fix(k3s): route audit logs through journald, codify etcd member recovery

Two changes prompted by today's etcd raft panic on worker1-k8s0
(tocommit out of range, lost-write on follower) and the cascading
disk pressure that surfaced underneath it.

Audit logs to journald
- kube-apiserver now uses audit-log-path=- so audit events flow to
  k3s.service stdout and into journald instead of growing files in
  /var/log/kubernetes. The previous setup combined apiserver's
  internal rotation with a logrotate *.log glob that double-rotated
  the rotated files into permanent orphans (observed: 7+ GB).
- New journald-limits operation writes a SystemMaxUse=2G drop-in so
  audit volume cannot fill /var/log even under bursty load.
- log-rotation operation repurposed to decommission the obsolete
  logrotate rule and reap leftover audit files. Idempotent: no-op
  on fresh installs.

Etcd member recovery
- New recoverEtcdMember(broken, peer, hostname) codifies the
  documented k3s recovery: stop k3s, etcdctl member remove, wipe
  /var/lib/rancher/k3s/server/{db,tls,cred}, restart, poll for
  rejoin. Refuses to operate when cluster size < 3 to preserve
  quorum.

Tests
- 7 new unit tests covering both decommission paths and the
  recovery procedure (54 total, all green).
- install.test.ts asserts the file-based audit args are gone.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitignore

@@ -23,3 +23,11 @@ node_modules/
 
 # OS specific
 .DS_Store
+
+# Task files
+# tasks.json
+# tasks/ 
+
+# Asahi build artifacts (large)
+bastion/.asahi-cache/
+bastion/asahi-repo/*.zip

CLAUDE.md

@@ -0,0 +1,19 @@
+## Skill routing
+
+When the user's request matches an available skill, ALWAYS invoke it using the Skill
+tool as your FIRST action. Do NOT answer directly, do NOT use other tools first.
+The skill has specialized workflows that produce better results than ad-hoc answers.
+
+Key routing rules:
+- Product ideas, "is this worth building", brainstorming → invoke gstack-office-hours
+- Bugs, errors, "why is this broken", 500 errors → invoke gstack-investigate
+- Ship, deploy, push, create PR → invoke gstack-ship
+- QA, test the site, find bugs → invoke gstack-qa
+- Code review, check my diff → invoke gstack-review
+- Update docs after shipping → invoke gstack-document-release
+- Weekly retro → invoke gstack-retro
+- Design system, brand → invoke gstack-design-consultation
+- Visual audit, design polish → invoke gstack-design-review
+- Architecture review → invoke gstack-plan-eng-review
+- Save progress, checkpoint, resume → invoke gstack-checkpoint
+- Code quality, health check → invoke gstack-health

TODOS.md

@@ -0,0 +1,47 @@
+# TODOS
+
+## P1 — Ship with Phase 1
+
+### v2.0 Architecture Document Update
+Update `bastion/docs/ARCHITECTURE.md` to cover v2.0: driver model, fleet system,
+Pulumi integration, Vault secrets, Deno evaluator, new CLI grammar. The existing
+doc covers v1.0 comprehensively (432 lines). v2.0 adds 5+ major subsystems.
+**Effort:** M (human: 1 week / CC: 1-2 days)
+**Depends on:** Phase 1 complete
+**Source:** CEO review 2026-04-01
+
+## P2 — Post-v2.0 Core
+
+### SSH Emergency Mode (scoped)
+SSH-based operations limited to: (1) earliest necessary box provisioning before agent
+is installed, and (2) emergency debugging/fixing operations that can't be done via agent.
+NOT a general-purpose DeploymentTarget alternative. The v1.0 `recheck` and `fix-ssh-root.sh`
+patterns are the model. Agent stays the primary management path.
+**Effort:** S (human: 1 week / CC: 1 day)
+**Depends on:** Phase 2 complete (DeploymentTarget interface exists)
+**Source:** CEO review 2026-04-01
+
+### Prometheus Metrics Endpoint
+Add `/metrics` endpoint to labd: resource counts by status, apply duration histograms,
+driver operation latency, fleet pipeline completion rates. Standard Prometheus scraping
+for Grafana dashboards and alerting.
+**Effort:** S (human: 2-3 days / CC: 2-3 hours)
+**Depends on:** Phase 1 (labd exists with resource store)
+**Source:** CEO review 2026-04-01 (observability gap)
+
+## P3 — Future Enhancements
+
+### Infrastructure Graph Visualization
+Visual representation of resource dependencies, environment topology, fleet status.
+Could be a web UI or terminal-based (like `kubectl tree`).
+**Source:** CEO review 2026-04-01
+
+### `labctl import` for Existing Cloud Resources
+Discover and import existing AWS/GCP resources into the state store.
+Pulumi's import functionality could be leveraged.
+**Source:** CEO review 2026-04-01
+
+### Built-in Secrets Rotation
+Automatic rotation of managed secrets (database passwords, API keys).
+Vault handles rotation but a labctl-native workflow could simplify.
+**Source:** CEO review 2026-04-01

bastion/asahi-repo/installer_data.json

@@ -0,0 +1,47 @@
+{
+  "os_list": [
+    {
+      "name": "Fedora Asahi Lab (infra)",
+      "default_os_name": "Fedora Linux Lab",
+      "boot_object": "m1n1.bin",
+      "next_object": "m1n1/boot.bin",
+      "package": "fedora-asahi-lab.zip",
+      "supported_fw": [
+        "12.3",
+        "12.3.1",
+        "13.5"
+      ],
+      "partitions": [
+        {
+          "name": "EFI",
+          "type": "EFI",
+          "size": "524288000B",
+          "format": "fat",
+          "volume_id": "0x804be8a6",
+          "copy_firmware": true,
+          "copy_installer_data": true,
+          "source": "esp"
+        },
+        {
+          "name": "Boot",
+          "type": "Linux",
+          "size": "1073741824B",
+          "image": "boot.img"
+        },
+        {
+          "name": "Root",
+          "type": "Linux",
+          "size": "4626296832B",
+          "expand": false,
+          "image": "root.img"
+        },
+        {
+          "name": "Data",
+          "type": "Linux",
+          "size": "1073741824B",
+          "expand": true
+        }
+      ]
+    }
+  ]
+}

bastion/bastion/.gitignore

@@ -0,0 +1,4 @@
+
+# Asahi build artifacts (large)
+.asahi-cache/
+asahi-repo/*.zip

bastion/completions/labctl.bash

@@ -29,43 +29,61 @@ _labctl() {
       COMPREPLY=($(compgen -W "--dir -h --help" -- "$cur"))
       return ;;
     "init bastion standalone status")
-      COMPREPLY=($(compgen -W "--dir --port -h --help" -- "$cur"))
+      COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
       return ;;
     "init bastion standalone")
       COMPREPLY=($(compgen -W "start stop status -h --help" -- "$cur"))
       return ;;
     "app labcontroller deploy")
-      COMPREPLY=($(compgen -W "--user --port --crdb-replicas -h --help" -- "$cur"))
+      COMPREPLY=($(compgen -W "--user --crdb-replicas -h --help" -- "$cur"))
       return ;;
     "app labcontroller status")
-      COMPREPLY=($(compgen -W "--user --port -h --help" -- "$cur"))
+      COMPREPLY=($(compgen -W "--user -h --help" -- "$cur"))
       return ;;
     "app k3s install")
-      COMPREPLY=($(compgen -W "--role --user --port --k3s-server --k3s-token -h --help" -- "$cur"))
+      COMPREPLY=($(compgen -W "--role --user --k3s-server --k3s-token -h --help" -- "$cur"))
       return ;;
     "app k3s health")
-      COMPREPLY=($(compgen -W "--user --port -h --help" -- "$cur"))
+      COMPREPLY=($(compgen -W "--user -h --help" -- "$cur"))
       return ;;
     "app k3s list")
-      COMPREPLY=($(compgen -W "--user --port -h --help" -- "$cur"))
+      COMPREPLY=($(compgen -W "--user -h --help" -- "$cur"))
+      return ;;
+    "app k3s kubeconfig")
+      COMPREPLY=($(compgen -W "--user --context --print -h --help" -- "$cur"))
       return ;;
     "init bastion")
       COMPREPLY=($(compgen -W "standalone -h --help" -- "$cur"))
       return ;;
     "provision list")
-      COMPREPLY=($(compgen -W "--port -h --help" -- "$cur"))
+      COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
       return ;;
     "provision install")
-      COMPREPLY=($(compgen -W "--role --os --disk --port -h --help" -- "$cur"))
+      COMPREPLY=($(compgen -W "--role --os --disk -h --help" -- "$cur"))
       return ;;
     "provision reprovision")
-      COMPREPLY=($(compgen -W "--role --os --disk --port -h --help" -- "$cur"))
+      COMPREPLY=($(compgen -W "--role --os --disk -h --help" -- "$cur"))
+      return ;;
+    "provision debug")
+      COMPREPLY=($(compgen -W "--pxe-boot -h --help" -- "$cur"))
       return ;;
     "provision forget")
-      COMPREPLY=($(compgen -W "--port -h --help" -- "$cur"))
+      COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
+      return ;;
+    "provision register")
+      COMPREPLY=($(compgen -W "--role --ip -h --help" -- "$cur"))
+      return ;;
+    "provision asahi")
+      COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
       return ;;
     "provision logs")
-      COMPREPLY=($(compgen -W "-f --follow --port -h --help" -- "$cur"))
+      COMPREPLY=($(compgen -W "-f --follow -h --help" -- "$cur"))
+      return ;;
+    "provision makeiso")
+      COMPREPLY=($(compgen -W "--arch --local --out -h --help" -- "$cur"))
+      return ;;
+    "provision recheck")
+      COMPREPLY=($(compgen -W "--user --target -h --help" -- "$cur"))
       return ;;
     "config list")
       COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
@@ -83,7 +101,7 @@ _labctl() {
       COMPREPLY=($(compgen -W "deploy status -h --help" -- "$cur"))
       return ;;
     "app k3s")
-      COMPREPLY=($(compgen -W "install health list -h --help" -- "$cur"))
+      COMPREPLY=($(compgen -W "install health list kubeconfig -h --help" -- "$cur"))
       return ;;
     "version")
       COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
@@ -92,7 +110,7 @@ _labctl() {
       COMPREPLY=($(compgen -W "bastion -h --help" -- "$cur"))
       return ;;
     "provision")
-      COMPREPLY=($(compgen -W "list install reprovision forget logs -h --help" -- "$cur"))
+      COMPREPLY=($(compgen -W "list install reprovision debug forget register asahi logs makeiso recheck -h --help" -- "$cur"))
       return ;;
     "config")
       COMPREPLY=($(compgen -W "list get set path -h --help" -- "$cur"))

bastion/completions/labctl.fish

@@ -118,38 +118,46 @@ complete -c labctl -n "__labctl_in_cmd init bastion standalone start" -l foregro
 # init bastion standalone stop options
 complete -c labctl -n "__labctl_in_cmd init bastion standalone stop" -l dir -d 'Bastion data directory' -x
 
-# init bastion standalone status options
-complete -c labctl -n "__labctl_in_cmd init bastion standalone status" -l dir -d 'Bastion data directory' -x
-complete -c labctl -n "__labctl_in_cmd init bastion standalone status" -l port -d 'Bastion HTTP port' -x
-
 # provision subcommands
 complete -c labctl -n "__labctl_using_cmd provision" -a list -d 'List all known machines'
 complete -c labctl -n "__labctl_using_cmd provision" -a install -d 'Queue a discovered machine for OS installation'
 complete -c labctl -n "__labctl_using_cmd provision" -a reprovision -d 'Queue install + SSH reboot into PXE (target: hostname, MAC, or IP)'
+complete -c labctl -n "__labctl_using_cmd provision" -a debug -d 'PXE boot into Fedora rescue mode for debugging (target: hostname, MAC, or IP)'
 complete -c labctl -n "__labctl_using_cmd provision" -a forget -d 'Remove a machine from bastion state'
+complete -c labctl -n "__labctl_using_cmd provision" -a register -d 'Register an already-installed machine (e.g. after state loss)'
+complete -c labctl -n "__labctl_using_cmd provision" -a asahi -d 'Show instructions to provision an Apple Silicon Mac with Asahi Linux'
 complete -c labctl -n "__labctl_using_cmd provision" -a logs -d 'Show provisioning logs for a machine (hostname, MAC, or IP)'
-
-# provision list options
-complete -c labctl -n "__labctl_in_cmd provision list" -l port -d 'Bastion HTTP port' -x
+complete -c labctl -n "__labctl_using_cmd provision" -a makeiso -d 'Generate a UEFI-bootable iPXE ISO for network provisioning'
+complete -c labctl -n "__labctl_using_cmd provision" -a recheck -d 'Refresh hardware info for all installed machines via SSH'
 
 # provision install options
 complete -c labctl -n "__labctl_in_cmd provision install" -l role -d 'Machine role (see below)' -xa 'vanilla worker infra labcontroller'
 complete -c labctl -n "__labctl_in_cmd provision install" -l os -d 'Operating system' -xa 'fedora-43 ubuntu-26.04'
 complete -c labctl -n "__labctl_in_cmd provision install" -l disk -d 'Target disk device (auto-detect if omitted)' -x
-complete -c labctl -n "__labctl_in_cmd provision install" -l port -d 'Bastion HTTP port' -x
 
 # provision reprovision options
 complete -c labctl -n "__labctl_in_cmd provision reprovision" -l role -d 'Machine role (see below)' -xa 'vanilla worker infra labcontroller'
 complete -c labctl -n "__labctl_in_cmd provision reprovision" -l os -d 'Operating system' -xa 'fedora-43 ubuntu-26.04'
 complete -c labctl -n "__labctl_in_cmd provision reprovision" -l disk -d 'Target disk device (auto-detect if omitted)' -x
-complete -c labctl -n "__labctl_in_cmd provision reprovision" -l port -d 'Bastion HTTP port' -x
 
-# provision forget options
-complete -c labctl -n "__labctl_in_cmd provision forget" -l port -d 'Bastion HTTP port' -x
+# provision debug options
+complete -c labctl -n "__labctl_in_cmd provision debug" -l pxe-boot -d 'Boot installed system via PXE (kernel+initrd from network, root from NVMe)'
+
+# provision register options
+complete -c labctl -n "__labctl_in_cmd provision register" -l role -d 'Machine role' -xa 'vanilla worker infra labcontroller'
+complete -c labctl -n "__labctl_in_cmd provision register" -l ip -d 'Machine IP address' -x
 
 # provision logs options
-complete -c labctl -n "__labctl_in_cmd provision logs" -s f -l follow -d 'Follow logs in real-time (SSE stream)'
-complete -c labctl -n "__labctl_in_cmd provision logs" -l port -d 'Bastion HTTP port' -x
+complete -c labctl -n "__labctl_in_cmd provision logs" -s f -l follow -d 'Follow log output in real-time'
+
+# provision makeiso options
+complete -c labctl -n "__labctl_in_cmd provision makeiso" -l arch -d 'Target architecture(s)' -xa 'x86_64 aarch64'
+complete -c labctl -n "__labctl_in_cmd provision makeiso" -l local -d 'Build ISO locally instead of using bastion-hosted URL'
+complete -c labctl -n "__labctl_in_cmd provision makeiso" -l out -d 'Output path for local ISO build' -x
+
+# provision recheck options
+complete -c labctl -n "__labctl_in_cmd provision recheck" -l user -d 'SSH user' -x
+complete -c labctl -n "__labctl_in_cmd provision recheck" -l target -d 'Only recheck a specific machine (by hostname or MAC)' -x
 
 # config subcommands
 complete -c labctl -n "__labctl_using_cmd config" -a list -d 'Show all configuration values'
@@ -173,30 +181,31 @@ complete -c labctl -n "__labctl_using_cmd app labcontroller" -a status -d 'Check
 
 # app labcontroller deploy options
 complete -c labctl -n "__labctl_in_cmd app labcontroller deploy" -l user -d 'SSH user' -x
-complete -c labctl -n "__labctl_in_cmd app labcontroller deploy" -l port -d 'Bastion HTTP port' -x
 complete -c labctl -n "__labctl_in_cmd app labcontroller deploy" -l crdb-replicas -d 'CockroachDB replicas' -x
 
 # app labcontroller status options
 complete -c labctl -n "__labctl_in_cmd app labcontroller status" -l user -d 'SSH user' -x
-complete -c labctl -n "__labctl_in_cmd app labcontroller status" -l port -d 'Bastion HTTP port' -x
 
 # app k3s subcommands
 complete -c labctl -n "__labctl_using_cmd app k3s" -a install -d 'Install k3s on a target machine (hostname, IP, or MAC)'
 complete -c labctl -n "__labctl_using_cmd app k3s" -a health -d 'Check k3s health (all hosts if no target given)'
 complete -c labctl -n "__labctl_using_cmd app k3s" -a list -d 'List installed machines and their k3s status'
+complete -c labctl -n "__labctl_using_cmd app k3s" -a kubeconfig -d 'Fetch kubeconfig from a target and merge into ~/.kube/config'
 
 # app k3s install options
 complete -c labctl -n "__labctl_in_cmd app k3s install" -l role -d 'k3s role: infra (server) or worker (agent)' -x
 complete -c labctl -n "__labctl_in_cmd app k3s install" -l user -d 'SSH user' -x
-complete -c labctl -n "__labctl_in_cmd app k3s install" -l port -d 'Bastion HTTP port (for resolving target)' -x
 complete -c labctl -n "__labctl_in_cmd app k3s install" -l k3s-server -d 'k3s server URL (required for worker role)' -x
 complete -c labctl -n "__labctl_in_cmd app k3s install" -l k3s-token -d 'k3s join token (required for worker role)' -x
 
 # app k3s health options
 complete -c labctl -n "__labctl_in_cmd app k3s health" -l user -d 'SSH user' -x
-complete -c labctl -n "__labctl_in_cmd app k3s health" -l port -d 'Bastion HTTP port' -x
 
 # app k3s list options
 complete -c labctl -n "__labctl_in_cmd app k3s list" -l user -d 'SSH user' -x
-complete -c labctl -n "__labctl_in_cmd app k3s list" -l port -d 'Bastion HTTP port' -x
+
+# app k3s kubeconfig options
+complete -c labctl -n "__labctl_in_cmd app k3s kubeconfig" -l user -d 'SSH user' -x
+complete -c labctl -n "__labctl_in_cmd app k3s kubeconfig" -l context -d 'Context name (defaults to hostname)' -x
+complete -c labctl -n "__labctl_in_cmd app k3s kubeconfig" -l print -d 'Print kubeconfig to stdout instead of merging'
 

bastion/docs/ARCHITECTURE.md

@@ -0,0 +1,431 @@
+# Lab Platform Architecture
+
+## Overview
+
+A bare-metal and hybrid cloud infrastructure platform for automated machine provisioning, Kubernetes cluster management, and fleet operations. The platform discovers hardware via PXE boot, installs operating systems unattended, deploys k3s clusters, and provides centralized management through a CLI and API.
+
+**Components:**
+- **bastion** -- PXE boot server (DHCP/TFTP/HTTP) for machine discovery and OS installation
+- **labd** -- Master daemon for multi-bastion aggregation, persistent state, agent management
+- **labctl** -- CLI tool for operators (kubectl-style interface)
+- **lab-agent** -- Daemon on provisioned servers for remote execution and monitoring
+- **modules** -- Declarative configuration system (k3s, labcontroller)
+
+---
+
+## Architecture
+
+```
+                           labctl (CLI)
+                               |
+                        labd (master daemon)
+                        /    |    \
+                  bastion1  bastion2  ...     (PXE provisioning)
+                    /   \      |
+              [machines]  [machines]           (bare metal)
+                  |           |
+              lab-agent   lab-agent            (remote exec)
+```
+
+### Communication Patterns
+
+| Path | Protocol | Auth |
+|------|----------|------|
+| labctl -> labd | HTTP/HTTPS | mTLS cert (future: token) |
+| bastion -> labd | WebSocket | Join token enrollment |
+| lab-agent -> labd | WebSocket | mTLS certificate |
+| machine -> bastion | HTTP | None (local network) |
+| Anaconda -> bastion | HTTP + UDP syslog | None (install-time) |
+| labctl -> bastion | HTTP | None (standalone mode) |
+
+### Standalone vs Centralized
+
+The bastion can operate in two modes:
+
+1. **Standalone** -- single bastion, state in local JSON file, CLI talks directly to bastion HTTP API
+2. **Centralized** -- bastion registers with labd via WebSocket, state aggregated in CockroachDB, CLI talks to labd which routes commands to the correct bastion
+
+---
+
+## Machine Lifecycle
+
+```
+                     PXE boot
+                        |
+               +--------v--------+
+               |    DISCOVERED   |  Hardware inventory collected
+               +---------+-------+
+                         |
+              labctl provision install
+                         |
+               +---------v-------+
+               |  INSTALL_QUEUE  |  Waiting for next PXE boot
+               +---------+-------+
+                         |
+                   PXE boot (Anaconda)
+                         |
+               +---------v-------+
+               |   INSTALLING    |  Progress: partitioning -> packages -> post-install
+               +---------+-------+
+                         |
+               +---------v-------+
+               |    INSTALLED    |  OS ready, SSH accessible
+               +---------+-------+
+                         |
+              labctl app k3s install
+                         |
+               +---------v-------+
+               |   K3S RUNNING   |  Kubernetes node operational
+               +--------+--------+
+                        |
+              labctl provision reprovision
+                        |
+                   (back to INSTALL_QUEUE)
+```
+
+Side paths:
+- **DEBUG** -- `labctl provision debug` boots Anaconda rescue mode for diagnostics
+- **FORGET** -- `labctl provision forget` removes machine from all state
+
+---
+
+## Packages
+
+### Monorepo Structure
+
+TypeScript ESM monorepo with pnpm workspaces. Six packages:
+
+| Package | Role | Key Tech |
+|---------|------|----------|
+| `@lab/shared` | Types, protocol, constants | - |
+| `@lab/bastion` | PXE server | Fastify, dnsmasq |
+| `@lab/cli` | CLI binary | Commander.js |
+| `@lab/labd` | Master daemon | Fastify, Prisma, CockroachDB |
+| `@lab/agent` | Server agent | WebSocket |
+| `@lab/modules` | Config modules | SSH, k8s-client |
+
+### @lab/shared
+
+Core type system shared by all packages.
+
+**State Model:**
+```typescript
+interface BastionState {
+  discovered:    Record<MAC, HardwareInfo>
+  install_queue: Record<MAC, InstallConfig>
+  installed:     Record<MAC, InstalledInfo>
+  debug:         Record<MAC, DebugConfig>
+}
+```
+
+**Roles:**
+- `vanilla` -- OS only, no k3s, no cluster services
+- `worker` -- k3s agent + Longhorn storage (joins existing cluster)
+- `infra` -- k3s server + etcd (control plane node)
+- `labcontroller` -- infra + bastion + labd + CockroachDB (self-sufficient)
+
+**OS Support:**
+- `fedora-43` -- Anaconda kickstart installer
+- `ubuntu-26.04` -- cloud-init autoinstall
+
+**Protocol:** Discriminated union message types for WebSocket communication between agents, bastions, and labd. Type guards and parsers for runtime validation.
+
+### @lab/bastion
+
+PXE boot server that handles the physical provisioning lifecycle.
+
+**Services:**
+- `StateManager` -- JSON file persistence with immutable update pattern
+- `SyslogListener` -- UDP syslog receiver (port 5514) for Anaconda install logs
+- `InstallLogBuffer` -- In-memory ring buffer + disk persistence per machine
+- `BastionConnection` -- WebSocket client to labd for centralized mode
+- dnsmasq management (spawn, config generation, proxy/full DHCP)
+- Network auto-detection (interface, IP, subnet, gateway)
+- ISO builder (xorriso + mtools for non-PXE machines)
+
+**HTTP Routes:**
+
+| Endpoint | Purpose |
+|----------|---------|
+| `GET /dispatch?mac=` | Dynamic iPXE script (discover/install/debug/local-boot) |
+| `GET /ks?mac=` | Per-machine Anaconda kickstart |
+| `GET /debug.ks` | Rescue mode kickstart |
+| `GET /debug-setup.sh` | nc listener setup script for rescue shell |
+| `GET /discover.ks` | Hardware discovery kickstart |
+| `POST /api/discover` | Hardware inventory report |
+| `POST /api/install` | Queue machine for install |
+| `POST /api/progress` | Install progress callback |
+| `POST /api/log` | Raw log line ingestion |
+| `POST /api/debug` | Queue debug/rescue mode |
+| `GET /api/machines` | List all machines |
+| `GET /api/logs/:mac` | Install logs + progress |
+| `GET /api/logs/:mac/follow` | SSE stream of progress events |
+| `DELETE /api/machines/:mac` | Forget machine |
+
+**Templates:**
+- `boot.ipxe.ts` -- iPXE scripts for each boot mode (discover, install, debug, pxe-boot-debug, local-boot)
+- `install.ks.ts` -- Full Fedora kickstart with LVM, SSH, k3s prereqs, progress callbacks, SysRq keys
+- `debug.ks.ts` -- Minimal rescue kickstart (SSH via inst.sshd)
+- `ubuntu-autoinstall.ts` -- cloud-init for Ubuntu
+- `dnsmasq.conf.ts` -- DHCP/TFTP configuration
+
+**Boot Dispatch Logic:**
+```
+1. debug[mac]?        -> renderDebugIpxe (auto-clear after serving)
+2. install_queue[mac]? -> renderInstallIpxe
+3. installed[mac]?    -> renderLocalBootIpxe (exit to disk)
+4. unknown            -> renderDiscoverIpxe
+```
+
+### @lab/labd
+
+Central management daemon. Aggregates multiple bastions, stores persistent state in CockroachDB, relays commands, manages agent fleet.
+
+**Database (Prisma + CockroachDB):**
+- `Server` -- hostname, MAC, IP, role, status, cloud, environment, labels
+- `Bastion` -- hostname, network, serverIp, lastHeartbeat
+- `Agent` -- certificate, enrollment, heartbeat
+- `Cluster` -- name, cloud, environment, kubeconfig (encrypted)
+- `User` / `Role` / `Permission` -- RBAC (action:cloud:env:server matrix)
+- `JoinToken` -- one-time/reusable enrollment tokens
+- `AuditLog` -- action, resource, result, timestamp
+
+**Key Services:**
+- `BastionRegistry` -- in-memory registry of connected bastions, state aggregation, MAC-to-bastion routing
+- `AgentRegistry` -- connected agents, heartbeat tracking
+- `MessageRouter` -- command relay between CLI/agents and bastions
+
+**Command Routing:**
+```
+CLI: labctl provision install <mac> <hostname>
+  -> POST /api/machines/install
+  -> labd finds bastion that knows this MAC
+  -> WebSocket: {type: "command-install", mac, hostname, disk, role}
+  -> bastion updates install_queue
+  -> WebSocket: {type: "command-response", status: "ok"}
+  -> HTTP response to CLI
+```
+
+### @lab/cli (labctl)
+
+Operator CLI. Commander.js binary, distributed as RPM/DEB or standalone bun-compiled executable.
+
+**Command Groups:**
+
+```
+labctl init bastion standalone start|stop|status
+labctl provision list|install|reprovision|forget|debug|logs|makeiso
+labctl app k3s install|health|list
+labctl config list|get|set|path
+labctl login
+labctl doctor
+labctl roles
+```
+
+**Key Features:**
+- Target resolution: hostname, MAC, or IP -> machine lookup
+- SSH reboot into PXE for reprovision/debug (efibootmgr --bootnext)
+- Follow mode: `labctl provision logs <target> -f` (5s polling)
+- Shell completions: bash, fish
+
+### @lab/modules
+
+Declarative configuration modules with three-phase lifecycle: install -> configure -> health.
+
+**k3s Module:**
+- 5 operation groups: host-prep, networking, k3s-server, k3s-agent, hardening
+- 15+ individual operations: kernel modules, sysctl, firewall, Cilium CNI, SELinux, audit policy, pod security, cert checks
+- Health checks: service running, node ready, API health, pod status, Cilium status, secrets encryption
+- SSH execution backend with progress callbacks
+
+### @lab/agent
+
+Daemon on provisioned servers. WebSocket to labd for:
+- Heartbeat (hostname, uptime, CPU/mem usage)
+- Command execution (with stdout/stderr streaming)
+- Log streaming (journalctl relay)
+- mTLS certificate enrollment and rotation
+
+---
+
+## Disk Layout
+
+### LVM Partitioning (labvg)
+
+All roles share a common LVM layout. The kickstart `%pre` auto-detects the install disk (NVMe preferred, then SATA, skipping USB/removable).
+
+| Volume | Size | FS | Reprovision |
+|--------|------|-----|-------------|
+| `/boot/efi` | 600 MB | vfat | Reused |
+| `/boot` | 3 GB | ext4 | Reused |
+| `swap` | 27 GB | swap | Recreated |
+| `/` (root) | 33 GB | xfs | Recreated |
+| `/var` | 100 GB | xfs | Recreated |
+| `/var/log` | 10 GB | xfs | Recreated |
+| `/home` | 10 GB | xfs | **Preserved** |
+| `/srv` | 20 GB | xfs | **Preserved** |
+| `/var/lib/longhorn` | remaining | xfs | **Preserved** (worker) |
+| `/var/lib/rancher` | 20 GB | xfs | **Preserved** (infra) |
+| `/tmp` | 4 GB | tmpfs | - |
+
+Reprovision detection: if `labvg` VG exists, reuse EFI/boot partitions and preserve data volumes.
+
+---
+
+## Kickstart Features
+
+The Fedora kickstart template (`install.ks.ts`) includes:
+
+- **Dynamic disk detection** -- `%pre` probes NVMe/SATA/virtio, skips USB/removable, supports both fresh install and reprovision
+- **Progress callbacks** -- `curl -sf POST /api/progress` at each stage (partitioning, post-install substeps, complete)
+- **Anaconda syslog forwarding** -- `logging --host --port` streams real-time install logs to bastion
+- **SSH hardening** -- key-only auth, root login via pubkey only, admin user with passwordless sudo
+- **Network-first boot order** -- `efibootmgr` reorders boot entries so PXE is always first (bastion controls every reboot)
+- **SysRq magic keys** -- `kernel.sysrq=1` for emergency reboot via KVM keyboard
+- **Role-specific setup:**
+  - `vanilla`: chronyd only
+  - `worker`/`infra`: kernel modules (br_netfilter, overlay), sysctl (ip_forward, inotify), firewalld disabled, k3s binary installed
+  - `infra`: k3s server binary pre-installed
+
+**What is NOT in the kickstart:**
+- `console=ttyS0` -- causes 30s-per-step boot timeout on hardware without physical serial UART (discovered 2026-03-30, see docs/pxe-boot-debugging-2026-03-30.md)
+- Background log streamer (`tail -f`) -- prevents Anaconda from syncing filesystem, causes %post writes to not persist
+
+---
+
+## Deployment
+
+### Container Images
+
+**bastion** (`Dockerfile.bastion`):
+- Base: Fedora 43 (needs dnsmasq, iPXE)
+- Multi-stage: Alpine build -> Fedora runtime
+- iPXE rebuilt from source (SNP driver for EFI)
+- hostNetwork in k8s (DHCP needs raw sockets)
+- Capabilities: NET_ADMIN, NET_RAW
+
+**labd** (`Dockerfile.labd`):
+- Base: Alpine (minimal)
+- Multi-stage build with Prisma client generation
+- Runs as non-root `node` user
+
+### Kubernetes (k3s)
+
+```
+Namespace: lab-infra
+  Deployment: bastion (hostNetwork, PVC for /data, host SSH keys)
+  ConfigMap: bastion-config (env vars)
+  Secret: bastion-join-token
+  PVC: bastion-state (local-path)
+
+Namespace: lab-system
+  Deployment: labd
+  Service: labd (NodePort 30100)
+  StatefulSet: cockroachdb-0
+```
+
+### CLI Distribution
+
+Built with `nfpm` as RPM/DEB. Includes:
+- `/usr/bin/labctl` (bun-compiled standalone binary)
+- `/usr/share/bash-completion/completions/labctl`
+- `/usr/share/fish/vendor_completions.d/labctl.fish`
+
+Config: `~/.labctl/config.yaml` with `labdUrl`, output format, default cloud/environment.
+
+---
+
+## Build & Release
+
+```bash
+# Development
+pnpm install && pnpm build      # Compile all packages
+pnpm test:run                    # Unit tests (vitest)
+npx tsc --noEmit                 # Type check
+
+# Deploy
+bash scripts/deploy.sh all       # Build containers + RPM, push, restart pods
+bash scripts/deploy.sh bastion   # Just bastion
+bash scripts/deploy.sh labd      # Just labd
+bash scripts/deploy.sh labctl    # Just CLI (local RPM install)
+
+# Container builds
+bash scripts/build-bastion.sh --platforms linux/amd64 --push latest
+bash scripts/build-labd.sh --platforms linux/amd64 --push latest
+bash scripts/build-rpm.sh        # RPM + DEB packages
+
+# Integration tests (require libvirt, sudo)
+sudo tests/integration/run-pxe-test.sh
+```
+
+Registry: `mysources.co.uk` (Gitea at 10.0.0.194:3012)
+
+---
+
+## Testing
+
+### Unit Tests
+- Kickstart rendering (ksvalidator syntax check, partition layout, role-specific sections)
+- State management (load, save, update, debug field)
+- Dispatch routing (correct iPXE script for each machine state)
+- Syslog listener (UDP receive, IP->MAC resolution, RFC 3164 parsing)
+
+### Integration Tests (libvirt VMs)
+- **pxe-provision.test.ts** -- Full end-to-end: create VM -> PXE discovery -> queue install -> Anaconda install -> SSH verification -> systemd health -> SELinux enforcing -> boot order check
+- **iso-provision.test.ts** -- ISO boot for non-PXE machines
+- **k3s-single-node.test.ts** -- Post-provision k3s installation and health
+- VM screenshot capture during boot for debugging
+
+---
+
+## Security
+
+- **mTLS** for agent-labd communication (certificate enrollment via join tokens)
+- **SSH key-only auth** on provisioned machines (no password auth)
+- **SELinux enforcing** verified in integration tests
+- **RBAC** (planned): action:cloud:environment:server permission matrix
+- **Audit logging** (planned): every mutation tracked in CockroachDB
+- **Network-first boot order** prevents machines from booting without bastion approval
+- **SysRq keys** enabled for emergency reboot without SSH access
+
+---
+
+## Known Issues & Lessons Learned
+
+### Serial Console Boot Delay (2026-03-30)
+`console=ttyS0,115200n8` in kernel cmdline causes 30-second timeout at every systemd boot phase on hardware without a physical serial UART. Root cause: systemd blocks writing to non-existent UART. Fix: removed from kickstart entirely.
+
+### Anaconda %post Log Streamer
+Background `tail -f` in kickstart `%post` prevents Anaconda from syncing the filesystem. All file writes in %post appear to succeed but are lost on reboot. Fix: removed background log streamer, replaced with Anaconda's built-in `logging --host --port` syslog forwarding.
+
+### Disk Auto-Detection
+Hardcoded `/dev/sda` default broke NVMe-only machines. Fix: default to empty string (auto-detect) which triggers the `%pre` disk probe logic.
+
+### Anaconda Rescue Mode Limitations
+`%pre` and `%post` sections do not execute in `inst.rescue` mode. SSH in rescue mode is provided by Anaconda's `inst.sshd` kernel parameter + `sshpw` kickstart directive. Manual setup via `curl bastion:8080/debug-setup.sh | bash` for nc listener.
+
+---
+
+## Planned Work (Taskmaster)
+
+13 tasks in queue, all pending:
+
+1. **#72** Expand Prisma schema with resource relationships (Network, ServerNic, ServerDisk, ClusterMember)
+2. **#73** State persistence service (bastion state -> CockroachDB)
+3. **#74** State loading from labd on bastion startup
+4. **#75** Fix bastion --dir env var default
+5. **#76** Resource type registry with aliases (kubectl-style)
+6. **#77** `labctl get <resource>` command
+7. **#78** `labctl describe <resource>` command
+8. **#79** `labctl create/delete` commands
+9. **#80** Refactor provision commands to kubectl-style
+10. **#81** Server and resource API endpoints in labd
+11. **#82** RBAC permission checks in CLI
+12. **#83** Audit logging for resource operations
+13. **#84** Update CLI entry point and help text
+
+Additional items not in taskmaster:
+- Ubuntu autoinstall disk auto-detect (still defaults to /dev/sda)
+- Verify `inst.sshd` works end-to-end in rescue mode
+- k3s cluster join vs new cluster distinction in `labctl app k3s install`
+- arm64 container build (iPXE cross-compilation broken)

bastion/docs/kickstart-reference.md

@@ -0,0 +1,103 @@
+# Kickstart Reference — Lessons Learned
+
+This documents pitfalls discovered during PXE boot testing. Read before modifying
+the kickstart template (`src/bastion/src/templates/install.ks.ts`).
+
+## Package requirements
+
+### `kernel-modules` is mandatory
+
+`@core` only installs `kernel-modules-core`, which lacks common modules like `vfat`,
+`zram`, and many network/filesystem drivers. Without `kernel-modules`:
+
+- `/boot/efi` (FAT32) cannot mount → `systemd-remount-fs` fails → **root stays
+  read-only** → sshd-keygen can't write host keys → SSH unreachable
+- `zram-generator` fails → can trigger emergency mode
+
+**Always include `kernel-modules` in %packages.** This matches what the real
+labmaster (192.168.8.11) has installed.
+
+Regression introduced in commit `fac14b6` which removed `@server-product`
+(that group pulled in `kernel-modules` via `fedora-release-server`).
+
+### `dosfstools` is needed
+
+Provides `mkfs.vfat` and ensures FAT filesystem support is available. The real
+labmaster has it installed.
+
+### Verify against the real machine
+
+Before changing the package list, SSH to the labmaster and compare:
+```bash
+ssh 192.168.8.11 "rpm -q <package>"
+```
+
+## Anaconda %post execution order
+
+This is critical and not well documented:
+
+1. `%pre` scripts run
+2. Disk partitioning and formatting
+3. Package installation
+4. **Anaconda writes system config (fstab, hostname, etc.)**
+5. `%post` scripts run (in chroot of installed system)
+6. `%post --nochroot` scripts run
+7. **Anaconda MAY overwrite fstab again after %post scripts**
+
+**Consequence:** You cannot reliably modify `/etc/fstab` from `%post` or
+`%post --nochroot`. Anaconda overwrites it. Tested and confirmed — both
+`sed` in %post and %post --nochroot had no effect on the final fstab.
+
+What DOES work from %post:
+- Writing files to `/etc/` (systemd units, config files, SSH keys)
+- Enabling/disabling systemd services
+- Installing additional packages
+- Running `systemctl enable/mask`
+
+What does NOT work from %post:
+- Modifying `/etc/fstab` (Anaconda overwrites it)
+- `--fsoptions` on `part /boot/efi` (Anaconda ignores it for EFI partitions)
+
+## UEFI / EFI partition
+
+- Anaconda always creates an EFI System Partition for UEFI installs
+- The EFI partition is FAT32 — requires `vfat` kernel module to mount
+- If `/boot/efi` fails to mount, `systemd-remount-fs` fails, which leaves
+  root as read-only. This cascades to break ALL services that need to write
+- The EFI partition is used by firmware directly for bootloader — the OS
+  doesn't strictly need it mounted, but Anaconda adds it to fstab
+
+## VM-specific issues (libvirt/QEMU/OVMF)
+
+### iPXE exit behavior
+- `exit` (no args) returns EFI_SUCCESS → OVMF retries PXE, never reaches disk
+- `exit 1` returns EFI_ABORTED → OVMF moves to next boot device (disk)
+- VM boot order needs both `network` and `hd`: `--boot=uefi,network,hd`
+
+### nftables
+- libvirt creates reject rules for NAT networks in table `ip libvirt_network`
+  (NOT `inet libvirt` — this wrong table name cost hours of debugging)
+- These rules block new host→VM connections (SSH)
+- Rules are recreated on every `virsh start` — must delete after each VM restart
+- Chains: `guest_input` and `guest_output`
+
+### Serial console
+- VM serial port: `--serial=tcp,host=127.0.0.1:4555,mode=bind,protocol=telnet`
+- Use `virsh console <vm-name>` for interactive access (handles telnet protocol)
+- Raw `socat` works for reading but pagers/readline break interactive use
+- Add `console=ttyS0,115200n8` to kernel args for boot output on serial
+
+### SELinux on labmaster
+- Set to **permissive** — this is for k3s/kubernetes, NOT because SSH needs it
+- SSH works fine with SELinux enforcing on a properly installed Fedora system
+- The `ld.so.cache` AVC denials seen during debugging were caused by the
+  read-only root filesystem, not by SELinux policy
+
+## Testing checklist
+
+Before merging kickstart changes:
+1. Check the real labmaster has the same packages: `ssh 192.168.8.11 "rpm -q <pkg>"`
+2. Run the PXE integration test: `sudo pnpm run test:integration:pxe`
+3. Verify via serial console (root / `lab-root-pw`) if SSH fails
+4. Check `mount | grep " / "` — must show `rw`, not `ro`
+5. Check `systemctl --failed` — no critical failures

