rollcall/CHANGELOG.md

Changelog

All notable changes to Rollcall. The format follows Keep a Changelog; the release workflow uses the section of the pushed tag as the release notes and refuses to publish a tag that has no section here.

[Unreleased]

Added

• Machine tags (MAAS-style): manual tags per machine, auto tags from match rules over the inventory ({{ gt .Node.GPUs 0 }}), re-evaluated at commissioning and when a tag changes.
• Tags carry a cloud-init fragment merged into deployment user-data (deploy/tags/gpu-nvidia.yaml installs the NVIDIA driver on GPU nodes) and extra overlays for stateless nodes.
• rollcall tag, rollcall tags, rollcall list -tag, deploy tag:NAME / power tag:NAME fan-out; tags column, editor and definitions panel in the web UI; ?tag= filter on the API.
• Web UI redesigned for fleets: sidebar navigation (Overview, Machines, Jobs, Tags, Profiles, OS images), state/tag filter chips, search, sorting and paging, multi-select with bulk power/deploy/assign/tag/re-commission/release, machine detail with tabs, dialog-driven actions, fleet-wide /api/v1/events and /api/v1/jobs, ?token= sign-in for bookmarks.
• Physical location per machine (building, room, rack, unit, asset tag): rollcall location, CSV import matched by id/serial/MAC/node name with dry run, rack definitions with height, list -rack/-room/-building, location column and chips in the UI, Racks page with elevation views, bulk "Set location…", .Node.Rack etc. in templates and tag rules.
• Terminal console: a bare rollcall in a terminal opens a full-screen UI in the llmgw style (Bubble Tea): overview, machines with filter/selection/bulk actions, machine detail, racks with elevation, jobs, events, tags, profiles, OS images; connect screen that saves ~/.config/rollcall/client.json, which the CLI also reads; rollcall tui -dump renders one screen. First Go tests (console rendering and keys).
• Network model after MAAS: fabrics, VLANs, subnets, IP ranges (dynamic/reserved/static) and IPAM; addresses already in use are adopted. rollcall fabric|vlan|subnet|range|ip.
• Interface layouts (physical, bond, VLAN; NICs by selector) per machine or per tag; deployment writes cloud-init network-config and udev name rules into the image; release frees addresses. rollcall layout, rollcall net show|set.
• Region/rack split: rollcall rack (dnsmasq state, per-MAC PXE files, BMC commands, image cache, node API proxy) long-polls the region; the region runs an embedded rack controller. deploy/install-rack.sh, rollcall controllers, rollcall dhcp.
• dnsmasq configuration generated from the model, restarted only when it changes and rolled back if dnsmasq does not come back.
• Web UI: Network page (rack controllers, subnets with ranges and usage, layouts), network tab per machine, layout action; console: Network page, network section, layout action.
• Certificate authority on the region (llmgw-style): HTTPS listener with an auto-renewed region certificate, admin_http policy, /ca.pem; rack controllers enroll with one-time join codes (rollcall controller join-code, rollcall rack join) and use mutual TLS, renewing their certificate themselves; removal revokes; deployed machines and overlays trust the CA; rollcall ca show|issue; the console trusts a CA on first connect after showing its fingerprint.
• Power drivers: ipmi, redfish, idrac, ilo, supermicro, xcc, openbmc, proxmox, manual, run on the rack controller; Redfish auto-detection after commissioning; rollcall bmc, BMC editing in the web UI and console. Lab Redfish emulator with iDRAC/iLO/generic profiles.
• IPv6: subnets, IPAM, dual-stack default layout, per-family default routes, dnsmasq RA/DHCPv6, AAAA host records, IPv6 listen addresses and URLs, IPv6 in the commissioning inventory.
• External IPAM authority (NetBox driver): allocation registers each address in NetBox first and skips addresses others hold there; ownership by tag + rollcall_machine custom field; releases and a periodic reconcile create, fix and delete only Rollcall-owned records; dns_name per address for DNS sync; delegated prefixes (rollcall ipam prefixes|import); rollcall ipam [sync -dry], /api/v1/ipam.
• Web UI: network topology drawing (region, external IPAM, rack controllers, one bus per VLAN with its subnets, machines wired to every VLAN they have an address on; large groups collapse) on the Network page and, compact, on the Overview. Overview redesigned: fleet state bar, per-rack counts, attention list incl. IPAM sync, capacity and free pool, OS, hardware, BMC drivers, locations, tags, recent deployments.
• CA delegation: new roots allow one level of intermediates; rollcall ca intermediate NAME -permit DOMAIN,CIDR [-csr FILE] signs a name-constrained intermediate (for an ACME server such as Caddy's acme_server); rollcall ca rotate -yes replaces a root that cannot delegate; tag fragment deploy/tags/acme-cert.yaml fetches and renews a node certificate with certbot.
• Rack controllers update themselves to the region's version: checksum- and version-checked download over mutual TLS, installed by a root path unit with automatic rollback; rack_binaries for other architectures, auto_update to opt out; versions in rollcall controllers and the web UI.
• Addresses on secondary subnets with a gateway get their own routing table and a source rule in network-config, so replies from a storage or tenant VLAN leave through that VLAN's gateway.
• With admin_http other than allow, browsers that open the web UI over HTTP are redirected to HTTPS (nodes keep HTTP for images and the agent).
• Admin client certificates: rollcall admin-cert request NAME (key stays on the client, CSR only), list, revoke; the region accepts them as admin over HTTPS; CLI/console use them from client.json, the web UI works without a token when the browser presents one (.p12 written).
• deploy/bootstrap.sh: a region on a fresh Debian 13 host. Day 0 needs nothing about the network: packages, PostgreSQL, TFTP tree, config, services and a verified commissioning image, the region reachable on its management address with no DHCP or subnets. Run again with --iface once the provisioning network is known: server address updated, subnet with ranges, DHCP, optional NAT.
• rollcall net discover: per interface link, speed, addresses and implied subnets, switch/port/VLAN from LLDP, DHCP servers that answer, neighbours, and what to do with it.
• commission_append follows server_url when left empty.
• rollcall doctor: checks configuration, database, listeners, certificates, TFTP files, image checksums, dnsmasq, DNS as machines see it, clock, foreign DHCP servers on the provisioning network (DHCPDISCOVER probe), rack controllers, OS images and IPAM, with what to do.
• rollcall version; CD-built binary carries git describe.
• Release notes from CHANGELOG.md.

