fix: Cilium multi-node support — auto-detect NIC, k3s agent API port, worker label

- Remove hardcoded devices/directRoutingDevice from Cilium install (let
  Cilium auto-detect per node — needed for heterogeneous NICs like eno1 vs enP7s7)
- Set k8sServiceHost=127.0.0.1 k8sServicePort=6444 so Cilium init
  containers can reach the API via k3s agent's local LB proxy
- Add node-role.kubernetes.io/worker label to agent config

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitignore

@@ -23,3 +23,7 @@ node_modules/
 
 # OS specific
 .DS_Store
+
+# Task files
+# tasks.json
+# tasks/ 

bastion/completions/labctl.bash

@@ -49,6 +49,9 @@ _labctl() {
     "app k3s list")
       COMPREPLY=($(compgen -W "--user -h --help" -- "$cur"))
       return ;;
+    "app k3s kubeconfig")
+      COMPREPLY=($(compgen -W "--user --context --print -h --help" -- "$cur"))
+      return ;;
     "init bastion")
       COMPREPLY=($(compgen -W "standalone -h --help" -- "$cur"))
       return ;;
@@ -61,11 +64,17 @@ _labctl() {
     "provision reprovision")
       COMPREPLY=($(compgen -W "--role --os --disk -h --help" -- "$cur"))
       return ;;
+    "provision debug")
+      COMPREPLY=($(compgen -W "--pxe-boot -h --help" -- "$cur"))
+      return ;;
     "provision forget")
       COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
       return ;;
+    "provision register")
+      COMPREPLY=($(compgen -W "--role --ip -h --help" -- "$cur"))
+      return ;;
     "provision logs")
-      COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
+      COMPREPLY=($(compgen -W "-f --follow -h --help" -- "$cur"))
       return ;;
     "provision makeiso")
       COMPREPLY=($(compgen -W "--arch --local --out -h --help" -- "$cur"))
@@ -86,7 +95,7 @@ _labctl() {
       COMPREPLY=($(compgen -W "deploy status -h --help" -- "$cur"))
       return ;;
     "app k3s")
-      COMPREPLY=($(compgen -W "install health list -h --help" -- "$cur"))
+      COMPREPLY=($(compgen -W "install health list kubeconfig -h --help" -- "$cur"))
       return ;;
     "version")
       COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
@@ -95,7 +104,7 @@ _labctl() {
       COMPREPLY=($(compgen -W "bastion -h --help" -- "$cur"))
       return ;;
     "provision")
-      COMPREPLY=($(compgen -W "list install reprovision forget logs makeiso -h --help" -- "$cur"))
+      COMPREPLY=($(compgen -W "list install reprovision debug forget register logs makeiso -h --help" -- "$cur"))
       return ;;
     "config")
       COMPREPLY=($(compgen -W "list get set path -h --help" -- "$cur"))

bastion/completions/labctl.fish

@@ -122,7 +122,9 @@ complete -c labctl -n "__labctl_in_cmd init bastion standalone stop" -l dir -d '
 complete -c labctl -n "__labctl_using_cmd provision" -a list -d 'List all known machines'
 complete -c labctl -n "__labctl_using_cmd provision" -a install -d 'Queue a discovered machine for OS installation'
 complete -c labctl -n "__labctl_using_cmd provision" -a reprovision -d 'Queue install + SSH reboot into PXE (target: hostname, MAC, or IP)'
+complete -c labctl -n "__labctl_using_cmd provision" -a debug -d 'PXE boot into Fedora rescue mode for debugging (target: hostname, MAC, or IP)'
 complete -c labctl -n "__labctl_using_cmd provision" -a forget -d 'Remove a machine from bastion state'
+complete -c labctl -n "__labctl_using_cmd provision" -a register -d 'Register an already-installed machine (e.g. after state loss)'
 complete -c labctl -n "__labctl_using_cmd provision" -a logs -d 'Show provisioning logs for a machine (hostname, MAC, or IP)'
 complete -c labctl -n "__labctl_using_cmd provision" -a makeiso -d 'Generate a UEFI-bootable iPXE ISO for network provisioning'
 
@@ -136,6 +138,16 @@ complete -c labctl -n "__labctl_in_cmd provision reprovision" -l role -d 'Machin
 complete -c labctl -n "__labctl_in_cmd provision reprovision" -l os -d 'Operating system' -xa 'fedora-43 ubuntu-26.04'
 complete -c labctl -n "__labctl_in_cmd provision reprovision" -l disk -d 'Target disk device (auto-detect if omitted)' -x
 
+# provision debug options
+complete -c labctl -n "__labctl_in_cmd provision debug" -l pxe-boot -d 'Boot installed system via PXE (kernel+initrd from network, root from NVMe)'
+
+# provision register options
+complete -c labctl -n "__labctl_in_cmd provision register" -l role -d 'Machine role' -xa 'vanilla worker infra labcontroller'
+complete -c labctl -n "__labctl_in_cmd provision register" -l ip -d 'Machine IP address' -x
+
+# provision logs options
+complete -c labctl -n "__labctl_in_cmd provision logs" -s f -l follow -d 'Follow log output in real-time'
+
 # provision makeiso options
 complete -c labctl -n "__labctl_in_cmd provision makeiso" -l arch -d 'Target architecture(s)' -xa 'x86_64 aarch64'
 complete -c labctl -n "__labctl_in_cmd provision makeiso" -l local -d 'Build ISO locally instead of using bastion-hosted URL'
@@ -172,6 +184,7 @@ complete -c labctl -n "__labctl_in_cmd app labcontroller status" -l user -d 'SSH
 complete -c labctl -n "__labctl_using_cmd app k3s" -a install -d 'Install k3s on a target machine (hostname, IP, or MAC)'
 complete -c labctl -n "__labctl_using_cmd app k3s" -a health -d 'Check k3s health (all hosts if no target given)'
 complete -c labctl -n "__labctl_using_cmd app k3s" -a list -d 'List installed machines and their k3s status'
+complete -c labctl -n "__labctl_using_cmd app k3s" -a kubeconfig -d 'Fetch kubeconfig from a target and merge into ~/.kube/config'
 
 # app k3s install options
 complete -c labctl -n "__labctl_in_cmd app k3s install" -l role -d 'k3s role: infra (server) or worker (agent)' -x
@@ -185,3 +198,8 @@ complete -c labctl -n "__labctl_in_cmd app k3s health" -l user -d 'SSH user' -x
 # app k3s list options
 complete -c labctl -n "__labctl_in_cmd app k3s list" -l user -d 'SSH user' -x
 
+# app k3s kubeconfig options
+complete -c labctl -n "__labctl_in_cmd app k3s kubeconfig" -l user -d 'SSH user' -x
+complete -c labctl -n "__labctl_in_cmd app k3s kubeconfig" -l context -d 'Context name (defaults to hostname)' -x
+complete -c labctl -n "__labctl_in_cmd app k3s kubeconfig" -l print -d 'Print kubeconfig to stdout instead of merging'
+