bastion/docs/pxe-boot-debugging-2026-03-30.md

@@ -0,0 +1,91 @@
+# PXE Boot Debugging Session — 2026-03-30
+
+## Problem
+Beelink SER Mini Pro (AMD Ryzen 7 255, Radeon 780M, 64GB DDR5, 1TB NVMe) boots Fedora 43 100x slower than normal after PXE kickstart install. Every systemd boot phase takes ~30 seconds. The Anaconda installer/rescue mode boots fast on the same hardware.
+
+## Root Cause
+**`console=ttyS0,115200n8` in kernel cmdline** — added via kickstart `bootloader --append` during install.
+
+This mini PC has **no physical serial UART**. When systemd writes to ttyS0, each log write blocks for ~30 seconds waiting for the non-existent UART hardware. Since systemd logs at every phase transition, the total boot time was 10+ minutes.
+
+The Anaconda installer was unaffected because it uses a different init flow that doesn't go through the same systemd phase transitions.
+
+## How We Found It
+Hours of systematic elimination:
+
+| What we tried | Result | Ruled out |
+|---|---|---|
+| `modprobe.blacklist=amdgpu` | No change | GPU driver |
+| `amd_iommu=off` | No change | IOMMU |
+| Rebuild initramfs without plymouth/drm/fips | No change | Initramfs bloat |
+| systemd-boot instead of GRUB | Still slow | Bootloader |
+| PXE-boot kernel+initrd (skip local GRUB entirely) | Still slow | Local bootloader/firmware |
+| Disable TPM in BIOS | No change | TPM |
+| Remove `resume=` + resume dracut module | No change | Hibernate resume |
+| Manual LVM activation in rescue shell | **Fast** | NVMe/LVM themselves |
+| Remove `console=ttyS0,115200n8` from GRUB | **FAST BOOT** | **This was it** |
+
+The key breakthrough was noticing the timestamps showed **exactly 30-second gaps** between boot phases — a timeout pattern, not general slowness. Then realising the serial console was added during install and had never been tested without.
+
+## What Was Fixed (PR #4, merged)
+
+### 1. Removed serial console from kickstart
+- Removed `console=ttyS0,115200n8` from `bootloader --append`
+- Removed `serial-getty@ttyS0.service` enablement
+- Removed rsyslog serial forwarding
+
+### 2. Enabled Anaconda syslog forwarding
+- Uncommented `logging --host --port` directive in kickstart
+- Bastion's SyslogListener was already built — just needed IP→MAC resolution improvement
+- Added `registerIp()` calls from kickstart fetch and progress callbacks
+- Added syslog listener unit tests
+
+### 3. Fixed disk auto-detection
+- Default disk changed from `/dev/sda` to `""` (auto-detect) in labd route and bastion command handler
+- The kickstart `%pre` auto-detect logic probes nvme0n1, sda, sdb, vda in order
+- Without this fix, NVMe-only machines (like the SER Mini Pro) fail immediately
+
+### 4. SysRq magic keys
+- Added `kernel.sysrq=1` sysctl to kickstart `%post`
+- Enables Alt+SysRq+REISUB via JetKVM for emergency reboot of stuck machines
+
+### 5. Simplified debug command
+- Removed `--sshd` flag (SSH always available via `inst.sshd` + `sshpw` in rescue mode)
+- Added `/debug-setup.sh` HTTP endpoint for nc listener setup from rescue shell
+- Cleaned up `sshd` field from DebugConfig, protocol types, all routes
+
+### 6. Added `labctl provision logs -f`
+- Follow mode with 5-second polling for real-time install monitoring
+
+## What Works
+
+- **PXE discovery → install → boot** — full flow works end-to-end
+- **Anaconda syslog forwarding** — install logs stream to bastion
+- **Progress callbacks** — stage-by-stage install tracking via curl
+- **Auto disk detection** — works for NVMe and SATA
+- **Debug rescue mode** — `labctl provision debug <target>` boots Anaconda rescue with SSH
+- **Network-first boot order** — bastion controls every reboot via efibootmgr
+- **SysRq keys** — emergency reboot via JetKVM keyboard
+
+## What Doesn't Work / Known Issues
+
+- **`--sshd` in rescue mode** — Anaconda rescue mode skips both `%pre` and `%post` kickstart sections. `inst.sshd` + `sshpw` should provide SSH access, but hasn't been verified end-to-end yet. The `/debug-setup.sh` curl workaround exists for nc.
+- **arm64 container build** — iPXE cross-compilation fails on arm64 (GCC flag incompatibility). Workaround: build with `--platforms linux/amd64` only.
+- **Integration test SSH timeout** — VM boots fine but SSH times out due to libvirt nftables reject rules after VM restart. Test infrastructure issue, not a code bug.
+
+## What Was Skipped / Left To Do
+
+1. **Syslog UDP port in k3s** — works because bastion uses `hostNetwork: true`, but should be documented properly
+2. **Background log streamer** — the old `tail -f` approach broke Anaconda filesystem sync. Replaced with syslog forwarding. If more granular %post logging is needed, a synchronous log push at end of %post would be safe.
+3. **Per-machine hardware overrides** — turned out not to be needed (serial console was the only "special" setting, and removing it is universal)
+4. **Ubuntu autoinstall disk default** — `ubuntu-autoinstall.ts` still has `disk || "/dev/sda"` fallback (line 38), should be changed to auto-detect
+5. **Verify `inst.sshd` works in rescue mode** — test SSH with password "debug" next time debug mode is used
+6. **Re-enable TPM in BIOS** — was disabled during debugging, should be factory-reset (user plans to reset BIOS to factory)
+
+## Key Learnings
+
+1. **`console=ttyS0` on hardware without UART = 30s timeout per boot phase.** Never add serial console to kernel cmdline unless the hardware has a verified physical UART.
+2. **Exactly-N-second gaps in boot logs = timeout, not slowness.** Look for the timeout source, not performance issues.
+3. **The bisection approach works.** Systematically removing features one at a time found the root cause. But it took hours because the serial console was added early and seemed harmless.
+4. **Anaconda rescue mode is limited.** It skips `%pre` and `%post`, so you can't automate setup via kickstart. Use `inst.sshd` + `sshpw` for SSH, and serve helper scripts via HTTP for everything else.
+5. **Default disk paths break NVMe machines.** Always default to auto-detect (empty string) rather than `/dev/sda`.

bastion/package.json

@@ -22,7 +22,11 @@
     "test:integration:iso": "vitest run -c tests/integration/vitest.config.ts -t 'ISO boot'",
     "test:integration:iso:host": "sudo -E $(which npx) vitest run -c tests/integration/vitest.config.ts -t 'ISO boot'",
     "test:integration:arm-iso": "vitest run -c tests/integration/vitest.config.ts -t 'ARM ISO'",
-    "test:integration:arm-iso:host": "sudo -E $(which npx) vitest run -c tests/integration/vitest.config.ts -t 'ARM ISO'"
+    "test:integration:arm-iso:host": "sudo -E $(which npx) vitest run -c tests/integration/vitest.config.ts -t 'ARM ISO'",
+    "test:integration:asahi": "vitest run -c tests/integration/vitest.config.ts -t 'asahi firstboot'",
+    "test:integration:asahi:host": "sudo -E $(which npx) vitest run -c tests/integration/vitest.config.ts -t 'asahi firstboot'",
+    "test:integration:asahi-validate": "vitest run -c tests/integration/vitest.config.ts -t 'asahi.*validation'",
+    "test:integration:asahi-validate:host": "sudo -E $(which npx) vitest run -c tests/integration/vitest.config.ts -t 'asahi.*validation'"
   },
   "engines": {
     "node": ">=20.0.0",

bastion/scripts/build-asahi-rootfs.sh

@@ -0,0 +1,302 @@
+#!/bin/bash
+# Build a custom Fedora Asahi Remix rootfs with lab firstboot LVM setup.
+#
+# Downloads the upstream Fedora Asahi Remix Server package, injects our
+# firstboot script + systemd service, and repackages it for the bastion.
+#
+# Requirements: root, curl, unzip, mount (loop), zip
+# Output: bastion/asahi-repo/ directory with package + installer_data.json
+#
+# Usage: sudo ./scripts/build-asahi-rootfs.sh [--bastion-ip IP] [--http-port PORT]
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+PROJECT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
+ASAHI_DIR="$PROJECT_DIR/asahi-repo"
+CACHE_DIR="$PROJECT_DIR/.asahi-cache"
+WORK_DIR=""
+
+# Defaults
+BASTION_IP="${BASTION_IP:-192.168.8.23}"
+HTTP_PORT="${HTTP_PORT:-8080}"
+ROLE="${ROLE:-infra}"
+HOSTNAME="${HOSTNAME:-mac-studio}"
+MAC="${MAC:-00:00:00:00:00:00}"
+ADMIN_USER="${ADMIN_USER:-michal}"
+
+# Parse args
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --bastion-ip) BASTION_IP="$2"; shift 2 ;;
+        --http-port) HTTP_PORT="$2"; shift 2 ;;
+        --role) ROLE="$2"; shift 2 ;;
+        --hostname) HOSTNAME="$2"; shift 2 ;;
+        --mac) MAC="$2"; shift 2 ;;
+        --admin-user) ADMIN_USER="$2"; shift 2 ;;
+        *) echo "Unknown option: $1"; exit 1 ;;
+    esac
+done
+
+# ── Resolve upstream package URL ─────────────────────────────────
+echo "==> Fetching Asahi installer data..."
+INSTALLER_DATA=$(curl -sfL "https://cdn.asahilinux.org/installer/installer_data.json")
+
+# Find the Server variant package URL
+SERVER_URL=$(echo "$INSTALLER_DATA" | python3 -c "
+import sys, json
+data = json.load(sys.stdin)
+for os in data.get('os_list', []):
+    name = os.get('name', '').lower()
+    if 'server' in name and 'uefi' not in name and not os.get('expert'):
+        print(os['package'])
+        break
+" 2>/dev/null)
+
+if [ -z "$SERVER_URL" ]; then
+    echo "ERROR: Could not find Fedora Asahi Remix Server in installer data."
+    echo "Available variants:"
+    echo "$INSTALLER_DATA" | python3 -c "
+import sys, json
+data = json.load(sys.stdin)
+for os in data.get('os_list', []):
+    print(f\"  - {os.get('name', '?')}\")" 2>/dev/null
+    exit 1
+fi
+
+PACKAGE_NAME=$(basename "$SERVER_URL")
+echo "    Variant: Fedora Asahi Remix Server"
+echo "    Package: $PACKAGE_NAME"
+
+# Also extract the partition layout and supported_fw from upstream
+UPSTREAM_CONFIG=$(echo "$INSTALLER_DATA" | python3 -c "
+import sys, json
+data = json.load(sys.stdin)
+for os in data.get('os_list', []):
+    name = os.get('name', '').lower()
+    if 'server' in name and 'uefi' not in name and not os.get('expert'):
+        json.dump(os, sys.stdout)
+        break
+")
+
+# ── Download upstream package ────────────────────────────────────
+mkdir -p "$CACHE_DIR" "$ASAHI_DIR"
+
+CACHED_PKG="$CACHE_DIR/$PACKAGE_NAME"
+if [ -f "$CACHED_PKG" ]; then
+    echo "==> Using cached package: $CACHED_PKG"
+else
+    echo "==> Downloading $SERVER_URL..."
+    curl -# -L -o "$CACHED_PKG" "$SERVER_URL"
+fi
+
+# ── Extract and modify rootfs ────────────────────────────────────
+WORK_DIR=$(mktemp -d)
+trap 'echo "==> Cleaning up..."; umount "$WORK_DIR/rootfs" 2>/dev/null || true; rm -rf "$WORK_DIR"' EXIT
+
+echo "==> Extracting package..."
+unzip -q -o "$CACHED_PKG" -d "$WORK_DIR/pkg"
+
+# List contents
+echo "    Package contents:"
+ls -lh "$WORK_DIR/pkg/" | grep -v ^total | while read -r line; do echo "      $line"; done
+
+# Find root.img
+ROOT_IMG=$(find "$WORK_DIR/pkg" -name "root.img" -type f | head -1)
+if [ -z "$ROOT_IMG" ]; then
+    echo "ERROR: root.img not found in package."
+    echo "Contents: $(ls "$WORK_DIR/pkg/")"
+    exit 1
+fi
+
+echo "==> Mounting root.img..."
+mkdir -p "$WORK_DIR/rootfs"
+mount -o loop "$ROOT_IMG" "$WORK_DIR/rootfs"
+
+# ── Read SSH keys from the system ────────────────────────────────
+SSH_KEYS=""
+REAL_USER="${SUDO_USER:-$USER}"
+REAL_HOME=$(eval echo "~$REAL_USER")
+for keyfile in "$REAL_HOME/.ssh/id_ed25519.pub" "$REAL_HOME/.ssh/id_ecdsa.pub" "$REAL_HOME/.ssh/id_rsa.pub"; do
+    if [ -f "$keyfile" ]; then
+        SSH_KEYS=$(cat "$keyfile")
+        echo "    SSH key: $keyfile"
+        break
+    fi
+done
+
+if [ -z "$SSH_KEYS" ]; then
+    echo "WARNING: No SSH public key found. You'll need to add keys manually."
+fi
+
+# ── Generate firstboot script from bastion ───────────────────────
+echo "==> Generating firstboot script..."
+
+# Try to get the script from a running bastion, fall back to local generation
+FIRSTBOOT_SCRIPT=""
+FIRSTBOOT_URL="http://$BASTION_IP:$HTTP_PORT/asahi/firstboot.sh?hostname=$HOSTNAME&role=$ROLE&mac=$MAC&user=$ADMIN_USER"
+FIRSTBOOT_SCRIPT=$(curl -sf "$FIRSTBOOT_URL" 2>/dev/null || echo "")
+
+if [ -z "$FIRSTBOOT_SCRIPT" ]; then
+    echo "    Bastion not reachable, generating script locally..."
+    # Generate a basic firstboot script inline
+    FIRSTBOOT_SCRIPT=$(cd "$PROJECT_DIR" && node -e "
+const { renderFirstbootScript } = require('./src/bastion/dist/templates/asahi-firstboot.sh.js');
+process.stdout.write(renderFirstbootScript({
+    hostname: '$HOSTNAME',
+    role: '$ROLE',
+    serverIp: '$BASTION_IP',
+    httpPort: $HTTP_PORT,
+    sshKeys: $([ -n "$SSH_KEYS" ] && echo "[\"$SSH_KEYS\"]" || echo "[]"),
+    adminUser: '$ADMIN_USER',
+    mac: '$MAC',
+}));
+" 2>/dev/null) || {
+        echo "    ERROR: Could not generate firstboot script. Build the project first: npm run build"
+        exit 1
+    }
+fi
+
+# ── Inject files into rootfs ─────────────────────────────────────
+echo "==> Injecting lab configuration into rootfs..."
+
+# Firstboot script
+mkdir -p "$WORK_DIR/rootfs/usr/local/bin"
+echo "$FIRSTBOOT_SCRIPT" > "$WORK_DIR/rootfs/usr/local/bin/lab-firstboot.sh"
+chmod 755 "$WORK_DIR/rootfs/usr/local/bin/lab-firstboot.sh"
+echo "    Installed: /usr/local/bin/lab-firstboot.sh"
+
+# Systemd service
+mkdir -p "$WORK_DIR/rootfs/etc/systemd/system"
+cat > "$WORK_DIR/rootfs/etc/systemd/system/lab-firstboot.service" << 'UNIT'
+[Unit]
+Description=Lab first-boot LVM setup
+After=local-fs.target network-online.target
+Wants=network-online.target
+ConditionPathExists=!/etc/lab-lvm-setup-done
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/lab-firstboot.sh
+RemainAfterExit=yes
+StandardOutput=journal+console
+StandardError=journal+console
+
+[Install]
+WantedBy=multi-user.target
+UNIT
+echo "    Installed: /etc/systemd/system/lab-firstboot.service"
+
+# Enable the service
+mkdir -p "$WORK_DIR/rootfs/etc/systemd/system/multi-user.target.wants"
+ln -sf /etc/systemd/system/lab-firstboot.service \
+    "$WORK_DIR/rootfs/etc/systemd/system/multi-user.target.wants/lab-firstboot.service"
+echo "    Enabled: lab-firstboot.service"
+
+# SSH authorized keys for root (for initial access before firstboot runs user creation)
+if [ -n "$SSH_KEYS" ]; then
+    mkdir -p "$WORK_DIR/rootfs/root/.ssh"
+    chmod 700 "$WORK_DIR/rootfs/root/.ssh"
+    echo "$SSH_KEYS" > "$WORK_DIR/rootfs/root/.ssh/authorized_keys"
+    chmod 600 "$WORK_DIR/rootfs/root/.ssh/authorized_keys"
+    echo "    Installed: /root/.ssh/authorized_keys"
+fi
+
+# Ensure lvm2 and xfsprogs are installed (should be in server image already)
+echo "    Checking required packages..."
+if [ -f "$WORK_DIR/rootfs/usr/sbin/pvcreate" ] || [ -f "$WORK_DIR/rootfs/usr/bin/pvcreate" ]; then
+    echo "      lvm2: present"
+else
+    echo "      WARNING: lvm2 not found in rootfs. LVM setup may fail."
+fi
+if [ -f "$WORK_DIR/rootfs/usr/sbin/mkfs.xfs" ] || [ -f "$WORK_DIR/rootfs/usr/bin/mkfs.xfs" ]; then
+    echo "      xfsprogs: present"
+else
+    echo "      WARNING: xfsprogs not found in rootfs. LVM setup may fail."
+fi
+
+# ── Unmount and repackage ────────────────────────────────────────
+echo "==> Unmounting rootfs..."
+umount "$WORK_DIR/rootfs"
+
+echo "==> Repackaging..."
+OUTPUT_PKG="$ASAHI_DIR/fedora-asahi-lab.zip"
+rm -f "$OUTPUT_PKG"
+(cd "$WORK_DIR/pkg" && zip -q "$OUTPUT_PKG" *)
+echo "    Output: $OUTPUT_PKG ($(du -sh "$OUTPUT_PKG" | cut -f1))"
+
+# ── Generate installer_data.json ─────────────────────────────────
+echo "==> Generating installer_data.json..."
+
+# Parse upstream config to get supported_fw, boot_object, next_object, and partition details
+python3 << PYEOF > "$ASAHI_DIR/installer_data.json"
+import json, sys
+
+upstream = json.loads('''$UPSTREAM_CONFIG''')
+
+# Build our custom installer data based on upstream
+# Keep EFI and Boot partitions identical, modify Root to not expand,
+# add Data partition that expands for LVM.
+partitions = []
+for p in upstream.get('partitions', []):
+    if p.get('type') == 'EFI':
+        partitions.append(p)
+    elif p.get('name') == 'Boot':
+        partitions.append(p)
+    elif p.get('name') == 'Root':
+        # Fixed size root, no expand
+        root_p = dict(p)
+        root_p['expand'] = False
+        # Keep the original size (it's the minimum needed for the rootfs)
+        partitions.append(root_p)
+
+# Add Data partition for LVM
+partitions.append({
+    "name": "Data",
+    "type": "Linux",
+    "size": "1073741824B",  # 1GB minimum, will expand
+    "expand": True
+})
+
+data = {
+    "os_list": [{
+        "name": "Fedora Asahi Lab (${ROLE})",
+        "default_os_name": "Fedora Linux Lab",
+        "boot_object": upstream.get("boot_object", "m1n1.bin"),
+        "next_object": upstream.get("next_object", "m1n1/boot.bin"),
+        "package": "fedora-asahi-lab.zip",
+        "supported_fw": upstream.get("supported_fw", ["13.5"]),
+        "partitions": partitions,
+    }]
+}
+
+json.dump(data, sys.stdout, indent=2)
+print()
+PYEOF
+
+echo "    Generated: $ASAHI_DIR/installer_data.json"
+
+# Pretty-print the partition layout
+echo ""
+echo "    Partition layout:"
+python3 -c "
+import json
+with open('$ASAHI_DIR/installer_data.json') as f:
+    data = json.load(f)
+for p in data['os_list'][0]['partitions']:
+    size = p.get('size', '?')
+    expand = ' (expand)' if p.get('expand') else ''
+    image = f\" [{p['image']}]\" if 'image' in p else ''
+    print(f\"      {p['name']:8s} {p['type']:8s} {size:>16s}{expand}{image}\")
+"
+
+echo ""
+echo "==> Build complete!"
+echo ""
+echo "    Package: $ASAHI_DIR/fedora-asahi-lab.zip"
+echo "    Config:  $ASAHI_DIR/installer_data.json"
+echo ""
+echo "    To serve from bastion, copy to the bastion's HTTP directory"
+echo "    or configure REPO_BASE to point here."
+echo ""
+echo "    To install on Mac Studio:"
+echo "      curl http://$BASTION_IP:$HTTP_PORT/asahi | sh"

bastion/scripts/build-bastion.sh

@@ -99,16 +99,22 @@ if [ "$PUSH" = true ]; then
     fi
   fi
 
+  # Use --tls-verify=false for plain HTTP registries (e.g. 10.0.0.194:3012)
+  TLS_FLAG=""
+  if [[ "$REGISTRY" =~ ^[0-9] ]] || [[ "$REGISTRY" =~ ^localhost ]]; then
+    TLS_FLAG="--tls-verify=false"
+  fi
+
   echo "==> Logging in to $REGISTRY..."
-  podman login -u michal -p "$GITEA_TOKEN" "$REGISTRY"
+  podman login $TLS_FLAG -u michal -p "$GITEA_TOKEN" "$REGISTRY"
 
   echo "==> Pushing $FULL_IMAGE:$TAG..."
-  podman manifest push --all "$MANIFEST" "docker://$FULL_IMAGE:$TAG"
+  podman manifest push --all $TLS_FLAG "$MANIFEST" "docker://$FULL_IMAGE:$TAG"
 
   # Also tag as :latest if not already
   if [ "$TAG" != "latest" ]; then
     echo "==> Also pushing as :latest..."
-    podman manifest push --all "$MANIFEST" "docker://$FULL_IMAGE:latest"
+    podman manifest push --all $TLS_FLAG "$MANIFEST" "docker://$FULL_IMAGE:latest"
   fi
 
   # Link package to repository if script exists

bastion/scripts/build-labd.sh

@@ -92,15 +92,21 @@ if [ "$PUSH" = true ]; then
     fi
   fi
 
+  # Use --tls-verify=false for plain HTTP registries (e.g. 10.0.0.194:3012)
+  TLS_FLAG=""
+  if [[ "$REGISTRY" =~ ^[0-9] ]] || [[ "$REGISTRY" =~ ^localhost ]]; then
+    TLS_FLAG="--tls-verify=false"
+  fi
+
   echo "==> Logging in to $REGISTRY..."
-  podman login -u michal -p "$GITEA_TOKEN" "$REGISTRY"
+  podman login $TLS_FLAG -u michal -p "$GITEA_TOKEN" "$REGISTRY"
 
   echo "==> Pushing $FULL_IMAGE:$TAG..."
-  podman manifest push --all "$MANIFEST" "docker://$FULL_IMAGE:$TAG"
+  podman manifest push --all $TLS_FLAG "$MANIFEST" "docker://$FULL_IMAGE:$TAG"
 
   if [ "$TAG" != "latest" ]; then
     echo "==> Also pushing as :latest..."
-    podman manifest push --all "$MANIFEST" "docker://$FULL_IMAGE:latest"
+    podman manifest push --all $TLS_FLAG "$MANIFEST" "docker://$FULL_IMAGE:latest"
   fi
 
   if [ -f "$SCRIPT_DIR/link-package.sh" ]; then

bastion/scripts/deploy.sh

@@ -0,0 +1,89 @@
+#!/bin/bash
+# Deploy bastion + labd to k3s cluster and install labctl locally.
+# Usage: ./scripts/deploy.sh [bastion|labd|labctl|all]
+#
+# Builds container images with existing build scripts, pushes to Gitea
+# registry, restarts k3s pods, and builds/installs labctl RPM.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+PROJECT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+cd "$PROJECT_DIR"
+
+# Load .env if present
+if [ -f .env ]; then
+  set -a; source .env; set +a
+fi
+
+deploy_bastion() {
+    echo "=== Building & pushing bastion image ==="
+    bash scripts/build-bastion.sh --push latest
+    echo ""
+    echo "=== Restarting bastion pod ==="
+    kubectl rollout restart deployment/bastion -n lab-infra
+    kubectl rollout status deployment/bastion -n lab-infra --timeout=180s
+    echo "✓ Bastion deployed"
+
+    # Sync Asahi rootfs package to bastion pod's persistent volume
+    if [ -d "$PROJECT_DIR/asahi-repo" ] && [ -f "$PROJECT_DIR/asahi-repo/fedora-asahi-lab.zip" ]; then
+        echo ""
+        echo "=== Syncing Asahi rootfs to bastion pod ==="
+        BASTION_POD=$(kubectl get pods -n lab-infra -l app=bastion -o jsonpath='{.items[0].metadata.name}' 2>/dev/null)
+        if [ -n "$BASTION_POD" ]; then
+            kubectl exec -n lab-infra "$BASTION_POD" -- mkdir -p /data/asahi-repo
+            kubectl cp "$PROJECT_DIR/asahi-repo/installer_data.json" "lab-infra/$BASTION_POD:/data/asahi-repo/installer_data.json"
+            kubectl cp "$PROJECT_DIR/asahi-repo/fedora-asahi-lab.zip" "lab-infra/$BASTION_POD:/data/asahi-repo/fedora-asahi-lab.zip"
+            echo "✓ Asahi rootfs synced ($(du -sh "$PROJECT_DIR/asahi-repo/fedora-asahi-lab.zip" | cut -f1))"
+        else
+            echo "WARNING: Could not find bastion pod — Asahi rootfs not synced"
+        fi
+    fi
+}
+
+deploy_labd() {
+    echo "=== Building & pushing labd image ==="
+    bash scripts/build-labd.sh --push latest
+    echo ""
+    echo "=== Restarting labd pod ==="
+    kubectl rollout restart deployment/labd -n lab-system
+    kubectl rollout status deployment/labd -n lab-system --timeout=180s
+    echo "✓ Labd deployed"
+}
+
+deploy_labctl() {
+    echo "=== Building labctl RPM ==="
+    bash scripts/build-rpm.sh
+    echo ""
+    echo "=== Installing labctl ==="
+    RPM_FILE=$(ls dist/labctl-*.x86_64.rpm 2>/dev/null | head -1)
+    if [ -n "$RPM_FILE" ]; then
+        sudo rpm -U --force "$RPM_FILE"
+        echo "✓ labctl installed: $(labctl --version 2>/dev/null || echo 'installed')"
+    else
+        echo "WARNING: No RPM found, falling back to direct install"
+        pnpm build
+        sudo install -m 755 <(echo '#!/bin/bash'; echo "exec node $PROJECT_DIR/src/cli/dist/index.js \"\$@\"") /usr/local/bin/labctl
+        echo "✓ labctl installed (dev mode)"
+    fi
+}
+
+case "${1:-all}" in
+    bastion)  deploy_bastion ;;
+    labd)     deploy_labd ;;
+    labctl)   deploy_labctl ;;
+    all)
+        deploy_bastion
+        echo ""
+        deploy_labd
+        echo ""
+        deploy_labctl
+        ;;
+    *)
+        echo "Usage: $0 [bastion|labd|labctl|all]"
+        exit 1
+        ;;
+esac
+
+echo ""
+echo "=== Deploy complete ==="

bastion/scripts/fix-ssh-root.sh

@@ -0,0 +1,131 @@
+#!/bin/bash
+# Fix root SSH access on all provisioned machines.
+# Tries root, lab, michal users to find one that works,
+# then ensures root has the SSH key and PermitRootLogin is enabled.
+set -euo pipefail
+
+SSH_KEY="ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDMJ3FkUGbG174eoO5RjZd2eNV680FM5pgp0AgpW/QwlJExK3qxMk0DJSr4ICmzGUx4yujAXcrqU1otcOMPzzFzwc5heWpSmlNHU3TIW6NHEt0sF9ZTAbGLw2zSw3si5UouqFkCcENA40mePFJqY+Q9R8N1uvLgu4m/do+Zrn/mk5Ewc1V7OCRE5Acrnaec4T7LTB0BuVXcjPUfAmZ0q5fI+bKPR1q2Kc3+IeGhVkBuZ9OJVeXXhnpedm0uEbLeriK/jUYKYw/1QhsNDM8Tyty+UIGr9QVnWwzCMHB+wuQcDYC9mPGTqg0fYwX8Mp8xMi1PPxdsh1G7bj/cpWMAF43KswWORF2ul8ICGbaE1zEgIYXO790SuBjpBHhaC6Iegqi58hmCuP+a9893q/EU9HyrWTJHCZXC5E4kP1MsM57KrhEpszM6I3sW9f9zMTPd5QsCXFi4si4OMwX4kYNVu3fQGQPpseDPlTTSrT6uUdqj4Irm0c1m9cYTmK0vYgsM3ss= michal@fedora"
+
+SSH_OPTS="-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR -o ConnectTimeout=5"
+USERS_TO_TRY=(root lab michal)
+
+# Machines: hostname ip
+MACHINES=(
+    "labmaster 192.168.8.11"
+    "worker0-k8s0 192.168.8.23"
+    "worker1-k8s0 192.168.8.13"
+    "worker2-k8s0 192.168.8.25"
+    "spark-2935 192.168.8.12"
+)
+
+BOLD="\033[1m"
+GREEN="\033[0;32m"
+RED="\033[0;31m"
+DIM="\033[2m"
+RESET="\033[0m"
+
+# Script to run on each machine (via sudo if needed)
+read -r -d '' FIX_SCRIPT << 'FIXEOF' || true
+#!/bin/bash
+set -e
+KEY="$1"
+
+# 1. Ensure root .ssh dir exists
+mkdir -p /root/.ssh
+chmod 700 /root/.ssh
+touch /root/.ssh/authorized_keys
+chmod 600 /root/.ssh/authorized_keys
+
+# 2. Add key if not present
+if ! grep -qF "$KEY" /root/.ssh/authorized_keys 2>/dev/null; then
+    echo "$KEY" >> /root/.ssh/authorized_keys
+    echo "KEY_ADDED"
+else
+    echo "KEY_EXISTS"
+fi
+
+# 3. Fix sshd_config for root login with keys
+SSHD_CONF="/etc/ssh/sshd_config"
+CHANGED=0
+
+# Ensure PermitRootLogin allows key auth
+CURRENT=$(grep -E "^PermitRootLogin" "$SSHD_CONF" 2>/dev/null | tail -1 || true)
+if [ "$CURRENT" = "PermitRootLogin prohibit-password" ] || [ "$CURRENT" = "PermitRootLogin without-password" ]; then
+    echo "SSHD_OK"
+elif [ "$CURRENT" = "PermitRootLogin yes" ]; then
+    echo "SSHD_OK"
+else
+    # Remove any existing PermitRootLogin lines
+    sed -i '/^#*PermitRootLogin/d' "$SSHD_CONF"
+    echo "PermitRootLogin prohibit-password" >> "$SSHD_CONF"
+    CHANGED=1
+    echo "SSHD_FIXED"
+fi
+
+# Ensure PubkeyAuthentication is enabled
+if grep -qE "^PubkeyAuthentication no" "$SSHD_CONF" 2>/dev/null; then
+    sed -i 's/^PubkeyAuthentication no/PubkeyAuthentication yes/' "$SSHD_CONF"
+    CHANGED=1
+    echo "PUBKEY_FIXED"
+else
+    echo "PUBKEY_OK"
+fi
+
+# Restart sshd if changed
+if [ "$CHANGED" -eq 1 ]; then
+    systemctl restart sshd 2>/dev/null || systemctl restart ssh 2>/dev/null || true
+    echo "SSHD_RESTARTED"
+fi
+
+# 4. Verify root can be reached
+echo "DONE"
+FIXEOF
+
+echo ""
+echo -e "${BOLD}Fixing root SSH access on all machines...${RESET}"
+echo ""
+
+for entry in "${MACHINES[@]}"; do
+    read -r hostname ip <<< "$entry"
+    printf "  %-24s ${DIM}(%s)${RESET}  " "$hostname" "$ip"
+
+    # Try each user until one works
+    WORKING_USER=""
+    for user in "${USERS_TO_TRY[@]}"; do
+        if ssh $SSH_OPTS "$user@$ip" "true" 2>/dev/null; then
+            WORKING_USER="$user"
+            break
+        fi
+    done
+
+    if [ -z "$WORKING_USER" ]; then
+        echo -e "${RED}UNREACHABLE${RESET} (tried: ${USERS_TO_TRY[*]})"
+        continue
+    fi
+
+    # Run fix script (with sudo if not root)
+    if [ "$WORKING_USER" = "root" ]; then
+        RESULT=$(ssh $SSH_OPTS "root@$ip" "bash -s -- '$SSH_KEY'" <<< "$FIX_SCRIPT" 2>&1)
+    else
+        RESULT=$(ssh $SSH_OPTS "$WORKING_USER@$ip" "sudo bash -s -- '$SSH_KEY'" <<< "$FIX_SCRIPT" 2>&1)
+    fi
+
+    # Parse result
+    DETAILS=""
+    if echo "$RESULT" | grep -q "KEY_ADDED"; then DETAILS="key added"; fi
+    if echo "$RESULT" | grep -q "KEY_EXISTS"; then DETAILS="key ok"; fi
+    if echo "$RESULT" | grep -q "SSHD_FIXED"; then DETAILS="$DETAILS, sshd fixed"; fi
+    if echo "$RESULT" | grep -q "SSHD_OK"; then DETAILS="$DETAILS, sshd ok"; fi
+    if echo "$RESULT" | grep -q "SSHD_RESTARTED"; then DETAILS="$DETAILS, restarted"; fi
+
+    # Verify root works now
+    if ssh $SSH_OPTS "root@$ip" "true" 2>/dev/null; then
+        echo -e "${GREEN}OK${RESET} ${DIM}(via $WORKING_USER: $DETAILS)${RESET}"
+    else
+        echo -e "${RED}PARTIAL${RESET} ${DIM}(via $WORKING_USER: $DETAILS -- root still blocked)${RESET}"
+    fi
+done
+
+echo ""
+echo -e "${BOLD}Done.${RESET} Verify: labctl provision recheck --user root"
+echo ""

bastion/src/bastion/src/config.ts

@@ -14,6 +14,8 @@ export function loadConfig(overrides: Partial<BastionConfig> = {}): BastionConfi
   const dhcpRangeStart = overrides.dhcpRangeStart ?? process.env["DHCP_RANGE_START"] ?? "";
   const dhcpRangeEnd = overrides.dhcpRangeEnd ?? process.env["DHCP_RANGE_END"] ?? "";
 
+  const syslogPort = overrides.syslogPort ?? parseInt(process.env["SYSLOG_PORT"] ?? "5514", 10);
+
   const ubuntuVersion = overrides.ubuntuVersion ?? process.env["UBUNTU_VERSION"] ?? "26.04";
   const ubuntuMirror = overrides.ubuntuMirror ?? process.env["UBUNTU_MIRROR"]
     ?? `https://releases.ubuntu.com/${ubuntuVersion}`;
@@ -43,6 +45,7 @@ export function loadConfig(overrides: Partial<BastionConfig> = {}): BastionConfi
     gateway: overrides.gateway ?? "",
     sshKeys: overrides.sshKeys ?? [],
     adminUser: overrides.adminUser ?? "",
+    syslogPort,
     skipDnsmasq: overrides.skipDnsmasq,
     skipArtifacts: overrides.skipArtifacts,
     labdUrl: overrides.labdUrl ?? process.env["LABD_URL"],

bastion/src/bastion/src/main.ts

@@ -220,10 +220,11 @@ export async function startBastion(overrides: Partial<BastionConfig> = {}): Prom
     openFirewall(config);
   }
 
-  // Start HTTP server
-  const { app, state } = createApp(config);
+  // Start HTTP server + syslog listener
+  const { app, state, syslog } = createApp(config);
   await app.listen({ port: config.httpPort, host: "0.0.0.0" });
   logger.info(`HTTP server listening on :${config.httpPort}`);
+  syslog.start();
 
   // Start dnsmasq (unless skipped)
   if (config.skipDnsmasq !== true) {
@@ -256,7 +257,7 @@ export async function startBastion(overrides: Partial<BastionConfig> = {}): Prom
       state.update((s) => {
         s.install_queue[msg.mac] = {
           hostname: msg.hostname,
-          disk: msg.disk ?? "/dev/sda",
+          disk: msg.disk ?? "",
           role: msg.role as import("@lab/shared").Role,
           os: msg.os as import("@lab/shared").OsId,
           queued_at: new Date().toISOString(),
@@ -265,6 +266,22 @@ export async function startBastion(overrides: Partial<BastionConfig> = {}): Prom
       return { status: "ok", data: { mac: msg.mac, hostname: msg.hostname } };
     });
 
+    labdConn.onCommand("command-debug", async (msg) => {
+      if (msg.type !== "command-debug") throw new Error("unexpected");
+      const mac = msg.mac.toLowerCase();
+      const pxeBoot = msg.pxeBoot ?? false;
+      const currentState = state.load();
+      const hostname =
+        currentState.installed[mac]?.hostname ??
+        currentState.install_queue[mac]?.hostname ??
+        currentState.discovered[mac]?.product ??
+        mac;
+      state.update((s) => {
+        s.debug[mac] = { hostname, queued_at: new Date().toISOString(), pxeBoot };
+      });
+      return { status: "ok", data: { mac, hostname } };
+    });
+
     labdConn.onCommand("command-forget", async (msg) => {
       if (msg.type !== "command-forget") throw new Error("unexpected");
       const mac = msg.mac.toLowerCase();
@@ -272,10 +289,52 @@ export async function startBastion(overrides: Partial<BastionConfig> = {}): Prom
         delete s.discovered[mac];
         delete s.install_queue[mac];
         delete s.installed[mac];
+        delete s.debug[mac];
       });
       return { status: "ok", data: { mac } };
     });
 
