Ilker ManapandClaude Opus 5.5
c8465c235a
CA (llmgw-style) - region creates its CA (ECDSA P-256) and serves API/UI/images over HTTPS on tls_listen with a certificate for every name/address it has (reissued on change or a month before expiry); admin_http policy (allow|loopback|deny) for the admin API over plain HTTP; /ca.pem - rack controllers enroll with one-time join codes (CA fingerprint + secret + expiry + address): rollcall controller join-code, rollcall rack join; mutual TLS from then on, identity from the certificate (CN rack:NAME, serial on record), removal revokes, renewal a month before expiry; the shared rack_secret stays as a legacy fallback - clients: CA from the server config, ROLLCALL_CA, or trusted on first connect in the console after showing the fingerprint (kept in client.json); deployed machines trust it via cloud-init ca_certs (allowed on RHEL-family images), overlays get .CA; rollcall ca show|issue Power drivers - ipmi (cipher/privilege/interface), redfish (system discovery, ResetType from AllowableValues or ActionInfo, boot override with If-Match), idrac, ilo, supermicro, xcc, openbmc, proxmox (API token), manual; executed on the rack controller; Redfish auto-detection after commissioning; operator settings survive recommissioning; rollcall bmc, BMC editing in web UI and console - lab: pve_redfish.py Redfish emulator per Proxmox VM (iDRAC, iLO, generic profiles) IPv6 - IPv6 subnets and IPAM (netip), dual-stack default layout (all subnets of the boot VLAN), per-family default routes, accept-ra off where addresses are planned, dnsmasq RA/DHCPv6 with router lifetime 0 unless the rack is the gateway, AAAA host records from IPAM, IPv6 listen addresses and URLs, rack interfaces and region certificate with IPv6, agent reports IPv6 Tests for CA/join/pinning/CSR signing, Redfish (iDRAC, iLO fallbacks, probe), Proxmox, manual, IPv6 candidates, dual-stack plans and dnsmasq IPv6. Verified in the lab: rack2 enrolled and running on mutual TLS only, revocation and single-use codes; iLO auto-detected through rack2, iDRAC and Proxmox drivers, wrong password not saved; Debian 13 (bond+VLAN), Rocky 9 and AlmaLinux 9 dual-stack with Redfish-driven deployments; CA trusted on Debian and AlmaLinux; admin CLI over HTTPS on IPv4 and IPv6. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
35 lines
1.6 KiB
JSON
35 lines
1.6 KiB
JSON
{
|
|
"listen": ":80",
|
|
"image_dir": "/srv/rollcall/image",
|
|
"tftp_root": "/srv/tftp",
|
|
"database_url": "postgres://rollcall:<PGPASS>@127.0.0.1:5432/rollcall?sslmode=disable",
|
|
"master_key_file": "/etc/rollcall/master.key",
|
|
"admin_token": "<ADMIN-TOKEN: rollcall keygen>",
|
|
"agent_token": "<AGENT-TOKEN: rollcall keygen>",
|
|
"commission_append": "boot=live components fetch=http://10.213.77.1/rollcall/filesystem.squashfs rollcall.server=http://10.213.77.1 noautologin rollcall.token=<AGENT-TOKEN> console=tty0 console=ttyS0,115200n8",
|
|
"ipmitool": "ipmitool",
|
|
"server_url": "http://10.213.77.1",
|
|
"images_dir": "/srv/rollcall/images",
|
|
"overlays_dir": "/etc/rollcall/overlays",
|
|
"dnsmasq_dir": "/var/lib/rollcall/dnsmasq",
|
|
"rack_name": "pxe-server",
|
|
"tls_listen": ":443",
|
|
"tls_names": ["rollcall.example.com"],
|
|
"admin_http": "loopback",
|
|
"os_dir": "/srv/rollcall/os",
|
|
"os_sources": "/etc/rollcall/os-sources.json",
|
|
"node_pools": {"mgmt": "10.213.77.50-10.213.77.99"},
|
|
"cluster_vars": {
|
|
"domain": "pxe.local",
|
|
"cluster_name": "rollcall-lab",
|
|
"slurm_controller": "pxe-server",
|
|
"slurm_controller_ip": "10.213.77.1",
|
|
"partition": "compute",
|
|
"ssh_keys": ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDSAJ4owXlJreHP3sa4HstasxA5pk1ZAPi6vnzOpA5R1 ilker@t440s"]
|
|
},
|
|
"bmc_hints": [
|
|
{"mac": "bc:24:11:8e:1e:6c", "address": "10.213.77.11", "port": 623, "user": "admin", "password": "password", "comment": "pxe-node01 (VM 211, pve-vbmc)"},
|
|
{"mac": "bc:24:11:36:90:3f", "address": "10.213.77.12", "port": 623, "user": "admin", "password": "password", "comment": "pxe-node02 (VM 212, pve-vbmc)"}
|
|
]
|
|
}
|