bastion/docs/ARCHITECTURE.md

@@ -0,0 +1,431 @@
+# Lab Platform Architecture
+
+## Overview
+
+A bare-metal and hybrid cloud infrastructure platform for automated machine provisioning, Kubernetes cluster management, and fleet operations. The platform discovers hardware via PXE boot, installs operating systems unattended, deploys k3s clusters, and provides centralized management through a CLI and API.
+
+**Components:**
+- **bastion** -- PXE boot server (DHCP/TFTP/HTTP) for machine discovery and OS installation
+- **labd** -- Master daemon for multi-bastion aggregation, persistent state, agent management
+- **labctl** -- CLI tool for operators (kubectl-style interface)
+- **lab-agent** -- Daemon on provisioned servers for remote execution and monitoring
+- **modules** -- Declarative configuration system (k3s, labcontroller)
+
+---
+
+## Architecture
+
+```
+                           labctl (CLI)
+                               |
+                        labd (master daemon)
+                        /    |    \
+                  bastion1  bastion2  ...     (PXE provisioning)
+                    /   \      |
+              [machines]  [machines]           (bare metal)
+                  |           |
+              lab-agent   lab-agent            (remote exec)
+```
+
+### Communication Patterns
+
+| Path | Protocol | Auth |
+|------|----------|------|
+| labctl -> labd | HTTP/HTTPS | mTLS cert (future: token) |
+| bastion -> labd | WebSocket | Join token enrollment |
+| lab-agent -> labd | WebSocket | mTLS certificate |
+| machine -> bastion | HTTP | None (local network) |
+| Anaconda -> bastion | HTTP + UDP syslog | None (install-time) |
+| labctl -> bastion | HTTP | None (standalone mode) |
+
+### Standalone vs Centralized
+
+The bastion can operate in two modes:
+
+1. **Standalone** -- single bastion, state in local JSON file, CLI talks directly to bastion HTTP API
+2. **Centralized** -- bastion registers with labd via WebSocket, state aggregated in CockroachDB, CLI talks to labd which routes commands to the correct bastion
+
+---
+
+## Machine Lifecycle
+
+```
+                     PXE boot
+                        |
+               +--------v--------+
+               |    DISCOVERED   |  Hardware inventory collected
+               +---------+-------+
+                         |
+              labctl provision install
+                         |
+               +---------v-------+
+               |  INSTALL_QUEUE  |  Waiting for next PXE boot
+               +---------+-------+
+                         |
+                   PXE boot (Anaconda)
+                         |
+               +---------v-------+
+               |   INSTALLING    |  Progress: partitioning -> packages -> post-install
+               +---------+-------+
+                         |
+               +---------v-------+
+               |    INSTALLED    |  OS ready, SSH accessible
+               +---------+-------+
+                         |
+              labctl app k3s install
+                         |
+               +---------v-------+
+               |   K3S RUNNING   |  Kubernetes node operational
+               +--------+--------+
+                        |
+              labctl provision reprovision
+                        |
+                   (back to INSTALL_QUEUE)
+```
+
+Side paths:
+- **DEBUG** -- `labctl provision debug` boots Anaconda rescue mode for diagnostics
+- **FORGET** -- `labctl provision forget` removes machine from all state
+
+---
+
+## Packages
+
+### Monorepo Structure
+
+TypeScript ESM monorepo with pnpm workspaces. Six packages:
+
+| Package | Role | Key Tech |
+|---------|------|----------|
+| `@lab/shared` | Types, protocol, constants | - |
+| `@lab/bastion` | PXE server | Fastify, dnsmasq |
+| `@lab/cli` | CLI binary | Commander.js |
+| `@lab/labd` | Master daemon | Fastify, Prisma, CockroachDB |
+| `@lab/agent` | Server agent | WebSocket |
+| `@lab/modules` | Config modules | SSH, k8s-client |
+
+### @lab/shared
+
+Core type system shared by all packages.
+
+**State Model:**
+```typescript
+interface BastionState {
+  discovered:    Record<MAC, HardwareInfo>
+  install_queue: Record<MAC, InstallConfig>
+  installed:     Record<MAC, InstalledInfo>
+  debug:         Record<MAC, DebugConfig>
+}
+```
+
+**Roles:**
+- `vanilla` -- OS only, no k3s, no cluster services
+- `worker` -- k3s agent + Longhorn storage (joins existing cluster)
+- `infra` -- k3s server + etcd (control plane node)
+- `labcontroller` -- infra + bastion + labd + CockroachDB (self-sufficient)
+
+**OS Support:**
+- `fedora-43` -- Anaconda kickstart installer
+- `ubuntu-26.04` -- cloud-init autoinstall
+
+**Protocol:** Discriminated union message types for WebSocket communication between agents, bastions, and labd. Type guards and parsers for runtime validation.
+
+### @lab/bastion
+
+PXE boot server that handles the physical provisioning lifecycle.
+
+**Services:**
+- `StateManager` -- JSON file persistence with immutable update pattern
+- `SyslogListener` -- UDP syslog receiver (port 5514) for Anaconda install logs
+- `InstallLogBuffer` -- In-memory ring buffer + disk persistence per machine
+- `BastionConnection` -- WebSocket client to labd for centralized mode
+- dnsmasq management (spawn, config generation, proxy/full DHCP)
+- Network auto-detection (interface, IP, subnet, gateway)
+- ISO builder (xorriso + mtools for non-PXE machines)
+
+**HTTP Routes:**
+
+| Endpoint | Purpose |
+|----------|---------|
+| `GET /dispatch?mac=` | Dynamic iPXE script (discover/install/debug/local-boot) |
+| `GET /ks?mac=` | Per-machine Anaconda kickstart |
+| `GET /debug.ks` | Rescue mode kickstart |
+| `GET /debug-setup.sh` | nc listener setup script for rescue shell |
+| `GET /discover.ks` | Hardware discovery kickstart |
+| `POST /api/discover` | Hardware inventory report |
+| `POST /api/install` | Queue machine for install |
+| `POST /api/progress` | Install progress callback |
+| `POST /api/log` | Raw log line ingestion |
+| `POST /api/debug` | Queue debug/rescue mode |
+| `GET /api/machines` | List all machines |
+| `GET /api/logs/:mac` | Install logs + progress |
+| `GET /api/logs/:mac/follow` | SSE stream of progress events |
+| `DELETE /api/machines/:mac` | Forget machine |
+
+**Templates:**
+- `boot.ipxe.ts` -- iPXE scripts for each boot mode (discover, install, debug, pxe-boot-debug, local-boot)
+- `install.ks.ts` -- Full Fedora kickstart with LVM, SSH, k3s prereqs, progress callbacks, SysRq keys
+- `debug.ks.ts` -- Minimal rescue kickstart (SSH via inst.sshd)
+- `ubuntu-autoinstall.ts` -- cloud-init for Ubuntu
+- `dnsmasq.conf.ts` -- DHCP/TFTP configuration
+
+**Boot Dispatch Logic:**
+```
+1. debug[mac]?        -> renderDebugIpxe (auto-clear after serving)
+2. install_queue[mac]? -> renderInstallIpxe
+3. installed[mac]?    -> renderLocalBootIpxe (exit to disk)
+4. unknown            -> renderDiscoverIpxe
+```
+
+### @lab/labd
+
+Central management daemon. Aggregates multiple bastions, stores persistent state in CockroachDB, relays commands, manages agent fleet.
+
+**Database (Prisma + CockroachDB):**
+- `Server` -- hostname, MAC, IP, role, status, cloud, environment, labels
+- `Bastion` -- hostname, network, serverIp, lastHeartbeat
+- `Agent` -- certificate, enrollment, heartbeat
+- `Cluster` -- name, cloud, environment, kubeconfig (encrypted)
+- `User` / `Role` / `Permission` -- RBAC (action:cloud:env:server matrix)
+- `JoinToken` -- one-time/reusable enrollment tokens
+- `AuditLog` -- action, resource, result, timestamp
+
+**Key Services:**
+- `BastionRegistry` -- in-memory registry of connected bastions, state aggregation, MAC-to-bastion routing
+- `AgentRegistry` -- connected agents, heartbeat tracking
+- `MessageRouter` -- command relay between CLI/agents and bastions
+
+**Command Routing:**
+```
+CLI: labctl provision install <mac> <hostname>
+  -> POST /api/machines/install
+  -> labd finds bastion that knows this MAC
+  -> WebSocket: {type: "command-install", mac, hostname, disk, role}
+  -> bastion updates install_queue
+  -> WebSocket: {type: "command-response", status: "ok"}
+  -> HTTP response to CLI
+```
+
+### @lab/cli (labctl)
+
+Operator CLI. Commander.js binary, distributed as RPM/DEB or standalone bun-compiled executable.
+
+**Command Groups:**
+
+```
+labctl init bastion standalone start|stop|status
+labctl provision list|install|reprovision|forget|debug|logs|makeiso
+labctl app k3s install|health|list
+labctl config list|get|set|path
+labctl login
+labctl doctor
+labctl roles
+```
+
+**Key Features:**
+- Target resolution: hostname, MAC, or IP -> machine lookup
+- SSH reboot into PXE for reprovision/debug (efibootmgr --bootnext)
+- Follow mode: `labctl provision logs <target> -f` (5s polling)
+- Shell completions: bash, fish
+
+### @lab/modules
+
+Declarative configuration modules with three-phase lifecycle: install -> configure -> health.
+
+**k3s Module:**
+- 5 operation groups: host-prep, networking, k3s-server, k3s-agent, hardening
+- 15+ individual operations: kernel modules, sysctl, firewall, Cilium CNI, SELinux, audit policy, pod security, cert checks
+- Health checks: service running, node ready, API health, pod status, Cilium status, secrets encryption
+- SSH execution backend with progress callbacks
+
+### @lab/agent
+
+Daemon on provisioned servers. WebSocket to labd for:
+- Heartbeat (hostname, uptime, CPU/mem usage)
+- Command execution (with stdout/stderr streaming)
+- Log streaming (journalctl relay)
+- mTLS certificate enrollment and rotation
+
+---
+
+## Disk Layout
+
+### LVM Partitioning (labvg)
+
+All roles share a common LVM layout. The kickstart `%pre` auto-detects the install disk (NVMe preferred, then SATA, skipping USB/removable).
+
+| Volume | Size | FS | Reprovision |
+|--------|------|-----|-------------|
+| `/boot/efi` | 600 MB | vfat | Reused |
+| `/boot` | 3 GB | ext4 | Reused |
+| `swap` | 27 GB | swap | Recreated |
+| `/` (root) | 33 GB | xfs | Recreated |
+| `/var` | 100 GB | xfs | Recreated |
+| `/var/log` | 10 GB | xfs | Recreated |
+| `/home` | 10 GB | xfs | **Preserved** |
+| `/srv` | 20 GB | xfs | **Preserved** |
+| `/var/lib/longhorn` | remaining | xfs | **Preserved** (worker) |
+| `/var/lib/rancher` | 20 GB | xfs | **Preserved** (infra) |
+| `/tmp` | 4 GB | tmpfs | - |
+
+Reprovision detection: if `labvg` VG exists, reuse EFI/boot partitions and preserve data volumes.
+
+---
+
+## Kickstart Features
+
+The Fedora kickstart template (`install.ks.ts`) includes:
+
+- **Dynamic disk detection** -- `%pre` probes NVMe/SATA/virtio, skips USB/removable, supports both fresh install and reprovision
+- **Progress callbacks** -- `curl -sf POST /api/progress` at each stage (partitioning, post-install substeps, complete)
+- **Anaconda syslog forwarding** -- `logging --host --port` streams real-time install logs to bastion
+- **SSH hardening** -- key-only auth, root login via pubkey only, admin user with passwordless sudo
+- **Network-first boot order** -- `efibootmgr` reorders boot entries so PXE is always first (bastion controls every reboot)
+- **SysRq magic keys** -- `kernel.sysrq=1` for emergency reboot via KVM keyboard
+- **Role-specific setup:**
+  - `vanilla`: chronyd only
+  - `worker`/`infra`: kernel modules (br_netfilter, overlay), sysctl (ip_forward, inotify), firewalld disabled, k3s binary installed
+  - `infra`: k3s server binary pre-installed
+
+**What is NOT in the kickstart:**
+- `console=ttyS0` -- causes 30s-per-step boot timeout on hardware without physical serial UART (discovered 2026-03-30, see docs/pxe-boot-debugging-2026-03-30.md)
+- Background log streamer (`tail -f`) -- prevents Anaconda from syncing filesystem, causes %post writes to not persist
+
+---
+
+## Deployment
+
+### Container Images
+
+**bastion** (`Dockerfile.bastion`):
+- Base: Fedora 43 (needs dnsmasq, iPXE)
+- Multi-stage: Alpine build -> Fedora runtime
+- iPXE rebuilt from source (SNP driver for EFI)
+- hostNetwork in k8s (DHCP needs raw sockets)
+- Capabilities: NET_ADMIN, NET_RAW
+
+**labd** (`Dockerfile.labd`):
+- Base: Alpine (minimal)
+- Multi-stage build with Prisma client generation
+- Runs as non-root `node` user
+
+### Kubernetes (k3s)
+
+```
+Namespace: lab-infra
+  Deployment: bastion (hostNetwork, PVC for /data, host SSH keys)
+  ConfigMap: bastion-config (env vars)
+  Secret: bastion-join-token
+  PVC: bastion-state (local-path)
+
+Namespace: lab-system
+  Deployment: labd
+  Service: labd (NodePort 30100)
+  StatefulSet: cockroachdb-0
+```
+
+### CLI Distribution
+
+Built with `nfpm` as RPM/DEB. Includes:
+- `/usr/bin/labctl` (bun-compiled standalone binary)
+- `/usr/share/bash-completion/completions/labctl`
+- `/usr/share/fish/vendor_completions.d/labctl.fish`
+
+Config: `~/.labctl/config.yaml` with `labdUrl`, output format, default cloud/environment.
+
+---
+
+## Build & Release
+
+```bash
+# Development
+pnpm install && pnpm build      # Compile all packages
+pnpm test:run                    # Unit tests (vitest)
+npx tsc --noEmit                 # Type check
+
+# Deploy
+bash scripts/deploy.sh all       # Build containers + RPM, push, restart pods
+bash scripts/deploy.sh bastion   # Just bastion
+bash scripts/deploy.sh labd      # Just labd
+bash scripts/deploy.sh labctl    # Just CLI (local RPM install)
+
+# Container builds
+bash scripts/build-bastion.sh --platforms linux/amd64 --push latest
+bash scripts/build-labd.sh --platforms linux/amd64 --push latest
+bash scripts/build-rpm.sh        # RPM + DEB packages
+
+# Integration tests (require libvirt, sudo)
+sudo tests/integration/run-pxe-test.sh
+```
+
+Registry: `mysources.co.uk` (Gitea at 10.0.0.194:3012)
+
+---
+
+## Testing
+
+### Unit Tests
+- Kickstart rendering (ksvalidator syntax check, partition layout, role-specific sections)
+- State management (load, save, update, debug field)
+- Dispatch routing (correct iPXE script for each machine state)
+- Syslog listener (UDP receive, IP->MAC resolution, RFC 3164 parsing)
+
+### Integration Tests (libvirt VMs)
+- **pxe-provision.test.ts** -- Full end-to-end: create VM -> PXE discovery -> queue install -> Anaconda install -> SSH verification -> systemd health -> SELinux enforcing -> boot order check
+- **iso-provision.test.ts** -- ISO boot for non-PXE machines
+- **k3s-single-node.test.ts** -- Post-provision k3s installation and health
+- VM screenshot capture during boot for debugging
+
+---
+
+## Security
+
+- **mTLS** for agent-labd communication (certificate enrollment via join tokens)
+- **SSH key-only auth** on provisioned machines (no password auth)
+- **SELinux enforcing** verified in integration tests
+- **RBAC** (planned): action:cloud:environment:server permission matrix
+- **Audit logging** (planned): every mutation tracked in CockroachDB
+- **Network-first boot order** prevents machines from booting without bastion approval
+- **SysRq keys** enabled for emergency reboot without SSH access
+
+---
+
+## Known Issues & Lessons Learned
+
+### Serial Console Boot Delay (2026-03-30)
+`console=ttyS0,115200n8` in kernel cmdline causes 30-second timeout at every systemd boot phase on hardware without a physical serial UART. Root cause: systemd blocks writing to non-existent UART. Fix: removed from kickstart entirely.
+
+### Anaconda %post Log Streamer
+Background `tail -f` in kickstart `%post` prevents Anaconda from syncing the filesystem. All file writes in %post appear to succeed but are lost on reboot. Fix: removed background log streamer, replaced with Anaconda's built-in `logging --host --port` syslog forwarding.
+
+### Disk Auto-Detection
+Hardcoded `/dev/sda` default broke NVMe-only machines. Fix: default to empty string (auto-detect) which triggers the `%pre` disk probe logic.
+
+### Anaconda Rescue Mode Limitations
+`%pre` and `%post` sections do not execute in `inst.rescue` mode. SSH in rescue mode is provided by Anaconda's `inst.sshd` kernel parameter + `sshpw` kickstart directive. Manual setup via `curl bastion:8080/debug-setup.sh | bash` for nc listener.
+
+---
+
+## Planned Work (Taskmaster)
+
+13 tasks in queue, all pending:
+
+1. **#72** Expand Prisma schema with resource relationships (Network, ServerNic, ServerDisk, ClusterMember)
+2. **#73** State persistence service (bastion state -> CockroachDB)
+3. **#74** State loading from labd on bastion startup
+4. **#75** Fix bastion --dir env var default
+5. **#76** Resource type registry with aliases (kubectl-style)
+6. **#77** `labctl get <resource>` command
+7. **#78** `labctl describe <resource>` command
+8. **#79** `labctl create/delete` commands
+9. **#80** Refactor provision commands to kubectl-style
+10. **#81** Server and resource API endpoints in labd
+11. **#82** RBAC permission checks in CLI
+12. **#83** Audit logging for resource operations
+13. **#84** Update CLI entry point and help text
+
+Additional items not in taskmaster:
+- Ubuntu autoinstall disk auto-detect (still defaults to /dev/sda)
+- Verify `inst.sshd` works end-to-end in rescue mode
+- k3s cluster join vs new cluster distinction in `labctl app k3s install`
+- arm64 container build (iPXE cross-compilation broken)