+    labdConn.onCommand("command-register", async (msg) => {
+      if (msg.type !== "command-register") throw new Error("unexpected");
+      const mac = msg.mac.toLowerCase();
+      state.update((s) => {
+        s.installed[mac] = {
+          hostname: msg.hostname,
+          role: msg.role,
+          ip: msg.ip,
+          installed_at: new Date().toISOString(),
+        };
+      });
+      logger.info(`MACHINE REGISTERED: ${mac} -> ${msg.hostname} (${msg.role}) ip=${msg.ip}`);
+      return { status: "ok", data: { mac, hostname: msg.hostname } };
+    });
+
+    labdConn.onCommand("command-discover", async (msg) => {
+      if (msg.type !== "command-discover") throw new Error("unexpected");
+      const mac = (msg.mac as string).toLowerCase();
+      const now = new Date().toISOString();
+      const existing = state.load().discovered[mac];
+      state.update((s) => {
+        s.discovered[mac] = {
+          mac,
+          product: (msg.product as string) ?? "unknown",
+          board: (msg.board as string) ?? "unknown",
+          serial: (msg.serial as string) ?? "unknown",
+          manufacturer: (msg.manufacturer as string) ?? "unknown",
+          cpu_model: (msg.cpu_model as string) ?? "unknown",
+          cpu_cores: (msg.cpu_cores as number) ?? 0,
+          memory_gb: (msg.memory_gb as number) ?? 0,
+          arch: (msg.arch as string) ?? "unknown",
+          disks: (msg.disks as Array<{ name: string; size_gb: number; model: string }>) ?? [],
+          nics: (msg.nics as Array<{ name: string; mac: string; state: string }>) ?? [],
+          first_seen: existing?.first_seen ?? now,
+          last_seen: now,
+        };
+      });
+      logger.info(`HARDWARE UPDATED: ${mac} -- ${msg.manufacturer ?? "?"} ${msg.product ?? "?"} (${msg.cpu_model ?? "?"}, ${msg.cpu_cores ?? "?"} cores, ${msg.memory_gb ?? "?"}GB RAM)`);
+      return { status: "ok", data: { mac } };
+    });
+
     labdConn.onCommand("command-role-update", async (msg) => {
       if (msg.type !== "command-role-update") throw new Error("unexpected");
       const mac = msg.mac.toLowerCase();
@@ -310,6 +369,7 @@ export async function startBastion(overrides: Partial<BastionConfig> = {}): Prom
   // Graceful shutdown
   const shutdown = async (): Promise<void> => {
     logger.info("Shutting down...");
+    syslog.stop();
     if (labdConn) labdConn.close();
     if (config.skipDnsmasq !== true) stopDnsmasq();
     closeFirewall(config);

bastion/src/bastion/src/routes/api.ts

@@ -13,11 +13,13 @@ import { triggerPostProvisionK3s } from "../services/post-provision.js";
 import { progressBus } from "../services/progress-events.js";
 import type { ProgressEvent } from "../services/progress-events.js";
 import type { InstallLogBuffer } from "../services/install-log.js";
+import type { SyslogListener } from "../services/syslog-listener.js";
 
 export function registerApiRoutes(
   app: FastifyInstance,
   state: StateManager,
   installLog: InstallLogBuffer,
+  syslog: SyslogListener,
 ): void {
   // List all machines
   app.get("/api/machines", async (_request, reply) => {
@@ -84,6 +86,11 @@ export function registerApiRoutes(
     const { mac: rawMac, stage, detail } = request.body ?? {};
     const mac = (rawMac ?? "unknown").toLowerCase();
     const stageName = stage ?? "unknown";
+
+    // Register IP → MAC for syslog routing
+    if (mac !== "unknown") {
+      syslog.registerIp(request.ip, mac);
+    }
     const detailStr = detail ?? "";
 
     const GREEN = "\x1b[0;32m";
@@ -132,16 +139,26 @@ export function registerApiRoutes(
             ? detailStr.replace("ready at ", "").trim()
             : "";
 
+          const hw = s.discovered[mac];
           const installedInfo: InstalledInfo = {
             hostname: cfg?.hostname ?? "?",
             role: cfg?.role ?? "?",
             ...(cfg?.os !== undefined ? { os: cfg.os } : {}),
             ip,
             installed_at: new Date().toISOString(),
+            // Preserve hardware info from discovery
+            ...(hw ? {
+              product: hw.product,
+              manufacturer: hw.manufacturer,
+              cpu_model: hw.cpu_model,
+              cpu_cores: hw.cpu_cores,
+              memory_gb: hw.memory_gb,
+              arch: hw.arch,
+            } : {}),
           };
           s.installed[mac] = installedInfo;
 
-          const admin = installedInfo.role !== "vanilla" && installedInfo.role !== "" ? "michal" : "root";
+          const admin = installedInfo.role !== "vanilla" && installedInfo.role !== "" ? "lab" : "root";
           console.log(`\n  \x1b[0;32m\x1b[1m  ssh ${admin}@${ip}\x1b[0m\n`);  // eslint-disable-line no-console
 
           // Auto-install k3s for non-vanilla roles
@@ -189,6 +206,32 @@ export function registerApiRoutes(
     return reply.send({ status: "ok", lines: allLines.length });
   });
 
+  // Queue debug/rescue mode for a machine
+  app.post<{
+    Body: { mac?: string; pxeBoot?: boolean };
+  }>("/api/debug", async (request, reply) => {
+    const mac = (request.body?.mac ?? "").toLowerCase().replace(/-/g, ":");
+    const pxeBoot = request.body?.pxeBoot ?? false;
+    if (mac === "") {
+      return reply.status(400).send({ error: "mac is required" });
+    }
+
+    // Look up hostname from installed or discovered state
+    const currentState = state.load();
+    const hostname =
+      currentState.installed[mac]?.hostname ??
+      currentState.install_queue[mac]?.hostname ??
+      currentState.discovered[mac]?.product ??
+      mac;
+
+    state.update((s) => {
+      s.debug[mac] = { hostname, queued_at: new Date().toISOString(), pxeBoot };
+    });
+
+    logger.info(`DEBUG QUEUED: ${mac} -> ${hostname}`);
+    return reply.send({ status: "ok", mac, hostname });
+  });
+
   // Delete a machine from all state
   app.delete<{
     Params: { mac: string };
@@ -213,6 +256,10 @@ export function registerApiRoutes(
         delete s.installed[mac];
         found = true;
       }
+      if (s.debug[mac] !== undefined) {
+        delete s.debug[mac];
+        found = true;
+      }
     });
 
     if (!found) {
@@ -278,6 +325,67 @@ export function registerApiRoutes(
     return reply.send({ status: "ok", mac, new: isNew });
   });
 
+  // Register an already-installed machine (e.g. re-add after state loss)
+  app.post<{
+    Body: {
+      mac?: string;
+      hostname?: string;
+      role?: string;
+      ip?: string;
+    };
+  }>("/api/register", async (request, reply) => {
+    const { mac: rawMac, hostname, role, ip } = request.body ?? {};
+    const mac = (rawMac ?? "").toLowerCase().replace(/-/g, ":");
+
+    if (mac === "") {
+      return reply.status(400).send({ error: "mac is required" });
+    }
+    if (!hostname) {
+      return reply.status(400).send({ error: "hostname is required" });
+    }
+
+    const validRole = role ?? "worker";
+    if (!(SUPPORTED_ROLES as readonly string[]).includes(validRole)) {
+      return reply.status(400).send({ error: `invalid role: '${validRole}'. Supported: ${SUPPORTED_ROLES.join(", ")}` });
+    }
+
+    state.update((s) => {
+      s.installed[mac] = {
+        hostname,
+        role: validRole,
+        ip: ip ?? "",
+        installed_at: new Date().toISOString(),
+      };
+    });
+
+    logger.info(`MACHINE REGISTERED: ${mac} -> hostname=${hostname} role=${validRole} ip=${ip ?? ""}`);
+
+    return reply.send({
+      status: "registered",
+      mac,
+      hostname,
+      role: validRole,
+      ip: ip ?? "",
+    });
+  });
+
+  // Simple machine state query (used by ks-auto for ISO boot dispatch)
+  app.get<{
+    Params: { mac: string };
+  }>("/api/machine-state/:mac", async (request, reply) => {
+    const mac = request.params.mac.toLowerCase().replace(/-/g, ":");
+    const currentState = state.load();
+
+    if (currentState.debug[mac]) return reply.send("debug");
+    if (currentState.install_queue[mac]) {
+      const progress = currentState.install_queue[mac].progress;
+      return reply.send(progress ? "installing" : "queued");
+    }
+    if (currentState.installed[mac]) return reply.send("installed");
+    if (currentState.discovered[mac]) return reply.send("discovered");
+    return reply.send("unknown");
+  });
+
   // Update a machine's role (e.g. promote infra -> labcontroller)
   app.post<{
     Body: {

bastion/src/bastion/src/routes/asahi.ts

@@ -0,0 +1,176 @@
+// Routes for Asahi Linux provisioning.
+// GET /asahi                     — wrapper script (curl bastion:8080/asahi | sh)
+// GET /asahi/installer_data.json — custom installer config (built or fallback)
+// GET /asahi/repo/*              — serves built rootfs package (fedora-asahi-lab.zip)
+// GET /asahi/firstboot.sh        — first-boot LVM setup script (for manual use)
+
+import type { FastifyInstance } from "fastify";
+import fastifyStatic from "@fastify/static";
+import { existsSync, readFileSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import type { BastionConfig } from "@lab/shared";
+import { renderFirstbootScript, renderFirstbootUnit } from "../templates/asahi-firstboot.sh.js";
+import type { Role } from "@lab/shared";
+
+/** Find the asahi-repo directory (built by scripts/build-asahi-rootfs.sh). */
+function findAsahiRepo(config: BastionConfig): string | null {
+  // Check relative to bastionDir (container deploy)
+  const inBastionDir = join(config.bastionDir, "asahi-repo");
+  if (existsSync(inBastionDir)) return inBastionDir;
+
+  // Check /data/asahi-repo (PVC mount in k3s container)
+  if (existsSync("/data/asahi-repo")) return "/data/asahi-repo";
+
+  // Check relative to project root (dev mode)
+  try {
+    const thisDir = dirname(fileURLToPath(import.meta.url));
+    const projectRoot = join(thisDir, "..", "..", "..", "..");
+    const inProjectRoot = join(projectRoot, "asahi-repo");
+    if (existsSync(inProjectRoot)) return inProjectRoot;
+  } catch { /* import.meta.url not available in tests */ }
+
+  return null;
+}
+
+export function registerAsahiRoutes(app: FastifyInstance, config: BastionConfig): void {
+  const repoDir = findAsahiRepo(config);
+
+  // Serve built rootfs package files (fedora-asahi-lab.zip, etc.)
+  if (repoDir) {
+    app.register(fastifyStatic, {
+      root: repoDir,
+      prefix: "/asahi/repo/",
+      decorateReply: false,
+    });
+  }
+
+  // Wrapper script — user runs: curl http://bastion:8080/asahi | sh
+  app.get("/asahi", async (_request, reply) => {
+    const script = `#!/bin/bash
+# Lab Asahi provisioner — sets up Apple Silicon machines with lab LVM layout.
+# This wraps the standard Asahi installer with custom installer_data.json
+# that creates a separate LVM data partition.
+set -euo pipefail
+
+BASTION="http://${config.serverIp}:${config.httpPort}"
+
+echo ""
+echo "  ╔══════════════════════════════════════════════╗"
+echo "  ║  Lab Asahi Provisioner                       ║"
+echo "  ║  Bastion: \${BASTION}                         ║"
+echo "  ╚══════════════════════════════════════════════╝"
+echo ""
+
+# Check we're on macOS
+if [ "$(uname)" != "Darwin" ]; then
+    echo "ERROR: This script must be run from macOS on the target Mac."
+    echo "       It uses the Asahi Linux installer to set up Apple Silicon boot."
+    exit 1
+fi
+
+# Download the standard Asahi installer
+echo "Downloading Asahi Linux installer..."
+WORKDIR=$(mktemp -d)
+cd "$WORKDIR"
+
+INSTALLER_BASE="https://cdn.asahilinux.org/installer"
+PKG_VER=$(curl -s "\${INSTALLER_BASE}/latest")
+echo "  Version: \${PKG_VER}"
+
+curl -# -L -o "installer-\${PKG_VER}.tar.gz" "\${INSTALLER_BASE}/installer-\${PKG_VER}.tar.gz"
+
+echo "  Extracting..."
+tar xf "installer-\${PKG_VER}.tar.gz"
+
+# Download our custom installer_data.json (installer reads it as a local file)
+echo "  Downloading custom installer data from bastion..."
+curl -sfL -o installer_data.json "\${BASTION}/asahi/installer_data.json"
+
+# Pre-download the rootfs package (avoids Python HTTP streaming issues on macOS)
+echo "  Downloading rootfs package from bastion..."
+mkdir -p os
+curl -# -L -o os/fedora-asahi-lab.zip "\${BASTION}/asahi/repo/fedora-asahi-lab.zip"
+
+# Point installer to local directory (REPO_BASE + /os/ + package name)
+export REPO_BASE="\${PWD}"
+
+echo ""
+echo "  Using custom partition layout + rootfs from bastion."
+echo "  This will create:"
+echo "    - Standard Asahi boot infrastructure (m1n1 + U-Boot)"
+echo "    - Fedora Asahi Remix root partition"
+echo "    - LVM data partition (remaining space)"
+echo ""
+echo "  After first boot, SSH in and set up LVM:"
+echo "    ssh lab@<ip> 'curl -sf \${BASTION}/asahi/firstboot.sh | sudo bash'"
+echo ""
+
+# Run the installer
+if [ "$USER" != "root" ]; then
+    echo "The installer needs root. Enter your sudo password if prompted."
+    exec caffeinate -dis sudo -E ./install.sh "$@"
+else
+    exec caffeinate -dis ./install.sh "$@"
+fi
+`;
+    return reply.type("text/x-shellscript").send(script);
+  });
+
+  // Custom installer_data.json — serves built config or fallback
+  app.get("/asahi/installer_data.json", async (_request, reply) => {
+    // Prefer the built installer_data.json (from build-asahi-rootfs.sh)
+    if (repoDir) {
+      const builtConfig = join(repoDir, "installer_data.json");
+      if (existsSync(builtConfig)) {
+        const data = JSON.parse(readFileSync(builtConfig, "utf-8"));
+        return reply.type("application/json").send(data);
+      }
+    }
+
+    // Fallback: minimal config (won't have boot.img, for testing only)
+    return reply.type("application/json").send({
+      os_list: [{
+        name: "Fedora Asahi Lab",
+        default_os_name: "Fedora Linux with Lab LVM",
+        boot_object: "m1n1.bin",
+        next_object: "m1n1/boot.bin",
+        package: "fedora-asahi-lab.zip",
+        supported_fw: ["13.5"],
+        partitions: [
+          { name: "EFI", type: "EFI", size: "524288000B", format: "fat",
+            copy_firmware: true, copy_installer_data: true, source: "esp" },
+          { name: "Root", type: "Linux", size: "5368709120B", image: "root.img", expand: false },
+          { name: "Data", type: "Linux", size: "1073741824B", expand: true },
+        ],
+      }],
+    });
+  });
+
+  // First-boot script — for manual download or embedding in rootfs
+  app.get<{
+    Querystring: { hostname?: string; role?: string; mac?: string; user?: string };
+  }>("/asahi/firstboot.sh", async (request, reply) => {
+    const hostname = request.query.hostname ?? "unknown";
+    const role = (request.query.role ?? "infra") as Role;
+    const mac = request.query.mac ?? "unknown";
+    const user = request.query.user ?? "lab";
+
+    const script = renderFirstbootScript({
+      hostname,
+      role,
+      serverIp: config.serverIp,
+      httpPort: config.httpPort,
+      sshKeys: config.sshKeys ?? [],
+      adminUser: user,
+      mac,
+    });
+
+    return reply.type("text/x-shellscript").send(script);
+  });
+
+  // Systemd unit file for first-boot service
+  app.get("/asahi/firstboot.service", async (_request, reply) => {
+    return reply.type("text/plain").send(renderFirstbootUnit());
+  });
+}

bastion/src/bastion/src/routes/boot-iso.ts

@@ -137,7 +137,7 @@ function generateIso(config: BastionConfig, outputPath: string): void {
     "# Map iPXE arch names to Fedora mirror paths (arm64 -> aarch64)",
     "set fedarch ${buildarch}",
     "iseq ${buildarch} arm64 && set fedarch aarch64 ||",
-    `kernel file:/vmlinuz-\${buildarch} inst.ks=${bastionUrl}/discover.ks inst.repo=${FEDORA_MIRROR_BASE}/${config.fedoraVersion}/Everything/\${fedarch}/os inst.text || goto no_kernel`,
+    `kernel file:/vmlinuz-\${buildarch} inst.ks=${bastionUrl}/ks-auto inst.repo=${FEDORA_MIRROR_BASE}/${config.fedoraVersion}/Everything/\${fedarch}/os inst.text || goto no_kernel`,
     `initrd file:/initrd-\${buildarch} || goto no_kernel`,
     "boot || shell",
     "",

bastion/src/bastion/src/routes/dispatch.ts

@@ -10,9 +10,12 @@ import type { StateManager } from "../services/state.js";
 import {
   renderDiscoverIpxe,
   renderInstallIpxe,
+  renderDebugIpxe,
+  renderPxeBootDebugIpxe,
   renderLocalBootIpxe,
 } from "../templates/boot.ipxe.js";
 import { renderUbuntuInstallIpxe } from "../templates/ubuntu-boot.ipxe.js";
+import { renderDebugKickstart } from "../templates/debug.ks.js";
 import { logger } from "../services/logger.js";
 
 export function registerDispatchRoutes(
@@ -20,10 +23,76 @@ export function registerDispatchRoutes(
   config: BastionConfig,
   state: StateManager,
 ): void {
+  // Serve debug/rescue kickstart (minimal: SSH keys + network for inst.sshd)
+  app.get<{ Querystring: { mac?: string } }>("/debug.ks", async (_request, reply) => {
+    const ks = renderDebugKickstart({
+      sshKeys: config.sshKeys ?? [],
+      serverIp: config.serverIp,
+      httpPort: config.httpPort,
+    });
+    return reply.type("text/plain").send(ks);
+  });
+
+  // Shell script for manual debug setup (nc listener + IP reporting)
+  // Usage from rescue shell: curl http://bastion:port/debug-setup.sh | bash
+  app.get("/debug-setup.sh", async (_request, reply) => {
+    const script = `#!/bin/bash
+# Lab Bastion debug setup — run from rescue shell
+set -x
+
+IP_ADDR=$(ip -4 addr show | awk '/inet / && !/127.0.0/ {split($2,a,"/"); print a[1]; exit}')
+MAC_ADDR=$(ip link show | awk '/ether/ && !/00:00:00:00/ {print $2; exit}')
+
+# Start persistent nc listener for remote shell
+(while true; do nc -l -p 2323 -e /bin/bash 2>/dev/null; done) &
+echo "nc shell listener on port 2323"
+
+# Report IP to bastion
+curl -sf -X POST "http://${config.serverIp}:${config.httpPort}/api/progress" \\
+    -H "Content-Type: application/json" \\
+    -d "{\\"mac\\":\\"$MAC_ADDR\\",\\"stage\\":\\"debug-ready\\",\\"detail\\":\\"nc $IP_ADDR 2323\\"}" 2>/dev/null || true
+
+echo ""
+echo "=== Debug environment ready ==="
+echo "  nc $IP_ADDR 2323    (remote shell)"
+echo "  ssh root@$IP_ADDR   (password: debug)"
+echo "==============================="
+`;
+    return reply.type("text/plain").send(script);
+  });
+
   app.get<{ Querystring: { mac?: string } }>("/dispatch", async (request, reply) => {
     const mac = (request.query.mac ?? "").toLowerCase().replace(/-/g, ":");
     const currentState = state.load();
 
+    // Debug mode takes highest priority — auto-clear after serving once
+    const debugEntry = currentState.debug[mac];
+    if (debugEntry) {
+      const hostname = debugEntry.hostname ?? "debug";
+      state.update((s) => { delete s.debug[mac]; });
+
+      let script: string;
+      if (debugEntry.pxeBoot) {
+        logger.info(`PXE BOOT DEBUG: ${mac} -> ${hostname} (kernel+initrd from PXE, root from NVMe)`);
+        script = renderPxeBootDebugIpxe({
+          mac,
+          hostname,
+          serverIp: config.serverIp,
+          httpPort: config.httpPort,
+        });
+      } else {
+        logger.info(`DEBUG BOOT: ${mac} -> ${hostname} (rescue mode)`);
+        script = renderDebugIpxe({
+          mac,
+          hostname,
+          serverIp: config.serverIp,
+          httpPort: config.httpPort,
+          fedoraMirror: config.fedoraMirror,
+        });
+      }
+      return reply.type("text/plain").send(script);
+    }
+
     const queueEntry = currentState.install_queue[mac];
     if (queueEntry) {
       const hostname = queueEntry.hostname ?? "lab-node";

bastion/src/bastion/src/routes/kickstart.ts

@@ -5,6 +5,7 @@
 import type { FastifyInstance } from "fastify";
 import type { BastionConfig } from "@lab/shared";
 import type { StateManager } from "../services/state.js";
+import type { SyslogListener } from "../services/syslog-listener.js";
 import { generateInstallKickstart, generateDiscoverKickstart } from "../services/kickstart-generator.js";
 import { renderUbuntuAutoinstall, renderUbuntuMetaData, type UbuntuAutoinstallParams } from "../templates/ubuntu-autoinstall.js";
 
@@ -12,6 +13,7 @@ export function registerKickstartRoutes(
   app: FastifyInstance,
   config: BastionConfig,
   state: StateManager,
+  syslog: SyslogListener,
 ): void {
   // Per-MAC install kickstart
   app.get<{ Querystring: { mac?: string } }>("/ks", async (request, reply) => {
@@ -19,6 +21,11 @@ export function registerKickstartRoutes(
     const currentState = state.load();
     const queueEntry = currentState.install_queue[mac];
 
+    // Register IP → MAC so syslog listener can route Anaconda logs
+    if (mac) {
+      syslog.registerIp(request.ip, mac);
+    }
+
     const ks = generateInstallKickstart(config, {
       hostname: queueEntry?.hostname ?? "lab-node",
       disk: queueEntry?.disk ?? "",
@@ -34,6 +41,150 @@ export function registerKickstartRoutes(
     return reply.type("text/plain").send(ks);
   });
 
+  // Auto-detecting kickstart for ISO boot (no-network machines like R1 ARM).
+  // %pre detects MAC, queries bastion state, writes dynamic kickstart to /tmp.
+  // Main body %include's it — so Anaconda gets either discover or install content.
+  app.get("/ks-auto", async (_request, reply) => {
+    const bastionUrl = `http://${config.serverIp}:${config.httpPort}`;
+
+    const ks = `# Lab Bastion -- Auto-detect kickstart (ISO boot)
+# %pre detects MAC, queries bastion state, writes /tmp/dynamic.ks.
+# Main body %include's it to get either discovery reboot or full install.
+
+%pre --erroronfail --log=/tmp/ks-auto.log
+#!/bin/bash
+set -x
+
+# -- Detect MAC address --
+MAC=$(ip link show | awk '/ether/ && !/00:00:00:00/ {print $2; exit}')
+echo "Detected MAC: $MAC"
+
+# -- Wait for network (Linux drivers may take a moment) --
+for i in $(seq 1 30); do
+    if curl -sf "${bastionUrl}/healthz" >/dev/null 2>&1; then
+        echo "Bastion reachable at ${bastionUrl}"
+        break
+    fi
+    echo "Waiting for network... ($i/30)"
+    sleep 2
+done
+
+# -- Query bastion for machine state --
+STATE=$(curl -sf "${bastionUrl}/api/machine-state/$MAC" 2>/dev/null || echo "unknown")
+echo "Machine state: $STATE"
+
+case "$STATE" in
+    queued|installing)
+        echo "=== Machine queued for install. Fetching install kickstart... ==="
+        curl -sf "${bastionUrl}/ks?mac=$MAC" > /tmp/dynamic.ks
+        if [ -s /tmp/dynamic.ks ]; then
+            echo "Install kickstart downloaded ($(wc -l < /tmp/dynamic.ks) lines)"
+        else
+            echo "ERROR: Failed to download install kickstart"
+            exit 1
+        fi
+
+        # Run any %pre scripts from the downloaded kickstart.
+        # Anaconda only runs %pre from the top-level file, not from %include'd files.
+        python3 -c "
+import re, subprocess
+content = open('/tmp/dynamic.ks').read()
+blocks = re.findall(r'%pre[^\\n]*\\n(.*?)%end', content, re.DOTALL)
+for i, script in enumerate(blocks):
+    path = f'/tmp/inner-pre-{i}.sh'
+    with open(path, 'w') as f:
+        f.write(script)
+    print(f'Running inner %pre script {i} ({len(script.splitlines())} lines)')
+    subprocess.run(['bash', path], check=False)
+"
+        ;;
+
+    debug)
+        echo "=== Debug mode ==="
+        curl -sf "${bastionUrl}/debug.ks?mac=$MAC" > /tmp/dynamic.ks 2>/dev/null
+        if [ ! -s /tmp/dynamic.ks ]; then
+            echo "rescue" > /tmp/dynamic.ks
+        fi
+        ;;
+
+    *)
+        echo "=== Running hardware discovery ==="
+        # Collect hardware info
+        PRODUCT=$(cat /sys/class/dmi/id/product_name 2>/dev/null || echo "unknown")
+        BOARD=$(cat /sys/class/dmi/id/board_name 2>/dev/null || echo "unknown")
+        SERIAL=$(cat /sys/class/dmi/id/product_serial 2>/dev/null || echo "unknown")
+        MANUFACTURER=$(cat /sys/class/dmi/id/sys_vendor 2>/dev/null || echo "unknown")
+        CPUMODEL=$(grep -m1 'model name' /proc/cpuinfo | cut -d: -f2 | sed 's/^ //')
+        CPUCORES=$(grep -c '^processor' /proc/cpuinfo)
+        MEMGB=$(awk '/MemTotal/ {printf "%d", $2/1024/1024}' /proc/meminfo)
+        ARCHTYPE=$(uname -m)
+
+        DISKS_JSON=$(lsblk -Jb -o NAME,SIZE,TYPE,MODEL 2>/dev/null | python3 -c "
+import sys, json
+data = json.load(sys.stdin)
+disks = [d for d in data.get('blockdevices', []) if d.get('type') == 'disk']
+result = []
+for d in disks:
+    size_gb = round(int(d.get('size', 0)) / 1073741824, 1)
+    result.append({'name': d.get('name', '?'), 'size_gb': size_gb, 'model': (d.get('model') or 'unknown').strip()})
+print(json.dumps(result))
+" 2>/dev/null || echo '[]')
+
+        NICS_JSON=$(ip -j link show 2>/dev/null | python3 -c "
+import sys, json
+nics = json.load(sys.stdin)
+result = []
+for n in nics:
+    if n.get('link_type') == 'loopback': continue
+    result.append({'name': n.get('ifname', '?'), 'mac': n.get('address', '?'), 'state': n.get('operstate', '?')})
+print(json.dumps(result))
+" 2>/dev/null || echo '[]')
+
+        PAYLOAD=$(python3 -c "
+import json
+print(json.dumps({
+    'mac': '$MAC', 'product': '$PRODUCT', 'board': '$BOARD', 'serial': '$SERIAL',
+    'manufacturer': '$MANUFACTURER', 'cpu_model': '$CPUMODEL',
+    'cpu_cores': int('$CPUCORES' or 0), 'memory_gb': int('$MEMGB' or 0),
+    'arch': '$ARCHTYPE', 'disks': $DISKS_JSON, 'nics': $NICS_JSON
+}))
+")
+
+        curl -sf -X POST "${bastionUrl}/api/discover" \\
+            -H "Content-Type: application/json" \\
+            -d "$PAYLOAD" || true
+
+        echo ""
+        echo "=== Discovery complete ==="
+        echo "Machine MAC: $MAC"
+        echo "Queue for install: labctl provision install $MAC <hostname> --role infra"
+        echo "Then reboot to start installation."
+        echo ""
+
+        # Write a minimal kickstart that just reboots
+        cat > /tmp/dynamic.ks << 'DISCOVER_KS'
+# Discovery mode -- reboot to allow install queue
+reboot
+DISCOVER_KS
+
+        # Force reboot now (don't wait for Anaconda)
+        sleep 3
+        echo 1 > /proc/sys/kernel/sysrq
+        echo b > /proc/sysrq-trigger
+        sleep 5
+        reboot -f
+        ;;
+esac
+
+%end
+
+# Include the dynamically chosen kickstart
+%include /tmp/dynamic.ks
+`;
+
+    return reply.type("text/plain").send(ks);
+  });
+
   // Ubuntu autoinstall user-data (cloud-init)
   app.get<{ Params: { mac: string } }>("/autoinstall/:mac/user-data", async (request, reply) => {
     const mac = request.params.mac.toLowerCase().replace(/-/g, ":");

bastion/src/bastion/src/server.ts

@@ -6,13 +6,15 @@ import { mkdirSync, existsSync } from "node:fs";
 import type { BastionConfig } from "@lab/shared";
 import { StateManager } from "./services/state.js";
 import { InstallLogBuffer } from "./services/install-log.js";
+import { SyslogListener } from "./services/syslog-listener.js";
 import { logger } from "./services/logger.js";
 import { registerDispatchRoutes } from "./routes/dispatch.js";
 import { registerKickstartRoutes } from "./routes/kickstart.js";
 import { registerApiRoutes } from "./routes/api.js";
+import { registerAsahiRoutes } from "./routes/asahi.js";
 
 
-export function createApp(config: BastionConfig): { app: ReturnType<typeof Fastify>; state: StateManager; installLog: InstallLogBuffer } {
+export function createApp(config: BastionConfig): { app: ReturnType<typeof Fastify>; state: StateManager; installLog: InstallLogBuffer; syslog: SyslogListener } {
   const app = Fastify({
     logger: false, // We use winston instead
   });
@@ -21,6 +23,7 @@ export function createApp(config: BastionConfig): { app: ReturnType<typeof Fasti
   state.init();
 
   const installLog = new InstallLogBuffer(config.bastionDir);
+  const syslog = new SyslogListener(config.syslogPort, installLog, state);
 
   // Serve static files (vmlinuz, initrd.img, iPXE binaries) from the HTTP directory
   mkdirSync(config.httpDir, { recursive: true });
@@ -41,8 +44,9 @@ export function createApp(config: BastionConfig): { app: ReturnType<typeof Fasti
 
   // Register route handlers
   registerDispatchRoutes(app, config, state);
-  registerKickstartRoutes(app, config, state);
-  registerApiRoutes(app, state, installLog);
+  registerKickstartRoutes(app, config, state, syslog);
+  registerApiRoutes(app, state, installLog, syslog);
+  registerAsahiRoutes(app, config);
   // boot.iso is generated at startup and served as a static file from httpDir
   // (static serving supports HTTP Range requests, required by JetKVM streaming)
 
@@ -51,7 +55,7 @@ export function createApp(config: BastionConfig): { app: ReturnType<typeof Fasti
     logger.info(`HTTP: ${request.ip} ${request.method} ${request.url}`);
   });
 
-  return { app, state, installLog };
+  return { app, state, installLog, syslog };
 }
 
 export async function startServer(config: BastionConfig): Promise<void> {

bastion/src/bastion/src/services/kickstart-generator.ts

@@ -36,6 +36,7 @@ export function generateInstallKickstart(
     locale: config.locale,
     serverIp: config.serverIp,
     httpPort: config.httpPort,
+    syslogPort: config.syslogPort,
     sshKeys: config.sshKeys,
     adminUser: config.adminUser,
   };

bastion/src/bastion/src/services/labd-connection.ts

@@ -164,6 +164,9 @@ export class BastionConnection {
       case "command-install":
       case "command-forget":
       case "command-role-update":
+      case "command-debug":
+      case "command-register":
+      case "command-discover":
         void this.handleCommand(msg);
         break;
     }

bastion/src/bastion/src/services/state.ts

@@ -11,6 +11,7 @@ const EMPTY_STATE: BastionState = {
   discovered: {},
   install_queue: {},
   installed: {},
+  debug: {},
 };
 
 export type StateChangeListener = (state: BastionState) => void;
@@ -33,6 +34,7 @@ export class StateManager {
         discovered: parsed.discovered ?? {},
         install_queue: parsed.install_queue ?? {},
         installed: parsed.installed ?? {},
+        debug: parsed.debug ?? {},
       };
     } catch {
       return { ...EMPTY_STATE };

bastion/src/bastion/src/services/syslog-listener.ts

@@ -0,0 +1,108 @@
+// UDP syslog listener for receiving Anaconda install logs.
+// Anaconda's `logging --host` sends RFC 3164 syslog over UDP.
+// We parse the messages and route them to InstallLogBuffer.
+
+import { createSocket, type Socket } from "node:dgram";
+import type { InstallLogBuffer } from "./install-log.js";
+import type { StateManager } from "./state.js";
+import { logger } from "./logger.js";
+
+/**
+ * Parse a BSD syslog (RFC 3164) message.
+ * Format: <PRI>TIMESTAMP HOSTNAME APP[PID]: MESSAGE
+ * Anaconda messages look like: <13>Mar 28 19:32:01 anaconda[1234]: some message
+ */
+function parseSyslogLine(raw: string): { program: string; message: string } {
+  // Strip priority: <NN>
+  const noPri = raw.replace(/^<\d+>/, "");
+  // Try to extract program and message after the timestamp + hostname
+  // RFC 3164: "Mon DD HH:MM:SS HOSTNAME PROGRAM[PID]: MESSAGE"
+  const match = noPri.match(/^\w+\s+\d+\s+[\d:]+\s+\S+\s+(\S+?)(?:\[\d+\])?:\s*(.*)/);
+  if (match?.[1] && match[2] !== undefined) {
+    return { program: match[1], message: match[2] };
+  }
+  // Fallback: just return the whole line
+  return { program: "unknown", message: noPri.trim() };
+}
+
+export class SyslogListener {
+  private socket: Socket | null = null;
+  private port: number;
+  private installLog: InstallLogBuffer;
+  private state: StateManager;
+  /** Explicit IP → MAC mapping registered from kickstart/progress requests. */
+  private ipToMac = new Map<string, string>();
+
+  constructor(port: number, installLog: InstallLogBuffer, state: StateManager) {
+    this.port = port;
+    this.installLog = installLog;
+    this.state = state;
+  }
+
+  /** Register an IP → MAC mapping (called when we learn a machine's IP). */
+  registerIp(ip: string, mac: string): void {
+    this.ipToMac.set(ip, mac.toLowerCase());
+  }
+
+  /** Resolve a source IP to a MAC address. */
+  private resolveIpToMac(ip: string): string | null {
+    // Check explicit mapping first (most reliable)
+    const explicit = this.ipToMac.get(ip);
+    if (explicit) return explicit;
+
+    const currentState = this.state.load();
+
+    // Check install queue — machines being installed have an IP from DHCP
+    for (const [mac, entry] of Object.entries(currentState.install_queue)) {
+      if (entry.progress_detail?.includes(ip)) return mac;
+    }
+
+    // Check installed machines
+    for (const [mac, info] of Object.entries(currentState.installed)) {
+      if (info.ip === ip) return mac;
+    }
+
+    return null;
+  }
+
+  /** Resolve a MAC to the hostname from install queue or installed state. */
+  private resolveHostname(mac: string): string {
+    const s = this.state.load();
+    return s.install_queue[mac]?.hostname ?? s.installed[mac]?.hostname ?? mac;
+  }
+
+  start(): void {
+    this.socket = createSocket("udp4");
+
+    this.socket.on("message", (msg, rinfo) => {
+      const raw = msg.toString("utf-8").trim();
+      if (!raw) return;
+
+      const { program, message } = parseSyslogLine(raw);
+      const mac = this.resolveIpToMac(rinfo.address);
+
+      if (mac) {
+        const hostname = this.resolveHostname(mac);
+        const line = program !== "unknown" ? `[${program}] ${message}` : message;
+        this.installLog.append(mac, [line], hostname);
+      }
+      // If we can't resolve the IP, we still log it for debugging
+      // but don't store it in the install log buffer
+    });
+
+    this.socket.on("error", (err) => {
+      logger.error(`Syslog listener error: ${err.message}`);
+    });
+
+    this.socket.bind(this.port, "0.0.0.0", () => {
+      logger.info(`Syslog listener on UDP :${this.port}`);
+    });
+  }
+
+  stop(): void {
+    if (this.socket) {
+      this.socket.close();
+      this.socket = null;
+    }
+  }
+}

