3 Commits

Include renames

Author	SHA1	Message	Date
Ilker ManapandClaude Opus 5.5	c8465c235a	Region as certificate authority, BMC power drivers, IPv6 ... CA (llmgw-style) - region creates its CA (ECDSA P-256) and serves API/UI/images over HTTPS on tls_listen with a certificate for every name/address it has (reissued on change or a month before expiry); admin_http policy (allow|loopback|deny) for the admin API over plain HTTP; /ca.pem - rack controllers enroll with one-time join codes (CA fingerprint + secret + expiry + address): rollcall controller join-code, rollcall rack join; mutual TLS from then on, identity from the certificate (CN rack:NAME, serial on record), removal revokes, renewal a month before expiry; the shared rack_secret stays as a legacy fallback - clients: CA from the server config, ROLLCALL_CA, or trusted on first connect in the console after showing the fingerprint (kept in client.json); deployed machines trust it via cloud-init ca_certs (allowed on RHEL-family images), overlays get .CA; rollcall ca show|issue Power drivers - ipmi (cipher/privilege/interface), redfish (system discovery, ResetType from AllowableValues or ActionInfo, boot override with If-Match), idrac, ilo, supermicro, xcc, openbmc, proxmox (API token), manual; executed on the rack controller; Redfish auto-detection after commissioning; operator settings survive recommissioning; rollcall bmc, BMC editing in web UI and console - lab: pve_redfish.py Redfish emulator per Proxmox VM (iDRAC, iLO, generic profiles) IPv6 - IPv6 subnets and IPAM (netip), dual-stack default layout (all subnets of the boot VLAN), per-family default routes, accept-ra off where addresses are planned, dnsmasq RA/DHCPv6 with router lifetime 0 unless the rack is the gateway, AAAA host records from IPAM, IPv6 listen addresses and URLs, rack interfaces and region certificate with IPv6, agent reports IPv6 Tests for CA/join/pinning/CSR signing, Redfish (iDRAC, iLO fallbacks, probe), Proxmox, manual, IPv6 candidates, dual-stack plans and dnsmasq IPv6. Verified in the lab: rack2 enrolled and running on mutual TLS only, revocation and single-use codes; iLO auto-detected through rack2, iDRAC and Proxmox drivers, wrong password not saved; Debian 13 (bond+VLAN), Rocky 9 and AlmaLinux 9 dual-stack with Redfish-driven deployments; CA trusted on Debian and AlmaLinux; admin CLI over HTTPS on IPv4 and IPv6. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-28 07:44:13 +01:00
Ilker ManapandClaude Fable 5.1	fad4e1c8bd	OS deployment: image catalog with upstream sync, deploy/release jobs, agent deploy mode, UI and CLI ... - rollcall os list|sync|import|promote|rm: <os_dir>/<name>/<version>/{disk.raw.zst,meta.json}, current symlink, vendor checksum verification (GNU/BSD formats, sha256/sha512), qemu-img -> raw, zstd in-process, keep-N pruning, nightly rollcall-os-sync.timer, deploy/os-sources.json (Debian 13, Ubuntu 24.04, Rocky 9, AlmaLinux 9, CentOS Stream 9) - jobs table + API: deploy (disk pick, hostname/IP allocation, job token, per-MAC deploy PXE entry), release (wipe), progress, cancel, cloud-init phone_home - agent/rollcall-deploy.py: streamed write with sha256 + pv progress, NoCloud seed, SELinux autorelabel, efibootmgr on UEFI; commissioning image gains zstd/parted/xfsprogs/... - web UI: deploy/release controls, deployment card with progress, OS catalog table - README: deployment section, image freshness policy Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-10-27 10:10:39 +01:00
ilkerandClaude Fable 5.1	d9ae89b295	Rollcall: bare-metal commissioning server, agent, image build, lab and CI ... Go server (API, embedded web UI, CLI) backed by PostgreSQL with AES-GCM sealed BMC secrets; Debian live commissioning agent and live-build recipe; Proxmox lab with pve-vbmc virtual BMCs; Gitea workflows for CI, releases and deployment; project website. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-10-27 01:29:53 +01:00