bastion/docs/kickstart-reference.md

@@ -0,0 +1,103 @@
+# Kickstart Reference — Lessons Learned
+
+This documents pitfalls discovered during PXE boot testing. Read before modifying
+the kickstart template (`src/bastion/src/templates/install.ks.ts`).
+
+## Package requirements
+
+### `kernel-modules` is mandatory
+
+`@core` only installs `kernel-modules-core`, which lacks common modules like `vfat`,
+`zram`, and many network/filesystem drivers. Without `kernel-modules`:
+
+- `/boot/efi` (FAT32) cannot mount → `systemd-remount-fs` fails → **root stays
+  read-only** → sshd-keygen can't write host keys → SSH unreachable
+- `zram-generator` fails → can trigger emergency mode
+
+**Always include `kernel-modules` in %packages.** This matches what the real
+labmaster (192.168.8.11) has installed.
+
+Regression introduced in commit `fac14b6` which removed `@server-product`
+(that group pulled in `kernel-modules` via `fedora-release-server`).
+
+### `dosfstools` is needed
+
+Provides `mkfs.vfat` and ensures FAT filesystem support is available. The real
+labmaster has it installed.
+
+### Verify against the real machine
+
+Before changing the package list, SSH to the labmaster and compare:
+```bash
+ssh 192.168.8.11 "rpm -q <package>"
+```
+
+## Anaconda %post execution order
+
+This is critical and not well documented:
+
+1. `%pre` scripts run
+2. Disk partitioning and formatting
+3. Package installation
+4. **Anaconda writes system config (fstab, hostname, etc.)**
+5. `%post` scripts run (in chroot of installed system)
+6. `%post --nochroot` scripts run
+7. **Anaconda MAY overwrite fstab again after %post scripts**
+
+**Consequence:** You cannot reliably modify `/etc/fstab` from `%post` or
+`%post --nochroot`. Anaconda overwrites it. Tested and confirmed — both
+`sed` in %post and %post --nochroot had no effect on the final fstab.
+
+What DOES work from %post:
+- Writing files to `/etc/` (systemd units, config files, SSH keys)
+- Enabling/disabling systemd services
+- Installing additional packages
+- Running `systemctl enable/mask`
+
+What does NOT work from %post:
+- Modifying `/etc/fstab` (Anaconda overwrites it)
+- `--fsoptions` on `part /boot/efi` (Anaconda ignores it for EFI partitions)
+
+## UEFI / EFI partition
+
+- Anaconda always creates an EFI System Partition for UEFI installs
+- The EFI partition is FAT32 — requires `vfat` kernel module to mount
+- If `/boot/efi` fails to mount, `systemd-remount-fs` fails, which leaves
+  root as read-only. This cascades to break ALL services that need to write
+- The EFI partition is used by firmware directly for bootloader — the OS
+  doesn't strictly need it mounted, but Anaconda adds it to fstab
+
+## VM-specific issues (libvirt/QEMU/OVMF)
+
+### iPXE exit behavior
+- `exit` (no args) returns EFI_SUCCESS → OVMF retries PXE, never reaches disk
+- `exit 1` returns EFI_ABORTED → OVMF moves to next boot device (disk)
+- VM boot order needs both `network` and `hd`: `--boot=uefi,network,hd`
+
+### nftables
+- libvirt creates reject rules for NAT networks in table `ip libvirt_network`
+  (NOT `inet libvirt` — this wrong table name cost hours of debugging)
+- These rules block new host→VM connections (SSH)
+- Rules are recreated on every `virsh start` — must delete after each VM restart
+- Chains: `guest_input` and `guest_output`
+
+### Serial console
+- VM serial port: `--serial=tcp,host=127.0.0.1:4555,mode=bind,protocol=telnet`
+- Use `virsh console <vm-name>` for interactive access (handles telnet protocol)
+- Raw `socat` works for reading but pagers/readline break interactive use
+- Add `console=ttyS0,115200n8` to kernel args for boot output on serial
+
+### SELinux on labmaster
+- Set to **permissive** — this is for k3s/kubernetes, NOT because SSH needs it
+- SSH works fine with SELinux enforcing on a properly installed Fedora system
+- The `ld.so.cache` AVC denials seen during debugging were caused by the
+  read-only root filesystem, not by SELinux policy
+
+## Testing checklist
+
+Before merging kickstart changes:
+1. Check the real labmaster has the same packages: `ssh 192.168.8.11 "rpm -q <pkg>"`
+2. Run the PXE integration test: `sudo pnpm run test:integration:pxe`
+3. Verify via serial console (root / `lab-root-pw`) if SSH fails
+4. Check `mount | grep " / "` — must show `rw`, not `ro`
+5. Check `systemctl --failed` — no critical failures

