snponly.efi rides the firmware's NII/UNDI stack, and on some NICs that
stack cannot receive unicast frames: DHCP (broadcast) succeeds, then every
ARP reply is lost and the boot.ipxe HTTP fetch times out. Observed on
thebeast's onboard NIC 2026-10-19 -- tcpdump on labmaster showed it
answering every ARP request within microseconds while iPXE re-asked for
ten seconds and gave up. The full build probes native NIC drivers first
and falls back to snp/nii, so hardware that worked before is unaffected.
The data dir is a persistent volume, so copy-if-missing would have kept
serving the old snponly binary forever; image-shipped binaries now replace
on content change (copyIfChanged).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DceLLgGmyS7zTGLaLNjQBd
The arm64 image build died at the iPXE compile: under podman multi-arch
builds the stage runs once per TARGET platform, and the iPXE toolchain
(gcc/perl build system) does not survive qemu-user emulation. The stage
already cross-compiles both bin-x86_64-efi and bin-arm64-efi outputs in
one pass, so it only ever needs to run natively on the build host —
FROM --platform=$BUILDPLATFORM restores the arm64 image without qemu
touching the iPXE build.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V6HNx6cyr4J4CiMGCy1wkF
Kickstart installs on real hardware failed silently — no error reporting,
only 3 progress callbacks, zero log streaming. This overhaul makes every
install fully observable.
Kickstart improvements:
- Error trapping in %pre and %post (trap ERR sends failure details to bastion)
- 12+ granular progress stages (was 3): SSH, hostname, k3s prep, EFI boot, metadata
- Background log streamer: tails %post output and batch-sends to /api/log
- bastion_log() function for explicit log lines from kickstart scripts
Bastion API:
- POST /api/log — receives raw log lines from kickstart (single or batch)
- InstallLogBuffer — per-MAC ring buffer (2000 lines) + file persistence
- GET /api/logs/:mac — now returns log_lines + log_total alongside stages
- SSE /api/logs/:mac/follow — uses named events (event: stage vs event: log)
- Progress events forwarded to labd via bastion-progress WebSocket message
- Post-provision k3s logs routed through progressBus (was console-only)
dnsmasq fixes found during VM testing:
- HTTP Boot filename: ipxe-real.efi → ipxe.efi (leftover from old 2-stage approach)
- pxe-service directives: only in proxy mode (breaks OVMF PXE in full mode)
- PXEClient vendor class echo for UEFI firmware compatibility
Integration tests:
- PXE boot test: blank UEFI VM → dnsmasq → HTTP Boot → iPXE → bastion → install
- ISO boot test: blank VM boots from bastion-generated ISO → same flow
- Shared helpers: pxe-network (no DHCP, nftables fix), pxe-vm (UEFI + ISO boot)
- test-provision.sh: runs both PXE + ISO tests with prerequisite checks
- 250GB sparse QCOW2 disk (LVM layout needs ~204GB)
201 unit tests passing (11 new).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
