updated pxe config

docs/pxe-boot.md

@@ -11,6 +11,7 @@ The `pxe-boot` host serves HTTP boot assets for iPXE clients.
 - TFTP root for first-stage bootloaders: `/srv/pxe/tftp`
 - iPXE entry script: `/srv/pxe/http/boot.ipxe`
 - Generated iPXE menu: `/srv/pxe/http/menu.ipxe`
+- SystemRescue iPXE script: `/srv/pxe/http/systemrescue.ipxe`
 - TFTP fallback script: `/srv/pxe/tftp/autoexec.ipxe`
 - Boot binaries copied from the Nix `ipxe` package:
   - `/srv/pxe/tftp/ipxe.efi`
@@ -25,6 +26,7 @@ The host creates these directories with systemd tmpfiles:
 /srv/pxe/http
 /srv/pxe/http/images
 /srv/pxe/http/nixos
+/srv/pxe/http/systemrescue
 /srv/pxe/http/ubuntu
 /srv/pxe/http/rescue
 /srv/pxe/tftp
@@ -46,14 +48,28 @@ undionly.kpxe or ipxe.efi
 The generated menu currently exposes entries for:
 
 - NixOS installer
-- Rescue environment
+- SystemRescue environment
 - iPXE shell
 - Reboot
 
-Kernel and initrd artifacts for installer or rescue entries must be placed under
-the matching `/srv/pxe/http/<entry>/` directories by an operator or a separate
-build process. This repository defines the service and menu, not the installer
-images.
+Kernel and initrd artifacts for the NixOS installer entry must be placed under
+`/srv/pxe/http/nixos` by an operator or a separate build process.
+
+The SystemRescue entry expects the source ISO at:
+
+```text
+/srv/pxe/http/images/systemrescue.iso
+```
+
+The `stage-systemrescue.service` oneshot extracts that ISO into:
+
+```text
+/srv/pxe/http/systemrescue
+```
+
+The rescue menu entry then chains `http://192.168.2.247/systemrescue.ipxe`,
+which loads the SystemRescue kernel and initramfs from the extracted tree and
+uses `archiso_http_srv` to fetch the squashfs payload over HTTP.
 
 ## Validation
 
@@ -68,6 +84,9 @@ After deployment by an operator, basic service checks are:
 ```bash
 curl http://pxe-boot/boot.ipxe
 curl http://pxe-boot/menu.ipxe
+curl http://pxe-boot/systemrescue.ipxe
+curl -I http://pxe-boot/systemrescue/sysresccd/boot/x86_64/vmlinuz
+curl -I http://pxe-boot/systemrescue/sysresccd/boot/x86_64/sysresccd.img
 ```
 
 During a successful BIOS chainload, TFTP should deliver `undionly.kpxe` once,

hosts/pxe-boot/configuration.nix

@@ -21,6 +21,47 @@ let
     chain ${pxeBaseUrl}/boot.ipxe
   '';
 
+  systemRescueIpxe = pkgs.writeText "systemrescue.ipxe" ''
+    #!ipxe
+
+    set base ${pxeBaseUrl}
+
+    kernel ''${base}/systemrescue/sysresccd/boot/x86_64/vmlinuz initrd=sysresccd.img archisobasedir=sysresccd archiso_http_srv=''${base}/systemrescue/ ip=dhcp checksum
+    initrd ''${base}/systemrescue/sysresccd/boot/x86_64/sysresccd.img sysresccd.img
+    boot
+  '';
+
+  stageSystemRescue = pkgs.writeShellScript "stage-systemrescue" ''
+    set -eu
+
+    iso="${httpRoot}/images/systemrescue.iso"
+    staged="${httpRoot}/systemrescue"
+    tmp="${httpRoot}/.systemrescue.tmp"
+    previous="${httpRoot}/.systemrescue.previous"
+
+    if [ ! -e "$iso" ]; then
+      echo "SystemRescue ISO not found at $iso; skipping staging."
+      exit 0
+    fi
+
+    rm -rf "$tmp"
+    mkdir -p "$tmp"
+
+    ${pkgs.libarchive}/bin/bsdtar -C "$tmp" -xf "$iso"
+
+    test -f "$tmp/sysresccd/boot/x86_64/vmlinuz"
+    test -f "$tmp/sysresccd/boot/x86_64/sysresccd.img"
+    chmod -R a+rX "$tmp"
+
+    rm -rf "$previous"
+    if [ -e "$staged" ]; then
+      mv "$staged" "$previous"
+    fi
+
+    mv "$tmp" "$staged"
+    rm -rf "$previous"
+  '';
+
   menuIpxe = pkgs.writeText "menu.ipxe" ''
     #!ipxe
 
@@ -40,9 +81,7 @@ let
     boot
 
     :rescue
-    kernel ''${base}/rescue/vmlinuz ip=dhcp
-    initrd ''${base}/rescue/initrd
-    boot
+    chain ''${base}/systemrescue.ipxe
 
     :shell
     shell
@@ -94,16 +133,31 @@ in
     "d ${httpRoot} 0755 root root -"
     "d ${httpRoot}/images 0755 root root -"
     "d ${httpRoot}/nixos 0755 root root -"
+    "d ${httpRoot}/systemrescue 0755 root root -"
     "d ${httpRoot}/ubuntu 0755 root root -"
     "d ${httpRoot}/rescue 0755 root root -"
     "d ${tftpRoot} 0755 root root -"
     "C+ ${httpRoot}/boot.ipxe 0644 root root - ${bootIpxe}"
     "C+ ${httpRoot}/menu.ipxe 0644 root root - ${menuIpxe}"
+    "C+ ${httpRoot}/systemrescue.ipxe 0644 root root - ${systemRescueIpxe}"
     "C+ ${tftpRoot}/autoexec.ipxe 0644 root root - ${autoexecIpxe}"
     "C+ ${tftpRoot}/ipxe.efi 0644 root root - ${pkgs.ipxe}/ipxe.efi"
     "C+ ${tftpRoot}/undionly.kpxe 0644 root root - ${pkgs.ipxe}/undionly.kpxe"
   ];
 
+  systemd.services.stage-systemrescue = {
+    description = "Stage SystemRescue ISO contents for HTTP PXE boot";
+    after = [
+      "local-fs.target"
+      "systemd-tmpfiles-setup.service"
+    ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = stageSystemRescue;
+    };
+  };
+
   services.openssh.settings.PermitRootLogin = "yes";
 
   networking.firewall.allowedTCPPorts = [ 80 ];