bastion/docs/pxe-boot-debugging-2026-03-30.md

@@ -0,0 +1,91 @@
+# PXE Boot Debugging Session — 2026-03-30
+
+## Problem
+Beelink SER Mini Pro (AMD Ryzen 7 255, Radeon 780M, 64GB DDR5, 1TB NVMe) boots Fedora 43 100x slower than normal after PXE kickstart install. Every systemd boot phase takes ~30 seconds. The Anaconda installer/rescue mode boots fast on the same hardware.
+
+## Root Cause
+**`console=ttyS0,115200n8` in kernel cmdline** — added via kickstart `bootloader --append` during install.
+
+This mini PC has **no physical serial UART**. When systemd writes to ttyS0, each log write blocks for ~30 seconds waiting for the non-existent UART hardware. Since systemd logs at every phase transition, the total boot time was 10+ minutes.
+
+The Anaconda installer was unaffected because it uses a different init flow that doesn't go through the same systemd phase transitions.
+
+## How We Found It
+Hours of systematic elimination:
+
+| What we tried | Result | Ruled out |
+|---|---|---|
+| `modprobe.blacklist=amdgpu` | No change | GPU driver |
+| `amd_iommu=off` | No change | IOMMU |
+| Rebuild initramfs without plymouth/drm/fips | No change | Initramfs bloat |
+| systemd-boot instead of GRUB | Still slow | Bootloader |
+| PXE-boot kernel+initrd (skip local GRUB entirely) | Still slow | Local bootloader/firmware |
+| Disable TPM in BIOS | No change | TPM |
+| Remove `resume=` + resume dracut module | No change | Hibernate resume |
+| Manual LVM activation in rescue shell | **Fast** | NVMe/LVM themselves |
+| Remove `console=ttyS0,115200n8` from GRUB | **FAST BOOT** | **This was it** |
+
+The key breakthrough was noticing the timestamps showed **exactly 30-second gaps** between boot phases — a timeout pattern, not general slowness. Then realising the serial console was added during install and had never been tested without.
+
+## What Was Fixed (PR #4, merged)
+
+### 1. Removed serial console from kickstart
+- Removed `console=ttyS0,115200n8` from `bootloader --append`
+- Removed `serial-getty@ttyS0.service` enablement
+- Removed rsyslog serial forwarding
+
+### 2. Enabled Anaconda syslog forwarding
+- Uncommented `logging --host --port` directive in kickstart
+- Bastion's SyslogListener was already built — just needed IP→MAC resolution improvement
+- Added `registerIp()` calls from kickstart fetch and progress callbacks
+- Added syslog listener unit tests
+
+### 3. Fixed disk auto-detection
+- Default disk changed from `/dev/sda` to `""` (auto-detect) in labd route and bastion command handler
+- The kickstart `%pre` auto-detect logic probes nvme0n1, sda, sdb, vda in order
+- Without this fix, NVMe-only machines (like the SER Mini Pro) fail immediately
+
+### 4. SysRq magic keys
+- Added `kernel.sysrq=1` sysctl to kickstart `%post`
+- Enables Alt+SysRq+REISUB via JetKVM for emergency reboot of stuck machines
+
+### 5. Simplified debug command
+- Removed `--sshd` flag (SSH always available via `inst.sshd` + `sshpw` in rescue mode)
+- Added `/debug-setup.sh` HTTP endpoint for nc listener setup from rescue shell
+- Cleaned up `sshd` field from DebugConfig, protocol types, all routes
+
+### 6. Added `labctl provision logs -f`
+- Follow mode with 5-second polling for real-time install monitoring
+
+## What Works
+
+- **PXE discovery → install → boot** — full flow works end-to-end
+- **Anaconda syslog forwarding** — install logs stream to bastion
+- **Progress callbacks** — stage-by-stage install tracking via curl
+- **Auto disk detection** — works for NVMe and SATA
+- **Debug rescue mode** — `labctl provision debug <target>` boots Anaconda rescue with SSH
+- **Network-first boot order** — bastion controls every reboot via efibootmgr
+- **SysRq keys** — emergency reboot via JetKVM keyboard
+
+## What Doesn't Work / Known Issues
+
+- **`--sshd` in rescue mode** — Anaconda rescue mode skips both `%pre` and `%post` kickstart sections. `inst.sshd` + `sshpw` should provide SSH access, but hasn't been verified end-to-end yet. The `/debug-setup.sh` curl workaround exists for nc.
+- **arm64 container build** — iPXE cross-compilation fails on arm64 (GCC flag incompatibility). Workaround: build with `--platforms linux/amd64` only.
+- **Integration test SSH timeout** — VM boots fine but SSH times out due to libvirt nftables reject rules after VM restart. Test infrastructure issue, not a code bug.
+
+## What Was Skipped / Left To Do
+
+1. **Syslog UDP port in k3s** — works because bastion uses `hostNetwork: true`, but should be documented properly
+2. **Background log streamer** — the old `tail -f` approach broke Anaconda filesystem sync. Replaced with syslog forwarding. If more granular %post logging is needed, a synchronous log push at end of %post would be safe.
+3. **Per-machine hardware overrides** — turned out not to be needed (serial console was the only "special" setting, and removing it is universal)
+4. **Ubuntu autoinstall disk default** — `ubuntu-autoinstall.ts` still has `disk || "/dev/sda"` fallback (line 38), should be changed to auto-detect
+5. **Verify `inst.sshd` works in rescue mode** — test SSH with password "debug" next time debug mode is used
+6. **Re-enable TPM in BIOS** — was disabled during debugging, should be factory-reset (user plans to reset BIOS to factory)
+
+## Key Learnings
+
+1. **`console=ttyS0` on hardware without UART = 30s timeout per boot phase.** Never add serial console to kernel cmdline unless the hardware has a verified physical UART.
+2. **Exactly-N-second gaps in boot logs = timeout, not slowness.** Look for the timeout source, not performance issues.
+3. **The bisection approach works.** Systematically removing features one at a time found the root cause. But it took hours because the serial console was added early and seemed harmless.
+4. **Anaconda rescue mode is limited.** It skips `%pre` and `%post`, so you can't automate setup via kickstart. Use `inst.sshd` + `sshpw` for SSH, and serve helper scripts via HTTP for everything else.
+5. **Default disk paths break NVMe machines.** Always default to auto-detect (empty string) rather than `/dev/sda`.

bastion/src/bastion/src/main.ts

@@ -257,7 +257,7 @@ export async function startBastion(overrides: Partial<BastionConfig> = {}): Prom
       state.update((s) => {
         s.install_queue[msg.mac] = {
           hostname: msg.hostname,
-          disk: msg.disk ?? "/dev/sda",
+          disk: msg.disk ?? "",
           role: msg.role as import("@lab/shared").Role,
           os: msg.os as import("@lab/shared").OsId,
           queued_at: new Date().toISOString(),
@@ -269,6 +269,7 @@ export async function startBastion(overrides: Partial<BastionConfig> = {}): Prom
     labdConn.onCommand("command-debug", async (msg) => {
       if (msg.type !== "command-debug") throw new Error("unexpected");
       const mac = msg.mac.toLowerCase();
+      const pxeBoot = msg.pxeBoot ?? false;
       const currentState = state.load();
       const hostname =
         currentState.installed[mac]?.hostname ??
@@ -276,7 +277,7 @@ export async function startBastion(overrides: Partial<BastionConfig> = {}): Prom
         currentState.discovered[mac]?.product ??
         mac;
       state.update((s) => {
-        s.debug[mac] = { hostname, queued_at: new Date().toISOString() };
+        s.debug[mac] = { hostname, queued_at: new Date().toISOString(), pxeBoot };
       });
       return { status: "ok", data: { mac, hostname } };
     });
@@ -293,6 +294,21 @@ export async function startBastion(overrides: Partial<BastionConfig> = {}): Prom
       return { status: "ok", data: { mac } };
     });
 
+    labdConn.onCommand("command-register", async (msg) => {
+      if (msg.type !== "command-register") throw new Error("unexpected");
+      const mac = msg.mac.toLowerCase();
+      state.update((s) => {
+        s.installed[mac] = {
+          hostname: msg.hostname,
+          role: msg.role,
+          ip: msg.ip,
+          installed_at: new Date().toISOString(),
+        };
+      });
+      logger.info(`MACHINE REGISTERED: ${mac} -> ${msg.hostname} (${msg.role}) ip=${msg.ip}`);
+      return { status: "ok", data: { mac, hostname: msg.hostname } };
+    });
+
     labdConn.onCommand("command-role-update", async (msg) => {
       if (msg.type !== "command-role-update") throw new Error("unexpected");
       const mac = msg.mac.toLowerCase();

bastion/src/bastion/src/routes/api.ts

@@ -13,11 +13,13 @@ import { triggerPostProvisionK3s } from "../services/post-provision.js";
 import { progressBus } from "../services/progress-events.js";
 import type { ProgressEvent } from "../services/progress-events.js";
 import type { InstallLogBuffer } from "../services/install-log.js";
+import type { SyslogListener } from "../services/syslog-listener.js";
 
 export function registerApiRoutes(
   app: FastifyInstance,
   state: StateManager,
   installLog: InstallLogBuffer,
+  syslog: SyslogListener,
 ): void {
   // List all machines
   app.get("/api/machines", async (_request, reply) => {
@@ -84,6 +86,11 @@ export function registerApiRoutes(
     const { mac: rawMac, stage, detail } = request.body ?? {};
     const mac = (rawMac ?? "unknown").toLowerCase();
     const stageName = stage ?? "unknown";
+
+    // Register IP → MAC for syslog routing
+    if (mac !== "unknown") {
+      syslog.registerIp(request.ip, mac);
+    }
     const detailStr = detail ?? "";
 
     const GREEN = "\x1b[0;32m";
@@ -191,9 +198,10 @@ export function registerApiRoutes(
 
   // Queue debug/rescue mode for a machine
   app.post<{
-    Body: { mac?: string };
+    Body: { mac?: string; pxeBoot?: boolean };
   }>("/api/debug", async (request, reply) => {
     const mac = (request.body?.mac ?? "").toLowerCase().replace(/-/g, ":");
+    const pxeBoot = request.body?.pxeBoot ?? false;
     if (mac === "") {
       return reply.status(400).send({ error: "mac is required" });
     }
@@ -207,7 +215,7 @@ export function registerApiRoutes(
       mac;
 
     state.update((s) => {
-      s.debug[mac] = { hostname, queued_at: new Date().toISOString() };
+      s.debug[mac] = { hostname, queued_at: new Date().toISOString(), pxeBoot };
     });
 
     logger.info(`DEBUG QUEUED: ${mac} -> ${hostname}`);
@@ -307,6 +315,50 @@ export function registerApiRoutes(
     return reply.send({ status: "ok", mac, new: isNew });
   });
 
+  // Register an already-installed machine (e.g. re-add after state loss)
+  app.post<{
+    Body: {
+      mac?: string;
+      hostname?: string;
+      role?: string;
+      ip?: string;
+    };
+  }>("/api/register", async (request, reply) => {
+    const { mac: rawMac, hostname, role, ip } = request.body ?? {};
+    const mac = (rawMac ?? "").toLowerCase().replace(/-/g, ":");
+
+    if (mac === "") {
+      return reply.status(400).send({ error: "mac is required" });
+    }
+    if (!hostname) {
+      return reply.status(400).send({ error: "hostname is required" });
+    }
+
+    const validRole = role ?? "worker";
+    if (!(SUPPORTED_ROLES as readonly string[]).includes(validRole)) {
+      return reply.status(400).send({ error: `invalid role: '${validRole}'. Supported: ${SUPPORTED_ROLES.join(", ")}` });
+    }
+
+    state.update((s) => {
+      s.installed[mac] = {
+        hostname,
+        role: validRole,
+        ip: ip ?? "",
+        installed_at: new Date().toISOString(),
+      };
+    });
+
+    logger.info(`MACHINE REGISTERED: ${mac} -> hostname=${hostname} role=${validRole} ip=${ip ?? ""}`);
+
+    return reply.send({
+      status: "registered",
+      mac,
+      hostname,
+      role: validRole,
+      ip: ip ?? "",
+    });
+  });
+
   // Update a machine's role (e.g. promote infra -> labcontroller)
   app.post<{
     Body: {

bastion/src/bastion/src/routes/dispatch.ts

@@ -11,6 +11,7 @@ import {
   renderDiscoverIpxe,
   renderInstallIpxe,
   renderDebugIpxe,
+  renderPxeBootDebugIpxe,
   renderLocalBootIpxe,
 } from "../templates/boot.ipxe.js";
 import { renderUbuntuInstallIpxe } from "../templates/ubuntu-boot.ipxe.js";
@@ -22,12 +23,44 @@ export function registerDispatchRoutes(
   config: BastionConfig,
   state: StateManager,
 ): void {
-  // Serve debug/rescue kickstart (minimal: SSH keys + network)
+  // Serve debug/rescue kickstart (minimal: SSH keys + network for inst.sshd)
   app.get<{ Querystring: { mac?: string } }>("/debug.ks", async (_request, reply) => {
-    const ks = renderDebugKickstart({ sshKeys: config.sshKeys ?? [] });
+    const ks = renderDebugKickstart({
+      sshKeys: config.sshKeys ?? [],
+      serverIp: config.serverIp,
+      httpPort: config.httpPort,
+    });
     return reply.type("text/plain").send(ks);
   });
 