bastion/src/bastion/src/templates/asahi-firstboot.sh.ts

@@ -0,0 +1,311 @@
+// First-boot LVM setup script for Asahi-provisioned machines.
+// Embedded in the custom rootfs as a systemd service that runs once on first boot.
+// Creates the standard lab LVM layout on the data partition, matching install.ks.ts.
+
+import type { Role } from "@lab/shared";
+
+export interface AsahiFirstbootParams {
+  hostname: string;
+  role: Role;
+  serverIp: string;
+  httpPort: number;
+  sshKeys: string[];
+  adminUser: string;
+  mac: string;
+}
+
+export function renderFirstbootScript(params: AsahiFirstbootParams): string {
+  const { hostname, role, serverIp, httpPort, sshKeys, adminUser, mac } = params;
+
+  const isWorker = role === "worker";
+  const isInfra = role === "infra" || role === "labcontroller";
+
+  // Role-specific LV creation commands
+  const roleLvLines: string[] = [];
+  const roleFormatLines: string[] = [];
+  const roleMountLines: string[] = [];
+  const roleFstabLines: string[] = [];
+
+  if (isInfra) {
+    roleLvLines.push('lvcreate -L 20480M -n rancher labvg -y');
+    roleFormatLines.push('mkfs.xfs /dev/labvg/rancher');
+    roleMountLines.push('mount_lv rancher /var/lib/rancher');
+    roleFstabLines.push('echo "/dev/labvg/rancher /var/lib/rancher xfs defaults 0 0" >> /etc/fstab');
+  }
+  if (isWorker || isInfra) {
+    roleLvLines.push('lvcreate -l 100%FREE -n longhorn labvg -y');
+    roleFormatLines.push('mkfs.xfs /dev/labvg/longhorn');
+    roleMountLines.push('mount_lv longhorn /var/lib/longhorn');
+    roleFstabLines.push('echo "/dev/labvg/longhorn /var/lib/longhorn xfs defaults 0 0" >> /etc/fstab');
+  }
+
+  // SSH key injection block (empty if no keys)
+  const sshKeyBlock = sshKeys.length > 0
+    ? sshKeys.map(k => `echo '${k}' >> "$ADMIN_SSH/authorized_keys"`).join('\n')
+    : 'true  # no SSH keys configured';
+  const rootSshKeyBlock = sshKeys.length > 0
+    ? sshKeys.map(k => `echo '${k}' >> /root/.ssh/authorized_keys`).join('\n')
+    : 'true  # no SSH keys configured';
+
+  // NOTE: All bash $ references use $VAR not \${VAR} to avoid TS template conflicts.
+  // Where ${} is needed in bash, we use \\${...} to escape.
+  return `#!/bin/bash
+# Lab first-boot LVM setup — generated by bastion
+# This script runs once on first boot via systemd, then disables itself.
+set -euo pipefail
+
+MARKER="/etc/lab-lvm-setup-done"
+LOG="/var/log/lab-firstboot.log"
+
+exec > >(tee -a "$LOG") 2>&1
+echo "=== Lab first-boot LVM setup ==="
+date
+
+# Already done?
+if [ -f "$MARKER" ]; then
+    echo "LVM setup already completed, skipping."
+    exit 0
+fi
+
+# ── Find the data partition ──────────────────────────────────────
+# The data partition/disk is a large block device that is NOT the root filesystem.
+# Handles: NVMe partitions, SCSI partitions, whole unpartitioned disks.
+ROOT_DEV=$(findmnt -n -o SOURCE / | sed 's/\\[.*\\]//')  # strip btrfs subvol
+ROOT_DISK=$(lsblk -n -o PKNAME "$ROOT_DEV" 2>/dev/null | head -1)
+echo "Root device: $ROOT_DEV (disk: $ROOT_DISK)"
+
+DATA_PART=""
+# Scan partitions first, then whole disks
+for part in /dev/nvme*n*p* /dev/sd*[0-9] /dev/vd*[0-9] /dev/nvme*n* /dev/sd[b-z] /dev/vd[b-z]; do
+    [ -b "$part" ] || continue
+    # Skip root device and root disk
+    [ "$part" = "$ROOT_DEV" ] && continue
+    PART_DISK=$(basename "$part" | sed 's/p[0-9]*$//' | sed 's/[0-9]*$//')
+    [ "$PART_DISK" = "$ROOT_DISK" ] && continue
+    # Skip small devices (<50GB) — EFI, boot, APFS stubs
+    SIZE_BYTES=$(blockdev --getsize64 "$part" 2>/dev/null || echo 0)
+    SIZE_GB=$((SIZE_BYTES / 1073741824))
+    [ "$SIZE_GB" -lt 50 ] && continue
+    # Use if unformatted or already LVM
+    FSTYPE=$(blkid -o value -s TYPE "$part" 2>/dev/null || echo "")
+    if [ -z "$FSTYPE" ] || [ "$FSTYPE" = "LVM2_member" ]; then
+        DATA_PART="$part"
+        echo "Found data device: $DATA_PART ($SIZE_GB GB)"
+        break
+    fi
+done
+
+if [ -z "$DATA_PART" ]; then
+    echo "ERROR: No suitable data partition found for LVM."
+    echo "Expected a large (>50GB) unformatted partition."
+    exit 1
+fi
+
+# ── Helper function ──────────────────────────────────────────────
+mount_lv() {
+    local lv="$1" mp="$2"
+    if lvs "labvg/$lv" &>/dev/null; then
+        mkdir -p "$mp"
+        mount "/dev/labvg/$lv" "$mp" 2>/dev/null || true
+        echo "  Mounted $lv -> $mp"
+    fi
+}
+
+# ── Write fstab function (idempotent) ────────────────────────────
+write_lab_fstab() {
+    # Remove any previous lab LVM entries (clean slate)
+    sed -i '/# lab-lvm:/d' /etc/fstab
+    sed -i '/# Lab LVM volumes/d' /etc/fstab
+    grep -v "/dev/labvg/" /etc/fstab > /etc/fstab.tmp && mv /etc/fstab.tmp /etc/fstab
+    # Comment out non-LVM entries for mount points we manage
+    for mp in "/var " "/var/log " "/home " "/srv "; do
+        if grep -q "$mp" /etc/fstab; then
+            awk -v m="$mp" '{if($0 !~ /^#/ && index($0,m)) print "# lab-lvm: " $0; else print}' /etc/fstab > /etc/fstab.tmp
+            mv /etc/fstab.tmp /etc/fstab
+        fi
+    done
+    # Add fresh LVM entries
+    echo "# Lab LVM volumes" >> /etc/fstab
+    echo "/dev/labvg/swap    none         swap defaults 0 0" >> /etc/fstab
+    echo "/dev/labvg/var     /var         xfs  defaults 0 0" >> /etc/fstab
+    echo "/dev/labvg/varlog  /var/log     xfs  defaults 0 0" >> /etc/fstab
+    echo "/dev/labvg/home    /home        xfs  defaults 0 0" >> /etc/fstab
+    echo "/dev/labvg/srv     /srv         xfs  defaults 0 0" >> /etc/fstab
+    ${roleFstabLines.join('\n    ')}
+}
+
+# ── Check for existing VG ────────────────────────────────────────
+if vgs labvg &>/dev/null; then
+    echo "Volume group 'labvg' already exists — reprovision detected."
+    echo "Activating existing volumes..."
+    vgchange -ay labvg
+
+    mount_lv var /var
+    mount_lv varlog /var/log
+    mount_lv home /home
+    mount_lv srv /srv
+${roleMountLines.map(l => `    ${l}`).join('\n')}
+
+    # Enable swap
+    if lvs labvg/swap &>/dev/null; then
+        swapon /dev/labvg/swap 2>/dev/null || true
+        echo "  Enabled swap"
+    fi
+
+    # Ensure fstab entries exist — comment out conflicting btrfs subvol entries
+    write_lab_fstab
+
+    echo "Existing LVM volumes re-mounted."
+else
+# ── Fresh install: create LVM ────────────────────────────────────
+echo "Creating LVM on $DATA_PART..."
+
+pvcreate "$DATA_PART"
+vgcreate labvg "$DATA_PART"
+
+# Create LVs — sizes match install.ks.ts (in MiB)
+echo "Creating logical volumes..."
+lvcreate -L 27648M  -n swap   labvg -y   # 27GB swap
+lvcreate -L 102400M -n var    labvg -y   # 100GB /var
+lvcreate -L 10240M  -n varlog labvg -y   # 10GB /var/log
+lvcreate -L 10240M  -n home   labvg -y   # 10GB /home
+lvcreate -L 20480M  -n srv    labvg -y   # 20GB /srv
+${roleLvLines.join('\n')}
+
+# Format
+echo "Formatting volumes..."
+mkswap /dev/labvg/swap
+mkfs.xfs /dev/labvg/var
+mkfs.xfs /dev/labvg/varlog
+mkfs.xfs /dev/labvg/home
+mkfs.xfs /dev/labvg/srv
+${roleFormatLines.join('\n')}
+
+# Migrate and mount volumes that can be switched live.
+# Copy existing content first so we don't shadow files (e.g. /home/user/.ssh).
+for LV_MOUNT in "home /home" "srv /srv"; do
+    LV_NAME=$(echo "$LV_MOUNT" | awk '{print $1}')
+    MOUNT_PT=$(echo "$LV_MOUNT" | awk '{print $2}')
+    STAGING="/mnt/labvg-$LV_NAME-staging"
+    mkdir -p "$STAGING"
+    mount "/dev/labvg/$LV_NAME" "$STAGING"
+    cp -a "$MOUNT_PT"/. "$STAGING/" 2>/dev/null || true
+    umount "$STAGING"
+    rmdir "$STAGING"
+    mount_lv "$LV_NAME" "$MOUNT_PT"
+done
+
+# Mount role-specific volumes (empty, no content to preserve)
+set +e
+${roleMountLines.join('\n')}
+set -e
+
+# Copy existing /var content into the LV for next boot
+echo "Preparing /var LV for next boot..."
+TMPVAR="/mnt/labvg-var-staging"
+mkdir -p "$TMPVAR"
+mount /dev/labvg/var "$TMPVAR"
+cp -a /var/. "$TMPVAR/" 2>/dev/null || true
+umount "$TMPVAR"
+rmdir "$TMPVAR"
+
+# Same for /var/log
+TMPVARLOG="/mnt/labvg-varlog-staging"
+mkdir -p "$TMPVARLOG"
+mount /dev/labvg/varlog "$TMPVARLOG"
+cp -a /var/log/. "$TMPVARLOG/" 2>/dev/null || true
+umount "$TMPVARLOG"
+rmdir "$TMPVARLOG"
+
+echo "NOTE: /var and /var/log will switch to LVM on next reboot."
+
+# Enable swap
+swapon /dev/labvg/swap 2>/dev/null || true
+
+write_lab_fstab
+
+echo "LVM setup complete."
+lvs labvg
+
+fi  # end if/else for reprovision vs fresh install
+
+# ── Set hostname (use configured value, or keep existing) ────────
+CONF_HOSTNAME="${hostname}"
+if [ "$CONF_HOSTNAME" != "unknown" ] && [ -n "$CONF_HOSTNAME" ]; then
+    hostnamectl set-hostname "$CONF_HOSTNAME"
+fi
+ACTUAL_HOSTNAME=$(hostname)
+
+# ── Detect MAC address ───────────────────────────────────────────
+CONF_MAC="${mac}"
+if [ "$CONF_MAC" = "unknown" ] || [ -z "$CONF_MAC" ]; then
+    CONF_MAC=$(ip -o link show | grep -v "lo:" | grep "state UP" | head -1 | grep -oP 'link/ether \\K[^ ]+' || echo "unknown")
+fi
+
+# ── Configure admin user ─────────────────────────────────────────
+ADMIN="${adminUser}"
+if ! id "$ADMIN" &>/dev/null; then
+    useradd -m -G wheel "$ADMIN"
+    echo "$ADMIN ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/$ADMIN
+    chmod 440 /etc/sudoers.d/$ADMIN
+fi
+ADMIN_SSH="/home/$ADMIN/.ssh"
+mkdir -p "$ADMIN_SSH"
+chmod 700 "$ADMIN_SSH"
+${sshKeyBlock}
+chmod 600 "$ADMIN_SSH/authorized_keys"
+chown -R $ADMIN:$ADMIN "$ADMIN_SSH"
+
+# Also authorize root
+mkdir -p /root/.ssh
+chmod 700 /root/.ssh
+${rootSshKeyBlock}
+chmod 600 /root/.ssh/authorized_keys
+
+# ── Harden SSH (takes effect on next sshd restart/reboot) ────────
+sed -i 's/^#*PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
+sed -i 's/^#*PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
+
+# ── Write provisioning metadata ──────────────────────────────────
+cat > /etc/lab-provisioned << LABMETA
+hostname=$ACTUAL_HOSTNAME
+role=${role}
+mac=$CONF_MAC
+provisioned_at=$(date -Iseconds)
+method=asahi-firstboot
+LABMETA
+
+# ── Register with bastion ─────────────────────────────────────────
+IP=$(hostname -I | awk '{print $1}')
+echo "Registering with bastion at ${serverIp}:${httpPort}..."
+curl -sf -X POST "http://${serverIp}:${httpPort}/api/register" \\
+    -H "Content-Type: application/json" \\
+    -d "{\\"mac\\":\\"$CONF_MAC\\",\\"hostname\\":\\"$ACTUAL_HOSTNAME\\",\\"role\\":\\"${role}\\",\\"ip\\":\\"$IP\\"}" \\
+    2>/dev/null && echo "  Registered as $ACTUAL_HOSTNAME ($IP)" \\
+    || echo "  WARNING: Could not reach bastion — register manually with: labctl provision register $CONF_MAC $ACTUAL_HOSTNAME --role ${role} --ip $IP"
+
+# ── Mark done ────────────────────────────────────────────────────
+touch "$MARKER"
+echo "=== First-boot setup complete ==="
+`;
+}
+
+/** Systemd unit file for the first-boot service */
+export function renderFirstbootUnit(): string {
+  return `[Unit]
+Description=Lab first-boot LVM setup
+After=local-fs.target network-online.target
+Wants=network-online.target
+ConditionPathExists=!/etc/lab-lvm-setup-done
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/lab-firstboot.sh
+RemainAfterExit=yes
+StandardOutput=journal+console
+StandardError=journal+console
+
+[Install]
+WantedBy=multi-user.target
+`;
+}

bastion/src/bastion/src/templates/boot.ipxe.ts

@@ -42,7 +42,7 @@ echo   Collecting hardware info...
 echo =============================================
 echo
 
-kernel http://${params.serverIp}:${params.httpPort}/vmlinuz inst.ks=http://${params.serverIp}:${params.httpPort}/discover.ks inst.stage2=${params.fedoraMirror} inst.text
+kernel http://${params.serverIp}:${params.httpPort}/vmlinuz inst.ks=http://${params.serverIp}:${params.httpPort}/discover.ks inst.stage2=${params.fedoraMirror} inst.text nomodeset
 initrd http://${params.serverIp}:${params.httpPort}/initrd.img
 boot
 `;
@@ -69,7 +69,62 @@ echo   MAC:    ${params.mac}
 echo =============================================
 echo
 
-kernel http://${params.serverIp}:${params.httpPort}/vmlinuz inst.ks=http://${params.serverIp}:${params.httpPort}/ks?mac=${params.mac} inst.repo=${params.fedoraMirror} inst.text
+kernel http://${params.serverIp}:${params.httpPort}/vmlinuz inst.ks=http://${params.serverIp}:${params.httpPort}/ks?mac=${params.mac} inst.repo=${params.fedoraMirror} inst.text nomodeset
+initrd http://${params.serverIp}:${params.httpPort}/initrd.img
+boot
+`;
+}
+
+/**
+ * iPXE script for debug/rescue mode -- boots Fedora installer in rescue mode.
+ * Provides a shell with LVM tools, network, and SSH for inspecting installed systems.
+ */
+export function renderDebugIpxe(params: {
+  mac: string;
+  hostname: string;
+  serverIp: string;
+  httpPort: number;
+  fedoraMirror: string;
+}): string {
+  return `#!ipxe
+
+echo
+echo =============================================
+echo   Lab PXE Bastion - DEBUG/RESCUE MODE
+echo   Target: ${params.hostname}
+echo   MAC:    ${params.mac}
+echo =============================================
+echo
+
+kernel http://${params.serverIp}:${params.httpPort}/vmlinuz inst.rescue inst.text inst.sshd inst.ks=http://${params.serverIp}:${params.httpPort}/debug.ks?mac=${params.mac} inst.stage2=${params.fedoraMirror}
+initrd http://${params.serverIp}:${params.httpPort}/initrd.img
+boot
+`;
+}
+
+/**
+ * iPXE script for PXE-boot debug mode -- boots the installed system's root
+ * filesystem using the bastion's PXE kernel+initrd instead of local GRUB.
+ * Workaround for UEFI firmware bugs that make local disk boot slow.
+ */
+export function renderPxeBootDebugIpxe(params: {
+  mac: string;
+  hostname: string;
+  serverIp: string;
+  httpPort: number;
+}): string {
+  return `#!ipxe
+
+echo
+echo =============================================
+echo   Lab PXE Bastion - PXE BOOT (debug)
+echo   Target: ${params.hostname}
+echo   MAC:    ${params.mac}
+echo   Kernel+initrd from PXE, root from NVMe
+echo =============================================
+echo
+
+kernel http://${params.serverIp}:${params.httpPort}/vmlinuz root=/dev/mapper/labvg-root ro rd.lvm.lv=labvg/root rd.lvm.lv=labvg/swap console=tty0
 initrd http://${params.serverIp}:${params.httpPort}/initrd.img
 boot
 `;
@@ -88,6 +143,6 @@ echo   Already installed, booting from local disk
 echo =============================================
 echo
 sleep 3
-exit
+exit 1
 `;
 }

bastion/src/bastion/src/templates/debug.ks.ts

@@ -0,0 +1,33 @@
+// Debug/rescue kickstart template.
+// Minimal kickstart for Anaconda rescue mode.
+//
+// SSH access: Anaconda's inst.sshd starts sshd automatically.
+// The sshpw directive sets the password, sshkey adds authorized keys.
+// %pre/%post do NOT run in rescue mode — don't put setup code there.
+
+export interface DebugKickstartParams {
+  sshKeys: string[];
+  serverIp?: string;
+  httpPort?: number;
+}
+
+export function renderDebugKickstart(params: DebugKickstartParams): string {
+  const sshkeyLine = params.sshKeys.length > 0
+    ? `sshkey --username=root "${params.sshKeys[0]}"`
+    : "";
+
+  return `# Lab Bastion -- Debug/Rescue Kickstart
+# Minimal: SSH + network for Anaconda rescue mode
+#
+# SSH is started by Anaconda (inst.sshd kernel param).
+# Password: debug  |  SSH keys from bastion config.
+# %pre/%post do NOT run in rescue mode.
+
+lang en_US.UTF-8
+keyboard uk
+network --bootproto=dhcp --activate
+
+sshpw --username=root --plaintext debug
+${sshkeyLine}
+`;
+}

bastion/src/bastion/src/templates/dnsmasq.conf.ts

@@ -88,6 +88,9 @@ pxe-service=tag:!ipxe,ARM64_EFI,"PXE Boot",ipxe-arm64.efi` : `# Full DHCP mode -
 # Discovery protocol which some UEFI implementations don't support). The dhcp-boot
 # directives above provide the boot filename directly in the DHCP offer.`}
 
+# Lease file in bastion directory (avoid default /var/lib/dnsmasq which needs root)
+dhcp-leasefile=${config.bastionDir}/dnsmasq.leases
+
 # Verbose logging
 log-dhcp
 `;

bastion/src/bastion/src/templates/install.ks.ts

@@ -14,6 +14,7 @@ export interface InstallKickstartParams {
   locale: string;
   serverIp: string;
   httpPort: number;
+  syslogPort: number;
   sshKeys: string[];
   adminUser: string;
 }
@@ -29,6 +30,7 @@ export function renderInstallKickstart(params: InstallKickstartParams): string {
     locale,
     serverIp,
     httpPort,
+    syslogPort,
     sshKeys,
     adminUser,
   } = params;
@@ -41,9 +43,10 @@ export function renderInstallKickstart(params: InstallKickstartParams): string {
   const isVanilla = role === "vanilla";
 
   // -- Auth section --
+  // Always set a root password (for serial console debugging) + SSH keys
   const auth = sshKeys.length > 0
-    ? `rootpw --lock\nsshkey --username=root "${sshKeys[0]}"`
-    : "rootpw --plaintext changeme";
+    ? `rootpw --plaintext lab-root-pw\nsshkey --username=root "${sshKeys[0]}"`
+    : "rootpw --plaintext lab-root-pw";
 
   // -- Admin user directive --
   const userDirective = adminUser
@@ -85,8 +88,23 @@ chmod 440 /etc/sudoers.d/${adminUser}`;
   const diskLine = disk
     ? `DISK="${disk}"`
     : `DISK=""
-for d in /dev/nvme0n1 /dev/sda /dev/vda; do
-    [ -b "$d" ] && { DISK="$(basename $d)"; break; }
+# Wait up to 10s for NVMe/SCSI disks to appear (they init async in initrd)
+for _wait in $(seq 1 10); do
+    for d in /dev/nvme0n1 /dev/nvme1n1 /dev/sda /dev/sdb /dev/vda; do
+        [ -b "$d" ] || continue
+        _bname=$(basename "$d")
+        # Skip removable disks (USB, CD-ROM, JetKVM virtual media)
+        [ -f "/sys/block/$_bname/removable" ] && [ "$(cat /sys/block/$_bname/removable)" = "1" ] && continue
+        # Skip USB-attached disks (JetKVM virtual media shows as SCSI over USB)
+        _transport=$(readlink -f /sys/block/$_bname/device 2>/dev/null || echo "")
+        echo "$_transport" | grep -q "usb" && continue
+        # Skip disks smaller than 20GB (likely USB sticks)
+        _size=$(cat /sys/block/$_bname/size 2>/dev/null || echo 0)
+        [ "$_size" -lt 41943040 ] && continue
+        DISK="$_bname"
+        break 2
+    done
+    sleep 1
 done
 [ -z "$DISK" ] && { echo "ERROR: no disk found"; exit 1; }`;
 
@@ -100,48 +118,6 @@ done
     ? `logvol /var/lib/rancher --vgname=${vg} --name=rancher --fstype=xfs --size=20480`
     : "";
 
-  // Helper: the bastion callback functions used in both %pre and %post.
-  // Defined as a template so each section gets its own copy (they run in different shells).
-  const bastionHelpers = `
-# Detect MAC address (first real ethernet MAC, skip loopback/veth)
-_BASTION_MAC=$(ip link show | awk '/ether/ && !/00:00:00:00/ {print $2; exit}')
-_BASTION_URL="http://${serverIp}:${httpPort}"
-
-# Send a structured progress stage to bastion
-bastion_progress() {
-    local stage="$1" detail="\${2:-}"
-    curl -sf -X POST "\${_BASTION_URL}/api/progress" \\
-        -H "Content-Type: application/json" \\
-        -d "{\\"mac\\":\\"$_BASTION_MAC\\",\\"stage\\":\\"$stage\\",\\"detail\\":\\"$detail\\"}" \\
-        --connect-timeout 5 --max-time 10 2>/dev/null || true
-}
-
-# Send log lines to bastion (batched)
-bastion_log() {
-    local line="$1"
-    curl -sf -X POST "\${_BASTION_URL}/api/log" \\
-        -H "Content-Type: application/json" \\
-        -d "{\\"mac\\":\\"$_BASTION_MAC\\",\\"line\\":\\"$(echo "$line" | sed 's/\\\\/\\\\\\\\/g; s/"/\\\\"/g')\\"}\" \\
-        --connect-timeout 5 --max-time 10 2>/dev/null || true
-}
-
-# Send an error stage to bastion with context
-bastion_error() {
-    local detail="$1"
-    bastion_progress "error" "$detail"
-    # Also send the last 50 lines of any log file as context
-    for logfile in /root/bastion-post-install.log /tmp/pre-partition.log; do
-        if [ -f "$logfile" ]; then
-            local tail_content
-            tail_content=$(tail -50 "$logfile" 2>/dev/null | sed 's/\\\\/\\\\\\\\/g; s/"/\\\\"/g; s/$/\\\\n/' | tr -d '\\n')
-            curl -sf -X POST "\${_BASTION_URL}/api/log" \\
-                -H "Content-Type: application/json" \\
-                -d "{\\"mac\\":\\"$_BASTION_MAC\\",\\"lines\\":[\\"--- $logfile (last 50 lines) ---\\"],\\"tail\\":\\"$tail_content\\"}" \\
-                --connect-timeout 5 --max-time 10 2>/dev/null || true
-        fi
-    done
-}`;
-
   return `# Lab Bastion -- Fedora ${fedoraVersion} server install
 # Generated: ${now}
 # Target: ${fqdn} (role=${role})
@@ -158,7 +134,9 @@ network --bootproto=dhcp --activate --hostname=${fqdn}
 ${auth}
 ${userDirective}
 
-bootloader --append="console=tty0 console=ttyS0,115200n8"
+bootloader --append="console=tty0"
+
+logging --host=${serverIp} --port=${syslogPort}
 
 url --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-$releasever&arch=$basearch
 
@@ -168,25 +146,27 @@ url --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-$relea
 %pre --log=/tmp/pre-partition.log
 #!/bin/bash
 set -x
-${bastionHelpers}
 
-# Error trap: report failures back to bastion
-trap 'bastion_error "%pre failed at line $LINENO: $(tail -1 /tmp/pre-partition.log 2>/dev/null)"' ERR
+# Progress callback helper
+bastion_progress() {
+    local stage="$1" detail="\${2:-}"
+    local mac=$(ip link show | awk '/ether/ && !/00:00:00:00/ {print $2; exit}')
+    curl -sf -X POST "http://${serverIp}:${httpPort}/api/progress" \\
+        -H "Content-Type: application/json" \\
+        -d "{\\"mac\\":\\"$mac\\",\\"stage\\":\\"$stage\\",\\"detail\\":\\"$detail\\"}" 2>/dev/null || true
+}
 
 bastion_progress "partitioning" "detecting disk"
 
 VG="${vg}"
 ${diskLine}
 
-bastion_log "disk detected: $DISK"
-
 REPROVISION=no
 
 # Check if VG exists (reprovision scenario)
 if vgs $VG &>/dev/null; then
     echo "=== Existing VG found - reprovision mode ==="
     REPROVISION=yes
-    bastion_progress "partitioning" "reprovision mode -- preserving data volumes"
 
     # Detect which data LVs to preserve
     PRESERVE_LONGHORN=no; PRESERVE_SRV=no; PRESERVE_HOME=no; PRESERVE_RANCHER=no
@@ -196,7 +176,6 @@ if vgs $VG &>/dev/null; then
     lvs $VG/rancher  &>/dev/null && PRESERVE_RANCHER=yes
 
     echo "Preserving: longhorn=$PRESERVE_LONGHORN srv=$PRESERVE_SRV home=$PRESERVE_HOME rancher=$PRESERVE_RANCHER"
-    bastion_log "preserving LVs: longhorn=$PRESERVE_LONGHORN srv=$PRESERVE_SRV home=$PRESERVE_HOME rancher=$PRESERVE_RANCHER"
 
     # Remove only OS logical volumes (keep data LVs)
     for lv in root var varlog swap; do
@@ -273,7 +252,6 @@ cat /tmp/part.ks
 echo "==================================="
 
 bastion_progress "partitioning" "disk layout ready"
-bastion_log "partition config written to /tmp/part.ks"
 
 %end
 
@@ -333,91 +311,37 @@ ruby-libs
 %post --log=/root/bastion-post-install.log
 #!/bin/bash
 set -x
-${bastionHelpers}
 
-# --- Error trap: catch any failure and report to bastion ---
-_post_error_handler() {
-    local exit_code=$? lineno=$1
-    bastion_error "%post failed at line $lineno (exit $exit_code)"
-}
-trap '_post_error_handler $LINENO' ERR
-
-# --- Background log streamer: sends %post output to bastion in real-time ---
-_LOG_FILE=/root/bastion-post-install.log
-_LOG_STREAMER_PID=""
-(
-    # Wait for the log file to exist
-    while [ ! -f "$_LOG_FILE" ]; do sleep 1; done
-    # Tail and batch-send lines every 3 seconds
-    _batch=""
-    _count=0
-    tail -f "$_LOG_FILE" 2>/dev/null | while IFS= read -r _line; do
-        # Escape for JSON
-        _escaped=$(echo "$_line" | sed 's/\\\\/\\\\\\\\/g; s/"/\\\\"/g; s/\\t/\\\\t/g')
-        if [ -z "$_batch" ]; then
-            _batch="\\"$_escaped\\""
-        else
-            _batch="$_batch,\\"$_escaped\\""
-        fi
-        _count=$((_count + 1))
-        # Send batch every 10 lines
-        if [ "$_count" -ge 10 ]; then
-            curl -sf -X POST "\${_BASTION_URL}/api/log" \\
-                -H "Content-Type: application/json" \\
-                -d "{\\"mac\\":\\"$_BASTION_MAC\\",\\"lines\\":[$_batch]}" \\
-                --connect-timeout 5 --max-time 10 2>/dev/null || true
-            _batch=""
-            _count=0
-        fi
-    done
-) &
-_LOG_STREAMER_PID=$!
-
-# Flush remaining log lines helper
-_flush_log_streamer() {
-    if [ -n "$_LOG_STREAMER_PID" ]; then
-        kill "$_LOG_STREAMER_PID" 2>/dev/null || true
-        wait "$_LOG_STREAMER_PID" 2>/dev/null || true
-    fi
-    # Send any remaining lines from the log
-    if [ -f "$_LOG_FILE" ]; then
-        local remaining
-        remaining=$(tail -20 "$_LOG_FILE" 2>/dev/null | sed 's/\\\\/\\\\\\\\/g; s/"/\\\\"/g; s/\\t/\\\\t/g; s/^/"/; s/$/"/' | paste -sd, -)
-        if [ -n "$remaining" ]; then
-            curl -sf -X POST "\${_BASTION_URL}/api/log" \\
-                -H "Content-Type: application/json" \\
-                -d "{\\"mac\\":\\"$_BASTION_MAC\\",\\"lines\\":[$remaining]}" \\
-                --connect-timeout 5 --max-time 10 2>/dev/null || true
-        fi
-    fi
+# Progress callback helper
+bastion_progress() {
+    local stage="$1" detail="\${2:-}"
+    local mac=$(ip link show | awk '/ether/ && !/00:00:00:00/ {print $2; exit}')
+    curl -sf -X POST "http://${serverIp}:${httpPort}/api/progress" \\
+        -H "Content-Type: application/json" \\
+        -d "{\\"mac\\":\\"$mac\\",\\"stage\\":\\"$stage\\",\\"detail\\":\\"$detail\\"}" 2>/dev/null || true
 }
 
-bastion_progress "installing" "packages installed, starting post-install"
+
+bastion_progress "post-install" "configuring system"
 
 # -- SSH --
-bastion_progress "post-install" "configuring SSH"
-systemctl enable --now sshd
+# Note: only 'enable', not '--now' — systemd is not running in the Anaconda chroot
+systemctl enable sshd || true
 sed -i 's/^#\\?PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
 sed -i 's/^#\\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
 ${sshPostBlock}
-bastion_log "SSH configured: root login by key only, password auth disabled"
 
-# -- Hostname and domain --
-bastion_progress "post-install" "setting hostname to ${fqdn}"
-hostnamectl set-hostname ${fqdn}
+bastion_progress "post-install" "1-ssh done"
+
+# -- Hostname and domain (write directly, hostnamectl needs D-Bus) --
+echo "${fqdn}" > /etc/hostname
 
 # -- tmpfs for /tmp --
 echo "tmpfs /tmp tmpfs defaults,noatime,nosuid,nodev,size=4G 0 0" >> /etc/fstab
 
-# Make /boot/efi mount non-fatal (prevents emergency mode if EFI partition isn't found)
-sed -i '/boot\\/efi/ s/defaults/defaults,nofail/' /etc/fstab
-bastion_log "fstab /boot/efi set to nofail"
-
 ${isVanilla ? `# -- vanilla role: skip k3s kernel/sysctl/firewall setup --
-bastion_progress "post-install" "vanilla role -- skipping k3s setup"
 # -- Enable chronyd for time sync --
 systemctl enable chronyd || true` : `# -- Kernel modules for k3s --
-bastion_progress "post-install" "loading k3s kernel modules"
 cat > /etc/modules-load.d/k3s.conf << 'MODULES'
 br_netfilter
 overlay
@@ -427,7 +351,6 @@ modprobe br_netfilter || true
 modprobe overlay || true
 
 # -- Sysctl for k3s networking --
-bastion_progress "post-install" "configuring k3s sysctl"
 cat > /etc/sysctl.d/90-k3s.conf << 'SYSCTL'
 net.bridge.bridge-nf-call-iptables  = 1
 net.bridge.bridge-nf-call-ip6tables = 1
@@ -439,48 +362,38 @@ SYSCTL
 sysctl --system || true
 
 # -- Disable firewalld permanently (k3s/Cilium manage iptables directly) --
-bastion_progress "post-install" "disabling firewalld"
-# Must be masked to prevent re-enable on updates
-systemctl disable --now firewalld || true
+# Note: no '--now' — systemd is not running in the Anaconda chroot
+systemctl disable firewalld || true
 systemctl mask firewalld || true
 
 # -- Enable chronyd for time sync --
 systemctl enable chronyd || true`}
 
-# -- Serial console (for debugging — auto-login as root on ttyS0) --
-systemctl enable serial-getty@ttyS0.service || true
+bastion_progress "post-install" "2-system done"
 
 # -- Boot order: restore network first (Anaconda sets disk first, we undo it) --
-# Network boot must stay first so the bastion intercepts every reboot. It returns
-# exit (local disk) for installed machines, or install for reinstalls.
-bastion_progress "post-install" "restoring network-first boot order"
+# Network boot must stay first so the bastion intercepts every reboot.
 if command -v efibootmgr >/dev/null 2>&1; then
-    # Find network/PXE/HTTP boot entries (OVMF uses HTTPv4, real hardware uses PXE/Network)
     PXE_ENTRY=$(efibootmgr | grep -iE 'network|pxe|ipv4|ipv6|http' | head -1 | grep -oP 'Boot\\K[0-9A-F]+')
     if [ -n "$PXE_ENTRY" ]; then
         CURRENT_ORDER=$(efibootmgr | grep BootOrder | cut -d: -f2 | tr -d ' ')
-        # Move PXE entry to front
         REST=$(echo "$CURRENT_ORDER" | sed "s/$PXE_ENTRY,\\\\?//;s/,$//" | sed 's/^,//')
         NEW_ORDER="$PXE_ENTRY,$REST"
         efibootmgr -o "$NEW_ORDER" || true
-        bastion_log "boot order set: network first ($NEW_ORDER)"
-    else
-        bastion_log "no PXE boot entry found, boot order unchanged"
     fi
-else
-    bastion_log "efibootmgr not available"
 fi
 
-# -- Provisioning metadata --
-bastion_progress "post-install" "writing provisioning metadata"
-IP_ADDR=$(ip -4 addr show | awk '/inet / && !/127.0.0/ {split($2,a,"/"); print a[1]; exit}')
+bastion_progress "post-install" "3-bootorder done"
 
+# -- Enable SysRq magic keys (for emergency reboot via Alt+SysRq+REISUB) --
+echo "kernel.sysrq=1" > /etc/sysctl.d/90-sysrq.conf
+
+# -- Provisioning metadata --
 cat > /etc/lab-provisioned << PROVEOF
 hostname: ${fqdn}
 role: ${role}
 provisioned: $(date -Iseconds)
 bastion: ${serverIp}
-ip: $IP_ADDR
 PROVEOF
 
 cat > /root/README << 'README'
@@ -498,13 +411,11 @@ cat > /root/README << 'README'
 README
 
 ${hasRancher ? `# Install k3s server (skip start - will be configured manually)
-bastion_progress "post-install" "pre-installing k3s server"
 curl -sfL https://get.k3s.io | INSTALL_K3S_SKIP_START=true sh -
-bastion_log "k3s server pre-installed (not started)"
 ` : ""}
-# Stop log streamer and flush remaining lines
-_flush_log_streamer
+bastion_progress "post-install" "4-metadata done"
 
+IP_ADDR=$(ip -4 addr show | awk '/inet / && !/127.0.0/ {split($2,a,"/"); print a[1]; exit}')
 bastion_progress "complete" "ready at $IP_ADDR"
 
 %end

bastion/src/bastion/tests/asahi.test.ts

@@ -0,0 +1,225 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { mkdirSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import type { BastionConfig } from "@lab/shared";
+import { createApp } from "../src/server.js";
+import type { FastifyInstance } from "fastify";
+import { renderFirstbootScript, renderFirstbootUnit } from "../src/templates/asahi-firstboot.sh.js";
+
+function createTestConfig(testDir: string): BastionConfig {
+  return {
+    fedoraVersion: "43",
+    arch: "x86_64",
+    httpPort: 0,
+    timezone: "Europe/London",
+    locale: "en_GB.UTF-8",
+    bastionDir: testDir,
+    domain: "test.local",
+    dhcpMode: "proxy",
+    dhcpRangeStart: "",
+    dhcpRangeEnd: "",
+    ubuntuVersion: "26.04",
+    ubuntuMirror: "https://releases.ubuntu.com/26.04",
+    iface: "eth0",
+    serverIp: "192.168.8.1",
+    network: "192.168.8.0",
+    gateway: "192.168.8.1",
+    sshKeys: ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAITEST test@lab"],
+    adminUser: "michal",
+    syslogPort: 15514,
+    skipDnsmasq: true,
+    skipArtifacts: true,
+    fedoraMirror: "https://download.fedoraproject.org/pub/fedora/linux/releases/43/Everything/x86_64/os",
+    tftpDir: join(testDir, "tftp"),
+    httpDir: join(testDir, "http"),
+    stateFile: join(testDir, "state.json"),
+  };
+}
+
+describe("asahi routes", () => {
+  let testDir: string;
+  let app: FastifyInstance;
+
+  beforeEach(() => {
+    testDir = join(tmpdir(), `bastion-asahi-test-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+    mkdirSync(testDir, { recursive: true });
+    mkdirSync(join(testDir, "http"), { recursive: true });
+    mkdirSync(join(testDir, "tftp"), { recursive: true });
+
+    const config = createTestConfig(testDir);
+    const result = createApp(config);
+    app = result.app;
+  });
+
+  afterEach(async () => {
+    await app.close();
+    rmSync(testDir, { recursive: true, force: true });
+  });
+
+  it("GET /asahi returns wrapper shell script", async () => {
+    const resp = await app.inject({ method: "GET", url: "/asahi" });
+    expect(resp.statusCode).toBe(200);
+    expect(resp.headers["content-type"]).toContain("text/x-shellscript");
+    expect(resp.body).toContain("#!/bin/bash");
+    expect(resp.body).toContain("installer_data.json");
+    expect(resp.body).toContain("192.168.8.1");
+    expect(resp.body).toContain("install.sh");
+  });
+
+  it("GET /asahi/installer_data.json returns valid config", async () => {
+    const resp = await app.inject({ method: "GET", url: "/asahi/installer_data.json" });
+    expect(resp.statusCode).toBe(200);
+    const data = JSON.parse(resp.body);
+
+    expect(data.os_list).toHaveLength(1);
+    const os = data.os_list[0];
+    expect(os.name).toContain("Fedora Asahi Lab");
+
+    // 3 partitions (fallback) or 4 (built: EFI + Boot + Root + Data)
+    expect(os.partitions.length).toBeGreaterThanOrEqual(3);
+    expect(os.partitions[0].type).toBe("EFI");
+    // Last partition should be the expanding Data partition
+    const lastPart = os.partitions[os.partitions.length - 1];
+    expect(lastPart.type).toBe("Linux");
+    expect(lastPart.expand).toBe(true);
+    // Root partition (second-to-last) should NOT expand
+    const rootPart = os.partitions[os.partitions.length - 2];
+    expect(rootPart.expand).toBe(false);
+    expect(rootPart.image).toBe("root.img");
+  });
+
+  it("GET /asahi/firstboot.sh returns parameterized script", async () => {
+    const resp = await app.inject({
+      method: "GET",
+      url: "/asahi/firstboot.sh?hostname=mac-studio&role=infra&mac=00:11:22:33:44:55",
+    });
+    expect(resp.statusCode).toBe(200);
+    expect(resp.body).toContain("#!/bin/bash");
+    expect(resp.body).toContain("mac-studio");
+    expect(resp.body).toContain("labvg");
+    expect(resp.body).toContain("rancher");  // infra gets rancher LV
+    expect(resp.body).toContain("longhorn"); // infra also gets longhorn
+    expect(resp.body).toContain("ssh-ed25519"); // SSH key injected
+  });
+
+  it("GET /asahi/firstboot.service returns systemd unit", async () => {
+    const resp = await app.inject({ method: "GET", url: "/asahi/firstboot.service" });
+    expect(resp.statusCode).toBe(200);
+    expect(resp.body).toContain("[Unit]");
+    expect(resp.body).toContain("lab-firstboot.sh");
+    expect(resp.body).toContain("ConditionPathExists=!/etc/lab-lvm-setup-done");
+  });
+});
+
+describe("renderFirstbootScript", () => {
+  const baseParams = {
+    hostname: "test-node",
+    serverIp: "10.0.0.1",
+    httpPort: 8080,
+    sshKeys: ["ssh-ed25519 AAAA... user@host"],
+    adminUser: "testadmin",
+    mac: "aa:bb:cc:dd:ee:ff",
+  };
+
+  it("generates valid bash with shebang", () => {
+    const script = renderFirstbootScript({ ...baseParams, role: "worker" });
+    expect(script.startsWith("#!/bin/bash")).toBe(true);
+  });
+
+  it("includes LVM creation commands", () => {
+    const script = renderFirstbootScript({ ...baseParams, role: "infra" });
+    expect(script).toContain("pvcreate");
+    expect(script).toContain("vgcreate labvg");
+    expect(script).toContain("lvcreate");
+  });
+
+  it("uses correct LV sizes from kickstart layout", () => {
+    const script = renderFirstbootScript({ ...baseParams, role: "infra" });
+    expect(script).toContain("27648M");  // swap
+    expect(script).toContain("102400M"); // /var
+    expect(script).toContain("10240M");  // /var/log and /home
+    expect(script).toContain("20480M");  // /srv and /rancher
+  });
+
+  it("includes rancher LV for infra role", () => {
+    const script = renderFirstbootScript({ ...baseParams, role: "infra" });
+    expect(script).toContain("rancher");
+    expect(script).toContain("/var/lib/rancher");
+  });
+
+  it("includes longhorn for worker role", () => {
+    const script = renderFirstbootScript({ ...baseParams, role: "worker" });
+    expect(script).toContain("longhorn");
+    expect(script).toContain("/var/lib/longhorn");
+    // Worker should NOT have rancher
+    expect(script).not.toContain("rancher");
+  });
+
+  it("includes longhorn for infra role", () => {
+    const script = renderFirstbootScript({ ...baseParams, role: "infra" });
+    expect(script).toContain("longhorn");
+    expect(script).toContain("/var/lib/longhorn");
+  });
+
+  it("vanilla role gets no role-specific LVs", () => {
+    const script = renderFirstbootScript({ ...baseParams, role: "vanilla" });
+    expect(script).not.toContain("rancher");
+    expect(script).not.toContain("longhorn");
+  });
+
+  it("handles reprovision (existing labvg)", () => {
+    const script = renderFirstbootScript({ ...baseParams, role: "infra" });
+    expect(script).toContain("reprovision detected");
+    expect(script).toContain("vgchange -ay labvg");
+    expect(script).toContain("mount_lv var /var");
+  });
+
+  it("injects SSH keys for admin user and root", () => {
+    const script = renderFirstbootScript({ ...baseParams, role: "worker" });
+    expect(script).toContain("ssh-ed25519 AAAA...");
+    expect(script).toContain("testadmin");
+    expect(script).toContain("/root/.ssh/authorized_keys");
+  });
+
+  it("sets hostname", () => {
+    const script = renderFirstbootScript({ ...baseParams, role: "worker" });
+    expect(script).toContain('CONF_HOSTNAME="test-node"');
+    expect(script).toContain("hostnamectl set-hostname");
+  });
+
+  it("includes bastion self-registration", () => {
+    const script = renderFirstbootScript({ ...baseParams, role: "worker" });
+    expect(script).toContain("/api/register");
+    expect(script).toContain("aa:bb:cc:dd:ee:ff");
+    expect(script).toContain("test-node");
+  });
+
+  it("writes provisioning metadata", () => {
+    const script = renderFirstbootScript({ ...baseParams, role: "infra" });
+    expect(script).toContain("/etc/lab-provisioned");
+    expect(script).toContain("method=asahi-firstboot");
+  });
+
+  it("creates marker file to prevent re-run", () => {
+    const script = renderFirstbootScript({ ...baseParams, role: "worker" });
+    expect(script).toContain("/etc/lab-lvm-setup-done");
+    expect(script).toContain('touch "$MARKER"');
+  });
+});
+
+describe("renderFirstbootUnit", () => {
+  it("generates valid systemd unit", () => {
+    const unit = renderFirstbootUnit();
+    expect(unit).toContain("[Unit]");
+    expect(unit).toContain("[Service]");
+    expect(unit).toContain("[Install]");
+    expect(unit).toContain("Type=oneshot");
+    expect(unit).toContain("WantedBy=multi-user.target");
+  });
+
+  it("only runs when marker is missing", () => {
+    const unit = renderFirstbootUnit();
+    expect(unit).toContain("ConditionPathExists=!/etc/lab-lvm-setup-done");
+  });
+});

bastion/src/bastion/tests/dispatch.test.ts

@@ -28,6 +28,7 @@ function createTestConfig(testDir: string): BastionConfig {
     gateway: "10.0.0.1",
     sshKeys: ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAITEST test@test"],
     adminUser: "testadmin",
+    syslogPort: 15514,
     skipDnsmasq: true,
     skipArtifacts: true,
     fedoraMirror: "https://download.fedoraproject.org/pub/fedora/linux/releases/43/Everything/x86_64/os",

bastion/src/bastion/tests/kickstart.test.ts

@@ -12,6 +12,7 @@ function baseParams(overrides: Partial<InstallKickstartParams> = {}): InstallKic
     locale: "en_GB.UTF-8",
     serverIp: "192.168.1.100",
     httpPort: 8080,
+    syslogPort: 5514,
     sshKeys: [
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAITEST1 user1@host",
       "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQTEST2 user2@host",
@@ -91,9 +92,8 @@ describe("renderInstallKickstart", () => {
       serverIp: "10.0.0.5",
       httpPort: 9090,
     }));
-    expect(ks).toContain('_BASTION_URL="http://10.0.0.5:9090"');
+    expect(ks).toContain("http://10.0.0.5:9090");
     expect(ks).toContain("/api/progress");
-    expect(ks).toContain("/api/log");
   });
 
   it("infra role has /var/lib/rancher partition", () => {
@@ -141,51 +141,73 @@ describe("renderInstallKickstart", () => {
     expect(ks).toContain("--name=swap --fstype=swap --size=27648");
   });
 