Fixed

• Rack controllers' dnsmasq had no upstream DNS on Debian (it looks for a resolvconf file that is usually missing) and refused every name outside the cluster domain; the generated configuration now forwards to systemd-resolved's stub (keeping split DNS) or the host's resolv.conf servers.
• Virtual BMC addresses are configured in netplan on the lab PXE server (they were lost on a network reconfigure, which made every BMC call fail).
• Commissioning console no longer shows a failing autologin (noautologin).

[0.1.0] - 2026-10-27

First tagged release.

Added

• Commissioning: Debian 13 live image with firmware, IB and NVMe tooling; hardware inventory (DMI, DIMMs, CPUs, disks, NVMe, NICs, InfiniBand, GPUs, PCI, LLDP, TPM); in-band BMC account creation with out-of-band hints for VMs; secrets sealed with AES-256-GCM; ipmitool server-side.
• Single static Go binary: HTTP API, embedded web UI, CLI, PostgreSQL schema.
• Stateless (Warewulf-style) nodes: profiles, node names and IP pools, rendered overlays, dnsmasq export, Slurm compute image and controller sync.
• OS deployment: image catalog with nightly upstream sync and vendor checksum verification (Debian 13, Ubuntu 24.04, Rocky 9, AlmaLinux 9, CentOS Stream 9), streamed zstd | dd writes with sha256 and live progress, cloud-init NoCloud seed, SELinux relabel, UEFI boot entry, phone-home, release/wipe jobs.
• Gitea Actions: CI, deploy to the PXE server, website publish, release on tags.
• Lab: Proxmox SDN subnet, pve-vbmc IPMI emulator for VMs.