feat(pxe-boot): add Debian bookworm minimal netboot menu entry

Adds a `fetch-debian-netboot.service` oneshot that downloads the Debian
bookworm netboot kernel and initrd from deb.debian.org on first boot,
stages them under /srv/pxe/http/debian/, and serves them via a generated
debian.ipxe chain script. The service is idempotent — it skips the
download if both files are already present.

Also merges the previously split systemd.tmpfiles.rules and
systemd.services blocks into a single systemd = { ... } attrset to
satisfy statix's repeated-keys lint.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

modules/build-types/pxe-boot.nix

@@ -21,6 +21,39 @@ let
     chain ${pxeBaseUrl}/boot.ipxe
   '';
 
+  debianRelease = "bookworm";
+  debianMirror = "https://deb.debian.org/debian";
+  debianNetbootBase = "${debianMirror}/dists/${debianRelease}/main/installer-amd64/current/images/netboot/debian-installer/amd64";
+
+  debianIpxe = pkgs.writeText "debian.ipxe" ''
+    #!ipxe
+
+    set base ${pxeBaseUrl}
+
+    kernel ''${base}/debian/linux
+    initrd ''${base}/debian/initrd.gz
+    boot
+  '';
+
+  fetchDebianNetboot = pkgs.writeShellScript "fetch-debian-netboot" ''
+    set -eu
+
+    dir="${httpRoot}/debian"
+    mirror="${debianNetbootBase}"
+
+    if [ -f "$dir/linux" ] && [ -f "$dir/initrd.gz" ]; then
+      echo "Debian ${debianRelease} netboot files already present; skipping download."
+      exit 0
+    fi
+
+    echo "Downloading Debian ${debianRelease} netboot kernel and initrd from $mirror ..."
+    ${pkgs.curl}/bin/curl -fsSL -o "$dir/linux.tmp" "$mirror/linux"
+    ${pkgs.curl}/bin/curl -fsSL -o "$dir/initrd.gz.tmp" "$mirror/initrd.gz"
+    mv "$dir/linux.tmp" "$dir/linux"
+    mv "$dir/initrd.gz.tmp" "$dir/initrd.gz"
+    echo "Debian ${debianRelease} netboot files staged."
+  '';
+
   systemRescueIpxe = pkgs.writeText "systemrescue.ipxe" ''
     #!ipxe
 
@@ -70,6 +103,7 @@ let
     menu PXE Boot Menu
     item auto-installer NixOS Auto-Installer
     item nixos-minimal NixOS Minimal
+    item debian Debian Minimal
     item rescue Rescue Environment
     item shell iPXE Shell
     item reboot Reboot
@@ -82,6 +116,9 @@ let
     :nixos-minimal
     chain ''${base}/nixos-minimal/netboot.ipxe
 
+    :debian
+    chain ''${base}/debian.ipxe
+
     :rescue
     chain ''${base}/systemrescue.ipxe
 
@@ -129,34 +166,56 @@ in
     openssh.settings.PermitRootLogin = "yes";
   };
 
-  systemd.tmpfiles.rules = [
-    "d ${pxeRoot} 0755 root root -"
-    "d ${httpRoot} 0755 root root -"
-    "d ${httpRoot}/images 0755 root root -"
-    "d ${httpRoot}/auto-installer 0755 root root -"
-    "d ${httpRoot}/nixos-minimal 0755 root root -"
-    "d ${httpRoot}/systemrescue 0755 root root -"
-    "d ${httpRoot}/ubuntu 0755 root root -"
-    "d ${httpRoot}/rescue 0755 root root -"
-    "d ${tftpRoot} 0755 root root -"
-    "C+ ${httpRoot}/boot.ipxe 0644 root root - ${bootIpxe}"
-    "C+ ${httpRoot}/menu.ipxe 0644 root root - ${menuIpxe}"
-    "C+ ${httpRoot}/systemrescue.ipxe 0644 root root - ${systemRescueIpxe}"
-    "C+ ${tftpRoot}/autoexec.ipxe 0644 root root - ${autoexecIpxe}"
-    "C+ ${tftpRoot}/ipxe.efi 0644 root root - ${pkgs.ipxe}/ipxe.efi"
-    "C+ ${tftpRoot}/undionly.kpxe 0644 root root - ${pkgs.ipxe}/undionly.kpxe"
-  ];
-
-  systemd.services.stage-systemrescue = {
-    description = "Stage SystemRescue ISO contents for HTTP PXE boot";
-    after = [
-      "local-fs.target"
-      "systemd-tmpfiles-setup.service"
+  systemd = {
+    tmpfiles.rules = [
+      "d ${pxeRoot} 0755 root root -"
+      "d ${httpRoot} 0755 root root -"
+      "d ${httpRoot}/images 0755 root root -"
+      "d ${httpRoot}/auto-installer 0755 root root -"
+      "d ${httpRoot}/nixos-minimal 0755 root root -"
+      "d ${httpRoot}/systemrescue 0755 root root -"
+      "d ${httpRoot}/debian 0755 root root -"
+      "d ${httpRoot}/ubuntu 0755 root root -"
+      "d ${httpRoot}/rescue 0755 root root -"
+      "d ${tftpRoot} 0755 root root -"
+      "C+ ${httpRoot}/boot.ipxe 0644 root root - ${bootIpxe}"
+      "C+ ${httpRoot}/menu.ipxe 0644 root root - ${menuIpxe}"
+      "C+ ${httpRoot}/debian.ipxe 0644 root root - ${debianIpxe}"
+      "C+ ${httpRoot}/systemrescue.ipxe 0644 root root - ${systemRescueIpxe}"
+      "C+ ${tftpRoot}/autoexec.ipxe 0644 root root - ${autoexecIpxe}"
+      "C+ ${tftpRoot}/ipxe.efi 0644 root root - ${pkgs.ipxe}/ipxe.efi"
+      "C+ ${tftpRoot}/undionly.kpxe 0644 root root - ${pkgs.ipxe}/undionly.kpxe"
     ];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      Type = "oneshot";
-      ExecStart = stageSystemRescue;
+
+    services = {
+      fetch-debian-netboot = {
+        description = "Download Debian ${debianRelease} netboot kernel and initrd for HTTP PXE boot";
+        after = [
+          "local-fs.target"
+          "systemd-tmpfiles-setup.service"
+          "network-online.target"
+        ];
+        wants = [ "network-online.target" ];
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart = fetchDebianNetboot;
+          RemainAfterExit = true;
+        };
+      };
+
+      stage-systemrescue = {
+        description = "Stage SystemRescue ISO contents for HTTP PXE boot";
+        after = [
+          "local-fs.target"
+          "systemd-tmpfiles-setup.service"
+        ];
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart = stageSystemRescue;
+        };
+      };
     };
   };