-  it("%pre has error trap", () => {
-    const ks = renderInstallKickstart(baseParams());
-    expect(ks).toContain("trap");
-    expect(ks).toContain("bastion_error");
-    expect(ks).toContain("%pre failed");
-  });
-
-  it("%post has error trap", () => {
-    const ks = renderInstallKickstart(baseParams());
-    expect(ks).toContain("_post_error_handler");
-    expect(ks).toContain("%post failed");
-  });
-
-  it("has granular progress stages in %post", () => {
-    const ks = renderInstallKickstart(baseParams());
-    expect(ks).toContain('"configuring SSH"');
-    expect(ks).toContain('"setting hostname');
-    expect(ks).toContain('"writing provisioning metadata"');
-    expect(ks).toContain('"writing provisioning metadata"');
-  });
-
-  it("has background log streamer in %post", () => {
-    const ks = renderInstallKickstart(baseParams());
-    expect(ks).toContain("_LOG_STREAMER_PID");
-    expect(ks).toContain("_flush_log_streamer");
-    expect(ks).toContain("tail -f");
-  });
-
-  it("has bastion_log function for sending log lines", () => {
-    const ks = renderInstallKickstart(baseParams());
-    expect(ks).toContain("bastion_log()");
-    expect(ks).toContain("/api/log");
-  });
-
-  it("vanilla role skips k3s progress stages", () => {
+  it("vanilla role skips k3s setup", () => {
     const ks = renderInstallKickstart(baseParams({ role: "vanilla" }));
     expect(ks).toContain("vanilla role");
-    expect(ks).not.toContain('"loading k3s kernel modules"');
-    expect(ks).not.toContain('"disabling firewalld"');
+    expect(ks).not.toContain("modules-load.d/k3s.conf");
+    expect(ks).not.toContain("firewalld");
   });
 
-  it("worker role has k3s-related progress stages", () => {
+  it("worker role has k3s setup", () => {
     const ks = renderInstallKickstart(baseParams({ role: "worker" }));
-    expect(ks).toContain('"loading k3s kernel modules"');
-    expect(ks).toContain('"configuring k3s sysctl"');
-    expect(ks).toContain('"disabling firewalld"');
+    expect(ks).toContain("modules-load.d/k3s.conf");
+    expect(ks).toContain("sysctl.d/90-k3s.conf");
+    expect(ks).toContain("firewalld");
+  });
+
+  it("kickstart syntax: no merged partition lines", () => {
+    for (const role of ["vanilla", "worker", "infra"] as const) {
+      const ks = renderInstallKickstart(baseParams({ role }));
+      const lines = ks.split("\n");
+      for (let i = 0; i < lines.length; i++) {
+        const l = lines[i].trim();
+        if (l.startsWith("part ")) {
+          const partCount = (l.match(/\bpart\b/g) || []).length;
+          expect(partCount, `line ${i + 1} has ${partCount} 'part' commands (role=${role}): ${l}`).toBe(1);
+        }
+      }
+    }
+  });
+
+  it("kickstart syntax: each section-opening has a %end", () => {
+    const ks = renderInstallKickstart(baseParams());
+    // Only match section openers at start of line
+    const sections = (ks.match(/^%(?:pre|post|packages)\b/gm) || []).length;
+    const ends = (ks.match(/^%end$/gm) || []).length;
+    expect(ends, `${sections} sections but ${ends} %end markers`).toBe(sections);
+  });
+
+  it("has complete progress stage", () => {
+    const ks = renderInstallKickstart(baseParams());
+    expect(ks).toContain('"complete"');
+    expect(ks).toContain("ready at");
+  });
+
+  it("sends install logs to bastion via syslog", () => {
+    const ks = renderInstallKickstart(baseParams({ syslogPort: 5514 }));
+    expect(ks).toContain("logging --host=192.168.1.100 --port=5514");
+  });
+
+  it("passes ksvalidator syntax check", () => {
+    for (const role of ["vanilla", "worker", "infra"] as const) {
+      const ks = renderInstallKickstart(baseParams({ role }));
+      const { execSync } = require("node:child_process");
+      const { writeFileSync, unlinkSync } = require("node:fs");
+      const tmp = `/tmp/ks-test-${role}.ks`;
+      writeFileSync(tmp, ks);
+      try {
+        execSync(`ksvalidator -v F43 ${tmp}`, { encoding: "utf-8" });
+      } catch (err: unknown) {
+        const msg = err instanceof Error ? (err as { stderr?: string }).stderr ?? err.message : String(err);
+        throw new Error(`ksvalidator failed for role=${role}: ${msg}`);
+      } finally {
+        try { unlinkSync(tmp); } catch {}
+      }
+    }
+  });
+
+  it("does not include serial console (causes 30s boot timeout on hardware without UART)", () => {
+    const ks = renderInstallKickstart(baseParams({ role: "vanilla" }));
+    expect(ks).not.toContain("ttyS0");
   });
 });

bastion/src/bastion/tests/state.test.ts

@@ -26,6 +26,7 @@ describe("StateManager", () => {
       discovered: {},
       install_queue: {},
       installed: {},
+      debug: {},
     });
   });
 
@@ -39,6 +40,7 @@ describe("StateManager", () => {
       discovered: {},
       install_queue: {},
       installed: {},
+      debug: {},
     });
   });
 

bastion/src/bastion/tests/syslog-listener.test.ts

@@ -0,0 +1,121 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { createSocket } from "node:dgram";
+import { mkdtempSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { SyslogListener } from "../src/services/syslog-listener.js";
+import { InstallLogBuffer } from "../src/services/install-log.js";
+import { StateManager } from "../src/services/state.js";
+
+function sendUdpSyslog(port: number, message: string): Promise<void> {
+  return new Promise((resolve, reject) => {
+    const client = createSocket("udp4");
+    const buf = Buffer.from(message);
+    client.send(buf, 0, buf.length, port, "127.0.0.1", (err) => {
+      client.close();
+      if (err) reject(err);
+      else resolve();
+    });
+  });
+}
+
+describe("SyslogListener", () => {
+  let tmpDir: string;
+  let state: StateManager;
+  let installLog: InstallLogBuffer;
+  let syslog: SyslogListener;
+  const PORT = 15514; // use non-privileged port for testing
+
+  beforeEach(() => {
+    tmpDir = mkdtempSync(join(tmpdir(), "syslog-test-"));
+    state = new StateManager(join(tmpDir, "state.json"));
+    state.init();
+    installLog = new InstallLogBuffer(tmpDir);
+    syslog = new SyslogListener(PORT, installLog, state);
+    syslog.start();
+  });
+
+  afterEach(() => {
+    syslog.stop();
+    rmSync(tmpDir, { recursive: true, force: true });
+  });
+
+  it("receives and stores syslog messages for registered IP", async () => {
+    const mac = "aa:bb:cc:dd:ee:ff";
+    // Queue a machine so hostname can be resolved
+    state.update((s) => {
+      s.install_queue[mac] = {
+        hostname: "testnode",
+        disk: "/dev/sda",
+        role: "worker",
+        os: "fedora-43",
+        queued_at: new Date().toISOString(),
+      };
+    });
+
+    // Register IP → MAC mapping
+    syslog.registerIp("127.0.0.1", mac);
+
+    // Send a syslog message (RFC 3164 format)
+    await sendUdpSyslog(PORT, "<13>Mar 30 01:30:00 localhost anaconda[1234]: Installing package vim-enhanced");
+
+    // Wait for UDP delivery
+    await new Promise((r) => setTimeout(r, 200));
+
+    const lines = installLog.getLines(mac);
+    expect(lines.length).toBeGreaterThan(0);
+    expect(lines[0]!.line).toContain("anaconda");
+    expect(lines[0]!.line).toContain("Installing package vim-enhanced");
+  });
+
+  it("ignores messages from unknown IPs", async () => {
+    // Don't register any IP mapping
+    await sendUdpSyslog(PORT, "<13>Mar 30 01:30:00 localhost anaconda[1234]: test message");
+    await new Promise((r) => setTimeout(r, 200));
+
+    // No MAC to check, but the listener should not crash
+    // and no logs should be stored for any MAC
+    expect(installLog.lineCount("unknown")).toBe(0);
+  });
+
+  it("resolves IP from installed machines state", async () => {
+    const mac = "11:22:33:44:55:66";
+    state.update((s) => {
+      s.installed[mac] = {
+        hostname: "installed-node",
+        role: "worker",
+        ip: "127.0.0.1",
+        installed_at: new Date().toISOString(),
+      };
+    });
+
+    await sendUdpSyslog(PORT, "<14>Mar 30 02:00:00 installed-node sshd[5678]: Accepted publickey for root");
+    await new Promise((r) => setTimeout(r, 200));
+
+    const lines = installLog.getLines(mac);
+    expect(lines.length).toBeGreaterThan(0);
+    expect(lines[0]!.line).toContain("sshd");
+  });
+
+  it("parses various syslog formats", async () => {
+    const mac = "aa:bb:cc:dd:ee:ff";
+    syslog.registerIp("127.0.0.1", mac);
+    state.update((s) => {
+      s.install_queue[mac] = {
+        hostname: "testnode",
+        disk: "/dev/sda",
+        role: "worker",
+        os: "fedora-43",
+        queued_at: new Date().toISOString(),
+      };
+    });
+
+    // Message without PID
+    await sendUdpSyslog(PORT, "<13>Mar 30 01:30:00 localhost kernel: NVMe device ready");
+    await new Promise((r) => setTimeout(r, 200));
+
+    const lines = installLog.getLines(mac);
+    expect(lines.length).toBeGreaterThan(0);
+    expect(lines[0]!.line).toContain("kernel");
+  });
+});

bastion/src/cli/src/api/client.ts

@@ -94,6 +94,26 @@ export class LabdClient {
     return this.request("POST", "/api/machines/install", { body: opts });
   }
 
+  async registerMachine(opts: {
+    mac: string; hostname: string; role?: string; ip?: string;
+  }): Promise<{ status: string; data?: unknown; error?: string }> {
+    return this.request("POST", "/api/machines/register", { body: opts });
+  }
+
+  async debugMachine(mac: string, opts?: { pxeBoot?: boolean }): Promise<{ status: string; data?: { mac: string; hostname: string }; error?: string }> {
+    return this.request("POST", "/api/machines/debug", { body: { mac, pxeBoot: opts?.pxeBoot } });
+  }
+
+  async discoverMachine(data: {
+    mac: string; product?: string; board?: string; serial?: string;
+    manufacturer?: string; cpu_model?: string; cpu_cores?: number;
+    memory_gb?: number; arch?: string;
+    disks?: Array<{ name: string; size_gb: number; model: string }>;
+    nics?: Array<{ name: string; mac: string; state: string }>;
+  }): Promise<{ status: string; error?: string }> {
+    return this.request("POST", "/api/machines/discover", { body: data });
+  }
+
   async forgetMachine(mac: string): Promise<{ status: string }> {
     return this.request("DELETE", `/api/machines/${encodeURIComponent(mac)}`);
   }

bastion/src/cli/src/commands/app.ts

@@ -1,9 +1,10 @@
 // CLI command: labctl app k3s install/health <target>
 // Install or check k3s on a target machine via SSH.
 
-import { existsSync } from "node:fs";
+import { existsSync, writeFileSync, mkdirSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { execSync } from "node:child_process";
 import type { Command } from "commander";
 import type { BastionState } from "@lab/shared";
 import { K3sModule, sshExec } from "@lab/modules";
@@ -69,7 +70,7 @@ export function registerAppCommand(program: Command): void {
     .command("install <target>")
     .description("Install k3s on a target machine (hostname, IP, or MAC)")
     .option("--role <role>", "k3s role: infra (server) or worker (agent)", "infra")
-    .option("--user <user>", "SSH user", "michal")
+    .option("--user <user>", "SSH user", "root")
     .option("--k3s-server <url>", "k3s server URL (required for worker role)")
     .option("--k3s-token <token>", "k3s join token (required for worker role)")
     .action(async (target: string, opts: {
@@ -163,7 +164,7 @@ export function registerAppCommand(program: Command): void {
   k3sCmd
     .command("health [target]")
     .description("Check k3s health (all hosts if no target given)")
-    .option("--user <user>", "SSH user", "michal")
+    .option("--user <user>", "SSH user", "root")
     .action(async (target: string | undefined, opts: { user: string }) => {
       const sshKey = findSshKey();
 
@@ -303,7 +304,7 @@ export function registerAppCommand(program: Command): void {
   k3sCmd
     .command("list")
     .description("List installed machines and their k3s status")
-    .option("--user <user>", "SSH user", "michal")
+    .option("--user <user>", "SSH user", "root")
     .action(async (opts: { user: string }) => {
       let state: BastionState;
       try {
@@ -400,4 +401,88 @@ export function registerAppCommand(program: Command): void {
         );
       }
     });
+
+  k3sCmd
+    .command("kubeconfig <target>")
+    .description("Fetch kubeconfig from a target and merge into ~/.kube/config")
+    .option("--user <user>", "SSH user", "root")
+    .option("--context <name>", "Context name (defaults to hostname)")
+    .option("--print", "Print kubeconfig to stdout instead of merging")
+    .action(async (target: string, opts: {
+      user: string;
+      context?: string;
+      print?: boolean;
+    }) => {
+      const state = await fetchState();
+      const resolved = resolveTarget(target, state);
+
+      if (!resolved) {
+        console.error(`Cannot resolve target: ${target}`);
+        console.error("Provide an IP address, hostname, or MAC of an installed machine.");
+        process.exit(1);
+      }
+
+      const sshKey = findSshKey();
+
+      // Fetch kubeconfig via SSH
+      let raw: string;
+      try {
+        const result = await sshExec(resolved.ip, opts.user, "cat /etc/rancher/k3s/k3s.yaml", {
+          ...(sshKey ? { keyPath: sshKey } : {}),
+          timeoutMs: 10_000,
+        });
+        raw = result.stdout;
+      } catch (err) {
+        console.error(`Failed to fetch kubeconfig: ${err instanceof Error ? err.message : String(err)}`);
+        process.exit(1);
+      }
+
+      const contextName = opts.context ?? resolved.hostname;
+
+      // Rewrite: replace 127.0.0.1 with actual IP, rename cluster/user/context
+      const rewritten = raw
+        .replace(/server:\s*https:\/\/127\.0\.0\.1:/, `server: https://${resolved.ip}:`)
+        .replace(/name:\s*default/g, `name: ${contextName}`)
+        .replace(/cluster:\s*default/g, `cluster: ${contextName}`)
+        .replace(/user:\s*default/g, `user: ${contextName}`)
+        .replace(/current-context:\s*default/, `current-context: ${contextName}`);
+
+      if (opts.print) {
+        process.stdout.write(rewritten);
+        return;
+      }
+
+      // Merge into ~/.kube/config using kubectl
+      const kubeDir = join(homedir(), ".kube");
+      mkdirSync(kubeDir, { recursive: true });
+      const mainConfig = join(kubeDir, "config");
+      const tmpFile = join(kubeDir, `.labctl-${contextName}.tmp`);
+
+      writeFileSync(tmpFile, rewritten, { mode: 0o600 });
+
+      try {
+        if (existsSync(mainConfig)) {
+          const merged = execSync(
+            `KUBECONFIG="${mainConfig}:${tmpFile}" kubectl config view --flatten`,
+            { encoding: "utf-8" },
+          );
+          writeFileSync(mainConfig, merged, { mode: 0o600 });
+        } else {
+          writeFileSync(mainConfig, rewritten, { mode: 0o600 });
+        }
+
+        // Set current context
+        execSync(`kubectl config use-context ${contextName}`, { stdio: "pipe" });
+
+        console.log(`Merged kubeconfig for ${contextName} (${resolved.ip})`);
+        console.log(`Context set to: ${contextName}`);
+        console.log(`\nSwitch contexts: kubectl config use-context <name>`);
+      } catch (err) {
+        console.error(`Failed to merge kubeconfig: ${err instanceof Error ? err.message : String(err)}`);
+        console.error(`Standalone config saved at: ${tmpFile}`);
+        process.exit(1);
+      } finally {
+        try { const { unlinkSync } = await import("node:fs"); unlinkSync(tmpFile); } catch { /* ignore */ }
+      }
+    });
 }

bastion/src/cli/src/commands/asahi.ts

@@ -0,0 +1,69 @@
+// CLI command: provision asahi
+// Prints the curl command to run on the Mac Studio (macOS) to install
+// Fedora Asahi Remix with lab LVM layout.
+
+import type { Command } from "commander";
+import { getLabdClient } from "../api/config.js";
+
+export function registerAsahiCommand(parent: Command): void {
+  parent
+    .command("asahi")
+    .description("Show instructions to provision an Apple Silicon Mac with Asahi Linux")
+    .action(async () => {
+      // Try to get bastion info to determine the correct URL
+      let bastionUrl = "";
+      try {
+        const bastions = await getLabdClient().getBastions();
+        const online = bastions.find(b => b.status === "online");
+        if (online) {
+          bastionUrl = `http://${online.serverIp}:8080`;
+        }
+      } catch { /* labd not reachable */ }
+
+      if (!bastionUrl) {
+        // Fall back to config
+        const { loadConfig } = await import("../config/index.js");
+        const config = loadConfig();
+        bastionUrl = config.labdUrl ?? "http://<bastion-ip>:8080";
+        // Convert labd URL to bastion URL (labd is on different port/host)
+        bastionUrl = bastionUrl.replace(/:\d+$/, ":8080");
+      }
+
+      const BOLD = "\x1b[1m";
+      const CYAN = "\x1b[36m";
+      const DIM = "\x1b[2m";
+      const RESET = "\x1b[0m";
+
+      console.log("");
+      console.log(`${BOLD}  Asahi Linux Provisioning${RESET}`);
+      console.log(`${DIM}  For Apple Silicon Macs (Mac Studio, MacBook, etc.)${RESET}`);
+      console.log("");
+      console.log(`  Run this command ${BOLD}on the Mac${RESET} (from macOS Terminal):`);
+      console.log("");
+      console.log(`    ${CYAN}${BOLD}curl ${bastionUrl}/asahi | sh${RESET}`);
+      console.log("");
+      console.log(`  The installer will ask a few interactive questions:`);
+      console.log(`    ${BOLD}1.${RESET} Action: press ${BOLD}r${RESET} to resize macOS`);
+      console.log(`    ${BOLD}2.${RESET} How much space for Linux: choose maximum`);
+      console.log(`    ${BOLD}3.${RESET} Confirm the resize operation`);
+      console.log(`    ${BOLD}4.${RESET} macOS password for firmware authentication`);
+      console.log("");
+      console.log(`  After that, everything is automatic:`);
+      console.log(`    - Asahi boot infrastructure (m1n1 + U-Boot)`);
+      console.log(`    - Fedora Asahi Remix root partition`);
+      console.log(`    - LVM data partition (remaining space)`);
+      console.log("");
+      console.log(`  On first boot, LVM volumes are created automatically:`);
+      console.log(`    ${DIM}labvg/swap (27GB), labvg/var (100GB), labvg/varlog (10GB),`);
+      console.log(`    labvg/home (10GB), labvg/srv (20GB), labvg/rancher (20GB),`);
+      console.log(`    labvg/longhorn (remaining space)${RESET}`);
+      console.log("");
+      console.log(`  After first boot, SSH in and run the firstboot script:`);
+      console.log(`    ${BOLD}ssh root@<ip> 'curl -sf ${bastionUrl}/asahi/firstboot.sh | bash'${RESET}`);
+      console.log("");
+      console.log(`  This sets up LVM, detects hostname/MAC, and self-registers.`);
+      console.log(`  Then install k3s:`);
+      console.log(`    ${BOLD}labctl app k3s install <hostname> --role infra${RESET}`);
+      console.log("");
+    });
+}

bastion/src/cli/src/commands/debug.ts

@@ -0,0 +1,156 @@
+// CLI command: provision debug
+// Queue a machine for debug/rescue PXE boot and optionally SSH reboot into PXE.
+
+import { execFileSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { Command } from "commander";
+import type { BastionState } from "@lab/shared";
+import { getLabdClient } from "../api/config.js";
+
+/** Resolve a target (hostname, MAC, or IP) to {mac, hostname, ip} from state. */
+function resolveTarget(
+  target: string,
+  state: BastionState,
+): { mac: string; hostname: string; ip: string } | null {
+  const normalized = target.toLowerCase().replace(/-/g, ":");
+
+  if (state.installed[normalized]) {
+    const info = state.installed[normalized];
+    return { mac: normalized, hostname: info.hostname, ip: info.ip };
+  }
+
+  if (state.discovered[normalized]) {
+    return { mac: normalized, hostname: normalized, ip: "" };
+  }
+
+  if (state.install_queue[normalized]) {
+    return { mac: normalized, hostname: state.install_queue[normalized].hostname, ip: "" };
+  }
+
+  for (const [mac, info] of Object.entries(state.installed)) {
+    if (info.hostname === target || info.hostname.startsWith(target + ".")) {
+      return { mac, hostname: info.hostname, ip: info.ip };
+    }
+  }
+
+  for (const [mac, info] of Object.entries(state.installed)) {
+    if (info.ip === target) {
+      return { mac, hostname: info.hostname, ip: info.ip };
+    }
+  }
+
+  return null;
+}
+
+export function registerDebugCommand(parent: Command): void {
+  parent
+    .command("debug <target>")
+    .description("PXE boot into Fedora rescue mode for debugging (target: hostname, MAC, or IP)")
+    .option("--pxe-boot", "Boot installed system via PXE (kernel+initrd from network, root from NVMe)")
+    .showHelpAfterError(true)
+    .action(async (target: string, opts: { pxeBoot?: boolean }) => {
+      const client = getLabdClient();
+
+      // Resolve target from labd aggregated state
+      let state: BastionState;
+      try {
+        state = await client.getMachines();
+      } catch (err) {
+        console.error(`Cannot reach labd: ${err instanceof Error ? err.message : String(err)}`);
+        process.exit(1);
+      }
+
+      const resolved = resolveTarget(target, state);
+      if (!resolved) {
+        console.error(`Cannot find machine: ${target}`);
+        console.error("Provide a hostname, MAC, or IP of a known machine.");
+        console.error("Run 'labctl provision list' to see available machines.");
+        process.exit(1);
+      }
+
+      const { mac, hostname, ip } = resolved;
+      console.log(`Queuing debug mode for ${hostname} (${mac})...`);
+
+      try {
+        const result = await client.debugMachine(mac, { pxeBoot: opts.pxeBoot === true });
+        if (result.error) {
+          console.error(`Failed: ${result.error}`);
+          process.exit(1);
+        }
+      } catch (err) {
+        console.error(`Failed to queue debug: ${err instanceof Error ? err.message : String(err)}`);
+        process.exit(1);
+      }
+
+      // Try SSH reboot into PXE
+      if (ip !== "") {
+        const adminUser = process.env["SUDO_USER"] ?? process.env["USER"] ?? "";
+        const effectiveUser = adminUser === "root" ? "" : adminUser;
+
+        if (effectiveUser !== "") {
+          console.log(`\nAttempting SSH reboot into PXE (${effectiveUser}@${ip})...`);
+
+          const sudoUser = process.env["SUDO_USER"];
+          const realHome = sudoUser !== undefined ? join("/home", sudoUser) : homedir();
+          const keyPaths = [
+            join(realHome, ".ssh", "id_ed25519"),
+            join(realHome, ".ssh", "id_rsa"),
+            join(realHome, ".ssh", "id_ecdsa"),
+          ];
+          const sshKey = keyPaths.find(k => existsSync(k));
+
+          const sshArgs = [
+            "-o", "StrictHostKeyChecking=no",
+            "-o", "UserKnownHostsFile=/dev/null",
+            "-o", "ConnectTimeout=10",
+            ...(sshKey !== undefined ? ["-i", sshKey] : []),
+            `${effectiveUser}@${ip}`,
+            'PXE_ENTRY=$(sudo efibootmgr | grep -iE "pxe|network|ipv4" | head -1 | grep -oP "Boot\\K[0-9A-F]+"); if [ -n "$PXE_ENTRY" ]; then sudo efibootmgr --bootnext "$PXE_ENTRY" && echo "PXE set as next boot" && sudo reboot; else echo "No PXE boot entry found, rebooting anyway..." && sudo reboot; fi',
+          ];
+
+          try {
+            execFileSync("ssh", sshArgs, { stdio: "inherit" });
+          } catch {
+            // SSH connection closing during reboot is expected
+          }
+        }
+      }
+
+      // Determine bastion URL from labd config for the setup script URL
+      const bastionUrl = process.env["LABD_URL"]
+        ? process.env["LABD_URL"].replace(/\/ws\/bastion$/, "").replace(/^wss?:/, "http:")
+        : "http://<bastion-ip>:8080";
+
+      console.log(`
+Debug mode queued for ${hostname} (${mac}).
+Reboot the machine to enter Fedora rescue mode.
+
+SSH access (started by Anaconda):
+  ssh root@<ip>   (password: debug)
+
+For nc remote shell, run from rescue shell:
+  curl ${bastionUrl}/debug-setup.sh | bash
+
+Once in rescue shell:
+
+  # Activate LVM and mount installed system
+  vgchange -ay
+  mkdir -p /mnt/sysroot
+  mount /dev/<vg>/root /mnt/sysroot
+  cat /mnt/sysroot/etc/fstab
+  mount /dev/<vg>/var  /mnt/sysroot/var
+  mount /dev/<vg>/home /mnt/sysroot/home
+
+  # Boot installed system in a container
+  /mnt/sysroot/usr/bin/systemd-nspawn -D /mnt/sysroot --boot
+
+  # Or chroot for quick fixes
+  mount --bind /dev  /mnt/sysroot/dev
+  mount --bind /proc /mnt/sysroot/proc
+  mount --bind /sys  /mnt/sysroot/sys
+  chroot /mnt/sysroot
+`);
+    });
+}

bastion/src/cli/src/commands/labcontroller.ts

@@ -38,7 +38,7 @@ export function registerLabcontrollerCommands(appCmd: Command): void {
   lcCmd
     .command("deploy <target>")
     .description("Deploy labcontroller stack to a k3s node")
-    .option("--user <user>", "SSH user", "michal")
+    .option("--user <user>", "SSH user", "root")
     .option("--crdb-replicas <n>", "CockroachDB replicas", "1")
     .action(async (target: string, opts: {
       user: string;
@@ -193,7 +193,7 @@ export function registerLabcontrollerCommands(appCmd: Command): void {
   lcCmd
     .command("status [target]")
     .description("Check labcontroller deployment status (all hosts if no target)")
-    .option("--user <user>", "SSH user", "michal")
+    .option("--user <user>", "SSH user", "root")
     .action(async (target: string | undefined, opts: { user: string }) => {
       const sshKey = findSshKey();
       const sshOpts = sshKey ? { keyPath: sshKey } : {};

bastion/src/cli/src/commands/list.ts

@@ -69,10 +69,10 @@ export function registerListCommand(parent: Command): void {
         const hostname = inst?.hostname ?? queued?.hostname ?? "-";
         const role = inst?.role ?? queued?.role ?? "-";
         const ip = inst?.ip ?? "-";
-        const cpu = hw?.cpu_model ?? "-";
-        const cores = hw?.cpu_cores != null ? String(hw.cpu_cores) : "-";
-        const ram = hw?.memory_gb != null ? `${hw.memory_gb}GB` : "-";
-        const product = hw?.product ?? "-";
+        const cpu = hw?.cpu_model ?? inst?.cpu_model ?? "-";
+        const cores = (hw?.cpu_cores ?? inst?.cpu_cores) != null ? String(hw?.cpu_cores ?? inst?.cpu_cores) : "-";
+        const ram = (hw?.memory_gb ?? inst?.memory_gb) != null ? `${hw?.memory_gb ?? inst?.memory_gb}GB` : "-";
+        const product = hw?.product ?? inst?.product ?? "-";
 
         const color = statusColor(status);
 

bastion/src/cli/src/commands/logs.ts

@@ -39,19 +39,25 @@ export function registerLogsCommand(parent: Command): void {
   parent
     .command("logs <target>")
     .description("Show provisioning logs for a machine (hostname, MAC, or IP)")
-    .action(async (target: string) => {
+    .option("-f, --follow", "Follow log output in real-time")
+    .action(async (target: string, opts: { follow?: boolean }) => {
       const mac = await resolveToMac(target);
 
+      const BOLD = "\x1b[1m";
+      const GREEN = "\x1b[32m";
+      const YELLOW = "\x1b[33m";
+      const RED = "\x1b[31m";
+      const DIM = "\x1b[2m";
+      const RESET = "\x1b[0m";
+
+      if (opts.follow) {
+        await followLogs(mac, { BOLD, GREEN, YELLOW, RED, DIM, RESET });
+        return;
+      }
+
       try {
         const data = await getLabdClient().getMachineLogs(mac);
 
-        const BOLD = "\x1b[1m";
-        const GREEN = "\x1b[32m";
-        const YELLOW = "\x1b[33m";
-        const RED = "\x1b[31m";
-        const DIM = "\x1b[2m";
-        const RESET = "\x1b[0m";
-
         console.log(`${BOLD}${data["hostname"]}${RESET} (${mac})`);
         console.log(`  Status:   ${data["status"] === "installed" ? GREEN : YELLOW}${data["status"]}${RESET}`);
         console.log(`  Role:     ${data["role"]}`);
@@ -83,3 +89,64 @@ export function registerLogsCommand(parent: Command): void {
       }
     });
 }
+
+/** Follow logs by polling labd. */
+async function followLogs(
+  mac: string,
+  colors: { BOLD: string; GREEN: string; YELLOW: string; RED: string; DIM: string; RESET: string },
+): Promise<void> {
+  const { BOLD, GREEN, YELLOW, RED, DIM, RESET } = colors;
+  const client = getLabdClient();
+
+  console.log(`${DIM}Following logs for ${mac} (Ctrl+C to stop)${RESET}`);
+  console.log("");
+
+  let lastStageCount = 0;
+  let lastStatus = "";
+  let sawInstalling = false;
+
+  while (true) {
+    try {
+      const data = await client.getMachineLogs(mac);
+      const status = String(data["status"] ?? "");
+      const log = data["log"] as Array<{ stage: string; detail: string; timestamp: string }> | undefined;
+
+      // Print header once or on status change
+      if (status !== lastStatus) {
+        const hostname = String(data["hostname"] ?? mac);
+        const statusColor = status === "installed" ? GREEN : YELLOW;
+        console.log(`  ${BOLD}${hostname}${RESET}  ${statusColor}${status}${RESET}`);
+        lastStatus = status;
+      }
+
+      if (status === "installing" || status === "queued") {
+        sawInstalling = true;
+      }
+
+      // Print new stages
+      if (log && log.length > lastStageCount) {
+        for (let i = lastStageCount; i < log.length; i++) {
+          const entry = log[i]!;
+          const time = entry.timestamp.slice(11, 19);
+          const color = entry.stage === "complete" ? GREEN : entry.stage === "error" ? RED : YELLOW;
+          const detail = entry.detail ? ` ${DIM}-- ${entry.detail}${RESET}` : "";
+          console.log(`  ${DIM}${time}${RESET}  ${color}${entry.stage}${RESET}${detail}`);
+        }
+        lastStageCount = log.length;
+      }
+
+      // Only exit on "installed" if we actually saw the install happen
+      // (avoids exiting immediately when following a reprovision that hasn't started yet)
+      if (status === "installed" && sawInstalling) {
+        const ip = data["ip"] ?? "";
+        console.log("");
+        console.log(`  ${GREEN}${BOLD}Install complete!${RESET}${ip ? ` ${DIM}ssh lab@${ip}${RESET}` : ""}`);
+        process.exit(0);
+      }
+    } catch {
+      // Machine may not be in logs yet (still queued)
+    }
+
+    await new Promise((r) => setTimeout(r, 5000));
+  }
+}

bastion/src/cli/src/commands/recheck.ts

@@ -0,0 +1,94 @@
+// CLI command: provision recheck
+// SSH into all installed machines, collect hardware info, update bastion state.
+
+import type { Command } from "commander";
+import { sshExec } from "@lab/modules";
+import { getLabdClient } from "../api/config.js";
+
+const BOLD = "\x1b[1m";
+const GREEN = "\x1b[0;32m";
+const RED = "\x1b[0;31m";
+const DIM = "\x1b[2m";
+const RESET = "\x1b[0m";
+
+const SSH_OPTS = { timeoutMs: 30_000 };
+
+// Shell script that collects hardware info as JSON.
+// Kept simple — no Python, pure shell + awk.
+const HW_COLLECT_SCRIPT = [
+  'P=$(cat /sys/class/dmi/id/product_name 2>/dev/null || echo unknown)',
+  'B=$(cat /sys/class/dmi/id/board_name 2>/dev/null || echo unknown)',
+  'S=$(cat /sys/class/dmi/id/product_serial 2>/dev/null || echo unknown)',
+  'M=$(cat /sys/class/dmi/id/sys_vendor 2>/dev/null || echo unknown)',
+  'C=$(grep -m1 "model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2 | sed "s/^ //" || grep -m1 Model /proc/cpuinfo 2>/dev/null | cut -d: -f2 | sed "s/^ //" || echo unknown)',
+  'N=$(grep -c "^processor" /proc/cpuinfo 2>/dev/null || echo 0)',
+  'R=$(awk "/MemTotal/ {printf \\"%d\\", \\$2/1024/1024}" /proc/meminfo 2>/dev/null || echo 0)',
+  'A=$(uname -m)',
+  'printf \'{"product":"%s","board":"%s","serial":"%s","manufacturer":"%s","cpu_model":"%s","cpu_cores":%s,"memory_gb":%s,"arch":"%s"}\\n\' "$P" "$B" "$S" "$M" "$C" "$N" "$R" "$A"',
+].join("; ");
+
+export function registerRecheckCommand(parent: Command): void {
+  parent
+    .command("recheck")
+    .description("Refresh hardware info for all installed machines via SSH")
+    .option("--user <user>", "SSH user", "root")
+    .option("--target <hostname>", "Only recheck a specific machine (by hostname or MAC)")
+    .action(async (opts: { user: string; target?: string }) => {
+      const client = getLabdClient();
+      let state;
+      try {
+        state = await client.getMachines();
+      } catch (err) {
+        console.error(`Cannot reach labd: ${err instanceof Error ? err.message : String(err)}`);
+        process.exit(1);
+      }
+
+      // Build list of machines to check
+      const targets: Array<{ mac: string; hostname: string; ip: string }> = [];
+      for (const [mac, info] of Object.entries(state.installed)) {
+        if (!info.ip) continue;
+        if (opts.target && info.hostname !== opts.target && mac !== opts.target) continue;
+        targets.push({ mac, hostname: info.hostname, ip: info.ip });
+      }
+
+      if (targets.length === 0) {
+        console.log("No installed machines with IPs to check.");
+        return;
+      }
+
+      console.log(`\n${BOLD}Rechecking ${targets.length} machine(s)...${RESET}\n`);
+
+      let updated = 0;
+      let failed = 0;
+
+      for (const { mac, hostname, ip } of targets) {
+        process.stdout.write(`  ${hostname.padEnd(24)} ${DIM}(${ip})${RESET}  `);
+
+        try {
+          const t0 = Date.now();
+          const result = await sshExec(ip, opts.user, HW_COLLECT_SCRIPT, SSH_OPTS);
+          const elapsed = Date.now() - t0;
+          if (result.exitCode !== 0) {
+            console.log(`${RED}SSH failed (exit ${result.exitCode}, ${elapsed}ms)${RESET}`);
+            if (result.stderr) console.log(`    ${DIM}${result.stderr.substring(0, 200)}${RESET}`);
+            console.log(`${RED}SSH failed (exit ${result.exitCode})${RESET}`);
+            failed++;
+            continue;
+          }
+
+          const hwData = JSON.parse(result.stdout.trim());
+          await client.discoverMachine({ mac, ...hwData });
+          const cpu = hwData.cpu_model || "?";
+          const cores = hwData.cpu_cores || "?";
+          const mem = hwData.memory_gb || "?";
+          console.log(`${GREEN}OK${RESET} ${DIM}${cpu}, ${cores} cores, ${mem}GB${RESET}`);
+          updated++;
+        } catch (err) {
+          console.log(`${RED}FAIL${RESET} ${DIM}${err instanceof Error ? err.message : String(err)}${RESET}`);
+          failed++;
+        }
+      }
+
+      console.log(`\n${BOLD}Done:${RESET} ${updated} updated, ${failed} failed\n`);
+    });
+}

bastion/src/cli/src/commands/register.ts

@@ -0,0 +1,37 @@
+// CLI command: provision register
+// Register an already-installed machine that is missing from bastion state.
+
+import { Command, Option } from "commander";
+import { SUPPORTED_ROLES } from "@lab/shared";
+import { getLabdClient } from "../api/config.js";
+
+export function registerRegisterCommand(parent: Command): void {
+  parent
+    .command("register <mac> <hostname>")
+    .description("Register an already-installed machine (e.g. after state loss)")
+    .addOption(new Option("--role <role>", "Machine role").choices([...SUPPORTED_ROLES]).default("worker"))
+    .option("--ip <address>", "Machine IP address")
+    .action(async (mac: string, hostname: string, opts: {
+      role: string;
+      ip?: string;
+    }) => {
+      try {
+        const result = await getLabdClient().registerMachine({
+          mac,
+          hostname,
+          role: opts.role,
+          ...(opts.ip ? { ip: opts.ip } : {}),
+        });
+
+        if (result.error) {
+          console.error(`Failed: ${result.error}`);
+          process.exit(1);
+        }
+
+        console.log(`Registered ${mac} as ${hostname} (role=${opts.role}${opts.ip ? `, ip=${opts.ip}` : ""})`);
+      } catch (err) {
+        console.error(`Failed: ${err instanceof Error ? err.message : String(err)}`);
+        process.exit(1);
+      }
+    });
+}

bastion/src/cli/src/commands/reprovision.ts

@@ -144,6 +144,7 @@ export function registerReprovisionCommand(parent: Command): void {
 
       const sshArgs = [
         "-o", "StrictHostKeyChecking=no",
+        "-o", "UserKnownHostsFile=/dev/null",
         "-o", "ConnectTimeout=10",
         ...(sshKey !== undefined ? ["-i", sshKey] : []),
         `${effectiveUser}@${ip}`,

bastion/src/cli/src/index.ts

@@ -2,7 +2,7 @@
 // CLI entry point for lab-bastion.
 // Commands:
 //   init bastion standalone start/stop/status
-//   provision list/install/reprovision/forget
+//   provision list/install/reprovision/forget/register
 
 import { fileURLToPath } from "node:url";
 import { Command, Option } from "commander";
@@ -14,9 +14,13 @@ import { registerStatusCommand } from "./commands/status.js";
 import { registerInstallCommand } from "./commands/install.js";
 import { registerListCommand } from "./commands/list.js";
 import { registerReprovisionCommand } from "./commands/reprovision.js";
+import { registerDebugCommand } from "./commands/debug.js";
 import { registerForgetCommand } from "./commands/forget.js";
+import { registerRegisterCommand } from "./commands/register.js";
+import { registerAsahiCommand } from "./commands/asahi.js";
 import { registerLogsCommand } from "./commands/logs.js";
 import { registerMakeIsoCommand } from "./commands/makeiso.js";
+import { registerRecheckCommand } from "./commands/recheck.js";
 import { registerConfigCommand } from "./commands/config.js";
 import { registerLoginCommand } from "./commands/login.js";
 import { registerDoctorCommand } from "./commands/doctor.js";
@@ -95,9 +99,13 @@ export function createProgram(): Command {
   registerListCommand(provisionCmd);
   registerInstallCommand(provisionCmd);
   registerReprovisionCommand(provisionCmd);
+  registerDebugCommand(provisionCmd);
   registerForgetCommand(provisionCmd);
+  registerRegisterCommand(provisionCmd);
+  registerAsahiCommand(provisionCmd);
   registerLogsCommand(provisionCmd);
   registerMakeIsoCommand(provisionCmd);
+  registerRecheckCommand(provisionCmd);
 
