Archived
beatzaplentyandClaude Sonnet 5
ff021ca6f7
Check NixOS configurations / eval-hosts (push) Failing after 53m34s
Both check-nixos.yml workflows (GitHub + Gitea) now call scripts/codex-maintenance.sh instead of a hand-rolled eval-only loop, closing a real gap: CI previously enforced none of the secret grep, nixpkgs-fmt, or statix checks that codex-maintenance.sh already runs locally — nothing was stopping that from regressing. One script now backs both, instead of two copies that can drift from each other. codex-maintenance.sh itself is extended to cover buildable surface that wasn't validated anywhere before: packages.x86_64-linux.*, plus config.system.build.tarball (lxc-* hosts) and config.system.build.diskoImagesScript (proxmox-*, excluding the installer's own proxmox-lxc target, which has no disko config). Also: - scripts/prepare-host-key.sh: dropped the redundant [path-to-nixos-repo] parameter — it always defaults to the repo the script itself lives in now, so a second argument never made sense after the nix-auto-installer migration. - Removed prepare.sh (dead pre-disko manual parted/mkfs/mkswap partitioning, fully superseded) and scripts/create-linode-installer-disk.sh (incomplete draft for an abandoned dd-via-rescue-mode approach; Linode hosts already deploy fine through the normal auto-installer flow). - docs/pxe-boot.md: fixed a stale `nixosConfigurations.pxe-boot` eval command (pre-refactor flat name, not a real flake attribute anymore) and added a cross-reference to docs/auto-installer.md. - CLAUDE.md/README.md: full documentation pass reconciling this session's changes — modules/installer/, modules/pxe-boot/, the LXC/Proxmox image-building deployment paths, corrected the password-hash/SSH-key locations in the safety-rules section (both had drifted to reference files/paths that no longer exist), and added session-workflow guidance to prefer targeted host evals over full-repo sweeps for incremental changes (explicitly scoped to interactive sessions, not CI). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot
106 lines
3.2 KiB
Markdown
106 lines
3.2 KiB
Markdown
# pxe-boot
|
|
|
|
The `pxe-boot` host serves HTTP boot assets for iPXE clients — including a
|
|
self-staged copy of this flake's own auto-installer netboot image, see
|
|
`docs/auto-installer.md` for what that image actually is and does once
|
|
booted.
|
|
|
|
## Host Role
|
|
|
|
- Hostname: `pxe-boot`
|
|
- Web service: nginx on TCP port 80
|
|
- PXE root: `/srv/pxe`
|
|
- HTTP root for scripts and images: `/srv/pxe/http`
|
|
- TFTP root for first-stage bootloaders: `/srv/pxe/tftp`
|
|
- iPXE entry script: `/srv/pxe/http/boot.ipxe`
|
|
- Generated iPXE menu: `/srv/pxe/http/menu.ipxe`
|
|
- SystemRescue iPXE script: `/srv/pxe/http/systemrescue.ipxe`
|
|
- TFTP fallback script: `/srv/pxe/tftp/autoexec.ipxe`
|
|
- Boot binaries copied from the Nix `ipxe` package:
|
|
- `/srv/pxe/tftp/ipxe.efi`
|
|
- `/srv/pxe/tftp/undionly.kpxe`
|
|
|
|
## Directory Layout
|
|
|
|
The host creates these directories with systemd tmpfiles:
|
|
|
|
```text
|
|
/srv/pxe
|
|
/srv/pxe/http
|
|
/srv/pxe/http/images
|
|
/srv/pxe/http/nixos
|
|
/srv/pxe/http/systemrescue
|
|
/srv/pxe/http/ubuntu
|
|
/srv/pxe/http/rescue
|
|
/srv/pxe/tftp
|
|
```
|
|
|
|
Mount shared image storage under `/srv/pxe/http`, preferably
|
|
`/srv/pxe/http/images` unless a menu entry expects files in a specific
|
|
directory such as `/srv/pxe/http/nixos`.
|
|
|
|
The HTTP iPXE chain is:
|
|
|
|
```text
|
|
undionly.kpxe or ipxe.efi
|
|
-> autoexec.ipxe from the TFTP root, when iPXE requests it
|
|
-> http://192.168.2.247/boot.ipxe
|
|
-> http://192.168.2.247/menu.ipxe
|
|
```
|
|
|
|
The generated menu currently exposes entries for:
|
|
|
|
- NixOS installer
|
|
- SystemRescue environment
|
|
- iPXE shell
|
|
- Reboot
|
|
|
|
The NixOS installer entry chain-loads `/srv/pxe/http/nixos/netboot.ipxe`,
|
|
which is nixpkgs' own generated netboot iPXE script (correct `init=`/`initrd=`
|
|
kernel parameters included) rather than a hand-rolled boot line — that script
|
|
in turn expects its kernel/initrd siblings in the same directory. All three
|
|
files (`bzImage`, `initrd`, `netboot.ipxe`) are built from this flake's own
|
|
`modules/installer/iso.nix` netboot image (the same one `nix build .#pxe`
|
|
produces) and staged automatically by
|
|
`modules/pxe-boot/stage-installer-artifacts.nix` via `systemd.tmpfiles.rules`
|
|
— no manual operator step required.
|
|
|
|
The SystemRescue entry expects the source ISO at:
|
|
|
|
```text
|
|
/srv/pxe/http/images/systemrescue.iso
|
|
```
|
|
|
|
The `stage-systemrescue.service` oneshot extracts that ISO into:
|
|
|
|
```text
|
|
/srv/pxe/http/systemrescue
|
|
```
|
|
|
|
The rescue menu entry then chains `http://192.168.2.247/systemrescue.ipxe`,
|
|
which loads the SystemRescue kernel and initramfs from the extracted tree and
|
|
uses `archiso_http_srv` to fetch the squashfs payload over HTTP.
|
|
|
|
## Validation
|
|
|
|
Safe evaluation check:
|
|
|
|
```bash
|
|
nix eval .#nixosConfigurations.proxmox-pxe-boot.config.system.build.toplevel.drvPath --raw
|
|
```
|
|
|
|
After deployment by an operator, basic service checks are:
|
|
|
|
```bash
|
|
curl http://pxe-boot/boot.ipxe
|
|
curl http://pxe-boot/menu.ipxe
|
|
curl http://pxe-boot/systemrescue.ipxe
|
|
curl -I http://pxe-boot/systemrescue/sysresccd/boot/x86_64/vmlinuz
|
|
curl -I http://pxe-boot/systemrescue/sysresccd/boot/x86_64/sysresccd.img
|
|
```
|
|
|
|
During a successful BIOS chainload, TFTP should deliver `undionly.kpxe` once,
|
|
then nginx should log requests for `/boot.ipxe` and `/menu.ipxe`. Repeated TFTP
|
|
downloads of `undionly.kpxe` indicate the iPXE stage is still not reaching the
|
|
HTTP chain.
|