+  // Shell script for manual debug setup (nc listener + IP reporting)
+  // Usage from rescue shell: curl http://bastion:port/debug-setup.sh | bash
+  app.get("/debug-setup.sh", async (_request, reply) => {
+    const script = `#!/bin/bash
+# Lab Bastion debug setup — run from rescue shell
+set -x
+
+IP_ADDR=$(ip -4 addr show | awk '/inet / && !/127.0.0/ {split($2,a,"/"); print a[1]; exit}')
+MAC_ADDR=$(ip link show | awk '/ether/ && !/00:00:00:00/ {print $2; exit}')
+
+# Start persistent nc listener for remote shell
+(while true; do nc -l -p 2323 -e /bin/bash 2>/dev/null; done) &
+echo "nc shell listener on port 2323"
+
+# Report IP to bastion
+curl -sf -X POST "http://${config.serverIp}:${config.httpPort}/api/progress" \\
+    -H "Content-Type: application/json" \\
+    -d "{\\"mac\\":\\"$MAC_ADDR\\",\\"stage\\":\\"debug-ready\\",\\"detail\\":\\"nc $IP_ADDR 2323\\"}" 2>/dev/null || true
+
+echo ""
+echo "=== Debug environment ready ==="
+echo "  nc $IP_ADDR 2323    (remote shell)"
+echo "  ssh root@$IP_ADDR   (password: debug)"
+echo "==============================="
+`;
+    return reply.type("text/plain").send(script);
+  });
+
   app.get<{ Querystring: { mac?: string } }>("/dispatch", async (request, reply) => {
     const mac = (request.query.mac ?? "").toLowerCase().replace(/-/g, ":");
     const currentState = state.load();
@@ -36,17 +69,27 @@ export function registerDispatchRoutes(
     const debugEntry = currentState.debug[mac];
     if (debugEntry) {
       const hostname = debugEntry.hostname ?? "debug";
-      logger.info(`DEBUG BOOT: ${mac} -> ${hostname} (rescue mode)`);
-
       state.update((s) => { delete s.debug[mac]; });
 
-      const script = renderDebugIpxe({
+      let script: string;
-        mac,
+      if (debugEntry.pxeBoot) {
-        hostname,
+        logger.info(`PXE BOOT DEBUG: ${mac} -> ${hostname} (kernel+initrd from PXE, root from NVMe)`);
-        serverIp: config.serverIp,
+        script = renderPxeBootDebugIpxe({
-        httpPort: config.httpPort,
+          mac,
-        fedoraMirror: config.fedoraMirror,
+          hostname,
-      });
+          serverIp: config.serverIp,
+          httpPort: config.httpPort,
+        });
+      } else {
+        logger.info(`DEBUG BOOT: ${mac} -> ${hostname} (rescue mode)`);
+        script = renderDebugIpxe({
+          mac,
+          hostname,
+          serverIp: config.serverIp,
+          httpPort: config.httpPort,
+          fedoraMirror: config.fedoraMirror,
+        });
+      }
       return reply.type("text/plain").send(script);
     }
 

bastion/src/bastion/src/routes/kickstart.ts

@@ -5,6 +5,7 @@
 import type { FastifyInstance } from "fastify";
 import type { BastionConfig } from "@lab/shared";
 import type { StateManager } from "../services/state.js";
+import type { SyslogListener } from "../services/syslog-listener.js";
 import { generateInstallKickstart, generateDiscoverKickstart } from "../services/kickstart-generator.js";
 import { renderUbuntuAutoinstall, renderUbuntuMetaData, type UbuntuAutoinstallParams } from "../templates/ubuntu-autoinstall.js";
 
@@ -12,6 +13,7 @@ export function registerKickstartRoutes(
   app: FastifyInstance,
   config: BastionConfig,
   state: StateManager,
+  syslog: SyslogListener,
 ): void {
   // Per-MAC install kickstart
   app.get<{ Querystring: { mac?: string } }>("/ks", async (request, reply) => {
@@ -19,6 +21,11 @@ export function registerKickstartRoutes(
     const currentState = state.load();
     const queueEntry = currentState.install_queue[mac];
 
+    // Register IP → MAC so syslog listener can route Anaconda logs
+    if (mac) {
+      syslog.registerIp(request.ip, mac);
+    }
+
     const ks = generateInstallKickstart(config, {
       hostname: queueEntry?.hostname ?? "lab-node",
       disk: queueEntry?.disk ?? "",

bastion/src/bastion/src/server.ts

@@ -43,8 +43,8 @@ export function createApp(config: BastionConfig): { app: ReturnType<typeof Fasti
 
   // Register route handlers
   registerDispatchRoutes(app, config, state);
-  registerKickstartRoutes(app, config, state);
+  registerKickstartRoutes(app, config, state, syslog);
-  registerApiRoutes(app, state, installLog);
+  registerApiRoutes(app, state, installLog, syslog);
   // boot.iso is generated at startup and served as a static file from httpDir
   // (static serving supports HTTP Range requests, required by JetKVM streaming)
 

bastion/src/bastion/src/services/labd-connection.ts

@@ -165,6 +165,7 @@ export class BastionConnection {
       case "command-forget":
       case "command-role-update":
       case "command-debug":
+      case "command-register":
         void this.handleCommand(msg);
         break;
     }

bastion/src/bastion/src/services/syslog-listener.ts

@@ -30,6 +30,8 @@ export class SyslogListener {
   private port: number;
   private installLog: InstallLogBuffer;
   private state: StateManager;
+  /** Explicit IP → MAC mapping registered from kickstart/progress requests. */
+  private ipToMac = new Map<string, string>();
 
   constructor(port: number, installLog: InstallLogBuffer, state: StateManager) {
     this.port = port;
@@ -37,14 +39,21 @@ export class SyslogListener {
     this.state = state;
   }
 
-  /** Resolve a source IP to a MAC address using the install queue. */
+  /** Register an IP → MAC mapping (called when we learn a machine's IP). */
+  registerIp(ip: string, mac: string): void {
+    this.ipToMac.set(ip, mac.toLowerCase());
+  }
+
+  /** Resolve a source IP to a MAC address. */
   private resolveIpToMac(ip: string): string | null {
+    // Check explicit mapping first (most reliable)
+    const explicit = this.ipToMac.get(ip);
+    if (explicit) return explicit;
+
     const currentState = this.state.load();
 
     // Check install queue — machines being installed have an IP from DHCP
     for (const [mac, entry] of Object.entries(currentState.install_queue)) {
-      // The progress callback sends IP in "complete" detail, but during install
-      // we need to match by what we know. Check if any progress mentions this IP.
       if (entry.progress_detail?.includes(ip)) return mac;
     }
 

bastion/src/bastion/src/templates/boot.ipxe.ts

@@ -102,6 +102,34 @@ boot
 `;
 }
 
+/**
+ * iPXE script for PXE-boot debug mode -- boots the installed system's root
+ * filesystem using the bastion's PXE kernel+initrd instead of local GRUB.
+ * Workaround for UEFI firmware bugs that make local disk boot slow.
+ */
+export function renderPxeBootDebugIpxe(params: {
+  mac: string;
+  hostname: string;
+  serverIp: string;
+  httpPort: number;
+}): string {
+  return `#!ipxe
+
+echo
+echo =============================================
+echo   Lab PXE Bastion - PXE BOOT (debug)
+echo   Target: ${params.hostname}
+echo   MAC:    ${params.mac}
+echo   Kernel+initrd from PXE, root from NVMe
+echo =============================================
+echo
+
+kernel http://${params.serverIp}:${params.httpPort}/vmlinuz root=/dev/mapper/labvg-root ro rd.lvm.lv=labvg/root rd.lvm.lv=labvg/swap console=tty0
+initrd http://${params.serverIp}:${params.httpPort}/initrd.img
+boot
+`;
+}
+
 /**
  * iPXE script for already-installed machines -- exits to boot from local disk.
  */

bastion/src/bastion/src/templates/debug.ks.ts

@@ -1,25 +1,33 @@
 // Debug/rescue kickstart template.
-// Minimal: sets SSH access and network for Anaconda rescue mode.
+// Minimal kickstart for Anaconda rescue mode.
-// No disk operations, no packages, no %post.
+//
+// SSH access: Anaconda's inst.sshd starts sshd automatically.
+// The sshpw directive sets the password, sshkey adds authorized keys.
+// %pre/%post do NOT run in rescue mode — don't put setup code there.
 
 export interface DebugKickstartParams {
   sshKeys: string[];
+  serverIp?: string;
+  httpPort?: number;
 }
 
 export function renderDebugKickstart(params: DebugKickstartParams): string {
-  const sshpw = "sshpw --username=root --plaintext lab-root-pw";
   const sshkeyLine = params.sshKeys.length > 0
     ? `sshkey --username=root "${params.sshKeys[0]}"`
     : "";
 
   return `# Lab Bastion -- Debug/Rescue Kickstart
-# Minimal: only SSH + network for Anaconda rescue mode
+# Minimal: SSH + network for Anaconda rescue mode
+#
+# SSH is started by Anaconda (inst.sshd kernel param).
+# Password: debug  |  SSH keys from bastion config.
+# %pre/%post do NOT run in rescue mode.
 
 lang en_US.UTF-8
 keyboard uk
 network --bootproto=dhcp --activate
 
-${sshpw}
+sshpw --username=root --plaintext debug
 ${sshkeyLine}
 `;
 }

bastion/src/bastion/src/templates/install.ks.ts

@@ -134,10 +134,9 @@ network --bootproto=dhcp --activate --hostname=${fqdn}
 ${auth}
 ${userDirective}
 
-bootloader --append="console=tty0 console=ttyS0,115200n8"
+bootloader --append="console=tty0"
 
-# logging --host=${serverIp} --port=${syslogPort}
+logging --host=${serverIp} --port=${syslogPort}
-# Disabled: syslog UDP port needs to be exposed in k3s service/hostPort first
 
 url --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-$releasever&arch=$basearch
 
@@ -342,17 +341,7 @@ echo "tmpfs /tmp tmpfs defaults,noatime,nosuid,nodev,size=4G 0 0" >> /etc/fstab
 