   // config list/get/set/path
   registerConfigCommand(program);

bastion/src/cli/tests/smoke-bastion.test.ts

@@ -137,7 +137,7 @@ describe("bastion smoke tests", () => {
 
     // Wait for the server to start (look for the banner)
     const startedAt = Date.now();
-    const maxWait = 10_000;
+    const maxWait = 15_000;
     while (Date.now() - startedAt < maxWait) {
       if (stdout.includes("Waiting for PXE boot requests")) break;
       await sleep(200);

bastion/src/labd/src/main.ts

@@ -34,6 +34,7 @@ async function main(): Promise<void> {
       server: {
         findMany: () => dbError(),
         findUnique: () => dbError(),
+        upsert: () => dbError(),
       },
       joinToken: {
         findUnique: () => dbError(),

bastion/src/labd/src/routes/bastions.ts

@@ -80,9 +80,54 @@ export function registerBastionRoutes(app: FastifyInstance, db: DbClient): void
     });
   });
 
-  // Aggregated machines from all connected bastions
+  // Aggregated machines from all connected bastions + DB fallback
   app.get("/api/machines", async () => {
-    return bastionRegistry.getAggregatedState();
+    const live = bastionRegistry.getAggregatedState();
+
+    // Merge DB records for machines not currently in any bastion's live state
+    try {
+      const dbServers = (await db.server.findMany({})) as Array<{
+        mac: string | null; hostname: string; role: string; ip: string | null;
+        status: string; labels: Record<string, unknown>;
+      }>;
+      for (const s of dbServers) {
+        if (!s.mac) continue;
+        const mac = s.mac.toLowerCase();
+        // Only add from DB if not already in live state
+        if (!(mac in live.discovered) && !(mac in live.install_queue) && !(mac in live.installed)) {
+          if (s.status === "discovered") {
+            live.discovered[mac] = {
+              mac,
+              product: String(s.labels?.product ?? "unknown"),
+              board: "unknown",
+              serial: "unknown",
+              manufacturer: String(s.labels?.manufacturer ?? "unknown"),
+              cpu_model: String(s.labels?.cpu ?? "unknown"),
+              cpu_cores: Number(s.labels?.cores ?? 0),
+              memory_gb: Number(s.labels?.memory_gb ?? 0),
+              arch: String(s.labels?.arch ?? "unknown"),
+              disks: [],
+              nics: [],
+              first_seen: "",
+              last_seen: "",
+              bastionId: "db",
+            };
+          } else if (s.status === "online" || s.status === "offline") {
+            live.installed[mac] = {
+              hostname: s.hostname,
+              role: s.role,
+              ip: s.ip ?? "",
+              installed_at: "",
+              bastionId: "db",
+            };
+          }
+        }
+      }
+    } catch {
+      // DB unavailable — return live state only
+    }
+
+    return live;
   });
 
   // Queue install — route to correct bastion by MAC
@@ -106,7 +151,7 @@ export function registerBastionRoutes(app: FastifyInstance, db: DbClient): void
         try {
           const result = await sendCommand(all[0]!.bastionId, {
             type: "command-install",
-            mac, hostname, disk: disk ?? "/dev/sda", role: role ?? "infra", os: os ?? "fedora-43",
+            mac, hostname, disk: disk ?? "", role: role ?? "infra", os: os ?? "fedora-43",
           });
           return reply.code(result.status === "ok" ? 200 : 500).send(result);
         } catch (err) {
@@ -119,7 +164,7 @@ export function registerBastionRoutes(app: FastifyInstance, db: DbClient): void
     try {
       const result = await sendCommand(bastion.bastionId, {
         type: "command-install",
-        mac, hostname, disk: disk ?? "/dev/sda", role: role ?? "infra", os: os ?? "fedora-43",
+        mac, hostname, disk: disk ?? "", role: role ?? "infra", os: os ?? "fedora-43",
       });
       return reply.code(result.status === "ok" ? 200 : 500).send(result);
     } catch (err) {
@@ -127,6 +172,78 @@ export function registerBastionRoutes(app: FastifyInstance, db: DbClient): void
     }
   });
 
+  // Register an already-installed machine — route to correct bastion (or single bastion)
+  app.post<{
+    Body: { mac?: string; hostname?: string; role?: string; ip?: string };
+  }>("/api/machines/register", async (request, reply) => {
+    const { mac, hostname, role, ip } = request.body ?? {};
+    if (!mac || !hostname) {
+      return reply.code(400).send({ error: "mac and hostname are required" });
+    }
+
+    const normalized = mac.toLowerCase().replace(/-/g, ":");
+
+    // Find bastion that knows this MAC, or use single connected bastion
+    const bastion = bastionRegistry.findBastionByMac(normalized);
+    const target = bastion ?? (bastionRegistry.getAll().length === 1 ? bastionRegistry.getAll()[0] : null);
+
+    if (!target) {
+      const all = bastionRegistry.getAll();
+      if (all.length === 0) {
+        return reply.code(503).send({ error: "No bastions connected" });
+      }
+      return reply.code(404).send({ error: `MAC ${normalized} not found on any bastion and multiple bastions connected` });
+    }
+
+    try {
+      const result = await sendCommand(target.bastionId, {
+        type: "command-register",
+        mac: normalized,
+        hostname,
+        role: role ?? "worker",
+        ip: ip ?? "",
+      });
+      return reply.code(result.status === "ok" ? 200 : 500).send(result);
+    } catch (err) {
+      return reply.code(500).send({ error: err instanceof Error ? err.message : String(err) });
+    }
+  });
+
+  // Queue debug/rescue mode — route to correct bastion by MAC
+  app.post<{
+    Body: { mac?: string; pxeBoot?: boolean };
+  }>("/api/machines/debug", async (request, reply) => {
+    const mac = (request.body?.mac ?? "").toLowerCase().replace(/-/g, ":");
+    const pxeBoot = request.body?.pxeBoot ?? false;
+    if (!mac) {
+      return reply.code(400).send({ error: "mac is required" });
+    }
+
+    const bastion = bastionRegistry.findBastionByMac(mac);
+    if (!bastion) {
+      const all = bastionRegistry.getAll();
+      if (all.length === 0) {
+        return reply.code(503).send({ error: "No bastions connected" });
+      }
+      if (all.length === 1) {
+        try {
+          const result = await sendCommand(all[0]!.bastionId, { type: "command-debug", mac, pxeBoot });
+          return reply.code(result.status === "ok" ? 200 : 500).send(result);
+        } catch (err) {
+          return reply.code(500).send({ error: err instanceof Error ? err.message : String(err) });
+        }
+      }
+      return reply.code(404).send({ error: `MAC ${mac} not found on any bastion` });
+    }
+
+    try {
+      const result = await sendCommand(bastion.bastionId, { type: "command-debug", mac, pxeBoot });
+      return reply.code(result.status === "ok" ? 200 : 500).send(result);
+    } catch (err) {
+      return reply.code(500).send({ error: err instanceof Error ? err.message : String(err) });
+    }
+  });
+
   // Forget machine
   app.delete<{ Params: { mac: string } }>("/api/machines/:mac", async (request, reply) => {
     const mac = request.params.mac.toLowerCase().replace(/-/g, ":");
@@ -143,6 +260,37 @@ export function registerBastionRoutes(app: FastifyInstance, db: DbClient): void
     }
   });
 
+  // Update hardware info (discovery data) for a machine
+  app.post<{
+    Body: {
+      mac?: string; product?: string; board?: string; serial?: string;
+      manufacturer?: string; cpu_model?: string; cpu_cores?: number;
+      memory_gb?: number; arch?: string;
+      disks?: Array<{ name: string; size_gb: number; model: string }>;
+      nics?: Array<{ name: string; mac: string; state: string }>;
+    };
+  }>("/api/machines/discover", async (request, reply) => {
+    const data = request.body ?? {};
+    const mac = (data.mac ?? "").toLowerCase().replace(/-/g, ":");
+    if (!mac) {
+      return reply.code(400).send({ error: "mac is required" });
+    }
+
+    const bastion = bastionRegistry.findBastionByMac(mac);
+    const target = bastion ?? (bastionRegistry.getAll().length === 1 ? bastionRegistry.getAll()[0] : null);
+
+    if (!target) {
+      return reply.code(503).send({ error: "No bastion found for this MAC" });
+    }
+
+    try {
+      const result = await sendCommand(target.bastionId, { type: "command-discover", ...data, mac });
+      return reply.code(result.status === "ok" ? 200 : 500).send(result);
+    } catch (err) {
+      return reply.code(500).send({ error: err instanceof Error ? err.message : String(err) });
+    }
+  });
+
   // Update role
   app.post<{
     Body: { mac?: string; role?: string };
@@ -177,17 +325,7 @@ export function registerBastionRoutes(app: FastifyInstance, db: DbClient): void
     const queued = bastion.state.install_queue[mac];
     const installed = bastion.state.installed[mac];
 
-    if (installed) {
-      return {
-        mac,
-        hostname: installed.hostname,
-        status: "installed",
-        role: installed.role,
-        ip: installed.ip,
-        installed_at: installed.installed_at,
-      };
-    }
-
+    // Active install takes priority over old installed state (reprovision case)
     if (queued) {
       return {
         mac,
@@ -202,6 +340,17 @@ export function registerBastionRoutes(app: FastifyInstance, db: DbClient): void
       };
     }
 
+    if (installed) {
+      return {
+        mac,
+        hostname: installed.hostname,
+        status: "installed",
+        role: installed.role,
+        ip: installed.ip,
+        installed_at: installed.installed_at,
+      };
+    }
+
     return reply.code(404).send({ error: `MAC ${mac} not found in install queue or installed` });
   });
 }

bastion/src/labd/src/server.ts

@@ -19,6 +19,7 @@ export interface DbClient {
   server: {
     findMany: (...args: unknown[]) => Promise<unknown[]>;
     findUnique: (...args: unknown[]) => Promise<unknown>;
+    upsert: (...args: unknown[]) => Promise<unknown>;
   };
   joinToken: {
     findUnique: (...args: unknown[]) => Promise<unknown>;
@@ -139,7 +140,7 @@ export async function createApp(_config: LabdConfig, db: DbClient): Promise<{
                     socket,
                     connectedAt: new Date(),
                     lastHeartbeat: new Date(),
-                    state: { discovered: {}, install_queue: {}, installed: {} },
+                    state: { discovered: {}, install_queue: {}, installed: {}, debug: {} },
                   });
 
                   socket.send(JSON.stringify({ type: "bastion-enrolled", bastionId: record.id }));
@@ -175,6 +176,52 @@ export async function createApp(_config: LabdConfig, db: DbClient): Promise<{
               if (bastionId) {
                 bastionRegistry.updateState(bastionId, msg.state);
                 logger.info(`Bastion ${bastionId.slice(0, 8)} state sync: ${Object.keys(msg.state.discovered).length} discovered, ${Object.keys(msg.state.installed).length} installed`);
+
+                // Persist machines to DB
+                void (async () => {
+                  try {
+                    // Upsert discovered machines
+                    for (const [mac, hw] of Object.entries(msg.state.discovered)) {
+                      await db.server.upsert({
+                        where: { mac },
+                        create: {
+                          hostname: hw.product ?? mac,
+                          mac,
+                          role: "unknown",
+                          status: "discovered",
+                          labels: { cpu: hw.cpu_model, cores: hw.cpu_cores, memory_gb: hw.memory_gb, arch: hw.arch, product: hw.product, manufacturer: hw.manufacturer },
+                        },
+                        update: {
+                          status: "discovered",
+                          lastHeartbeat: new Date(),
+                          labels: { cpu: hw.cpu_model, cores: hw.cpu_cores, memory_gb: hw.memory_gb, arch: hw.arch, product: hw.product, manufacturer: hw.manufacturer },
+                        },
+                      });
+                    }
+                    // Upsert installed machines
+                    for (const [mac, info] of Object.entries(msg.state.installed)) {
+                      await db.server.upsert({
+                        where: { mac },
+                        create: {
+                          hostname: info.hostname,
+                          mac,
+                          role: info.role ?? "worker",
+                          ip: info.ip,
+                          status: "online",
+                        },
+                        update: {
+                          hostname: info.hostname,
+                          role: info.role ?? "worker",
+                          ip: info.ip,
+                          status: "online",
+                          lastHeartbeat: new Date(),
+                        },
+                      });
+                    }
+                  } catch (err) {
+                    logger.warn(`Failed to persist machines to DB: ${err instanceof Error ? err.message : String(err)}`);
+                  }
+                })();
               }
               break;
             }

bastion/src/labd/src/services/bastion-registry.ts

@@ -3,7 +3,7 @@
 
 import { EventEmitter } from "node:events";
 import type { WebSocket } from "ws";
-import type { BastionState, HardwareInfo, InstallConfig, InstalledInfo } from "@lab/shared";
+import type { BastionState, HardwareInfo, InstallConfig, InstalledInfo, DebugConfig } from "@lab/shared";
 
 export interface ConnectedBastion {
   bastionId: string;
@@ -20,6 +20,7 @@ export interface AggregatedState {
   discovered: Record<string, HardwareInfo>;
   install_queue: Record<string, InstallConfig>;
   installed: Record<string, InstalledInfo>;
+  debug: Record<string, DebugConfig>;
 }
 
 export class BastionRegistry extends EventEmitter {
@@ -86,6 +87,7 @@ export class BastionRegistry extends EventEmitter {
       discovered: {},
       install_queue: {},
       installed: {},
+      debug: {},
     };
 
     for (const bastion of this.bastions.values()) {
@@ -98,6 +100,9 @@ export class BastionRegistry extends EventEmitter {
       for (const [mac, info] of Object.entries(bastion.state.installed)) {
         result.installed[mac] = { ...info, bastionId: bastion.bastionId };
       }
+      for (const [mac, dbg] of Object.entries(bastion.state.debug ?? {})) {
+        result.debug[mac] = { ...dbg };
+      }
     }
 
     return result;

bastion/src/modules/modules/k3s/src/groups/hardening.ts

@@ -1,18 +1,22 @@
-// Hardening: Pod Security Standards, certificate check, log rotation.
+// Hardening: Pod Security Standards, certificate check, journald cap, storage.
 
 import type { OperationContext, OperationResult, OperationGroup } from "../types.js";
 import { runSequential } from "../utils.js";
 import { applyPodSecurityStandards } from "../operations/pod-security.js";
 import { checkCertExpiry } from "../operations/cert-check.js";
 import { configureLogRotation } from "../operations/log-rotation.js";
+import { configureJournaldLimits } from "../operations/journald-limits.js";
+import { configureLonghornDisk } from "../operations/longhorn-disk.js";
 
 export const hardeningGroup: OperationGroup = {
   name: "hardening",
-  description: "Pod security, certificate check, log rotation",
+  description: "Pod security, certificate check, journald cap, storage",
   operations: [
     { name: "Apply Pod Security Standards", fn: applyPodSecurityStandards },
     { name: "Check certificate expiry", fn: checkCertExpiry },
-    { name: "Configure log rotation", fn: configureLogRotation },
+    { name: "Decommission file-based audit logs", fn: configureLogRotation },
+    { name: "Configure journald disk cap", fn: configureJournaldLimits },
+    { name: "Configure Longhorn disk", fn: configureLonghornDisk },
   ],
 };
 

bastion/src/modules/modules/k3s/src/groups/host-prep.ts

@@ -7,16 +7,18 @@ import { applyCisHardening } from "../operations/sysctl.js";
 import { disableSwap } from "../operations/swap.js";
 import { disableFirewall } from "../operations/firewall.js";
 import { setSelinuxPermissive } from "../operations/selinux.js";
+import { enableIscsi } from "../operations/iscsi.js";
 
 export const hostPrepGroup: OperationGroup = {
   name: "host-prep",
-  description: "Prepare host for k3s: kernel modules, sysctl, swap, firewall, SELinux",
+  description: "Prepare host for k3s: kernel modules, sysctl, swap, firewall, SELinux, iSCSI",
   operations: [
     { name: "Load kernel modules", fn: loadKernelModules },
     { name: "Apply CIS sysctl", fn: applyCisHardening },
     { name: "Disable swap", fn: disableSwap },
     { name: "Disable firewall", fn: disableFirewall },
     { name: "Set SELinux permissive", fn: setSelinuxPermissive },
+    { name: "Enable iSCSI", fn: enableIscsi },
   ],
 };
 

bastion/src/modules/modules/k3s/src/install.ts

@@ -76,7 +76,6 @@ sed -i 's/^SELINUX=enforcing/SELINUX=permissive/' /etc/selinux/config 2>/dev/nul
 # ── 5b. Create k3s config directory ──
 echo "[5/10] Writing k3s server configuration..."
 mkdir -p /etc/rancher/k3s
-mkdir -p /var/log/kubernetes
 
 cat > /etc/rancher/k3s/config.yaml << 'K3S_CONFIG'
 # k3s server configuration — CIS hardened
@@ -91,13 +90,10 @@ disable:
   - servicelb
   - traefik
 
-# API server hardening
+# API server hardening (audit-log-path=- routes audit to journald via stdout)
 kube-apiserver-arg:
   - "anonymous-auth=false"
-  - "audit-log-path=/var/log/kubernetes/audit.log"
-  - "audit-log-maxage=30"
-  - "audit-log-maxbackup=10"
-  - "audit-log-maxsize=100"
+  - "audit-log-path=-"
   - "audit-policy-file=/etc/rancher/k3s/audit-policy.yaml"
   - "enable-admission-plugins=NodeRestriction,PodSecurity"
   - "request-timeout=300s"

bastion/src/modules/modules/k3s/src/k3s-module.ts

@@ -78,9 +78,10 @@ export class K3sModule implements Module {
       return toModuleResult("install", [...prepResults, ...k3sResults], start);
     }
 
-    // Phase 3: Networking (server only — agents don't install Cilium)
+    // Phase 3: Networking (initial server only — joining servers get Cilium via daemonset)
     let netResults: OperationResult[] = [];
-    if (isServer) {
+    const isJoiningServer = isServer && !!opCtx.config.k3sServerUrl;
+    if (isServer && !isJoiningServer) {
       netResults = await runNetworking(opCtx);
     }
 

bastion/src/modules/modules/k3s/src/operations/cilium.ts

@@ -35,21 +35,15 @@ export const installCilium: Operation = async (ctx): Promise<OperationResult> =>
   }
   details.push(`Installed cilium CLI ${version} (${cliArch})`);
 
-  // Detect default network device (avoid tailscale/wireguard)
-  const devResult = await ctx.ssh.exec(
-    "ip -4 route show default | awk '{print $5}' | head -1",
-    sshOpts(ctx),
-  );
-  const defaultDev = devResult.stdout.trim();
-  details.push(`Network device: ${defaultDev}`);
-
   // Install Cilium
+  // - No hardcoded devices: Cilium auto-detects per node (heterogeneous NICs like eno1 vs enP7s7)
+  // - k8sServiceHost/Port: k3s agents proxy the API on 127.0.0.1:6444 (not 6443)
   const installResult = await ctx.ssh.exec(
     `KUBECONFIG=/etc/rancher/k3s/k3s.yaml cilium install \
       --set kubeProxyReplacement=true \
       --set ipam.mode=kubernetes \
-      --set devices="${defaultDev}" \
-      --set nodePort.directRoutingDevice="${defaultDev}"`,
+      --set k8sServiceHost=127.0.0.1 \
+      --set k8sServicePort=6444`,
     { timeoutMs: 300_000 },
   );
   if (installResult.exitCode !== 0) {

bastion/src/modules/modules/k3s/src/operations/etcd-recover.ts

@@ -0,0 +1,194 @@
+// Recover a broken etcd member by removing it from the cluster, wiping its
+// local state, and restarting k3s so it rejoins as a fresh member.
+//
+// Use case: a node panics on startup with
+//   "tocommit(N+1) is out of range [lastIndex(N)]. Was the raft log corrupted,
+//    truncated, or lost?"
+// This means the local raft WAL is missing the last entry the leader thinks
+// the follower acknowledged (lost write, unclean shutdown, etc). The fix is
+// always the same and well-documented; this codifies it so we don't fumble
+// the procedure under pressure.
+//
+// Preconditions:
+//   - At least one healthy peer is reachable so the cluster has quorum after
+//     we remove the broken member. (For a 3-node cluster: 2 healthy. For a
+//     5-node: 3 healthy.) If quorum would be lost, this function refuses.
+//   - SSH access to both the broken node and a healthy peer.
+//   - etcdctl available on the healthy peer (k3s does not bundle it; the
+//     procedure installs it on demand on Fedora).
+
+import type { SshClient } from "../types.js";
+
+const ETCD_TLS = {
+  ca: "/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt",
+  cert: "/var/lib/rancher/k3s/server/tls/etcd/server-client.crt",
+  key: "/var/lib/rancher/k3s/server/tls/etcd/server-client.key",
+} as const;
+
+const SSH_TIMEOUT = 60_000;
+
+export interface RecoverEtcdMemberOptions {
+  /** SSH client for the broken node (the one panicking). */
+  broken: SshClient;
+  /** SSH client for any healthy server peer in the same cluster. */
+  peer: SshClient;
+  /** Hostname (k8s node name) of the broken node. Used to find its etcd member id. */
+  brokenHostname: string;
+  /** Logger for progress output. */
+  log?: (msg: string) => void;
+}
+
+export interface RecoverEtcdMemberResult {
+  success: boolean;
+  changed: boolean;
+  message: string;
+  /** New etcd member id assigned after rejoin (when known). */
+  newMemberId?: string;
+  /** Old etcd member id that was removed. */
+  removedMemberId?: string;
+  error?: string;
+}
+
+function etcdctl(subcmd: string): string {
+  return [
+    "ETCDCTL_API=3 etcdctl",
+    `--cacert=${ETCD_TLS.ca}`,
+    `--cert=${ETCD_TLS.cert}`,
+    `--key=${ETCD_TLS.key}`,
+    "--endpoints=https://127.0.0.1:2379",
+    "--command-timeout=10s",
+    subcmd,
+  ].join(" ");
+}
+
+async function ensureEtcdctl(peer: SshClient): Promise<void> {
+  const probe = await peer.exec("command -v etcdctl 2>/dev/null", { timeoutMs: 5_000 });
+  if (probe.exitCode === 0 && probe.stdout.trim()) return;
+  // Best-effort install on Fedora. If the host isn't dnf-based, surface the
+  // error to the caller via the next etcdctl invocation.
+  await peer.exec("dnf install -y etcd 2>&1", { timeoutMs: 120_000 });
+}
+
+async function getMemberList(peer: SshClient): Promise<Array<{ id: string; name: string }>> {
+  const result = await peer.exec(etcdctl("member list"), { timeoutMs: SSH_TIMEOUT });
+  if (result.exitCode !== 0) {
+    throw new Error(`etcdctl member list failed: ${result.stderr || result.stdout}`);
+  }
+  // Format: <hex-id>, started, <name>, <peer-urls>, <client-urls>, <isLearner>
+  return result.stdout
+    .split("\n")
+    .map((line) => line.trim())
+    .filter(Boolean)
+    .map((line) => {
+      const [id, , name] = line.split(",").map((p) => p.trim());
+      return { id: id ?? "", name: name ?? "" };
+    })
+    .filter((m) => m.id);
+}
+
+export async function recoverEtcdMember(
+  opts: RecoverEtcdMemberOptions,
+): Promise<RecoverEtcdMemberResult> {
+  const log = opts.log ?? (() => {});
+
+  try {
+    log(`Looking up etcd member id for ${opts.brokenHostname} via peer...`);
+    await ensureEtcdctl(opts.peer);
+
+    const members = await getMemberList(opts.peer);
+    if (members.length < 3) {
+      return {
+        success: false,
+        changed: false,
+        message: "Refusing to remove a member from a cluster with <3 members (quorum would be lost)",
+        error: `member count = ${members.length}`,
+      };
+    }
+
+    // Member names are <hostname>-<random-suffix>; match by hostname prefix.
+    const broken = members.find((m) => m.name.startsWith(opts.brokenHostname));
+    if (!broken) {
+      return {
+        success: false,
+        changed: false,
+        message: `No etcd member found matching hostname ${opts.brokenHostname}`,
+        error: `members: ${members.map((m) => m.name).join(", ")}`,
+      };
+    }
+    log(`Broken member: ${broken.id} (${broken.name})`);
+
+    log("Step 1/4: stopping k3s on broken node");
+    await opts.broken.exec("systemctl stop k3s 2>&1", { timeoutMs: SSH_TIMEOUT });
+
+    log("Step 2/4: removing broken etcd member from cluster");
+    const remove = await opts.peer.exec(
+      etcdctl(`member remove ${broken.id}`),
+      { timeoutMs: SSH_TIMEOUT },
+    );
+    if (remove.exitCode !== 0) {
+      return {
+        success: false,
+        changed: false,
+        message: "etcdctl member remove failed",
+        error: remove.stderr || remove.stdout,
+        removedMemberId: broken.id,
+      };
+    }
+
+    log("Step 3/4: archiving corrupt etcd state and stale TLS/cred dirs on broken node");
+    const ts = Math.floor(Date.now() / 1000);
+    await opts.broken.exec(
+      [
+        `mv /var/lib/rancher/k3s/server/db /var/lib/rancher/k3s/server/db.corrupt-${ts} 2>/dev/null || true`,
+        "rm -rf /var/lib/rancher/k3s/server/tls /var/lib/rancher/k3s/server/cred",
+      ].join(" && "),
+      { timeoutMs: SSH_TIMEOUT },
+    );
+
+    log("Step 4/4: starting k3s on broken node — it will rejoin");
+    await opts.broken.exec("systemctl start k3s 2>&1", { timeoutMs: SSH_TIMEOUT });
+
+    // Poll for rejoin. The new member-id is what the cluster assigns on join.
+    let newMemberId: string | undefined;
+    for (let i = 0; i < 60; i++) {
+      await new Promise((r) => setTimeout(r, 5_000));
+      try {
+        const after = await getMemberList(opts.peer);
+        const rejoined = after.find(
+          (m) => m.name.startsWith(opts.brokenHostname) && m.id !== broken.id,
+        );
+        if (rejoined) {
+          newMemberId = rejoined.id;
+          break;
+        }
+      } catch {
+        // peer may briefly be unreachable mid-rejoin — keep polling
+      }
+    }
+
+    if (!newMemberId) {
+      return {
+        success: false,
+        changed: true,
+        message: "k3s started but new member did not appear in cluster within 5 minutes",
+        removedMemberId: broken.id,
+      };
+    }
+
+    log(`Rejoined as ${newMemberId}`);
+    return {
+      success: true,
+      changed: true,
+      message: `Recovered: removed ${broken.id}, rejoined as ${newMemberId}`,
+      removedMemberId: broken.id,
+      newMemberId,
+    };
+  } catch (err) {
+    return {
+      success: false,
+      changed: false,
+      message: "Recovery failed",
+      error: err instanceof Error ? err.message : String(err),
+    };
+  }
+}

bastion/src/modules/modules/k3s/src/operations/index.ts

@@ -1,6 +1,7 @@
 export { loadKernelModules } from "./kernel-modules.js";
 export { applyCisHardening } from "./sysctl.js";
 export { disableSwap } from "./swap.js";
+export { enableIscsi } from "./iscsi.js";
 export { disableFirewall } from "./firewall.js";
 export { setSelinuxPermissive } from "./selinux.js";
 export { writeK3sConfig } from "./k3s-config.js";
@@ -10,6 +11,13 @@ export { installK3sBinary } from "./k3s-install.js";
 export { installCilium } from "./cilium.js";
 export { fixCoreDnsUpstream } from "./dns-fix.js";
 export { configureLogRotation } from "./log-rotation.js";
+export { configureJournaldLimits } from "./journald-limits.js";
 export { applyDefaultNetworkPolicies } from "./network-policy.js";
 export { applyPodSecurityStandards } from "./pod-security.js";
 export { checkCertExpiry } from "./cert-check.js";
+export { configureLonghornDisk } from "./longhorn-disk.js";
+export { recoverEtcdMember } from "./etcd-recover.js";
+export type {
+  RecoverEtcdMemberOptions,
+  RecoverEtcdMemberResult,
+} from "./etcd-recover.js";

bastion/src/modules/modules/k3s/src/operations/iscsi.ts

@@ -0,0 +1,31 @@
+// Install and enable iSCSI initiator (required by Longhorn storage).
+// Fedora: iscsi-initiator-utils, Ubuntu: open-iscsi
+
+import type { Operation, OperationResult } from "../types.js";
+import { sshOpts } from "../utils.js";
+
+export const enableIscsi: Operation = async (ctx): Promise<OperationResult> => {
+  // Check if iscsid is already running
+  const check = await ctx.ssh.exec("systemctl is-active iscsid 2>/dev/null", sshOpts(ctx));
+  if (check.stdout.trim() === "active") {
+    return { success: true, changed: false, message: "iSCSI already active" };
+  }
+
+  // Install the package (detect distro)
+  const osRelease = await ctx.ssh.exec("cat /etc/os-release", sshOpts(ctx));
+  const osLower = osRelease.stdout.toLowerCase();
+  const isFedora = osLower.includes("fedora") || osLower.includes("rhel") || osLower.includes("centos");
+
+  const pkg = isFedora ? "iscsi-initiator-utils" : "open-iscsi";
+  const installCmd = isFedora ? `sudo dnf install -y ${pkg}` : `sudo apt-get install -y ${pkg}`;
+
+  const install = await ctx.ssh.exec(installCmd, { timeoutMs: 120_000 });
+  if (install.exitCode !== 0) {
+    return { success: false, changed: false, message: `Failed to install ${pkg}`, error: install.stderr.trim() };
+  }
+
+  // Enable and start
+  await ctx.ssh.exec("sudo systemctl enable --now iscsid", sshOpts(ctx));
+
+  return { success: true, changed: true, message: `Installed ${pkg} and enabled iscsid` };
+};

bastion/src/modules/modules/k3s/src/operations/journald-limits.ts

@@ -0,0 +1,33 @@
+// Cap journald disk usage so audit logs (which now flow through journald via
+// kube-apiserver's stdout) cannot fill /var/log. Default journald uses up to
+// 10% of the filesystem, capped at 4 GB. In a /var/log of ~10 GB shared with
+// other services, that's still room for audit volume to evict useful logs.
+// 2 GB / 200 MB-per-file is a comfortable middle.
+
+import type { Operation, OperationResult } from "../types.js";
+import { sshOpts, writeRemoteFile } from "../utils.js";
+
+const DROPIN_CONTENT = `[Journal]
+SystemMaxUse=2G
+SystemKeepFree=1G
+SystemMaxFileSize=200M
+`;
+
+const DROPIN_PATH = "/etc/systemd/journald.conf.d/10-k3s-audit-cap.conf";
+
+export const configureJournaldLimits: Operation = async (ctx): Promise<OperationResult> => {
+  const changed = await writeRemoteFile(ctx, DROPIN_PATH, DROPIN_CONTENT);
+  if (changed) {
+    // Reload journald so the new limit applies without a reboot.
+    await ctx.ssh.exec(
+      "systemctl kill --signal=SIGUSR2 systemd-journald 2>/dev/null; " +
+      "systemctl restart systemd-journald 2>&1 || true",
+      sshOpts(ctx),
+    );
+  }
+  return {
+    success: true,
+    changed,
+    message: changed ? "journald limits configured (2 GB cap)" : "journald limits already configured",
+  };
+};

bastion/src/modules/modules/k3s/src/operations/k3s-config.ts

@@ -9,7 +9,18 @@ function isServerRole(role: string): boolean {
 
 function generateServerConfig(config: K3sConfig): string {
   const tlsSans = [config.hostname, config.ip, ...(config.tlsSans ?? [])];
-  return `# k3s server configuration — CIS hardened
+  const isJoining = !!config.k3sServerUrl;
+  const clusterLines = isJoining
+    ? `server: "${config.k3sServerUrl}"\ntoken: "${config.k3sToken}"`
+    : "cluster-init: true";
+  // audit-log-path=- routes audit events to k3s.service's stdout, which systemd
+  // forwards to journald. journald enforces its own size caps (see
+  // configureJournaldLimits) so audit volume cannot fill the disk. File-based
+  // audit logs led to /var/log/kubernetes growing to 7+ GB because apiserver's
+  // own rotation produced files that any logrotate glob would double-rotate
+  // and never expire.
+  return `# k3s server configuration — CIS hardened, etcd HA
+${clusterLines}
 protect-kernel-defaults: true
 secrets-encryption: true
 write-kubeconfig-mode: "0640"
@@ -20,12 +31,12 @@ disable:
   - servicelb
   - traefik
 
+node-label:
+  - "node.longhorn.io/create-default-disk=config"
+
 kube-apiserver-arg:
   - "anonymous-auth=false"
-  - "audit-log-path=/var/log/kubernetes/audit.log"
-  - "audit-log-maxage=30"
-  - "audit-log-maxbackup=10"
-  - "audit-log-maxsize=100"
+  - "audit-log-path=-"
   - "audit-policy-file=/etc/rancher/k3s/audit-policy.yaml"
   - "enable-admission-plugins=NodeRestriction,PodSecurity"
   - "request-timeout=300s"
@@ -42,6 +53,9 @@ ${tlsSans.map((s) => `  - "${s}"`).join("\n")}
 
 function generateAgentConfig(): string {
   return `protect-kernel-defaults: true
+node-label:
+  - "node-role.kubernetes.io/worker=true"
+  - "node.longhorn.io/create-default-disk=config"
 kubelet-arg:
   - "protect-kernel-defaults=true"
   - "streaming-connection-idle-timeout=5m"
@@ -50,7 +64,7 @@ kubelet-arg:
 }
 
 export const writeK3sConfig: Operation = async (ctx): Promise<OperationResult> => {
-  await ctx.ssh.exec("mkdir -p /etc/rancher/k3s /var/log/kubernetes", sshOpts(ctx));
+  await ctx.ssh.exec("mkdir -p /etc/rancher/k3s", sshOpts(ctx));
 
   const content = isServerRole(ctx.config.role)
     ? generateServerConfig(ctx.config)

bastion/src/modules/modules/k3s/src/operations/k3s-install.ts

@@ -15,8 +15,21 @@ export const installK3sBinary: Operation = async (ctx): Promise<OperationResult>
   const alreadyInstalled = version.exitCode === 0;
 
   if (isServer) {
+    // Clean stale server state when joining an existing cluster
+    // (TLS certs from a previous run cause "newer than datastore" fatal error)
+    if (ctx.config.k3sServerUrl && ctx.config.k3sToken) {
+      await ctx.ssh.exec(
+        "rm -rf /var/lib/rancher/k3s/server/tls /var/lib/rancher/k3s/server/cred /var/lib/rancher/k3s/server/db",
+        sshOpts(ctx),
+      );
+    }
+
+    // If joining an existing cluster, pass K3S_URL and K3S_TOKEN
+    const joinEnv = ctx.config.k3sServerUrl && ctx.config.k3sToken
+      ? `K3S_URL="${ctx.config.k3sServerUrl}" K3S_TOKEN="${ctx.config.k3sToken}"`
+      : "";
     const result = await ctx.ssh.exec(
-      'curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="server" INSTALL_K3S_SKIP_SELINUX_RPM=true sh -',
+      `curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="server" INSTALL_K3S_SKIP_SELINUX_RPM=true ${joinEnv} sh -`,
       { timeoutMs: 300_000 },
     );
     if (result.exitCode !== 0) {

bastion/src/modules/modules/k3s/src/operations/log-rotation.ts

@@ -1,25 +1,44 @@
-// Configure log rotation for k3s.
+// Decommission file-based k8s audit logging in favor of journald.
+//
+// Earlier versions wrote audit events to /var/log/kubernetes/audit.log and
+// rotated them with a logrotate rule. Two failure modes followed: kube-apiserver
+// rotated internally (audit-{ts}.log), the *.log glob in logrotate
+// double-rotated those (-{date}), and the resulting filename matched no
+// retention policy, so the directory grew unbounded (we observed 7+ GB).
+//
+// k3s now sets audit-log-path=- so audit goes to stdout → journald, which
+// enforces SystemMaxUse caps. This operation removes the obsolete logrotate
+// rule and reaps any audit files left behind by the old setup. Idempotent: on
+// fresh installs everything is already absent and the operation is a no-op.
 
