Document the install modes and every undocumented installer flag - #127
Open
darksidemilk wants to merge 2 commits into
Open
Document the install modes and every undocumented installer flag#127darksidemilk wants to merge 2 commits into
darksidemilk wants to merge 2 commits into
Conversation
Four options existed in the installer and appeared nowhere in these docs at
all: --install-mode, --public-web-cert, --rebuild-ipxe-with-my-ca and
--https-redirect. Two more, --netboot-proto and --boot-delay, were documented
only on other pages. The pasted --help block was old enough to predate all of
them.
Regenerated that block from the installer itself rather than editing it by
hand, which is also how the ordering bug in usage() got found and fixed
upstream of this. Added a section for the four install modes with the tuple
each one writes, and a table for the individual transport options they are
shorthand for.
Three things a reader can currently only learn by being bitten:
- -S no longer means what it did. Before 1.6 it decided the web protocol,
the redirect and whether iPXE was recompiled; it now means only the
redirect, which is what its help text always claimed.
- --install-mode does not touch the redirect, despite the prompt describing
standard as 'no redirect'. An upgraded -S server keeps it whichever mode
is chosen.
- http-only does not persist. httpProto returns to https on every run, so
the flag has to be passed again on each upgrade.
Also corrected the Secure Boot section, which still described the flat
pre-PKI layout -- a key at /opt/fog/secureboot/MOK.key that is 'never
regenerated'. That layout is gone: there is an enrolled CA in
pki/secureboot/ca/ and a rotatable signing leaf in leaf/, which is the whole
point of the split and is why --secureboot-ca-cert exists. That flag was
undocumented here too.
Added the name-constraint options, including the one an admin supplying an
enterprise intermediate needs to know: iPXE only understands dNSName and
iPAddress subtrees, and a CA carrying anything else fails to parse.
Front matter loses in-progress/updating-content and gains a real description;
the -S line's 'comunication' typo goes with the regenerated block.
Verified with a full Quartz build: no errors, unparsed-wikilink count still
12. The one unresolved target is the sibling branch's new page.
Co-Authored-By: Claude <noreply@anthropic.com>
--rebuild-ipxe-with-my-ca said it adds 10-25 minutes to 'this and every future install'. The build is stamped against the pinned iPXE version, the embedded CA and the staged binary, and skipped when all three still match -- so it re-runs when one of those changes, not on every install. Rebuilt: no errors, unparsed-wikilink count still 12. Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of
FOGProject/fogproject#1120(Phase 3). Depends on #124 for the link target; pairs withFOGProject/fogproject#1199.Four options existed in the installer and appeared nowhere in these docs at all:
--install-mode,--public-web-cert,--rebuild-ipxe-with-my-caand--https-redirect. Two more,--netboot-protoand--boot-delay, were documented only on other pages. The pasted--helpblock was old enough to predate all of them.Regenerated that block from the installer itself rather than editing it by hand — which is also how the ordering bug in
usage()got found and fixed upstream of this.Three things a reader can currently only learn by being bitten
-Sno longer means what it did. Before 1.6 it decided the web protocol, the redirect and whether iPXE was recompiled. It now means only the redirect, which is what its help text always claimed.--install-modedoes not touch the redirect, despite the prompt describingstandardas "no redirect". An upgraded-Sserver keeps it whichever mode is chosen.http-onlydoes not persist.httpProtoreturns tohttpson every run, so the flag has to be passed again on each upgrade.Secure Boot section was pre-PKI
It described a key at
/opt/fog/secureboot/MOK.keythat is "never regenerated". That layout is gone: there is an enrolled CA inpki/secureboot/ca/and a rotatable signing leaf inleaf/, which is the whole point of the split and why--secureboot-ca-certexists. That flag was undocumented here too.Added
The name-constraint options, including the one an admin supplying an enterprise intermediate needs: iPXE only understands
dNSNameandiPAddresssubtrees, and a CA carrying anything else fails to parse.Front matter loses
in-progress/updating-contentand gains a real description; the-Sline's "comunication" typo goes with the regenerated block.Verified
Full Quartz build: no errors, unparsed-wikilink count still 12.