ops: add CI boot-image releases and Unifi PXE rollout

scripts/netboot-serve.sh

@@ -0,0 +1,99 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "${root}"
+
+netboot_root="${EVERY_CHANNEL_NETBOOT_ROOT:-tmp/netboot}"
+http_dir="${netboot_root}/http"
+tftp_dir="${netboot_root}/tftp"
+
+listen_ip="${EVERY_CHANNEL_NETBOOT_LISTEN_IP:-}"
+interface_name="${EVERY_CHANNEL_NETBOOT_INTERFACE:-}"
+proxy_subnet="${EVERY_CHANNEL_NETBOOT_PROXY_SUBNET:-}"
+netboot_hostname="${EVERY_CHANNEL_NETBOOT_HOSTNAME:-}"
+http_port="${EVERY_CHANNEL_NETBOOT_HTTP_PORT:-8080}"
+dnsmasq_port="${EVERY_CHANNEL_NETBOOT_DNS_PORT:-0}"
+
+need_cmd() {
+  local name="$1"
+  if ! command -v "${name}" >/dev/null 2>&1; then
+    echo "error: required command not found: ${name}" >&2
+    exit 2
+  fi
+}
+
+need_cmd dnsmasq
+need_cmd python3
+
+if [[ "$(id -u)" -ne 0 ]]; then
+  echo "error: netboot-serve requires root (TFTP + ProxyDHCP ports)." >&2
+  echo "hint: run with sudo and pass env vars, for example:" >&2
+  echo "  sudo EVERY_CHANNEL_NETBOOT_LISTEN_IP=10.20.30.2 EVERY_CHANNEL_NETBOOT_INTERFACE=eth0 EVERY_CHANNEL_NETBOOT_PROXY_SUBNET=10.20.30.0/24 EVERY_CHANNEL_NETBOOT_HOSTNAME=boot.every.channel ./scripts/netboot-serve.sh" >&2
+  exit 2
+fi
+
+if [[ -z "${listen_ip}" ]]; then
+  echo "error: set EVERY_CHANNEL_NETBOOT_LISTEN_IP (boot server IP on NUC VLAN)" >&2
+  exit 2
+fi
+if [[ -z "${interface_name}" ]]; then
+  echo "error: set EVERY_CHANNEL_NETBOOT_INTERFACE (interface on NUC VLAN)" >&2
+  exit 2
+fi
+if [[ -z "${proxy_subnet}" ]]; then
+  echo "error: set EVERY_CHANNEL_NETBOOT_PROXY_SUBNET (for example 10.20.30.0/24)" >&2
+  exit 2
+fi
+if [[ -z "${netboot_hostname}" ]]; then
+  netboot_hostname="${listen_ip}"
+fi
+
+for required in "${http_dir}/kernel" "${http_dir}/initrd" "${http_dir}/netboot.ipxe" "${tftp_dir}/ipxe.efi"; do
+  if [[ ! -f "${required}" ]]; then
+    echo "error: missing required staged file: ${required}" >&2
+    echo "hint: run ./scripts/netboot-stage.sh first" >&2
+    exit 2
+  fi
+done
+
+run_dir="$(mktemp -d)"
+cleanup() {
+  if [[ -n "${http_pid:-}" ]] && kill -0 "${http_pid}" >/dev/null 2>&1; then
+    kill "${http_pid}" >/dev/null 2>&1 || true
+    wait "${http_pid}" 2>/dev/null || true
+  fi
+  rm -rf "${run_dir}"
+}
+trap cleanup EXIT INT TERM
+
+cat > "${run_dir}/dnsmasq.conf" <<EOF
+port=${dnsmasq_port}
+bind-interfaces
+interface=${interface_name}
+listen-address=${listen_ip}
+log-dhcp
+enable-tftp
+tftp-root=${tftp_dir}
+dhcp-range=${proxy_subnet},proxy
+dhcp-userclass=set:ipxe,iPXE
+dhcp-match=set:efi64,option:client-arch,7
+dhcp-match=set:efi64,option:client-arch,9
+dhcp-option=66,${netboot_hostname}
+dhcp-boot=tag:!ipxe,tag:efi64,ipxe.efi
+dhcp-boot=tag:ipxe,tag:efi64,http://${netboot_hostname}:${http_port}/netboot.ipxe
+dhcp-boot=tag:!ipxe,ipxe.efi
+dhcp-boot=tag:ipxe,http://${netboot_hostname}:${http_port}/netboot.ipxe
+EOF
+
+python3 -m http.server "${http_port}" --bind "${listen_ip}" --directory "${http_dir}" >/tmp/every-channel-netboot-http.log 2>&1 &
+http_pid="$!"
+
+echo "ok: HTTP serving ${http_dir} on http://${listen_ip}:${http_port}/"
+echo "ok: advertised netboot host: ${netboot_hostname}"
+echo "ok: TFTP serving ${tftp_dir} on ${listen_ip}:69"
+echo "ok: ProxyDHCP active for ${proxy_subnet} on interface ${interface_name}"
+echo "ok: Use normal Unifi DHCP for IP assignment; do not configure Unifi DHCP bootfile while proxy mode is active."
+echo
+echo "Press Ctrl+C to stop."
+dnsmasq --no-daemon --conf-file="${run_dir}/dnsmasq.conf"