infra/hosts/wob-vpn-gw/netboot.nix

{ lib, pkgs, nodes, config, modulesPath, ... }:

# The way the connection is established is specific to the wob01 site and the Intel S2600KPR blades.
# Proper netboot is not possible, because while the blades and the APU board (which is the netboot
# server here) are in the same L2 network, the uplink connection of each blade is an LACP LAG,
# meaning that the switch on the other side will only enable the port if it sees valid LACP packets.
# IPXE sends out these LACP packets while it is probing the ports, however the NICs of the blades
# do not have a flash which IPXE could be written to.
# We work around this by presenting a virtual floppy drive using the "IUSB" protocol of the BMC.
# This virtual floppy drive contains an per-blade customized IPXE script which will initialize the
# network connection including IP configuration and chainload the actual script off the netboot
# server.

let
  netboot-server-ip = "2a01:584:11::2";
in {
  networking.firewall.allowedTCPPorts = [ 80 ];

  systemd.services = lib.mapAttrs' (nodename: node: let
    ip = "2a01:584:11::1:${toString node.config.bagel.baremetal.builders.num}";
    bmcIp = "192.168.1.${toString (node.config.bagel.baremetal.builders.num * 4 + 2)}";
    gw = "2a01:584:11::1";
    dns = "2a01:580:6000::ff01";
    notipxe = node.config.system.build.notipxe.config.system.build.usbImage;
  in lib.nameValuePair "iusb-spoof-${nodename}" {
    wantedBy = [ "multi-user.target" ];
    serviceConfig = {
      Restart = "always";
    };
    script = ''
      AUTH_TOKEN=$(${pkgs.iusb-spoof}/bin/make-token ${bmcIp})
      exec ${pkgs.iusb-spoof}/bin/iusb-spoof -r ${bmcIp} 5123 $AUTH_TOKEN ${notipxe}
    '';
  }) (lib.filterAttrs (_: node: node.config.bagel.baremetal.builders.enable && node.config.bagel.baremetal.builders.netboot) nodes);
}