 ${isVanilla ? `# -- vanilla role: skip k3s kernel/sysctl/firewall setup --
 # -- Enable chronyd for time sync --
-systemctl enable chronyd || true
+systemctl enable chronyd || true` : `# -- Kernel modules for k3s --
-
-# -- Serial console (for debugging — auto-login as root on ttyS0) --
-# AWS EC2 compatible: ttyS0 @ 115200n8
-systemctl enable serial-getty@ttyS0.service || true
-
-# -- Forward all system logs to serial console --
-cat > /etc/rsyslog.d/serial-console.conf << 'RSYSLOG'
-*.* /dev/ttyS0
-RSYSLOG
-systemctl enable rsyslog || true` : `# -- Kernel modules for k3s --
 cat > /etc/modules-load.d/k3s.conf << 'MODULES'
 br_netfilter
 overlay
@@ -396,6 +385,9 @@ fi
 
 bastion_progress "post-install" "3-bootorder done"
 
+# -- Enable SysRq magic keys (for emergency reboot via Alt+SysRq+REISUB) --
+echo "kernel.sysrq=1" > /etc/sysctl.d/90-sysrq.conf
+
 # -- Provisioning metadata --
 cat > /etc/lab-provisioned << PROVEOF
 hostname: ${fqdn}

bastion/src/bastion/tests/dispatch.test.ts

@@ -28,6 +28,7 @@ function createTestConfig(testDir: string): BastionConfig {
     gateway: "10.0.0.1",
     sshKeys: ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAITEST test@test"],
     adminUser: "testadmin",
+    syslogPort: 15514,
     skipDnsmasq: true,
     skipArtifacts: true,
     fedoraMirror: "https://download.fedoraproject.org/pub/fedora/linux/releases/43/Everything/x86_64/os",

bastion/src/bastion/tests/kickstart.test.ts

@@ -206,10 +206,8 @@ describe("renderInstallKickstart", () => {
     }
   });
 
-  it("forwards system logs to serial console", () => {
+  it("does not include serial console (causes 30s boot timeout on hardware without UART)", () => {
     const ks = renderInstallKickstart(baseParams({ role: "vanilla" }));
-    expect(ks).toContain("serial-console.conf");
+    expect(ks).not.toContain("ttyS0");
-    expect(ks).toContain("/dev/ttyS0");
-    expect(ks).toContain("rsyslog");
   });
 });

bastion/src/bastion/tests/syslog-listener.test.ts

@@ -0,0 +1,121 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { createSocket } from "node:dgram";
+import { mkdtempSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { SyslogListener } from "../src/services/syslog-listener.js";
+import { InstallLogBuffer } from "../src/services/install-log.js";
+import { StateManager } from "../src/services/state.js";
+
+function sendUdpSyslog(port: number, message: string): Promise<void> {
+  return new Promise((resolve, reject) => {
+    const client = createSocket("udp4");
+    const buf = Buffer.from(message);
+    client.send(buf, 0, buf.length, port, "127.0.0.1", (err) => {
+      client.close();
+      if (err) reject(err);
+      else resolve();
+    });
+  });
+}
+
+describe("SyslogListener", () => {
+  let tmpDir: string;
+  let state: StateManager;
+  let installLog: InstallLogBuffer;
+  let syslog: SyslogListener;
+  const PORT = 15514; // use non-privileged port for testing
+
+  beforeEach(() => {
+    tmpDir = mkdtempSync(join(tmpdir(), "syslog-test-"));
+    state = new StateManager(join(tmpDir, "state.json"));
+    state.init();
+    installLog = new InstallLogBuffer(tmpDir);
+    syslog = new SyslogListener(PORT, installLog, state);
+    syslog.start();
+  });
+
+  afterEach(() => {
+    syslog.stop();
+    rmSync(tmpDir, { recursive: true, force: true });
+  });
+
+  it("receives and stores syslog messages for registered IP", async () => {
+    const mac = "aa:bb:cc:dd:ee:ff";
+    // Queue a machine so hostname can be resolved
+    state.update((s) => {
+      s.install_queue[mac] = {
+        hostname: "testnode",
+        disk: "/dev/sda",
+        role: "worker",
+        os: "fedora-43",
+        queued_at: new Date().toISOString(),
+      };
+    });
+
+    // Register IP → MAC mapping
+    syslog.registerIp("127.0.0.1", mac);
+
+    // Send a syslog message (RFC 3164 format)
+    await sendUdpSyslog(PORT, "<13>Mar 30 01:30:00 localhost anaconda[1234]: Installing package vim-enhanced");
+
+    // Wait for UDP delivery
+    await new Promise((r) => setTimeout(r, 200));
+
+    const lines = installLog.getLines(mac);
+    expect(lines.length).toBeGreaterThan(0);
+    expect(lines[0]!.line).toContain("anaconda");
+    expect(lines[0]!.line).toContain("Installing package vim-enhanced");
+  });
+
+  it("ignores messages from unknown IPs", async () => {
+    // Don't register any IP mapping
+    await sendUdpSyslog(PORT, "<13>Mar 30 01:30:00 localhost anaconda[1234]: test message");
+    await new Promise((r) => setTimeout(r, 200));
+
+    // No MAC to check, but the listener should not crash
+    // and no logs should be stored for any MAC
+    expect(installLog.lineCount("unknown")).toBe(0);
+  });
+
+  it("resolves IP from installed machines state", async () => {
+    const mac = "11:22:33:44:55:66";
+    state.update((s) => {
+      s.installed[mac] = {
+        hostname: "installed-node",
+        role: "worker",
+        ip: "127.0.0.1",
+        installed_at: new Date().toISOString(),
+      };
+    });
+
+    await sendUdpSyslog(PORT, "<14>Mar 30 02:00:00 installed-node sshd[5678]: Accepted publickey for root");
+    await new Promise((r) => setTimeout(r, 200));
+
+    const lines = installLog.getLines(mac);
+    expect(lines.length).toBeGreaterThan(0);
+    expect(lines[0]!.line).toContain("sshd");
+  });
+
+  it("parses various syslog formats", async () => {
+    const mac = "aa:bb:cc:dd:ee:ff";
+    syslog.registerIp("127.0.0.1", mac);
+    state.update((s) => {
+      s.install_queue[mac] = {
+        hostname: "testnode",
+        disk: "/dev/sda",
+        role: "worker",
+        os: "fedora-43",
+        queued_at: new Date().toISOString(),
+      };
+    });
+
+    // Message without PID
+    await sendUdpSyslog(PORT, "<13>Mar 30 01:30:00 localhost kernel: NVMe device ready");
+    await new Promise((r) => setTimeout(r, 200));
+
+    const lines = installLog.getLines(mac);
+    expect(lines.length).toBeGreaterThan(0);
+    expect(lines[0]!.line).toContain("kernel");
+  });
+});

bastion/src/cli/src/api/client.ts

@@ -94,8 +94,14 @@ export class LabdClient {
     return this.request("POST", "/api/machines/install", { body: opts });
   }
 
-  async debugMachine(mac: string): Promise<{ status: string; data?: { mac: string; hostname: string }; error?: string }> {
+  async registerMachine(opts: {
-    return this.request("POST", "/api/machines/debug", { body: { mac } });
+    mac: string; hostname: string; role?: string; ip?: string;
+  }): Promise<{ status: string; data?: unknown; error?: string }> {
+    return this.request("POST", "/api/machines/register", { body: opts });
+  }
+
+  async debugMachine(mac: string, opts?: { pxeBoot?: boolean }): Promise<{ status: string; data?: { mac: string; hostname: string }; error?: string }> {
+    return this.request("POST", "/api/machines/debug", { body: { mac, pxeBoot: opts?.pxeBoot } });
   }
 
   async forgetMachine(mac: string): Promise<{ status: string }> {

bastion/src/cli/src/commands/app.ts

@@ -1,9 +1,10 @@
 // CLI command: labctl app k3s install/health <target>
 // Install or check k3s on a target machine via SSH.
 
-import { existsSync } from "node:fs";
+import { existsSync, writeFileSync, mkdirSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { execSync } from "node:child_process";
 import type { Command } from "commander";
 import type { BastionState } from "@lab/shared";
 import { K3sModule, sshExec } from "@lab/modules";
@@ -400,4 +401,88 @@ export function registerAppCommand(program: Command): void {
         );
       }
     });
+
+  k3sCmd
+    .command("kubeconfig <target>")
+    .description("Fetch kubeconfig from a target and merge into ~/.kube/config")
+    .option("--user <user>", "SSH user", "root")
+    .option("--context <name>", "Context name (defaults to hostname)")
+    .option("--print", "Print kubeconfig to stdout instead of merging")
+    .action(async (target: string, opts: {
+      user: string;
+      context?: string;
+      print?: boolean;
+    }) => {
+      const state = await fetchState();
+      const resolved = resolveTarget(target, state);
+
+      if (!resolved) {
+        console.error(`Cannot resolve target: ${target}`);
+        console.error("Provide an IP address, hostname, or MAC of an installed machine.");
+        process.exit(1);
+      }
+
+      const sshKey = findSshKey();
+
+      // Fetch kubeconfig via SSH
+      let raw: string;
+      try {
+        const result = await sshExec(resolved.ip, opts.user, "cat /etc/rancher/k3s/k3s.yaml", {
+          ...(sshKey ? { keyPath: sshKey } : {}),
+          timeoutMs: 10_000,
+        });
+        raw = result.stdout;
+      } catch (err) {
+        console.error(`Failed to fetch kubeconfig: ${err instanceof Error ? err.message : String(err)}`);
+        process.exit(1);
+      }
+
+      const contextName = opts.context ?? resolved.hostname;
+
+      // Rewrite: replace 127.0.0.1 with actual IP, rename cluster/user/context
+      const rewritten = raw
+        .replace(/server:\s*https:\/\/127\.0\.0\.1:/, `server: https://${resolved.ip}:`)
+        .replace(/name:\s*default/g, `name: ${contextName}`)
+        .replace(/cluster:\s*default/g, `cluster: ${contextName}`)
+        .replace(/user:\s*default/g, `user: ${contextName}`)
+        .replace(/current-context:\s*default/, `current-context: ${contextName}`);
+
+      if (opts.print) {
+        process.stdout.write(rewritten);
+        return;
+      }
+
+      // Merge into ~/.kube/config using kubectl
+      const kubeDir = join(homedir(), ".kube");
+      mkdirSync(kubeDir, { recursive: true });
+      const mainConfig = join(kubeDir, "config");
+      const tmpFile = join(kubeDir, `.labctl-${contextName}.tmp`);
+
+      writeFileSync(tmpFile, rewritten, { mode: 0o600 });
+
+      try {
+        if (existsSync(mainConfig)) {
+          const merged = execSync(
+            `KUBECONFIG="${mainConfig}:${tmpFile}" kubectl config view --flatten`,
+            { encoding: "utf-8" },
+          );
+          writeFileSync(mainConfig, merged, { mode: 0o600 });
+        } else {
+          writeFileSync(mainConfig, rewritten, { mode: 0o600 });
+        }
+
+        // Set current context
+        execSync(`kubectl config use-context ${contextName}`, { stdio: "pipe" });
+
+        console.log(`Merged kubeconfig for ${contextName} (${resolved.ip})`);
+        console.log(`Context set to: ${contextName}`);
+        console.log(`\nSwitch contexts: kubectl config use-context <name>`);
+      } catch (err) {
+        console.error(`Failed to merge kubeconfig: ${err instanceof Error ? err.message : String(err)}`);
+        console.error(`Standalone config saved at: ${tmpFile}`);
+        process.exit(1);
+      } finally {
+        try { const { unlinkSync } = await import("node:fs"); unlinkSync(tmpFile); } catch { /* ignore */ }
+      }
+    });
 }

bastion/src/cli/src/commands/debug.ts

@@ -48,8 +48,9 @@ export function registerDebugCommand(parent: Command): void {
   parent
     .command("debug <target>")
     .description("PXE boot into Fedora rescue mode for debugging (target: hostname, MAC, or IP)")
+    .option("--pxe-boot", "Boot installed system via PXE (kernel+initrd from network, root from NVMe)")
     .showHelpAfterError(true)
-    .action(async (target: string) => {
+    .action(async (target: string, opts: { pxeBoot?: boolean }) => {
       const client = getLabdClient();
 
