Ilker ManapandClaude Fable 5.1
fad4e1c8bd
- rollcall os list|sync|import|promote|rm: <os_dir>/<name>/<version>/{disk.raw.zst,meta.json},
current symlink, vendor checksum verification (GNU/BSD formats, sha256/sha512), qemu-img -> raw,
zstd in-process, keep-N pruning, nightly rollcall-os-sync.timer, deploy/os-sources.json
(Debian 13, Ubuntu 24.04, Rocky 9, AlmaLinux 9, CentOS Stream 9)
- jobs table + API: deploy (disk pick, hostname/IP allocation, job token, per-MAC deploy PXE
entry), release (wipe), progress, cancel, cloud-init phone_home
- agent/rollcall-deploy.py: streamed write with sha256 + pv progress, NoCloud seed, SELinux
autorelabel, efibootmgr on UEFI; commissioning image gains zstd/parted/xfsprogs/...
- web UI: deploy/release controls, deployment card with progress, OS catalog table
- README: deployment section, image freshness policy
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
130 lines
3.5 KiB
Bash
130 lines
3.5 KiB
Bash
#!/bin/bash
|
|
# Build the Debian 13 commissioning live image with live-build.
|
|
# Run as root on pxe-server. Output: $OUT/{vmlinuz,initrd.img,filesystem.squashfs}
|
|
set -euo pipefail
|
|
SRC=$(cd "$(dirname "$0")" && pwd)
|
|
BUILD=${BUILD:-/srv/rollcall/build}
|
|
OUT=${OUT:-/srv/rollcall/image}
|
|
MIRROR=${MIRROR:-http://deb.debian.org/debian}
|
|
AUTHKEYS=${AUTHKEYS:-/home/ilker/.ssh/authorized_keys}
|
|
|
|
mkdir -p "$BUILD" "$OUT"
|
|
cd "$BUILD"
|
|
if [ -d config ]; then lb clean --purge >/dev/null 2>&1 || true; rm -rf config; fi
|
|
|
|
lb config \
|
|
--distribution trixie --architectures amd64 \
|
|
--archive-areas "main contrib non-free non-free-firmware" \
|
|
--mirror-bootstrap "$MIRROR" --mirror-binary "$MIRROR" \
|
|
--binary-images iso-hybrid --bootloaders syslinux \
|
|
--debian-installer none --memtest none \
|
|
--firmware-chroot true --firmware-binary false \
|
|
--apt-recommends false \
|
|
--bootappend-live "boot=live components quiet" \
|
|
--linux-flavours amd64 \
|
|
--iso-volume "rollcall" --iso-application "rollcall commissioning image" \
|
|
--cache-packages true --cache-indices false
|
|
|
|
# Package set: hardware discovery + BMC + IB + firmware + debugging
|
|
cat > config/package-lists/rollcall.list.chroot <<'EOF'
|
|
linux-image-amd64
|
|
live-boot
|
|
live-config
|
|
live-config-systemd
|
|
systemd-sysv
|
|
systemd-timesyncd
|
|
busybox
|
|
kmod
|
|
pciutils
|
|
usbutils
|
|
dmidecode
|
|
util-linux
|
|
lshw
|
|
ethtool
|
|
iproute2
|
|
isc-dhcp-client
|
|
nvme-cli
|
|
smartmontools
|
|
hdparm
|
|
sg3-utils
|
|
lsscsi
|
|
ipmitool
|
|
freeipmi-tools
|
|
rdma-core
|
|
ibverbs-utils
|
|
infiniband-diags
|
|
mstflint
|
|
lldpd
|
|
python3
|
|
curl
|
|
wget
|
|
ca-certificates
|
|
openssh-server
|
|
openssh-client
|
|
less
|
|
vim-tiny
|
|
procps
|
|
pv
|
|
jq
|
|
mdadm
|
|
lvm2
|
|
efibootmgr
|
|
zstd
|
|
gdisk
|
|
parted
|
|
xfsprogs
|
|
e2fsprogs
|
|
btrfs-progs
|
|
dosfstools
|
|
bash
|
|
firmware-linux
|
|
firmware-linux-nonfree
|
|
firmware-misc-nonfree
|
|
firmware-bnx2
|
|
firmware-bnx2x
|
|
firmware-qlogic
|
|
firmware-realtek
|
|
firmware-cavium
|
|
firmware-netronome
|
|
amd64-microcode
|
|
intel-microcode
|
|
EOF
|
|
|
|
# Files baked into the rootfs
|
|
mkdir -p config/includes.chroot/usr/local/bin config/includes.chroot/etc/systemd/system \
|
|
config/includes.chroot/root/.ssh config/includes.chroot/etc/modules-load.d \
|
|
config/hooks/live
|
|
install -m 0755 "$SRC/rollcall-agent.py" config/includes.chroot/usr/local/bin/rollcall-agent.py
|
|
install -m 0755 "$SRC/rollcall-deploy.py" config/includes.chroot/usr/local/bin/rollcall-deploy.py
|
|
install -m 0644 "$SRC/rollcall-agent.service" config/includes.chroot/etc/systemd/system/rollcall-agent.service
|
|
printf 'ipmi_msghandler\nipmi_devintf\nipmi_si\nipmi_ssif\n' > config/includes.chroot/etc/modules-load.d/ipmi.conf
|
|
if [ -r "$AUTHKEYS" ]; then
|
|
install -m 0600 "$AUTHKEYS" config/includes.chroot/root/.ssh/authorized_keys
|
|
chmod 0700 config/includes.chroot/root/.ssh
|
|
fi
|
|
|
|
cat > config/hooks/live/0100-rollcall.hook.chroot <<'EOF'
|
|
#!/bin/sh
|
|
set -e
|
|
systemctl enable rollcall-agent.service
|
|
systemctl enable lldpd.service
|
|
systemctl enable ssh.service
|
|
# allow root login with key only
|
|
sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
|
|
# lldpd: speak LLDP + CDP so switch ports are discovered quickly
|
|
printf 'configure lldp tx-interval 5\n' > /etc/lldpd.d/rollcall.conf
|
|
echo rollcall > /etc/hostname
|
|
EOF
|
|
chmod +x config/hooks/live/0100-rollcall.hook.chroot
|
|
|
|
echo "=== lb build started $(date)"
|
|
lb build 2>&1 | tee "$BUILD/build.log" | grep -E "^P:|^E:|error" || true
|
|
|
|
for f in vmlinuz initrd.img filesystem.squashfs; do
|
|
src=$(ls binary/live/$f* 2>/dev/null | head -1)
|
|
[ -n "$src" ] || { echo "missing $f in binary/live" >&2; exit 1; }
|
|
install -m 0644 "$src" "$OUT/$f"
|
|
done
|
|
ls -la "$OUT"
|
|
echo "=== done $(date)"
|