Goal

Boot server2 from the network, point it at an AlmaLinux 10 install tree hosted by server1, and complete installation with a Kickstart file that can also bootstrap your existing kickstart and tools repos in %post.

Repo Layout

dnsmasq/: sample dnsmasq config
boot/grub2/: UEFI GRUB menu example
boot/pxelinux.cfg/: BIOS PXELINUX menu example
kickstarts/: AlmaLinux Kickstart templates
scripts/: helper scripts for ISO extraction and post-install bootstrap
docs/: replication and operating notes

Current Lab

Current virtual lab values:

server1 management NIC: libvirt default NAT network
server1 PXE NIC: 192.168.50.1/24
host access to pxe-lab: virbr1 on 192.168.50.254/24
PXE DHCP range: 192.168.50.100-192.168.50.150
TFTP root: /var/lib/tftpboot
HTTP root: /var/www/html

High-Level Flow

Put the AlmaLinux ISO in this repo root or another local path.
Use scripts/sync_alma_tree.sh to copy the ISO contents into an HTTP-served tree on server1.
Copy vmlinuz and initrd.img from the Alma tree into your TFTP directory.
Install the sample dnsmasq config from dnsmasq/dnsmasq.conf.example and adjust interface/IP/path values.
Use the sample PXE menu files from boot/grub2/grub.cfg and boot/pxelinux.cfg/default.
Customize kickstarts/alma10-auto.ks.
Boot server2 with disk first and PXE second.

The sample Kickstart stores only a salted password hash for root, not a plaintext password.

Existing Repo Integration

The starter Kickstart includes a %post phase that can call your current repos:

/usr/local/valherun/kickstart
/usr/local/valherun/tools

The wrapper script is scripts/post-install-bootstrap.sh. It now prefers calling kickstart.sh --nounraid --all after cloning the repos, while exporting the committed password hashes and preferred CODEX_PUBKEY, so the installed Alma host inherits the same reusable bootstrap flow as your normal host setup:

committed SHA-512 password hashes for both root and valherun
Docker Engine installation from Docker's official repository
valherun and codex membership in the docker group
kickstart/bash_profiles.sh deployment for root and valherun when present
tools/bin/install_codex_access.sh with the preferred codex public key
tools/bin/update_sshd_config.sh
optional tools/bin/configure_package_caches.sh via kickstart.sh --package-cache-url

The Kickstart %packages list and %post bootstrap now also seed the same practical host baseline used by the main kickstart repo:

admin shell tools like git, curl, wget, sudo, bash-completion, tmux
archive and file helpers like rsync, tree, zip, unzip
search and editing tools like vim, jq, ripgrep
network and storage helpers like DNS tools, net-tools, parted, growpart/LVM utilities, and acl
light build/runtime tools like gcc, make, and python3-pip

The bootstrap script pulls kickstart and tools directly from Gitea over HTTPS, using the proxy on server1 for the isolated PXE subnet.

To enroll the installed host into apt-cacher-ng during %post, export:

PACKAGE_CACHE_URL=http://your-cache-host:3142
PACKAGE_CACHE_INSTALL_CRON=false

This now relies on the updated non-interactive kickstart.sh --nounraid --all path instead of duplicating the older interactive passwd behavior.

Current Validation Status

The current virtual lab has completed a full unattended install and reboot for server2.

Verified working:

UEFI PXE with Secure Boot enabled
server2 boot order set to hd first, network second
post-install clone/bootstrap of:
- /usr/local/valherun/kickstart
- /usr/local/valherun/tools
direct host access to server2 over pxe-lab
direct SSH as codex with passwordless sudo
direct SSH as valherun

Current caveats:

valherun sudo still prompts for a password
the installed hostname is still the generic alma10-auto

First Files To Edit

Before using this in production, update:

dnsmasq/dnsmasq.conf.example
boot/grub2/grub.cfg
boot/pxelinux.cfg/default
kickstarts/alma10-auto.ks
scripts/post-install-bootstrap.sh if you want different bootstrap behavior

Documentation

General rebuild guide: docs/replication.md
Exact VM lab steps used on this host: docs/virtual-lab.md