       // Resolve target from labd aggregated state
@@ -73,7 +74,7 @@ export function registerDebugCommand(parent: Command): void {
       console.log(`Queuing debug mode for ${hostname} (${mac})...`);
 
       try {
-        const result = await client.debugMachine(mac);
+        const result = await client.debugMachine(mac, { pxeBoot: opts.pxeBoot === true });
         if (result.error) {
           console.error(`Failed: ${result.error}`);
           process.exit(1);
@@ -102,6 +103,7 @@ export function registerDebugCommand(parent: Command): void {
 
           const sshArgs = [
             "-o", "StrictHostKeyChecking=no",
+            "-o", "UserKnownHostsFile=/dev/null",
             "-o", "ConnectTimeout=10",
             ...(sshKey !== undefined ? ["-i", sshKey] : []),
             `${effectiveUser}@${ip}`,
@@ -116,38 +118,39 @@ export function registerDebugCommand(parent: Command): void {
         }
       }
 
+      // Determine bastion URL from labd config for the setup script URL
+      const bastionUrl = process.env["LABD_URL"]
+        ? process.env["LABD_URL"].replace(/\/ws\/bastion$/, "").replace(/^wss?:/, "http:")
+        : "http://<bastion-ip>:8080";
+
       console.log(`
 Debug mode queued for ${hostname} (${mac}).
 Reboot the machine to enter Fedora rescue mode.
 
+SSH access (started by Anaconda):
+  ssh root@<ip>   (password: debug)
+
+For nc remote shell, run from rescue shell:
+  curl ${bastionUrl}/debug-setup.sh | bash
+
 Once in rescue shell:
 
-  # Activate LVM
+  # Activate LVM and mount installed system
-  vgchange -ay labvg
+  vgchange -ay
-
-  # Mount root + other volumes
   mkdir -p /mnt/sysroot
-  mount /dev/labvg/root /mnt/sysroot
+  mount /dev/<vg>/root /mnt/sysroot
-  cat /mnt/sysroot/etc/fstab   # check what else to mount
+  cat /mnt/sysroot/etc/fstab
-  mount /dev/labvg/var  /mnt/sysroot/var
+  mount /dev/<vg>/var  /mnt/sysroot/var
-  mount /dev/labvg/home /mnt/sysroot/home
+  mount /dev/<vg>/home /mnt/sysroot/home
 
-  # Boot the installed system in a container
+  # Boot installed system in a container
   /mnt/sysroot/usr/bin/systemd-nspawn -D /mnt/sysroot --boot
 
-  # Or just chroot for quick fixes
+  # Or chroot for quick fixes
   mount --bind /dev  /mnt/sysroot/dev
   mount --bind /proc /mnt/sysroot/proc
   mount --bind /sys  /mnt/sysroot/sys
   chroot /mnt/sysroot
-
-  # Check initramfs size
-  ls -lh /mnt/sysroot/boot/initramfs-*.img
-
-  # Rebuild initramfs without amdgpu
-  chroot /mnt/sysroot
-  echo 'omit_drivers+=" amdgpu "' > /etc/dracut.conf.d/omit-amdgpu.conf
-  dracut -f --regenerate-all
 `);
     });
 }

bastion/src/cli/src/commands/logs.ts

@@ -39,19 +39,25 @@ export function registerLogsCommand(parent: Command): void {
   parent
     .command("logs <target>")
     .description("Show provisioning logs for a machine (hostname, MAC, or IP)")
-    .action(async (target: string) => {
+    .option("-f, --follow", "Follow log output in real-time")
+    .action(async (target: string, opts: { follow?: boolean }) => {
       const mac = await resolveToMac(target);
 
+      const BOLD = "\x1b[1m";
+      const GREEN = "\x1b[32m";
+      const YELLOW = "\x1b[33m";
+      const RED = "\x1b[31m";
+      const DIM = "\x1b[2m";
+      const RESET = "\x1b[0m";
+
+      if (opts.follow) {
+        await followLogs(mac, { BOLD, GREEN, YELLOW, RED, DIM, RESET });
+        return;
+      }
+
       try {
         const data = await getLabdClient().getMachineLogs(mac);
 
-        const BOLD = "\x1b[1m";
-        const GREEN = "\x1b[32m";
-        const YELLOW = "\x1b[33m";
-        const RED = "\x1b[31m";
-        const DIM = "\x1b[2m";
-        const RESET = "\x1b[0m";
-
         console.log(`${BOLD}${data["hostname"]}${RESET} (${mac})`);
         console.log(`  Status:   ${data["status"] === "installed" ? GREEN : YELLOW}${data["status"]}${RESET}`);
         console.log(`  Role:     ${data["role"]}`);
@@ -83,3 +89,64 @@ export function registerLogsCommand(parent: Command): void {
       }
     });
 }
+
+/** Follow logs by polling labd. */
+async function followLogs(
+  mac: string,
+  colors: { BOLD: string; GREEN: string; YELLOW: string; RED: string; DIM: string; RESET: string },
+): Promise<void> {
+  const { BOLD, GREEN, YELLOW, RED, DIM, RESET } = colors;
+  const client = getLabdClient();
+
+  console.log(`${DIM}Following logs for ${mac} (Ctrl+C to stop)${RESET}`);
+  console.log("");
+
+  let lastStageCount = 0;
+  let lastStatus = "";
+  let sawInstalling = false;
+
+  while (true) {
+    try {
+      const data = await client.getMachineLogs(mac);
+      const status = String(data["status"] ?? "");
+      const log = data["log"] as Array<{ stage: string; detail: string; timestamp: string }> | undefined;
+
+      // Print header once or on status change
+      if (status !== lastStatus) {
+        const hostname = String(data["hostname"] ?? mac);
+        const statusColor = status === "installed" ? GREEN : YELLOW;
+        console.log(`  ${BOLD}${hostname}${RESET}  ${statusColor}${status}${RESET}`);
+        lastStatus = status;
+      }
+
+      if (status === "installing" || status === "queued") {
+        sawInstalling = true;
+      }
+
+      // Print new stages
+      if (log && log.length > lastStageCount) {
+        for (let i = lastStageCount; i < log.length; i++) {
+          const entry = log[i]!;
+          const time = entry.timestamp.slice(11, 19);
+          const color = entry.stage === "complete" ? GREEN : entry.stage === "error" ? RED : YELLOW;
+          const detail = entry.detail ? ` ${DIM}-- ${entry.detail}${RESET}` : "";
+          console.log(`  ${DIM}${time}${RESET}  ${color}${entry.stage}${RESET}${detail}`);
+        }
+        lastStageCount = log.length;
+      }
+
+      // Only exit on "installed" if we actually saw the install happen
+      // (avoids exiting immediately when following a reprovision that hasn't started yet)
+      if (status === "installed" && sawInstalling) {
+        const ip = data["ip"] ?? "";
+        console.log("");
+        console.log(`  ${GREEN}${BOLD}Install complete!${RESET}${ip ? ` ${DIM}ssh lab@${ip}${RESET}` : ""}`);
+        process.exit(0);
+      }
+    } catch {
+      // Machine may not be in logs yet (still queued)
+    }
+
+    await new Promise((r) => setTimeout(r, 5000));
+  }
+}

bastion/src/cli/src/commands/register.ts

@@ -0,0 +1,37 @@
+// CLI command: provision register
+// Register an already-installed machine that is missing from bastion state.
+
+import { Command, Option } from "commander";
+import { SUPPORTED_ROLES } from "@lab/shared";
+import { getLabdClient } from "../api/config.js";
+
+export function registerRegisterCommand(parent: Command): void {
+  parent
+    .command("register <mac> <hostname>")
+    .description("Register an already-installed machine (e.g. after state loss)")
+    .addOption(new Option("--role <role>", "Machine role").choices([...SUPPORTED_ROLES]).default("worker"))
+    .option("--ip <address>", "Machine IP address")
+    .action(async (mac: string, hostname: string, opts: {
+      role: string;
+      ip?: string;
+    }) => {
+      try {
+        const result = await getLabdClient().registerMachine({
+          mac,
+          hostname,
+          role: opts.role,
+          ...(opts.ip ? { ip: opts.ip } : {}),
+        });
+
+        if (result.error) {
+          console.error(`Failed: ${result.error}`);
+          process.exit(1);
+        }
+
+        console.log(`Registered ${mac} as ${hostname} (role=${opts.role}${opts.ip ? `, ip=${opts.ip}` : ""})`);
+      } catch (err) {
+        console.error(`Failed: ${err instanceof Error ? err.message : String(err)}`);
+        process.exit(1);
+      }
+    });
+}

bastion/src/cli/src/commands/reprovision.ts

@@ -144,6 +144,7 @@ export function registerReprovisionCommand(parent: Command): void {
 
       const sshArgs = [
         "-o", "StrictHostKeyChecking=no",
+        "-o", "UserKnownHostsFile=/dev/null",
         "-o", "ConnectTimeout=10",
         ...(sshKey !== undefined ? ["-i", sshKey] : []),
         `${effectiveUser}@${ip}`,

bastion/src/cli/src/index.ts

@@ -2,7 +2,7 @@
 // CLI entry point for lab-bastion.
 // Commands:
 //   init bastion standalone start/stop/status
-//   provision list/install/reprovision/forget
+//   provision list/install/reprovision/forget/register
 