 import type { Operation, OperationResult } from "../types.js";
-import { writeRemoteFile } from "../utils.js";
+import { sshOpts } from "../utils.js";
 
-const LOGROTATE_CONFIG = `/var/log/kubernetes/*.log {
-  daily
-  rotate 14
-  compress
-  delaycompress
-  missingok
-  notifempty
-  copytruncate
-  maxsize 100M
-}`;
+const REMOVE_LOGROTATE = "rm -f /etc/logrotate.d/k3s";
+
+// Bounded by a max-depth and explicit name pattern so we never reach outside
+// the deprecated audit-log directory.
+const REAP_OLD_AUDIT_FILES =
+  "find /var/log/kubernetes -maxdepth 1 -type f " +
+  "\\( -name 'audit*.log*' -o -name 'audit-*.log' \\) " +
+  "-delete 2>/dev/null; " +
+  "rmdir /var/log/kubernetes 2>/dev/null; true";
 
 export const configureLogRotation: Operation = async (ctx): Promise<OperationResult> => {
-  const changed = await writeRemoteFile(ctx, "/etc/logrotate.d/k3s", LOGROTATE_CONFIG);
+  const before = await ctx.ssh.exec(
+    "test -e /etc/logrotate.d/k3s -o -d /var/log/kubernetes && echo present || echo absent",
+    sshOpts(ctx),
+  );
+  const wasPresent = before.stdout.trim() === "present";
+
+  await ctx.ssh.exec(REMOVE_LOGROTATE, sshOpts(ctx));
+  await ctx.ssh.exec(REAP_OLD_AUDIT_FILES, sshOpts(ctx));
 
   return {
     success: true,
-    changed,
-    message: changed ? "Log rotation configured" : "Log rotation already configured",
+    changed: wasPresent,
+    message: wasPresent
+      ? "Removed legacy file-based audit logging (now via journald)"
+      : "No legacy audit log artifacts present",
   };
 };

bastion/src/modules/modules/k3s/src/operations/longhorn-disk.ts

@@ -0,0 +1,50 @@
+// Annotate nodes with Longhorn default disk config when /var/lib/longhorn exists.
+// The label is set in k3s config (node-label), but the annotation must be applied via kubectl.
+
+import type { Operation, OperationResult } from "../types.js";
+import { sshOpts } from "../utils.js";
+import { sshExec as remoteSshExec } from "../../../../src/ssh.js";
+
+export const configureLonghornDisk: Operation = async (ctx): Promise<OperationResult> => {
+  // Check if /var/lib/longhorn exists on this node
+  const check = await ctx.ssh.exec("test -d /var/lib/longhorn && echo yes || echo no", sshOpts(ctx));
+  if (check.stdout.trim() !== "yes") {
+    return { success: true, changed: false, message: "No /var/lib/longhorn directory — skipping Longhorn disk config" };
+  }
+
+  // Find the node name (hostname as registered in k3s)
+  const nodeNameResult = await ctx.ssh.exec("hostname -f 2>/dev/null || hostname", sshOpts(ctx));
+  const nodeName = nodeNameResult.stdout.trim();
+
+  const annotation = JSON.stringify([{ path: "/var/lib/longhorn", allowScheduling: true }]);
+
+  // Try kubectl locally first (works on server nodes)
+  const result = await ctx.ssh.exec(
+    `k3s kubectl annotate node "${nodeName}" "node.longhorn.io/default-disks-config=${annotation}" --overwrite 2>&1 || true`,
+    sshOpts(ctx),
+  );
+
+  if (result.stdout.includes("annotated") || result.stdout.includes("unchanged")) {
+    return { success: true, changed: true, message: `Longhorn disk annotation applied to ${nodeName}` };
+  }
+
+  // For worker/agent nodes without local kubectl: apply via the server
+  if (ctx.config.k3sServerUrl) {
+    // The CLI has SSH access to the server — use sshExec from there
+    const serverHost = new URL(ctx.config.k3sServerUrl).hostname;
+    try {
+      const remoteResult = await remoteSshExec(
+        serverHost, "root",
+        `k3s kubectl annotate node "${nodeName}" "node.longhorn.io/default-disks-config=${annotation}" --overwrite`,
+        { ...(ctx.ssh.keyPath ? { keyPath: ctx.ssh.keyPath } : {}), timeoutMs: 15_000 },
+      );
+      if (remoteResult.stdout.includes("annotated") || remoteResult.stdout.includes("unchanged")) {
+        return { success: true, changed: true, message: `Longhorn disk annotation applied to ${nodeName} (via server)` };
+      }
+    } catch {
+      // Fall through to manual instruction
+    }
+  }
+
+  return { success: true, changed: false, message: "Longhorn disk label set (annotation requires server kubectl)" };
+};

bastion/src/modules/modules/k3s/tests/install.test.ts

@@ -71,9 +71,14 @@ describe("k3s install script — server role", () => {
     expect(script).toContain("enable-admission-plugins=NodeRestriction,PodSecurity");
   });
 
-  it("configures audit logging", () => {
-    expect(script).toContain("audit-log-path=/var/log/kubernetes/audit.log");
-    expect(script).toContain("audit-log-maxage=30");
+  it("configures audit logging via journald (stdout)", () => {
+    expect(script).toContain("audit-log-path=-");
+    // file-based fields and the now-obsolete log directory must be gone
+    expect(script).not.toContain("/var/log/kubernetes/audit.log");
+    expect(script).not.toContain("audit-log-maxage");
+    expect(script).not.toContain("audit-log-maxbackup");
+    expect(script).not.toContain("audit-log-maxsize");
+    expect(script).not.toContain("mkdir -p /var/log/kubernetes");
   });
 
   it("cleans stale flannel vxlan before Cilium install", () => {

bastion/src/modules/modules/k3s/tests/operations.test.ts

@@ -348,3 +348,143 @@ describe("applyPodSecurityStandards", () => {
     expectCommand(ctx.ssh, "pod-security.kubernetes.io/audit=restricted");
   });
 });
+
+// --- Audit Logging Decommission (file-based → journald) ---
+
+import { configureLogRotation } from "../src/operations/log-rotation.js";
+import { configureJournaldLimits } from "../src/operations/journald-limits.js";
+
+describe("configureLogRotation (decommission file-based audit logs)", () => {
+  it("removes the legacy logrotate rule and reaps obsolete audit files", async () => {
+    const ctx = mockCtx();
+    ctx.ssh.exec.mockResolvedValueOnce(stdout("present")); // probe: legacy artifacts exist
+    ctx.ssh.exec.mockResolvedValue(OK);
+
+    const result = await configureLogRotation(ctx);
+
+    expect(result.success).toBe(true);
+    expect(result.changed).toBe(true);
+    expectCommand(ctx.ssh, "rm -f /etc/logrotate.d/k3s");
+    expectCommand(ctx.ssh, /find \/var\/log\/kubernetes.*audit.*-delete/);
+    expectCommand(ctx.ssh, "rmdir /var/log/kubernetes");
+  });
+
+  it("is a no-op when nothing legacy is present", async () => {
+    const ctx = mockCtx();
+    ctx.ssh.exec.mockResolvedValueOnce(stdout("absent"));
+    ctx.ssh.exec.mockResolvedValue(OK);
+
+    const result = await configureLogRotation(ctx);
+    expect(result.success).toBe(true);
+    expect(result.changed).toBe(false);
+  });
+});
+
+describe("configureJournaldLimits", () => {
+  it("writes a 2 GB SystemMaxUse drop-in and reloads journald when changed", async () => {
+    const ctx = mockCtx();
+    ctx.ssh.exec.mockResolvedValueOnce(stdout("__LABCTL_NOT_FOUND__")); // no existing drop-in
+    ctx.ssh.exec.mockResolvedValue(OK);
+
+    const result = await configureJournaldLimits(ctx);
+
+    expect(result.success).toBe(true);
+    expect(result.changed).toBe(true);
+    const writeCall = ctx.ssh.exec.mock.calls.find((c) => {
+      const cmd = c[0] as string;
+      return cmd.includes("10-k3s-audit-cap.conf") && cmd.includes("LABCTL_EOF");
+    });
+    expect(writeCall).toBeTruthy();
+    const written = writeCall?.[0] as string;
+    expect(written).toContain("SystemMaxUse=2G");
+    expect(written).toContain("SystemKeepFree=1G");
+    expectCommand(ctx.ssh, "systemctl restart systemd-journald");
+  });
+
+  it("does not restart journald when the drop-in is already correct", async () => {
+    const ctx = mockCtx();
+    const existing =
+      "[Journal]\nSystemMaxUse=2G\nSystemKeepFree=1G\nSystemMaxFileSize=200M\n";
+    ctx.ssh.exec.mockResolvedValueOnce(stdout(existing));
+    ctx.ssh.exec.mockResolvedValue(OK);
+
+    const result = await configureJournaldLimits(ctx);
+
+    expect(result.success).toBe(true);
+    expect(result.changed).toBe(false);
+    expectNoCommand(ctx.ssh, "systemctl restart systemd-journald");
+  });
+});
+
+// --- Etcd Recovery ---
+
+import { recoverEtcdMember } from "../src/operations/etcd-recover.js";
+import { mockSsh } from "./helpers.js";
+
+describe("recoverEtcdMember", () => {
+  it("refuses to operate when cluster is below 3 members (quorum risk)", async () => {
+    const broken = mockSsh();
+    const peer = mockSsh();
+    peer.exec.mockResolvedValueOnce(stdout("/usr/bin/etcdctl")); // etcdctl present
+    peer.exec.mockResolvedValueOnce(stdout(
+      "111, started, host-a-aaa, https://10.0.0.1:2380, https://10.0.0.1:2379, false\n" +
+      "222, started, host-b-bbb, https://10.0.0.2:2380, https://10.0.0.2:2379, false",
+    ));
+
+    const result = await recoverEtcdMember({ broken, peer, brokenHostname: "host-b" });
+
+    expect(result.success).toBe(false);
+    expect(result.message).toMatch(/quorum/i);
+    // Critically: must NOT have stopped k3s or removed anything
+    expect(broken.exec).not.toHaveBeenCalledWith(expect.stringContaining("systemctl stop k3s"), expect.anything());
+  });
+
+  it("performs full procedure when quorum is preserved", async () => {
+    const broken = mockSsh();
+    const peer = mockSsh();
+    // ensureEtcdctl: present
+    peer.exec.mockResolvedValueOnce(stdout("/usr/bin/etcdctl"));
+    // member list (3 members, target = host-b)
+    peer.exec.mockResolvedValueOnce(stdout(
+      "111, started, host-a-aaa, https://10.0.0.1:2380, https://10.0.0.1:2379, false\n" +
+      "222, started, host-b-bbb, https://10.0.0.2:2380, https://10.0.0.2:2379, false\n" +
+      "333, started, host-c-ccc, https://10.0.0.3:2380, https://10.0.0.3:2379, false",
+    ));
+    // member remove
+    peer.exec.mockResolvedValueOnce(stdout("Member 222 removed"));
+    // post-rejoin member list — new id 444 for host-b
+    peer.exec.mockResolvedValueOnce(stdout(
+      "111, started, host-a-aaa, https://10.0.0.1:2380, https://10.0.0.1:2379, false\n" +
+      "333, started, host-c-ccc, https://10.0.0.3:2380, https://10.0.0.3:2379, false\n" +
+      "444, started, host-b-zzz, https://10.0.0.2:2380, https://10.0.0.2:2379, false",
+    ));
+
+    const result = await recoverEtcdMember({ broken, peer, brokenHostname: "host-b" });
+
+    expect(result.success).toBe(true);
+    expect(result.removedMemberId).toBe("222");
+    expect(result.newMemberId).toBe("444");
+    expectCommand(broken,"systemctl stop k3s");
+    expectCommand(peer,"member remove 222");
+    expectCommand(broken,/db\.corrupt-/);
+    expectCommand(broken,/rm -rf .*\/server\/tls/);
+    expectCommand(broken,"systemctl start k3s");
+  });
+
+  it("fails clearly when no member matches the broken hostname", async () => {
+    const broken = mockSsh();
+    const peer = mockSsh();
+    peer.exec.mockResolvedValueOnce(stdout("/usr/bin/etcdctl"));
+    peer.exec.mockResolvedValueOnce(stdout(
+      "111, started, host-a-aaa, https://10.0.0.1:2380, https://10.0.0.1:2379, false\n" +
+      "222, started, host-b-bbb, https://10.0.0.2:2380, https://10.0.0.2:2379, false\n" +
+      "333, started, host-c-ccc, https://10.0.0.3:2380, https://10.0.0.3:2379, false",
+    ));
+
+    const result = await recoverEtcdMember({ broken, peer, brokenHostname: "host-d" });
+
+    expect(result.success).toBe(false);
+    expect(result.message).toMatch(/No etcd member found/);
+    expect(broken.exec).not.toHaveBeenCalledWith(expect.stringContaining("systemctl stop k3s"), expect.anything());
+  });
+});

bastion/src/shared/src/index.ts

@@ -5,6 +5,7 @@ export type {
   HardwareInfo,
   InstallConfig,
   InstalledInfo,
+  DebugConfig,
   BastionState,
   BastionConfig,
 } from "./types/index.js";

bastion/src/shared/src/protocol/index.ts

@@ -100,6 +100,7 @@ export type BastionMessage =
   | { type: "bastion-heartbeat"; bastionId: string; uptime: number; machineCount: number }
   | { type: "bastion-state-sync"; bastionId: string; state: import("../types/state.js").BastionState }
   | { type: "bastion-progress"; bastionId: string; mac: string; stage: string; detail: string; timestamp: string }
+  | { type: "bastion-install-log"; bastionId: string; mac: string; hostname: string; provisionerType: import("../types/state.js").ProvisionStackType; sessionId: string; lines: string[]; timestamp: string }
   | { type: "command-response"; requestId: string; status: "ok" | "error"; data?: unknown; error?: string };
 
 // --- labd -> Bastion messages ---
@@ -110,6 +111,9 @@ export type LabdBastionMessage =
   | { type: "command-install"; requestId: string; mac: string; hostname: string; disk?: string; role: string; os: string }
   | { type: "command-forget"; requestId: string; mac: string }
   | { type: "command-role-update"; requestId: string; mac: string; role: string }
+  | { type: "command-debug"; requestId: string; mac: string; pxeBoot?: boolean }
+  | { type: "command-register"; requestId: string; mac: string; hostname: string; role: string; ip: string }
+  | { type: "command-discover"; requestId: string; mac: string; product?: string; board?: string; serial?: string; manufacturer?: string; cpu_model?: string; cpu_cores?: number; memory_gb?: number; arch?: string; disks?: Array<{ name: string; size_gb: number; model: string }>; nics?: Array<{ name: string; mac: string; state: string }> }
   | { type: "server-shutdown"; reconnectAfter: number };
 
 export type BastionMessageType = BastionMessage["type"];
@@ -119,12 +123,12 @@ export type LabdBastionMessageType = LabdBastionMessage["type"];
 
 const BASTION_MESSAGE_TYPES = new Set<string>([
   "bastion-enroll", "bastion-heartbeat", "bastion-state-sync",
-  "bastion-progress", "command-response",
+  "bastion-progress", "bastion-install-log", "command-response",
 ]);
 
 const LABD_BASTION_MESSAGE_TYPES = new Set<string>([
   "bastion-enrolled", "bastion-heartbeat-ack", "command-install",
-  "command-forget", "command-role-update", "server-shutdown",
+  "command-forget", "command-role-update", "command-debug", "command-register", "command-discover", "server-shutdown",
 ]);
 
 export function isBastionMessage(msg: unknown): msg is BastionMessage {

bastion/src/shared/src/types/config.ts

@@ -14,6 +14,8 @@ export interface BastionConfig {
   // Ubuntu support
   ubuntuVersion: string;
   ubuntuMirror: string;
+  // Syslog listener for install logs (Anaconda logging --host)
+  syslogPort: number;
   // Flags
   skipDnsmasq?: boolean | undefined;
   skipArtifacts?: boolean | undefined;

bastion/src/shared/src/types/index.ts

@@ -5,6 +5,7 @@ export type {
   HardwareInfo,
   InstallConfig,
   InstalledInfo,
+  DebugConfig,
   BastionState,
 } from "./state.js";
 

bastion/src/shared/src/types/state.ts

@@ -1,5 +1,7 @@
 // State types for discovered machines, install queue, and installed machines.
 
+export type ProvisionStackType = "dhcpproxy" | "iso" | "cloud-init";
+
 export type OsId = "fedora-43" | "ubuntu-26.04";
 export type Arch = "x86_64" | "aarch64";
 
@@ -94,10 +96,24 @@ export interface InstalledInfo {
   ip: string;
   installed_at: string;
   bastionId?: string;  // set when aggregated through labd
+  // Hardware info (copied from discovered on install completion)
+  product?: string;
+  manufacturer?: string;
+  cpu_model?: string;
+  cpu_cores?: number;
+  memory_gb?: number;
+  arch?: string;
+}
+
+export interface DebugConfig {
+  hostname: string;
+  queued_at: string;
+  pxeBoot?: boolean;
 }
 
 export interface BastionState {
   discovered: Record<string, HardwareInfo>;
   install_queue: Record<string, InstallConfig>;
   installed: Record<string, InstalledInfo>;
+  debug: Record<string, DebugConfig>;
 }

bastion/tests/integration/asahi-firstboot.test.ts

@@ -0,0 +1,355 @@
+// Integration test: Asahi first-boot LVM setup.
+//
+// Tests the first-boot script that creates the standard lab LVM layout
+// on a separate data disk — simulating the Asahi provisioning flow where
+// the root partition is pre-installed and a data partition is left for LVM.
+//
+// Uses a Fedora cloud VM with two disks:
+//   disk0: 20GB root (Fedora cloud image)
+//   disk1: 200GB empty (simulates the Asahi "Data" partition)
+//
+// The firstboot script should detect disk1, create labvg + LVs, mount them.
+// Then we test reprovision: wipe marker, re-run, verify existing VG reused.
+//
+// Prerequisites: libvirt, virsh, virt-install, qemu, sudo access, lvm2
+// Run: sudo pnpm run test:integration:asahi
+
+import { describe, it, expect, beforeAll, afterAll } from "vitest";
+import { readFileSync, existsSync } from "node:fs";
+import { execSync } from "node:child_process";
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { destroyVm, waitForVmIp, waitForSsh, log, ensureCloudImage, createCloudInitIso } from "./helpers/libvirt.js";
+import { ensureTestNetwork, TEST_NETWORK_NAME } from "./helpers/network.js";
+import { sshExec, sshRun } from "./helpers/ssh.js";
+import { renderFirstbootScript } from "../../src/bastion/src/templates/asahi-firstboot.sh.js";
+
+const VM_NAME = "lab-asahi-firstboot-test";
+const VM_MEMORY = 4096;
+const VM_VCPUS = 2;
+const VM_ROOT_DISK_GB = 20;
+const VM_DATA_DISK_GB = 200;    // Simulates the Asahi "Data" partition
+const SSH_USER = "fedora";
+const IMAGE_DIR = "/var/lib/libvirt/images";
+const IS_ROOT = process.getuid?.() === 0;
+
+const FEDORA_CLOUD_IMAGE = "https://download.fedoraproject.org/pub/fedora/linux/releases/43/Cloud/x86_64/images/Fedora-Cloud-Base-Generic-43-1.6.x86_64.qcow2";
+
+function run(cmd: string, opts?: { timeout?: number }): string {
+  const full = IS_ROOT ? cmd : `sudo ${cmd}`;
+  return execSync(full, { encoding: "utf-8", stdio: "pipe", timeout: opts?.timeout ?? 60_000 });
+}
+
+function findSshKey(): { pubKey: string; keyPath: string } {
+  const homes = [homedir()];
+  const sudoUser = process.env["SUDO_USER"];
+  if (sudoUser) homes.push(join("/home", sudoUser));
+  if (process.env["SSH_KEY_PATH"]) {
+    const keyPath = process.env["SSH_KEY_PATH"];
+    const pubPath = `${keyPath}.pub`;
+    if (existsSync(keyPath) && existsSync(pubPath)) {
+      return { pubKey: readFileSync(pubPath, "utf-8").trim(), keyPath };
+    }
+  }
+  for (const home of homes) {
+    for (const name of ["id_ed25519", "id_ecdsa", "id_rsa"]) {
+      const keyPath = join(home, ".ssh", name);
+      const pubPath = `${keyPath}.pub`;
+      if (existsSync(keyPath) && existsSync(pubPath)) {
+        return { pubKey: readFileSync(pubPath, "utf-8").trim(), keyPath };
+      }
+    }
+  }
+  throw new Error("No SSH key found");
+}
+
+/** Create a VM with two disks: root (cloud image) + empty data disk. */
+function createTwoDiskVm(config: {
+  name: string;
+  memory: number;
+  vcpus: number;
+  rootDiskGb: number;
+  dataDiskGb: number;
+  network: string;
+  cloudImageUrl: string;
+  sshPubKey: string;
+}): void {
+  destroyVm(config.name);
+
+  log(`Creating two-disk VM: ${config.name} (root=${config.rootDiskGb}GB, data=${config.dataDiskGb}GB)`);
+
+  const baseImage = ensureCloudImage(config.cloudImageUrl, `${config.name}-base`);
+  const rootDiskPath = join(IMAGE_DIR, `${config.name}.qcow2`);
+  const dataDiskPath = join(IMAGE_DIR, `${config.name}-data.qcow2`);
+
+  // Root disk from cloud image
+  run(`cp "${baseImage}" "${rootDiskPath}"`);
+  run(`qemu-img resize "${rootDiskPath}" ${config.rootDiskGb}G`);
+
+  // Empty data disk
+  run(`qemu-img create -f qcow2 "${dataDiskPath}" ${config.dataDiskGb}G`);
+
+  // Cloud-init with LVM tools
+  const cloudInitIso = createCloudInitIso(config.name, {
+    name: config.name,
+    memory: config.memory,
+    vcpus: config.vcpus,
+    diskSize: config.rootDiskGb,
+    network: config.network,
+    cloudImageUrl: config.cloudImageUrl,
+    sshPubKey: config.sshPubKey,
+    userData: `#cloud-config
+hostname: ${config.name}
+manage_etc_hosts: true
+users:
+  - default
+  - name: fedora
+    sudo: ALL=(ALL) NOPASSWD:ALL
+    shell: /bin/bash
+    ssh_authorized_keys:
+      - ${config.sshPubKey}
+ssh_pwauth: false
+package_update: false
+packages:
+  - lvm2
+  - xfsprogs
+`,
+  });
+
+  const virtInstallArgs = [
+    "virt-install",
+    `--name=${config.name}`,
+    `--memory=${config.memory}`,
+    `--vcpus=${config.vcpus}`,
+    `--disk=path=${rootDiskPath},format=qcow2`,
+    `--disk=path=${dataDiskPath},format=qcow2`,  // Second disk for LVM
+    `--disk=path=${cloudInitIso},device=cdrom`,
+    `--network=network=${config.network},model=virtio`,
+    "--os-variant=generic",
+    "--import",
+    "--noautoconsole",
+    "--wait=0",
+  ];
+
+  run(virtInstallArgs.join(" "));
+  log(`Two-disk VM ${config.name} created`);
+}
+
+describe("asahi firstboot LVM integration", () => {
+  let vmIp: string;
+  let sshKeyPath: string;
+  let sshPubKey: string;
+
+  beforeAll(async () => {
+    const keys = findSshKey();
+    sshKeyPath = keys.keyPath;
+    sshPubKey = keys.pubKey;
+
+    log("Setting up test network...");
+    ensureTestNetwork();
+
+    log("Creating two-disk VM...");
+    createTwoDiskVm({
+      name: VM_NAME,
+      memory: VM_MEMORY,
+      vcpus: VM_VCPUS,
+      rootDiskGb: VM_ROOT_DISK_GB,
+      dataDiskGb: VM_DATA_DISK_GB,
+      network: TEST_NETWORK_NAME,
+      cloudImageUrl: FEDORA_CLOUD_IMAGE,
+      sshPubKey,
+    });
+
+    log("Waiting for VM IP...");
+    vmIp = await waitForVmIp(VM_NAME, 120_000);
+
+    log("Waiting for SSH...");
+    await waitForSsh(vmIp, SSH_USER, 180_000, sshKeyPath);
+
+    log("Waiting for cloud-init to finish...");
+    await sshRun(vmIp, SSH_USER, "sudo cloud-init status --wait 2>/dev/null || sleep 30", "cloud-init", { keyPath: sshKeyPath });
+
+    // Verify second disk exists
+    const disks = sshExec(vmIp, SSH_USER, "lsblk -d -n -o NAME,SIZE", { keyPath: sshKeyPath });
+    log(`Disks:\n${disks.stdout}`);
+  }, 300_000);
+
+  afterAll(async () => {
+    log("Cleaning up VM...");
+    destroyVm(VM_NAME);
+    // Also remove data disk
+    try { run(`rm -f "${join(IMAGE_DIR, `${VM_NAME}-data.qcow2`)}"`); } catch { /* ignore */ }
+  });
+
+  it("second disk is visible and unformatted", () => {
+    const result = sshExec(vmIp, SSH_USER, "lsblk -d -n -o NAME,SIZE,TYPE | grep disk", { keyPath: sshKeyPath });
+    const disks = result.stdout.trim().split("\n");
+    expect(disks.length).toBeGreaterThanOrEqual(2);
+
+    // Second disk (vdb) should exist
+    const vdb = sshExec(vmIp, SSH_USER, "sudo blkid /dev/vdb 2>/dev/null; echo exit=$?", { keyPath: sshKeyPath });
+    // Should have no filesystem (blkid returns nothing or non-zero)
+    expect(vdb.stdout).toContain("exit=2");
+  });
+
+  it("firstboot script creates LVM on data disk", async () => {
+    // Generate the firstboot script
+    const script = renderFirstbootScript({
+      hostname: "asahi-test",
+      role: "infra",
+      serverIp: "10.0.0.1",
+      httpPort: 8080,
+      sshKeys: [sshPubKey],
+      adminUser: "testadmin",
+      mac: "52:54:00:aa:bb:cc",
+    });
+
+    // Upload and run
+    log("Uploading firstboot script...");
+    await sshRun(vmIp, SSH_USER,
+      `cat > /tmp/firstboot.sh << 'SCRIPT_EOF'\n${script}\nSCRIPT_EOF\nchmod +x /tmp/firstboot.sh`,
+      "upload script", { keyPath: sshKeyPath });
+
+    log("Running firstboot script...");
+    const result = await sshRun(vmIp, SSH_USER,
+      "sudo /tmp/firstboot.sh 2>&1",
+      "firstboot", { keyPath: sshKeyPath, timeout: 120_000 });
+
+    expect(result).toBe(0);
+  }, 180_000);
+
+  it("SSH still works after firstboot script", () => {
+    const result = sshExec(vmIp, SSH_USER, "echo hello", { keyPath: sshKeyPath });
+    if (result.stdout.trim() !== "hello") {
+      log(`SSH debug: exitCode=${result.exitCode} stdout='${result.stdout}' stderr='${result.stderr}'`);
+    }
+    expect(result.stdout.trim()).toBe("hello");
+  });
+
+  it("volume group labvg exists", () => {
+    const result = sshExec(vmIp, SSH_USER, "sudo vgs labvg --noheadings -o vg_name", { keyPath: sshKeyPath });
+    expect(result.stdout.trim()).toBe("labvg");
+  });
+
+  it("all expected logical volumes exist", () => {
+    const result = sshExec(vmIp, SSH_USER,
+      "sudo lvs labvg --noheadings -o lv_name --sort lv_name",
+      { keyPath: sshKeyPath });
+    const lvs = result.stdout.trim().split("\n").map(l => l.trim()).sort();
+    expect(lvs).toContain("home");
+    expect(lvs).toContain("longhorn");
+    expect(lvs).toContain("rancher");   // infra role
+    expect(lvs).toContain("srv");
+    expect(lvs).toContain("swap");
+    expect(lvs).toContain("var");
+    expect(lvs).toContain("varlog");
+  });
+
+  it("LV sizes match kickstart layout", () => {
+    const result = sshExec(vmIp, SSH_USER,
+      "sudo lvs labvg --noheadings -o lv_name,lv_size --units m --nosuffix",
+      { keyPath: sshKeyPath });
+    const lvMap = new Map<string, number>();
+    for (const line of result.stdout.trim().split("\n")) {
+      const [name, size] = line.trim().split(/\s+/);
+      if (name && size) lvMap.set(name, Math.round(parseFloat(size)));
+    }
+
+    expect(lvMap.get("swap")).toBe(27648);
+    expect(lvMap.get("var")).toBe(102400);
+    expect(lvMap.get("varlog")).toBe(10240);
+    expect(lvMap.get("home")).toBe(10240);
+    expect(lvMap.get("srv")).toBe(20480);
+    expect(lvMap.get("rancher")).toBe(20480);
+    // longhorn gets remaining — should be at least 5GB (200GB disk - ~191GB used)
+    expect(lvMap.get("longhorn")).toBeGreaterThan(5000);
+  });
+
+  it("non-var volumes are mounted with XFS", () => {
+    const mounts = sshExec(vmIp, SSH_USER, "mount | grep labvg", { keyPath: sshKeyPath });
+    // /var and /var/log deferred to next reboot (can't migrate live)
+    expect(mounts.stdout).toContain("/home ");
+    expect(mounts.stdout).toContain("/srv ");
+    expect(mounts.stdout).toContain("/var/lib/rancher ");
+    expect(mounts.stdout).toContain("/var/lib/longhorn ");
+    expect(mounts.stdout).toContain("xfs");
+  });
+
+  it("swap is active", () => {
+    const result = sshExec(vmIp, SSH_USER, "swapon --show --noheadings", { keyPath: sshKeyPath });
+    // swapon may show /dev/dm-X or /dev/labvg/swap
+    expect(result.stdout.length).toBeGreaterThan(0);
+  });
+
+  it("fstab has LVM entries", () => {
+    const result = sshExec(vmIp, SSH_USER, "grep labvg /etc/fstab", { keyPath: sshKeyPath });
+    const lines = result.stdout.trim().split("\n");
+    expect(lines.length).toBeGreaterThanOrEqual(7); // swap + var + varlog + home + srv + rancher + longhorn
+  });
+
+  it("hostname was set", () => {
+    const result = sshExec(vmIp, SSH_USER, "hostname", { keyPath: sshKeyPath });
+    expect(result.stdout.trim()).toBe("asahi-test");
+  });
+
+  it("admin user was created with sudo", () => {
+    const result = sshExec(vmIp, SSH_USER, "sudo id testadmin", { keyPath: sshKeyPath });
+    expect(result.stdout).toContain("testadmin");
+    expect(result.stdout).toContain("wheel");
+  });
+
+  it("provisioning metadata file exists", () => {
+    const result = sshExec(vmIp, SSH_USER, "cat /etc/lab-provisioned", { keyPath: sshKeyPath });
+    expect(result.stdout).toContain("hostname=asahi-test");
+    expect(result.stdout).toContain("role=infra");
+    expect(result.stdout).toContain("method=asahi-firstboot");
+  });
+
+  it("marker file prevents re-run", () => {
+    const result = sshExec(vmIp, SSH_USER, "test -f /etc/lab-lvm-setup-done && echo yes", { keyPath: sshKeyPath });
+    expect(result.stdout.trim()).toBe("yes");
+  });
+
+  // ── Reprovision test ──────────────────────────────────────────────
+
+  it("reprovision: detects existing labvg and re-mounts", async () => {
+    // Write a test file to a preserved LV
+    await sshRun(vmIp, SSH_USER,
+      "echo 'precious-data' | sudo tee /var/lib/rancher/test-preserve.txt",
+      "write test data", { keyPath: sshKeyPath });
+
+    // Remove marker to simulate fresh boot after reinstall
+    await sshRun(vmIp, SSH_USER, "sudo rm /etc/lab-lvm-setup-done", "remove marker", { keyPath: sshKeyPath });
+
+    // Unmount everything (simulate reinstall wiping root)
+    await sshRun(vmIp, SSH_USER, `
+      sudo umount /var/lib/longhorn 2>/dev/null || true
+      sudo umount /var/lib/rancher 2>/dev/null || true
+      sudo umount /srv 2>/dev/null || true
+      sudo umount /home 2>/dev/null || true
+      sudo umount /var/log 2>/dev/null || true
+      # Don't unmount /var — it's in use
+      sudo swapoff /dev/labvg/swap 2>/dev/null || true
+      sudo sed -i '/labvg/d' /etc/fstab
+    `, "unmount LVs", { keyPath: sshKeyPath });
+
+    // Re-run firstboot script — should detect existing VG
+    log("Re-running firstboot (reprovision)...");
+    const result = await sshRun(vmIp, SSH_USER,
+      "sudo /tmp/firstboot.sh 2>&1",
+      "firstboot reprovision", { keyPath: sshKeyPath });
+    expect(result).toBe(0);
+
+    // Verify data was preserved
+    const data = sshExec(vmIp, SSH_USER, "cat /var/lib/rancher/test-preserve.txt", { keyPath: sshKeyPath });
+    expect(data.stdout.trim()).toBe("precious-data");
+
+    // Verify marker was re-created
+    const marker = sshExec(vmIp, SSH_USER, "test -f /etc/lab-lvm-setup-done && echo yes", { keyPath: sshKeyPath });
+    expect(marker.stdout.trim()).toBe("yes");
+
+    // Verify fstab was re-populated
+    const fstab = sshExec(vmIp, SSH_USER, "grep labvg /etc/fstab", { keyPath: sshKeyPath });
+    expect(fstab.stdout).toContain("/var/lib/rancher");
+  }, 60_000);
+});

