24`
- host access to `pxe-lab`: `virbr1` on `192.168.50.254/24`
- PXE DHCP range: `192.168.50.100-192.168.50.150`
- TFTP root: `/var/lib/tftpboot`
- HTTP root: `/var/www/html`

## High-Level Flow

1. Put the AlmaLinux ISO in this repo root or another local path.
2. Use [`scripts/sync_alma_tree.sh`](/usr/local/valherun/pxe_boot_alma/scripts/sync_alma_tree.sh) to copy the ISO contents into an HTTP-served tree on `server1`.
3. Copy `vmlinuz` and `initrd.img` from the Alma tree into your TFTP directory.
4. Install the sample `dnsmasq` config from [`dnsmasq/dnsmasq.conf.example`](/usr/local/valherun/pxe_boot_alma/dnsmasq/dnsmasq.conf.example) and adjust interface/IP/path values.
5. Use the sample PXE menu files from [`boot/grub2/grub.cfg`](/usr/local/valherun/pxe_boot_alma/boot/grub2/grub.cfg) and [`boot/pxelinux.cfg/default`](/usr/local/valherun/pxe_boot_alma/boot/pxelinux.cfg/default).
6. Customize [`kickstarts/alma10-auto.ks`](/usr/local/valherun/pxe_boot_alma/kickstarts/alma10-auto.ks).
7. Boot `server2` with disk first and PXE second.

The sample Kickstart stores only a salted password hash for `root`, not a plaintext password.

## Existing Repo Integration

The starter Kickstart includes a `%post` phase that can call your current repos:

- `/usr/local/valherun/kickstart`
- `/usr/local/valherun/tools`

The wrapper script is [`scripts/post-install-bootstrap.sh`](/usr/local/valherun/pxe_boot_alma/scripts/post-install-bootstrap.sh). It now prefers calling `kickstart.sh --nounraid --all` after cloning the repos, while exporting the committed password hashes and preferred `CODEX_PUBKEY`, so the installed Alma host inherits the same reusable bootstrap flow as your normal host setup:

- committed SHA-512 password hashes for both `root` and `valherun`
- Docker Engine installation from Docker's official repository
- `valherun` and `codex` membership in the `docker` group
- `kickstart/bash_profiles.sh` deployment for `root` and `valherun` when present
- `tools/bin/install_codex_access.sh` with the preferred `codex` public key
- `tools/bin/update_sshd_config.sh`
- optional `tools/bin/configure_package_caches.sh` via `kickstart.sh --package-cache-url`

The Kickstart `%packages` list and `%post` bootstrap now also seed the same
practical host baseline used by the main `kickstart` repo:

- admin shell tools like `git`, `curl`, `wget`, `sudo`, `bash-completion`, `tmux`
- archive and file helpers like `rsync`, `tree`, `zip`, `unzip`
- search and editing tools like `vim`, `jq`, `ripgrep`
- network and storage helpers like DNS tools, `net-tools`, `parted`, growpart/LVM utilities, and `acl`
- light build/runtime tools like `gcc`, `make`, and `python3-pip`

The bootstrap script pulls `kickstart` and `tools` directly from Gitea over HTTPS, using the proxy on `server1` for the isolated PXE subnet.

To enroll the installed host into apt-cacher-ng during `%post`, export:

```bash
PACKAGE_CACHE_URL=http://your-cache-host:3142
PACKAGE_CACHE_INSTALL_CRON=false
```

This now relies on the updated non-interactive `kickstart.sh --nounraid --all` path instead of duplicating the older interactive `passwd` behavior.

## Current Validation Status

The current virtual lab has completed a full unattended install and reboot for `server2`.

Verified working:

- UEFI PXE with Secure Boot enabled
- `server2` boot order set to `hd` first, `network` second
- post-install clone/bootstrap of:
  - `/usr/local/valherun/kickstart`
  - `/usr/local/valherun/tools`
- direct host access to `server2` over `pxe-lab`
- direct SSH as `codex` with passwordless `sudo`
- direct SSH as `valherun`

Current caveats:

- `valherun` sudo still prompts for a password
- the installed hostname is still the generic `alma10-auto`

## First Files To Edit

Before using this in production, update:

- [`dnsmasq/dnsmasq.conf.example`](/usr/local/valherun/pxe_boot_alma/dnsmasq/dnsmasq.conf.example)
- [`boot/grub2/grub.cfg`](/usr/local/valherun/pxe_boot_alma/boot/grub2/grub.cfg)
- [`boot/pxelinux.cfg/default`](/usr/local/valherun/pxe_boot_alma/boot/pxelinux.cfg/default)
- [`kickstarts/alma10-auto.ks`](/usr/local/valherun/pxe_boot_alma/kickstarts/alma10-auto.ks)
- [`scripts/post-install-bootstrap.sh`](/usr/local/valherun/pxe_boot_alma/scripts/post-install-bootstrap.sh) if you want different bootstrap behavior

## Documentation

- General rebuild guide: [`docs/replication.md`](/usr/local/valherun/pxe_boot_alma/docs/replication.md)
- Exact VM lab steps used on this host: [`docs/virtual-lab.md`](/usr/local/valherun/pxe_boot_alma/docs/virtual-lab.md)