 import { fileURLToPath } from "node:url";
 import { Command, Option } from "commander";
@@ -16,6 +16,7 @@ import { registerListCommand } from "./commands/list.js";
 import { registerReprovisionCommand } from "./commands/reprovision.js";
 import { registerDebugCommand } from "./commands/debug.js";
 import { registerForgetCommand } from "./commands/forget.js";
+import { registerRegisterCommand } from "./commands/register.js";
 import { registerLogsCommand } from "./commands/logs.js";
 import { registerMakeIsoCommand } from "./commands/makeiso.js";
 import { registerConfigCommand } from "./commands/config.js";
@@ -98,6 +99,7 @@ export function createProgram(): Command {
   registerReprovisionCommand(provisionCmd);
   registerDebugCommand(provisionCmd);
   registerForgetCommand(provisionCmd);
+  registerRegisterCommand(provisionCmd);
   registerLogsCommand(provisionCmd);
   registerMakeIsoCommand(provisionCmd);
 

bastion/src/labd/src/routes/bastions.ts

@@ -151,7 +151,7 @@ export function registerBastionRoutes(app: FastifyInstance, db: DbClient): void
         try {
           const result = await sendCommand(all[0]!.bastionId, {
             type: "command-install",
-            mac, hostname, disk: disk ?? "/dev/sda", role: role ?? "infra", os: os ?? "fedora-43",
+            mac, hostname, disk: disk ?? "", role: role ?? "infra", os: os ?? "fedora-43",
           });
           return reply.code(result.status === "ok" ? 200 : 500).send(result);
         } catch (err) {
@@ -164,7 +164,44 @@ export function registerBastionRoutes(app: FastifyInstance, db: DbClient): void
     try {
       const result = await sendCommand(bastion.bastionId, {
         type: "command-install",
-        mac, hostname, disk: disk ?? "/dev/sda", role: role ?? "infra", os: os ?? "fedora-43",
+        mac, hostname, disk: disk ?? "", role: role ?? "infra", os: os ?? "fedora-43",
+      });
+      return reply.code(result.status === "ok" ? 200 : 500).send(result);
+    } catch (err) {
+      return reply.code(500).send({ error: err instanceof Error ? err.message : String(err) });
+    }
+  });
+
+  // Register an already-installed machine — route to correct bastion (or single bastion)
+  app.post<{
+    Body: { mac?: string; hostname?: string; role?: string; ip?: string };
+  }>("/api/machines/register", async (request, reply) => {
+    const { mac, hostname, role, ip } = request.body ?? {};
+    if (!mac || !hostname) {
+      return reply.code(400).send({ error: "mac and hostname are required" });
+    }
+
+    const normalized = mac.toLowerCase().replace(/-/g, ":");
+
+    // Find bastion that knows this MAC, or use single connected bastion
+    const bastion = bastionRegistry.findBastionByMac(normalized);
+    const target = bastion ?? (bastionRegistry.getAll().length === 1 ? bastionRegistry.getAll()[0] : null);
+
+    if (!target) {
+      const all = bastionRegistry.getAll();
+      if (all.length === 0) {
+        return reply.code(503).send({ error: "No bastions connected" });
+      }
+      return reply.code(404).send({ error: `MAC ${normalized} not found on any bastion and multiple bastions connected` });
+    }
+
+    try {
+      const result = await sendCommand(target.bastionId, {
+        type: "command-register",
+        mac: normalized,
+        hostname,
+        role: role ?? "worker",
+        ip: ip ?? "",
       });
       return reply.code(result.status === "ok" ? 200 : 500).send(result);
     } catch (err) {
@@ -174,9 +211,10 @@ export function registerBastionRoutes(app: FastifyInstance, db: DbClient): void
 
   // Queue debug/rescue mode — route to correct bastion by MAC
   app.post<{
-    Body: { mac?: string };
+    Body: { mac?: string; pxeBoot?: boolean };
   }>("/api/machines/debug", async (request, reply) => {
     const mac = (request.body?.mac ?? "").toLowerCase().replace(/-/g, ":");
+    const pxeBoot = request.body?.pxeBoot ?? false;
     if (!mac) {
       return reply.code(400).send({ error: "mac is required" });
     }
@@ -189,7 +227,7 @@ export function registerBastionRoutes(app: FastifyInstance, db: DbClient): void
       }
       if (all.length === 1) {
         try {
-          const result = await sendCommand(all[0]!.bastionId, { type: "command-debug", mac });
+          const result = await sendCommand(all[0]!.bastionId, { type: "command-debug", mac, pxeBoot });
           return reply.code(result.status === "ok" ? 200 : 500).send(result);
         } catch (err) {
           return reply.code(500).send({ error: err instanceof Error ? err.message : String(err) });
@@ -199,7 +237,7 @@ export function registerBastionRoutes(app: FastifyInstance, db: DbClient): void
     }
 
     try {
-      const result = await sendCommand(bastion.bastionId, { type: "command-debug", mac });
+      const result = await sendCommand(bastion.bastionId, { type: "command-debug", mac, pxeBoot });
       return reply.code(result.status === "ok" ? 200 : 500).send(result);
     } catch (err) {
       return reply.code(500).send({ error: err instanceof Error ? err.message : String(err) });
@@ -256,17 +294,7 @@ export function registerBastionRoutes(app: FastifyInstance, db: DbClient): void
     const queued = bastion.state.install_queue[mac];
     const installed = bastion.state.installed[mac];
 
-    if (installed) {
+    // Active install takes priority over old installed state (reprovision case)
-      return {
-        mac,
-        hostname: installed.hostname,
-        status: "installed",
-        role: installed.role,
-        ip: installed.ip,
-        installed_at: installed.installed_at,
-      };
-    }
-
     if (queued) {
       return {
         mac,
@@ -281,6 +309,17 @@ export function registerBastionRoutes(app: FastifyInstance, db: DbClient): void
       };
     }
 
+    if (installed) {
+      return {
+        mac,
+        hostname: installed.hostname,
+        status: "installed",
+        role: installed.role,
+        ip: installed.ip,
+        installed_at: installed.installed_at,
+      };
+    }
+
     return reply.code(404).send({ error: `MAC ${mac} not found in install queue or installed` });
   });
 }

bastion/src/modules/modules/k3s/src/operations/cilium.ts

@@ -35,21 +35,15 @@ export const installCilium: Operation = async (ctx): Promise<OperationResult> =>
   }
   details.push(`Installed cilium CLI ${version} (${cliArch})`);
 
-  // Detect default network device (avoid tailscale/wireguard)
-  const devResult = await ctx.ssh.exec(
-    "ip -4 route show default | awk '{print $5}' | head -1",
-    sshOpts(ctx),
-  );
-  const defaultDev = devResult.stdout.trim();
-  details.push(`Network device: ${defaultDev}`);
-
   // Install Cilium
+  // - No hardcoded devices: Cilium auto-detects per node (heterogeneous NICs like eno1 vs enP7s7)
+  // - k8sServiceHost/Port: k3s agents proxy the API on 127.0.0.1:6444 (not 6443)
   const installResult = await ctx.ssh.exec(
     `KUBECONFIG=/etc/rancher/k3s/k3s.yaml cilium install \
       --set kubeProxyReplacement=true \
       --set ipam.mode=kubernetes \
-      --set devices="${defaultDev}" \
+      --set k8sServiceHost=127.0.0.1 \
-      --set nodePort.directRoutingDevice="${defaultDev}"`,
+      --set k8sServicePort=6444`,
     { timeoutMs: 300_000 },
   );
   if (installResult.exitCode !== 0) {

bastion/src/modules/modules/k3s/src/operations/k3s-config.ts

@@ -42,6 +42,8 @@ ${tlsSans.map((s) => `  - "${s}"`).join("\n")}
 
 function generateAgentConfig(): string {
   return `protect-kernel-defaults: true
+node-label:
+  - "node-role.kubernetes.io/worker=true"
 kubelet-arg:
   - "protect-kernel-defaults=true"
   - "streaming-connection-idle-timeout=5m"

bastion/src/shared/src/protocol/index.ts

@@ -111,7 +111,8 @@ export type LabdBastionMessage =
   | { type: "command-install"; requestId: string; mac: string; hostname: string; disk?: string; role: string; os: string }
   | { type: "command-forget"; requestId: string; mac: string }
   | { type: "command-role-update"; requestId: string; mac: string; role: string }
-  | { type: "command-debug"; requestId: string; mac: string }
+  | { type: "command-debug"; requestId: string; mac: string; pxeBoot?: boolean }
+  | { type: "command-register"; requestId: string; mac: string; hostname: string; role: string; ip: string }
   | { type: "server-shutdown"; reconnectAfter: number };
 
 export type BastionMessageType = BastionMessage["type"];
@@ -126,7 +127,7 @@ const BASTION_MESSAGE_TYPES = new Set<string>([
 
 const LABD_BASTION_MESSAGE_TYPES = new Set<string>([
   "bastion-enrolled", "bastion-heartbeat-ack", "command-install",
-  "command-forget", "command-role-update", "command-debug", "server-shutdown",
+  "command-forget", "command-role-update", "command-debug", "command-register", "server-shutdown",
 ]);
 
 export function isBastionMessage(msg: unknown): msg is BastionMessage {

bastion/src/shared/src/types/state.ts

@@ -101,6 +101,7 @@ export interface InstalledInfo {
 export interface DebugConfig {
   hostname: string;
   queued_at: string;
+  pxeBoot?: boolean;
 }
 
 export interface BastionState {

bastion/tests/integration/pxe-provision.test.ts

@@ -224,11 +224,12 @@ describe("PXE boot provisioning", () => {
     // Generate dnsmasq config
     generateDnsmasqConf(config);
 
-    // Start HTTP server
+    // Start HTTP server + syslog listener
-    const { app, state } = createApp(config);
+    const { app, state, syslog } = createApp(config);
     bastionApp = app;
     await app.listen({ port: config.httpPort, host: "0.0.0.0" });
-    log(`Bastion HTTP server listening on :${HTTP_PORT}`);
+    syslog.start();
+    log(`Bastion HTTP server listening on :${HTTP_PORT}, syslog on UDP :${config.syslogPort}`);
 
     // Start dnsmasq (fire-and-forget — it runs until killed)
     // May fail without root (DHCP socket needs CAP_NET_BIND_SERVICE); libvirt network provides DHCP fallback
@@ -387,8 +388,8 @@ describe("PXE boot provisioning", () => {
     expect(data.progress).toBe("complete");
   });
 
-  it.skip("log lines were captured", async () => {
+  it("syslog install logs were captured", async () => {
-    // Requires log streamer in %post — skipped until re-added
+    // Anaconda forwards logs via syslog (logging --host directive in kickstart)
     const res = await fetch(`http://${BASTION_IP}:${HTTP_PORT}/api/logs/${encodeURIComponent(vmMac)}`);
     const data = (await res.json()) as { log_total?: number; log_lines?: Array<{ line: string }> };
     expect(data.log_total).toBeGreaterThan(0);