bastion/tests/integration/asahi-validate.test.ts

@@ -0,0 +1,353 @@
+// Validation tests for Asahi provisioning artifacts.
+//
+// Tests that can run WITHOUT Apple Silicon hardware:
+//   1. Shellcheck the generated firstboot script
+//   2. Verify the built rootfs ZIP structure
+//   3. Mount the rootfs and verify injected files
+//   4. Validate installer_data.json against the Asahi installer's Python parser
+//   5. Verify partition layout arithmetic
+//
+// Prerequisites:
+//   - Run scripts/build-asahi-rootfs.sh first (creates asahi-repo/)
+//   - shellcheck installed (dnf install ShellCheck)
+//   - python3 installed
+//   - root for loop mount (sudo)
+//
+// Run: sudo pnpm run test:integration:asahi-validate
+
+import { describe, it, expect, beforeAll, afterAll } from "vitest";
+import { existsSync, lstatSync, readFileSync, writeFileSync, mkdirSync, rmSync } from "node:fs";
+import { execSync, spawnSync } from "node:child_process";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { renderFirstbootScript } from "../../src/bastion/src/templates/asahi-firstboot.sh.js";
+
+const PROJECT_ROOT = join(import.meta.dirname, "..", "..");
+const ASAHI_REPO = join(PROJECT_ROOT, "asahi-repo");
+const ASAHI_CACHE = join(PROJECT_ROOT, ".asahi-cache");
+const IS_ROOT = process.getuid?.() === 0;
+
+function run(cmd: string, opts?: { timeout?: number }): string {
+  const full = IS_ROOT ? cmd : `sudo ${cmd}`;
+  return execSync(full, { encoding: "utf-8", stdio: "pipe", timeout: opts?.timeout ?? 60_000 });
+}
+
+function hasBuiltArtifacts(): boolean {
+  return existsSync(join(ASAHI_REPO, "fedora-asahi-lab.zip")) &&
+         existsSync(join(ASAHI_REPO, "installer_data.json"));
+}
+
+describe("asahi script validation", () => {
+  it("firstboot script passes shellcheck", () => {
+    const script = renderFirstbootScript({
+      hostname: "test-node",
+      role: "infra",
+      serverIp: "10.0.0.1",
+      httpPort: 8080,
+      sshKeys: ["ssh-ed25519 AAAA... user@host"],
+      adminUser: "testadmin",
+      mac: "aa:bb:cc:dd:ee:ff",
+    });
+
+    const tmpFile = join(tmpdir(), `asahi-shellcheck-${Date.now()}.sh`);
+    writeFileSync(tmpFile, script);
+
+    try {
+      const result = spawnSync("shellcheck", [
+        "-s", "bash",
+        "-e", "SC2086,SC2164",  // allow unquoted variables (intentional in some LVM commands)
+        tmpFile,
+      ], { encoding: "utf-8", stdio: "pipe", timeout: 30_000 });
+
+      if (result.status !== 0) {
+        console.log("Shellcheck warnings/errors:");
+        console.log(result.stdout);
+      }
+      // Allow warnings (exit 1 for warnings), fail on errors (exit 2+)
+      expect(result.status).toBeLessThan(2);
+    } finally {
+      try { rmSync(tmpFile); } catch { /* ignore */ }
+    }
+  });
+
+  it("firstboot script for worker role passes shellcheck", () => {
+    const script = renderFirstbootScript({
+      hostname: "worker-node",
+      role: "worker",
+      serverIp: "10.0.0.1",
+      httpPort: 8080,
+      sshKeys: [],
+      adminUser: "michal",
+      mac: "00:11:22:33:44:55",
+    });
+
+    const tmpFile = join(tmpdir(), `asahi-shellcheck-worker-${Date.now()}.sh`);
+    writeFileSync(tmpFile, script);
+
+    try {
+      const result = spawnSync("shellcheck", ["-s", "bash", "-e", "SC2086,SC2164", tmpFile],
+        { encoding: "utf-8", stdio: "pipe", timeout: 30_000 });
+      if (result.status !== 0) console.log(result.stdout);
+      expect(result.status).toBeLessThan(2);
+    } finally {
+      try { rmSync(tmpFile); } catch { /* ignore */ }
+    }
+  });
+
+  it("firstboot script for vanilla role passes shellcheck", () => {
+    const script = renderFirstbootScript({
+      hostname: "vanilla-node",
+      role: "vanilla",
+      serverIp: "10.0.0.1",
+      httpPort: 8080,
+      sshKeys: ["ssh-rsa AAAA... user@host"],
+      adminUser: "admin",
+      mac: "ff:ee:dd:cc:bb:aa",
+    });
+
+    const tmpFile = join(tmpdir(), `asahi-shellcheck-vanilla-${Date.now()}.sh`);
+    writeFileSync(tmpFile, script);
+
+    try {
+      const result = spawnSync("shellcheck", ["-s", "bash", "-e", "SC2086,SC2164", tmpFile],
+        { encoding: "utf-8", stdio: "pipe", timeout: 30_000 });
+      if (result.status !== 0) console.log(result.stdout);
+      expect(result.status).toBeLessThan(2);
+    } finally {
+      try { rmSync(tmpFile); } catch { /* ignore */ }
+    }
+  });
+});
+
+describe("asahi installer_data.json validation", () => {
+  let installerData: Record<string, unknown>;
+
+  beforeAll(() => {
+    if (!hasBuiltArtifacts()) {
+      throw new Error("Run scripts/build-asahi-rootfs.sh first to generate artifacts");
+    }
+    installerData = JSON.parse(readFileSync(join(ASAHI_REPO, "installer_data.json"), "utf-8"));
+  });
+
+  it("has os_list with one entry", () => {
+    const osList = installerData["os_list"] as unknown[];
+    expect(osList).toBeInstanceOf(Array);
+    expect(osList.length).toBe(1);
+  });
+
+  it("has required top-level fields", () => {
+    const os = (installerData["os_list"] as Record<string, unknown>[])[0]!;
+    expect(os["name"]).toBeDefined();
+    expect(os["default_os_name"]).toBeDefined();
+    expect(os["boot_object"]).toBeDefined();
+    expect(os["next_object"]).toBeDefined();
+    expect(os["package"]).toBe("fedora-asahi-lab.zip");
+    expect(os["supported_fw"]).toBeInstanceOf(Array);
+    expect((os["supported_fw"] as string[]).length).toBeGreaterThan(0);
+  });
+
+  it("has 4 partitions (EFI + Boot + Root + Data)", () => {
+    const os = (installerData["os_list"] as Record<string, unknown>[])[0]!;
+    const partitions = os["partitions"] as Record<string, unknown>[];
+    expect(partitions).toHaveLength(4);
+    expect(partitions[0]!["name"]).toBe("EFI");
+    expect(partitions[1]!["name"]).toBe("Boot");
+    expect(partitions[2]!["name"]).toBe("Root");
+    expect(partitions[3]!["name"]).toBe("Data");
+  });
+
+  it("EFI partition has correct format", () => {
+    const os = (installerData["os_list"] as Record<string, unknown>[])[0]!;
+    const efi = (os["partitions"] as Record<string, unknown>[])[0]!;
+    expect(efi["type"]).toBe("EFI");
+    expect(efi["format"]).toBe("fat");
+    expect(efi["copy_firmware"]).toBe(true);
+    // Size should be ~500MB in bytes
+    const size = parseInt(String(efi["size"]).replace("B", ""), 10);
+    expect(size).toBeGreaterThanOrEqual(500 * 1024 * 1024);
+  });
+
+  it("Boot partition references boot.img", () => {
+    const os = (installerData["os_list"] as Record<string, unknown>[])[0]!;
+    const boot = (os["partitions"] as Record<string, unknown>[])[1]!;
+    expect(boot["type"]).toBe("Linux");
+    expect(boot["image"]).toBe("boot.img");
+  });
+
+  it("Root partition does NOT expand", () => {
+    const os = (installerData["os_list"] as Record<string, unknown>[])[0]!;
+    const root = (os["partitions"] as Record<string, unknown>[])[2]!;
+    expect(root["type"]).toBe("Linux");
+    expect(root["image"]).toBe("root.img");
+    expect(root["expand"]).toBe(false);
+  });
+
+  it("Data partition expands for LVM", () => {
+    const os = (installerData["os_list"] as Record<string, unknown>[])[0]!;
+    const data = (os["partitions"] as Record<string, unknown>[])[3]!;
+    expect(data["type"]).toBe("Linux");
+    expect(data["expand"]).toBe(true);
+    expect(data["image"]).toBeUndefined(); // No image — empty partition for LVM
+  });
+
+  it("partition sizes use bytes format (NB suffix)", () => {
+    const os = (installerData["os_list"] as Record<string, unknown>[])[0]!;
+    const partitions = os["partitions"] as Record<string, unknown>[];
+    for (const p of partitions) {
+      const size = String(p["size"]);
+      expect(size).toMatch(/^\d+B$/);
+    }
+  });
+
+  it("validates against Asahi installer Python parser", () => {
+    // Download the Asahi installer and run its validation logic on our config
+    const validation = spawnSync("python3", ["-c", `
+import json, sys
+
+with open("${join(ASAHI_REPO, "installer_data.json")}") as f:
+    data = json.load(f)
+
+errors = []
+os_list = data.get("os_list", [])
+if not os_list:
+    errors.append("Empty os_list")
+
+for os_entry in os_list:
+    required = ["name", "default_os_name", "boot_object", "next_object", "package", "supported_fw", "partitions"]
+    for field in required:
+        if field not in os_entry:
+            errors.append(f"Missing field: {field}")
+
+    partitions = os_entry.get("partitions", [])
+    if not partitions:
+        errors.append("No partitions defined")
+
+    has_efi = False
+    has_root_image = False
+    expand_count = 0
+    for p in partitions:
+        if "name" not in p or "type" not in p or "size" not in p:
+            errors.append(f"Partition missing name/type/size: {p}")
+        if p.get("type") == "EFI":
+            has_efi = True
+            if p.get("format") != "fat":
+                errors.append("EFI partition must be FAT format")
+        if p.get("image"):
+            has_root_image = True
+        if p.get("expand"):
+            expand_count += 1
+        # Validate size format
+        size_str = str(p.get("size", ""))
+        if not size_str.endswith("B") or not size_str[:-1].isdigit():
+            errors.append(f"Invalid size format: {size_str} (expected NB)")
+
+    if not has_efi:
+        errors.append("No EFI partition found")
+    if not has_root_image:
+        errors.append("No partition with root image found")
+    if expand_count > 1:
+        errors.append(f"Multiple expanding partitions ({expand_count}) — only one should expand")
+
+    # Verify supported_fw is a list of strings
+    fw = os_entry.get("supported_fw", [])
+    if not isinstance(fw, list) or not all(isinstance(v, str) for v in fw):
+        errors.append("supported_fw must be a list of strings")
+
+if errors:
+    print("ERRORS:")
+    for e in errors:
+        print(f"  - {e}")
+    sys.exit(1)
+else:
+    print("OK: installer_data.json is valid")
+`], { encoding: "utf-8", stdio: "pipe", timeout: 10_000 });
+
+    if (validation.status !== 0) {
+      console.log(validation.stdout);
+      console.log(validation.stderr);
+    }
+    expect(validation.stdout).toContain("OK");
+    expect(validation.status).toBe(0);
+  });
+});
+
+describe("asahi rootfs ZIP validation", () => {
+  beforeAll(() => {
+    if (!hasBuiltArtifacts()) {
+      throw new Error("Run scripts/build-asahi-rootfs.sh first to generate artifacts");
+    }
+  });
+
+  it("ZIP contains required files", () => {
+    const result = spawnSync("unzip", ["-l", join(ASAHI_REPO, "fedora-asahi-lab.zip")],
+      { encoding: "utf-8", stdio: "pipe", timeout: 10_000 });
+    expect(result.stdout).toContain("boot.img");
+    expect(result.stdout).toContain("root.img");
+    expect(result.stdout).toContain("esp/");
+  });
+
+  it("boot.img is ~1GB", () => {
+    const result = spawnSync("unzip", ["-l", join(ASAHI_REPO, "fedora-asahi-lab.zip")],
+      { encoding: "utf-8", stdio: "pipe", timeout: 10_000 });
+    const bootLine = result.stdout.split("\n").find(l => l.includes("boot.img") && !l.includes("/"));
+    expect(bootLine).toBeDefined();
+    const size = parseInt(bootLine!.trim().split(/\s+/)[0]!, 10);
+    expect(size).toBeGreaterThan(500 * 1024 * 1024);  // > 500MB
+    expect(size).toBeLessThan(2 * 1024 * 1024 * 1024); // < 2GB
+  });
+
+  it("root.img is > 3GB", () => {
+    const result = spawnSync("unzip", ["-l", join(ASAHI_REPO, "fedora-asahi-lab.zip")],
+      { encoding: "utf-8", stdio: "pipe", timeout: 10_000 });
+    const rootLine = result.stdout.split("\n").find(l => l.includes("root.img"));
+    expect(rootLine).toBeDefined();
+    const size = parseInt(rootLine!.trim().split(/\s+/)[0]!, 10);
+    expect(size).toBeGreaterThan(3 * 1024 * 1024 * 1024); // > 3GB
+  });
+
+  it("rootfs contains lab-firstboot.sh", () => {
+    const mountDir = join(tmpdir(), `asahi-rootfs-check-${Date.now()}`);
+    const extractDir = join(tmpdir(), `asahi-rootfs-extract-${Date.now()}`);
+    mkdirSync(mountDir);
+    mkdirSync(extractDir);
+
+    try {
+      // Extract root.img from ZIP
+      run(`unzip -o -j "${join(ASAHI_REPO, "fedora-asahi-lab.zip")}" root.img -d "${extractDir}"`);
+
+      // Mount and check
+      run(`mount -o loop,ro "${join(extractDir, "root.img")}" "${mountDir}"`);
+
+      // Verify firstboot script
+      expect(existsSync(join(mountDir, "usr/local/bin/lab-firstboot.sh"))).toBe(true);
+      const script = readFileSync(join(mountDir, "usr/local/bin/lab-firstboot.sh"), "utf-8");
+      expect(script).toContain("#!/bin/bash");
+      expect(script).toContain("labvg");
+      expect(script).toContain("pvcreate");
+
+      // Verify systemd service
+      expect(existsSync(join(mountDir, "etc/systemd/system/lab-firstboot.service"))).toBe(true);
+      const service = readFileSync(join(mountDir, "etc/systemd/system/lab-firstboot.service"), "utf-8");
+      expect(service).toContain("lab-firstboot.sh");
+
+      // Verify service is enabled (symlink exists)
+      const symlinkPath = join(mountDir, "etc/systemd/system/multi-user.target.wants/lab-firstboot.service");
+      let symlinkExists = false;
+      try { lstatSync(symlinkPath); symlinkExists = true; } catch { /* not found */ }
+      expect(symlinkExists).toBe(true);
+
+      // Verify SSH keys
+      expect(existsSync(join(mountDir, "root/.ssh/authorized_keys"))).toBe(true);
+
+      // Verify lvm2 + xfsprogs are in the image
+      const hasLvm = existsSync(join(mountDir, "usr/bin/pvcreate")) || existsSync(join(mountDir, "usr/sbin/pvcreate"));
+      const hasXfs = existsSync(join(mountDir, "usr/bin/mkfs.xfs")) || existsSync(join(mountDir, "usr/sbin/mkfs.xfs"));
+      expect(hasLvm).toBe(true);
+      expect(hasXfs).toBe(true);
+    } finally {
+      run(`umount "${mountDir}" 2>/dev/null || true`);
+      rmSync(mountDir, { recursive: true, force: true });
+      rmSync(extractDir, { recursive: true, force: true });
+    }
+  }, 120_000);
+});

bastion/tests/integration/helpers/jetkvm.sh

@@ -0,0 +1,82 @@
+#!/bin/bash
+# JetKVM helper — authenticate and interact with JetKVM device.
+# Usage:
+#   jetkvm.sh status              — check device status
+#   jetkvm.sh reboot              — reboot the target machine via ATX
+#   jetkvm.sh poweron             — power on via ATX short press
+#   jetkvm.sh poweroff            — power off via ATX long press
+#
+# Environment:
+#   JETKVM_HOST    — JetKVM IP (default: 192.168.3.10)
+#   JETKVM_PASS    — device password
+
+set -euo pipefail
+
+HOST="${JETKVM_HOST:-192.168.3.10}"
+PASS="${JETKVM_PASS:-}"
+
+if [ -z "$PASS" ]; then
+    echo "ERROR: JETKVM_PASS not set" >&2
+    exit 1
+fi
+
+BASE="http://$HOST"
+
+# Authenticate and get token
+login() {
+    local resp
+    resp=$(curl -s -X POST "$BASE/auth/login-local" \
+        -H "Content-Type: application/json" \
+        -d "{\"password\":\"$PASS\"}" 2>&1)
+
+    local token
+    token=$(echo "$resp" | grep -oP '"token"\s*:\s*"[^"]*"' | head -1 | grep -oP '"[^"]*"$' | tr -d '"')
+
+    if [ -z "$token" ]; then
+        echo "ERROR: Login failed: $resp" >&2
+        exit 1
+    fi
+    echo "$token"
+}
+
+# Make authenticated request
+api() {
+    local method="$1" path="$2" body="${3:-}"
+    local token
+    token=$(login)
+
+    if [ -n "$body" ]; then
+        curl -s -X "$method" "$BASE$path" \
+            -H "Authorization: Bearer $token" \
+            -H "Content-Type: application/json" \
+            -d "$body"
+    else
+        curl -s -X "$method" "$BASE$path" \
+            -H "Authorization: Bearer $token"
+    fi
+}
+
+case "${1:-status}" in
+    status)
+        curl -s "$BASE/device/status" 2>&1
+        ;;
+    device)
+        api GET /device
+        ;;
+    reboot)
+        echo "Sending ATX reset..."
+        api POST /device/atx/reset
+        ;;
+    poweron)
+        echo "Sending ATX short power press..."
+        api POST /device/atx/power-short
+        ;;
+    poweroff)
+        echo "Sending ATX long power press..."
+        api POST /device/atx/power-long
+        ;;
+    *)
+        echo "Usage: $0 {status|device|reboot|poweron|poweroff}"
+        exit 1
+        ;;
+esac

bastion/tests/integration/helpers/pxe-network.ts

@@ -40,50 +40,50 @@ export function ensurePxeNetwork(): void {
 
   if (result.status === 0 && result.stdout.includes("Active:         yes")) {
     log(`Network ${PXE_NETWORK_NAME} already active`);
-    return;
+  } else {
+    // Destroy existing if present but inactive
+    if (result.status === 0) {
+      virsh("net-destroy", PXE_NETWORK_NAME);
+      virsh("net-undefine", PXE_NETWORK_NAME);
+    }
+
+    const xmlPath = "/tmp/lab-pxe-test-network.xml";
+    writeFileSync(xmlPath, NETWORK_XML);
+
+    log(`Creating PXE libvirt network: ${PXE_NETWORK_NAME} (${PXE_SUBNET}.0/24, no DHCP)`);
+    run(`virsh net-define "${xmlPath}"`);
+    run(`virsh net-start "${PXE_NETWORK_NAME}"`);
+
+    try { unlinkSync(xmlPath); } catch { /* ignore */ }
+
+    log(`Network ${PXE_NETWORK_NAME} created and active`);
   }
 
-  // Destroy existing if present but inactive
-  if (result.status === 0) {
-    virsh("net-destroy", PXE_NETWORK_NAME);
-    virsh("net-undefine", PXE_NETWORK_NAME);
-  }
+  // Libvirt adds nftables reject rules for NAT networks that block host→VM SSH.
+  // Delete them now and after every VM reboot (libvirt recreates them).
+  deleteNftablesRejectRules();
+}
 
-  const xmlPath = "/tmp/lab-pxe-test-network.xml";
-  writeFileSync(xmlPath, NETWORK_XML);
-
-  log(`Creating PXE libvirt network: ${PXE_NETWORK_NAME} (${PXE_SUBNET}.0/24, no DHCP)`);
-  run(`virsh net-define "${xmlPath}"`);
-  run(`virsh net-start "${PXE_NETWORK_NAME}"`);
-
-  try { unlinkSync(xmlPath); } catch { /* ignore */ }
-
-  // Libvirt creates nftables rules that reject traffic on the bridge.
-  // DHCP works (dnsmasq uses raw sockets) but TFTP/HTTP from VM->host gets blocked.
-  // Delete the reject rules so VM traffic can reach the bastion.
-  try {
-    // Delete the reject rules that libvirt added for our bridge.
-    // We find and delete each rule by its handle number.
-    const deleteRejectRules = (chain: string): void => {
-      const output = run(`nft -a list chain inet libvirt ${chain} 2>/dev/null || true`);
-      const lines = output.split("\n");
-      for (const line of lines) {
-        if (line.includes(PXE_BRIDGE) && line.includes("reject")) {
-          const handleMatch = line.match(/# handle (\d+)/);
-          if (handleMatch) {
-            run(`nft delete rule inet libvirt ${chain} handle ${handleMatch[1]}`);
+/** Delete libvirt's nftables reject rules for our bridge so host→VM traffic works.
+ *  Must be called after every VM start/restart — libvirt recreates them. */
+export function deleteNftablesRejectRules(): void {
+  // libvirt uses "ip libvirt_network" table (not "inet libvirt")
+  const tables = ["ip libvirt_network", "ip6 libvirt_network", "inet libvirt"];
+  for (const table of tables) {
+    try {
+      for (const chain of ["guest_input", "guest_output"]) {
+        const output = run(`nft -a list chain ${table} ${chain} 2>/dev/null || true`);
+        for (const line of output.split("\n")) {
+          if (line.includes(PXE_BRIDGE) && line.includes("reject")) {
+            const handleMatch = line.match(/# handle (\d+)/);
+            if (handleMatch) {
+              run(`nft delete rule ${table} ${chain} handle ${handleMatch[1]}`);
+            }
           }
         }
       }
-    };
-    deleteRejectRules("guest_input");
-    deleteRejectRules("guest_output");
-    log(`Removed nftables reject rules for ${PXE_BRIDGE}`);
-  } catch {
-    log(`Could not update nftables rules (may need manual firewall config)`);
+    } catch { /* table may not exist */ }
   }
-
-  log(`Network ${PXE_NETWORK_NAME} created and active`);
 }
 
 /** Destroy the PXE test network. */

bastion/tests/integration/helpers/pxe-vm.ts

@@ -63,7 +63,7 @@ export function createPxeVm(config: PxeVmConfig): void {
     `--disk=path=${diskPath},format=qcow2,bus=virtio`,
     `--network=network=${config.network},model=virtio`,
     // UEFI firmware — required for PXE boot in modern mode
-    `--boot=uefi,network`,
+    `--boot=uefi,network,hd`,
     // No OS to install — PXE provides everything
     "--os-variant=generic",
     "--noautoconsole",
@@ -113,29 +113,54 @@ export function rebootPxeVm(name: string): void {
   log(`PXE VM ${name} restarted`);
 }
 
-/** Change VM boot order to disk first (skip PXE on next boot). */
-export function setBootDisk(name: string): void {
-  log(`Setting ${name} boot order to disk first`);
-  virsh("destroy", name);
-  spawnSync("sleep", ["2"]);
-  // Get current XML, replace boot dev='network' with boot dev='hd'
-  // This preserves UEFI loader/nvram settings (virt-xml --boot hd can break them)
-  const dumpXml = virsh("dumpxml", name);
-  if (dumpXml.status !== 0) throw new Error("Failed to dump VM XML");
-  let xml = dumpXml.stdout;
-  // Replace any <boot dev='...' /> entries with hd
-  xml = xml.replace(/<boot dev='[^']*'\/>/g, "<boot dev='hd'/>");
-  // If no boot dev entry, add one before </os>
-  if (!xml.includes("<boot dev=")) {
-    xml = xml.replace("</os>", "  <boot dev='hd'/>\n  </os>");
-  }
-  const xmlPath = `/tmp/${name}-bootfix.xml`;
-  const { writeFileSync: writeFs, unlinkSync: unlinkFs } = require("node:fs") as typeof import("node:fs");
-  writeFs(xmlPath, xml);
-  run(`virsh define "${xmlPath}"`);
-  try { unlinkFs(xmlPath); } catch { /* ignore */ }
-  virsh("start", name);
-  log(`${name} restarted with disk boot (UEFI preserved)`);
+/**
+ * Read raw output from the VM's serial console (telnet TCP port).
+ * Returns the last N lines. Useful for diagnostics when SSH isn't available.
+ */
+export async function readSerialLog(
+  port: number,
+  opts: { lastLines?: number; timeoutMs?: number } = {},
+): Promise<string> {
+  const { lastLines = 50, timeoutMs = 10_000 } = opts;
+  return new Promise((resolve) => {
+    const sock = createConnection({ host: "127.0.0.1", port });
+    let buf = "";
+    const timer = setTimeout(() => { sock.destroy(); resolve(buf); }, timeoutMs);
+    sock.on("data", (d: Buffer) => { buf += d.toString(); });
+    sock.on("error", () => { clearTimeout(timer); resolve(`(connection error) ${buf}`); });
+    sock.on("close", () => { clearTimeout(timer); resolve(buf); });
+    // Send a newline to trigger any buffered output / prompt
+    setTimeout(() => sock.write("\r\n"), 500);
+  }).then((raw: unknown) => {
+    const lines = (raw as string).split("\n").map(l => l.trimEnd()).filter(Boolean);
+    return lines.slice(-lastLines).join("\n");
+  });
+}
+
+/**
+ * Execute a command on the VM's serial console via socat.
+ * Requires auto-login root shell on the serial port.
+ */
+export function serialExec(
+  port: number,
+  command: string,
+  timeoutMs = 15_000,
+): string {
+  const marker = `__END_${Date.now()}__`;
+  // Use socat to handle telnet negotiation properly
+  const input = `\r\n${command}; echo '${marker}'\r\n`;
+  const result = spawnSync("bash", ["-c",
+    `echo -e '${input.replace(/'/g, "\\'")}' | socat -T${Math.ceil(timeoutMs / 1000)} - TCP:127.0.0.1:${port} 2>/dev/null`
+  ], { encoding: "utf-8", stdio: "pipe", timeout: timeoutMs + 5000 });
+  const output = result.stdout ?? "";
+  const markerIdx = output.indexOf(marker);
+  if (markerIdx < 0) return `(no marker) ${output.slice(-500)}`;
+  // Get lines between command echo and marker
+  const before = output.substring(0, markerIdx);
+  const lines = before.split("\n");
+  // Skip everything up to and including the command echo line
+  const cmdIdx = lines.findIndex(l => l.includes(command.substring(0, 20)));
+  return lines.slice(cmdIdx >= 0 ? cmdIdx + 1 : 1).join("\n").trim();
 }
 
 export interface IsoVmConfig {
@@ -187,69 +212,3 @@ export function createIsoVm(config: IsoVmConfig): void {
   log(`ISO boot VM ${config.name} created (serial: telnet 127.0.0.1 4556)`);
 }
 
-/**
- * Execute a command on a VM via its serial console (telnet).
- * Works even when the VM has no network/SSH.
- * Returns the output after the command's echo.
- */
-export async function serialExec(
-  port: number,
-  command: string,
-  timeoutMs = 10_000,
-): Promise<string> {
-  return new Promise((resolve, reject) => {
-    const timer = setTimeout(() => {
-      sock.destroy();
-      reject(new Error(`Serial exec timeout after ${timeoutMs}ms`));
-    }, timeoutMs);
-
-    const sock = createConnection({ host: "127.0.0.1", port });
-    let buffer = "";
-    let sentCommand = false;
-    // Random marker to delimit command output
-    const marker = `__SERIAL_END_${Date.now()}__`;
-
-    sock.on("connect", () => {
-      // Wait for login prompt or shell prompt, then send command
-      setTimeout(() => {
-        // Send a newline first to get a prompt
-        sock.write("\r\n");
-      }, 500);
-    });
-
-    sock.on("data", (data: Buffer) => {
-      buffer += data.toString();
-
-      if (!sentCommand && (buffer.includes("login:") || buffer.includes("# ") || buffer.includes("$ "))) {
-        if (buffer.includes("login:")) {
-          // Auto-login as root
-          sock.write("root\r\n");
-          sentCommand = false; // wait for shell prompt after login
-          buffer = "";
-          return;
-        }
-        // At shell prompt — send command with marker
-        sentCommand = true;
-        buffer = "";
-        sock.write(`${command}; echo "${marker}"\r\n`);
-      }
-
-      if (sentCommand && buffer.includes(marker)) {
-        clearTimeout(timer);
-        // Extract output between command echo and marker
-        const markerIdx = buffer.indexOf(marker);
-        const output = buffer.substring(0, markerIdx).trim();
-        // Remove the command echo (first line)
-        const lines = output.split("\n");
-        const result = lines.slice(1).join("\n").trim();
-        sock.destroy();
-        resolve(result);
-      }
-    });
-
-    sock.on("error", (err) => {
-      clearTimeout(timer);
-      reject(new Error(`Serial connection failed: ${err.message}`));
-    });
-  });
-}

bastion/tests/integration/helpers/vm-screenshot.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+# Capture a screenshot of a libvirt VM and convert to PNG for viewing.
+# Usage: vm-screenshot.sh [VM_NAME] [OUTPUT_PATH]
+VM_NAME="${1:-lab-pxe-test}"
+OUTPUT="${2:-/tmp/vm-screenshot.png}"
+PPM="/tmp/vm-screenshot-$$.ppm"
+
+if ! sudo virsh domstate "$VM_NAME" &>/dev/null; then
+    echo "ERROR: VM '$VM_NAME' not found or not running" >&2
+    exit 1
+fi
+
+sudo virsh screenshot "$VM_NAME" "$PPM" --screen 0 2>/dev/null
+if [ ! -f "$PPM" ]; then
+    echo "ERROR: screenshot failed" >&2
+    exit 1
+fi
+
+# Convert to PNG (ppm -> png)
+if command -v convert &>/dev/null; then
+    convert "$PPM" "$OUTPUT"
+elif command -v ffmpeg &>/dev/null; then
+    ffmpeg -y -i "$PPM" "$OUTPUT" 2>/dev/null
+elif command -v pnmtopng &>/dev/null; then
+    pnmtopng "$PPM" > "$OUTPUT"
+else
+    # fallback: just copy the PPM (Read tool can handle it)
+    cp "$PPM" "${OUTPUT%.png}.ppm"
+    OUTPUT="${OUTPUT%.png}.ppm"
+fi
+
+rm -f "$PPM"
+echo "$OUTPUT"

bastion/tests/integration/pxe-provision.test.ts

@@ -23,17 +23,56 @@ import { execSync } from "node:child_process";
 import { join } from "node:path";
 import { homedir, tmpdir } from "node:os";
 import { log, waitForSsh } from "./helpers/libvirt.js";
-import { ensurePxeNetwork, destroyPxeNetwork, PXE_NETWORK_NAME, PXE_GATEWAY, PXE_SUBNET } from "./helpers/pxe-network.js";
-import { createPxeVm, destroyPxeVm, getVmMac, rebootPxeVm, serialExec } from "./helpers/pxe-vm.js";
+import { ensurePxeNetwork, destroyPxeNetwork, deleteNftablesRejectRules, PXE_NETWORK_NAME, PXE_GATEWAY, PXE_SUBNET } from "./helpers/pxe-network.js";
+import { createPxeVm, destroyPxeVm, getVmMac, rebootPxeVm, readSerialLog } from "./helpers/pxe-vm.js";
 import { sshExec } from "./helpers/ssh.js";
 
+// --- Boot screenshot capture ---
+const SCREENSHOT_DIR = "/tmp/vm-screenshots";
+
+function startBootScreenshots(vmName: string): { stop: () => void } {
+  try { mkdirSync(SCREENSHOT_DIR, { recursive: true }); } catch {}
+  // Clean old screenshots
+  try {
+    for (const f of require("node:fs").readdirSync(SCREENSHOT_DIR)) {
+      rmSync(join(SCREENSHOT_DIR, f), { force: true });
+    }
+  } catch {}
+
+  let running = true;
+  let seq = 0;
+  const BUFFER_SIZE = 60; // keep last 60 screenshots (1 per second)
+
+  const loop = async () => {
+    while (running) {
+      try {
+        const idx = String(seq % BUFFER_SIZE).padStart(4, "0");
+        const ppm = join(SCREENSHOT_DIR, `tmp-${idx}.ppm`);
+        const png = join(SCREENSHOT_DIR, `boot-${idx}.png`);
+        execSync(`sudo virsh screenshot ${vmName} ${ppm} --screen 0 2>/dev/null`, { timeout: 3000 });
+        execSync(`convert ${ppm} ${png} 2>/dev/null && rm -f ${ppm}`, { timeout: 3000 });
+        seq++;
+      } catch {}
+      await new Promise(r => setTimeout(r, 1000));
+    }
+  };
+  loop();
+
+  return {
+    stop: () => {
+      running = false;
+      log(`Boot screenshots saved to ${SCREENSHOT_DIR}/ (${seq} captured, last ${Math.min(seq, BUFFER_SIZE)} kept)`);
+    },
+  };
+}
+
 // --- Test constants ---
 const VM_NAME = "lab-pxe-test";
 const VM_MEMORY = 4096;     // 4GB (Anaconda needs ~2GB minimum)
-const VM_VCPUS = 2;
+const VM_VCPUS = 12;
 const VM_DISK_GB = 250;      // LVM layout needs ~204GB (swap 27 + root 33 + var 100 + etc). QCOW2 is sparse.
 const HTTP_PORT = 8099;      // Avoid conflicts with real bastion
-const SSH_USER = "michal";   // Admin user created by kickstart
+const SSH_USER = "lab";      // Admin user created by kickstart
 const BASTION_IP = PXE_GATEWAY; // 192.168.251.1
 const DHCP_RANGE_START = `${PXE_SUBNET}.100`;
 const DHCP_RANGE_END = `${PXE_SUBNET}.200`;
@@ -185,15 +224,19 @@ describe("PXE boot provisioning", () => {
     // Generate dnsmasq config
     generateDnsmasqConf(config);
 
-    // Start HTTP server
-    const { app, state } = createApp(config);
+    // Start HTTP server + syslog listener
+    const { app, state, syslog } = createApp(config);
     bastionApp = app;
     await app.listen({ port: config.httpPort, host: "0.0.0.0" });
-    log(`Bastion HTTP server listening on :${HTTP_PORT}`);
+    syslog.start();
+    log(`Bastion HTTP server listening on :${HTTP_PORT}, syslog on UDP :${config.syslogPort}`);
 
     // Start dnsmasq (fire-and-forget — it runs until killed)
-    log("Starting dnsmasq (full DHCP mode)...");
-    void startDnsmasq(config);
+    // May fail without root (DHCP socket needs CAP_NET_BIND_SERVICE); libvirt network provides DHCP fallback
+    log("Starting dnsmasq (proxy DHCP mode)...");
+    startDnsmasq(config).catch((err) => {
+      log(`dnsmasq failed (expected without root): ${err instanceof Error ? err.message : String(err)}`);
+    });
     // Give dnsmasq a moment to bind ports
     await sleep(1000);
 
@@ -267,38 +310,32 @@ describe("PXE boot provisioning", () => {
     vmIp = finalState.ip ?? "";
     log(`Install complete! VM IP: ${vmIp}`);
 
-    // 9. Force-restart VM to ensure clean boot with updated NVRAM.
-    // The %post efibootmgr sets network-first boot order, but OVMF may not
-    // reread NVRAM during a warm reboot. Force cold-restart ensures it does.
-    log("Force-restarting VM for clean network-first boot...");
+    // 9. Reboot VM — it network-boots again, bastion /dispatch returns
+    // "exit" (already installed), iPXE falls through to local disk boot.
+    log("Rebooting VM (network-first → bastion dispatch → local disk)...");
     await sleep(15_000);
     rebootPxeVm(VM_NAME);
+    // Libvirt recreates nftables reject rules on VM restart — wait for them then delete
+    await sleep(3_000);
+    deleteNftablesRejectRules();
 
-    // 10. Wait for SSH — VM network-boots, iPXE chains to /dispatch,
-    // bastion returns exit (installed), iPXE falls through to disk boot
+    // 10. Wait for SSH (with aggressive boot screenshots)
     log("Waiting for SSH access...");
+    const screenshots = startBootScreenshots(VM_NAME);
     try {
       await waitForSsh(vmIp, SSH_USER, SSH_TIMEOUT_MS, sshKeyPath);
     } catch {
-      // SSH failed — use serial console to diagnose
-      log("SSH timed out. Diagnosing via serial console...");
+      // SSH failed — read serial console (lab-boot-diag.service dumps diagnostics there)
+      log("SSH timed out. Reading serial console diagnostics...");
       try {
-        const hostname = await serialExec(4555, "hostname", 15_000);
-        log(`Serial: hostname = ${hostname}`);
-        const ip = await serialExec(4555, "ip -4 addr show | grep inet", 15_000);
-        log(`Serial: ip = ${ip}`);
-        const nm = await serialExec(4555, "systemctl is-active NetworkManager", 15_000);
-        log(`Serial: NetworkManager = ${nm}`);
-        const sshd = await serialExec(4555, "systemctl is-active sshd", 15_000);
-        log(`Serial: sshd = ${sshd}`);
-        const failed = await serialExec(4555, "systemctl --failed --no-pager", 15_000);
-        log(`Serial: failed units = ${failed}`);
-        const fstab = await serialExec(4555, "grep efi /etc/fstab", 15_000);
-        log(`Serial: fstab efi = ${fstab}`);
+        const serialOut = await readSerialLog(4555, { lastLines: 80, timeoutMs: 15_000 });
+        log(`Serial console:\n${serialOut}`);
       } catch (serialErr) {
         log(`Serial console failed: ${serialErr instanceof Error ? serialErr.message : String(serialErr)}`);
       }
-      throw new Error(`SSH not available on ${vmIp} — check serial console diagnostics above`);
+      throw new Error(`SSH not available on ${vmIp} — check serial console diagnostics above. Screenshots: ${SCREENSHOT_DIR}/`);
+    } finally {
+      screenshots.stop();
     }
 
     log("PXE provision test setup complete.");
@@ -316,10 +353,7 @@ describe("PXE boot provisioning", () => {
     const { stopDnsmasq } = await import("../../src/bastion/src/services/dnsmasq.js");
     stopDnsmasq();
 
-    // Destroy VM
     destroyPxeVm(VM_NAME);
-
-    // Destroy network
     destroyPxeNetwork();
 
     // Clean up test dir
@@ -354,10 +388,10 @@ describe("PXE boot provisioning", () => {
     expect(data.progress).toBe("complete");
   });
 
-  it("log lines were captured", async () => {
+  it("syslog install logs were captured", async () => {
+    // Anaconda forwards logs via syslog (logging --host directive in kickstart)
     const res = await fetch(`http://${BASTION_IP}:${HTTP_PORT}/api/logs/${encodeURIComponent(vmMac)}`);
     const data = (await res.json()) as { log_total?: number; log_lines?: Array<{ line: string }> };
-    // Should have at least some log lines from the log streamer
     expect(data.log_total).toBeGreaterThan(0);
   });
 
@@ -400,7 +434,15 @@ describe("PXE boot provisioning", () => {
   it("EFI boot order keeps network first (bastion controls boot)", () => {
     const result = sshExec(vmIp, SSH_USER, "sudo efibootmgr", { keyPath: sshKeyPath });
     expect(result.exitCode).toBe(0);
-    expect(result.stdout).toContain("BootOrder:");
+    // The first entry in BootOrder should be a network/PXE/HTTP boot entry
+    const orderMatch = result.stdout.match(/BootOrder:\s*([0-9A-Fa-f]+)/);
+    expect(orderMatch).toBeTruthy();
+    const firstEntry = orderMatch![1];
+    // Find what that entry maps to — should be network-related
+    const entryLine = result.stdout.match(new RegExp(`Boot${firstEntry}\\*?\\s+(.+)`));
+    expect(entryLine).toBeTruthy();
+    const entryName = entryLine![1].toLowerCase();
+    expect(entryName).toMatch(/network|pxe|ipv4|ipv6|http|uefi.*nic/i);
   });
 
   it("tmpfs mount for /tmp is configured", () => {
@@ -422,4 +464,53 @@ describe("PXE boot provisioning", () => {
       expect(lvs).toContain(expected);
     }
   });
+
+  // --- Post-provision health checks ---
+
+  it("no failed systemd services", () => {
+    const result = sshExec(vmIp, SSH_USER, "sudo systemctl --failed --no-legend --no-pager", { keyPath: sshKeyPath });
+    expect(result.exitCode).toBe(0);
+    const failed = result.stdout.trim();
+    expect(failed).toBe("");
+  });
+
+  it("root filesystem is mounted read-write", () => {
+    const result = sshExec(vmIp, SSH_USER, "mount | grep ' / '", { keyPath: sshKeyPath });
+    expect(result.stdout).toContain("rw,");
+    expect(result.stdout).not.toContain("(ro,");
+  });
+
+  it("/boot/efi is mounted", () => {
+    const result = sshExec(vmIp, SSH_USER, "mount | grep /boot/efi", { keyPath: sshKeyPath });
+    expect(result.exitCode).toBe(0);
+    expect(result.stdout).toContain("vfat");
+  });
+
+  it("kernel modules are loaded (depmod correct)", () => {
+    const result = sshExec(vmIp, SSH_USER, "lsmod | wc -l", { keyPath: sshKeyPath });
+    expect(result.exitCode).toBe(0);
+    // Should have a reasonable number of modules loaded
+    expect(Number(result.stdout.trim())).toBeGreaterThan(10);
+  });
+
+  it("SELinux is enforcing", () => {
+    const result = sshExec(vmIp, SSH_USER, "getenforce", { keyPath: sshKeyPath });
+    expect(result.exitCode).toBe(0);
+    expect(result.stdout.trim()).toBe("Enforcing");
+  });
+
+  it("SELinux context on /etc/fstab is correct", () => {
+    const result = sshExec(vmIp, SSH_USER, "ls -Z /etc/fstab", { keyPath: sshKeyPath });
+    expect(result.stdout).toContain("etc_t");
+  });
+
+  it("sshd is running", () => {
+    const result = sshExec(vmIp, SSH_USER, "sudo systemctl is-active sshd", { keyPath: sshKeyPath });
+    expect(result.stdout.trim()).toBe("active");
+  });
+
+  it("chronyd is running for time sync", () => {
+    const result = sshExec(vmIp, SSH_USER, "sudo systemctl is-active chronyd", { keyPath: sshKeyPath });
+    expect(result.stdout.trim()).toBe("active");
+  });
 });

bastion/tests/integration/run-pxe-test.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+# One-shot PXE integration test runner.
+# Compiles, runs unit tests, cleans up, and runs the full integration test.
+set -e
+
+cd "$(dirname "$0")/../.."
+
+echo "=== Step 1: Compile ==="
+npx tsc --noEmit
+echo "✓ Compile OK"
+
+echo ""
+echo "=== Step 2: Kickstart unit tests ==="
+npx vitest run src/bastion/tests/kickstart.test.ts 2>&1 | tail -5
+echo "✓ Unit tests OK"
+
+echo ""
+echo "=== Step 3: Clean up ==="
+sudo lsof -ti:8099 2>/dev/null | xargs -r sudo kill -9 || true
+sudo virsh destroy lab-pxe-test 2>/dev/null || true
+sudo virsh undefine lab-pxe-test --nvram 2>/dev/null || true
+sudo rm -f /var/lib/libvirt/images/lab-pxe-test.qcow2
+echo "✓ Cleanup done"
+
+echo ""
+echo "=== Step 4: Integration test ==="
+npx vitest run -c /dev/null tests/integration/pxe-provision.test.ts 2>&1

bastion/vitest.integration.config.ts

@@ -0,0 +1,9 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    globals: true,
+    include: ['tests/integration/**/*.test.ts'],
+    testTimeout: 600000,
+  },
+});