v0.3.0 — rebrand: PXEForge → OpenPXE, Gated → Queued Deployment
Full rename to match the openpxe.com brand. The product now reads as a
polished open-source project rather than a personal-tool nickname:
the anvil/forge metaphor is gone, replaced with the rainbow-horizon
brand mark from the marketing site.
## Naming changes
**PXEForge → OpenPXE** everywhere it's user-visible or developer-
facing:
- All 8 crate package names (`pxeforge-*` → `openpxe-*`).
- The bin crate dir + binary (`crates/pxeforge` → `crates/openpxe`,
`bin = "openpxe"`).
- Env vars: `PXEFORGE_*` → `OPENPXE_*` (no compat shim — pre-beta).
- Tracing targets: `pxeforge::*` → `openpxe::*`.
- Prometheus metrics: `pxeforge_*` → `openpxe_*` (pre-beta; nobody
has dashboards on these yet).
- Container image: `gitea.milesward.dev/mward4/openpxe:0.3.0`.
- All in-tree paths: `/var/lib/openpxe/{isos,work,smb}`,
`/usr/share/openpxe/ipxe`, `/etc/openpxe/...`.
- Unraid template renamed `pxeforge.xml` → `openpxe.xml`.
- README, NEXT_PHASE.md, architecture.md, comments, and the WebUI
brand string.
**Gated Deployment → Queued Deployment** as the user-facing concept:
- `Settings::TimeoutAction::GatedDeployment` →
`QueuedDeployment` (with `#[serde(alias = "gated_deployment")]`
so v0.2.0 settings.json files keep deserializing).
- Rust types: `Gate` → `QueueEntry`, `GateQueue` → `DeploymentQueue`,
`GateInner` → `QueueEntryInner`.
- File: `crates/core/src/gate.rs` → `crates/core/src/queue.rs`.
- HTTP routes: `/api/gate/*` → `/api/queue/*`. The JSON list key
flipped from `"gates"` to `"entries"` to match.
- iPXE shortcut: `/boot/_gate.ipxe` → `/boot/_queue.ipxe`. The
top-level menu's item id is now `queue` instead of `gate`.
- WebUI sidebar tab: "Forge Gate" → "Queue".
- Field on `AppState`: `gates` → `queue`.
## Brand assets
The anvil + forging-sparks logos are dropped:
- `logo.svg` is now a 24×24 medallion filled with the
`rainbow-horizon` gradient from openpxe.com (sliding hue rotation
via SMIL on the gradient stops, no JS needed).
- `anvil-forge.svg` renamed to `loader.svg` and rebuilt as a 64×64
louder version of the same disc — used for page-load transitions
and the imaging-progress widget. Adds a subtle scale pulse and a
white inner-glow so it has dimensionality on either theme.
## CSS rename
- `.forge-progress` → `.queue-progress`
- `.forge-progress .anvil` → `.queue-progress .mark`
- `@keyframes forge-sheen` → `queue-sheen`
- `.loader .anvil` → `.loader .mark`
- "Heating the forge…" loader text → "Loading…"
The rest of the layout is untouched. Light/dark theme tokens and the
sidebar/topbar structure carry over from v0.2.0 unchanged — the
brief was "keeping the UI similar."
## Validation
- `cargo build --workspace` — clean.
- `cargo clippy --workspace --all-targets` — no warnings.
- `cargo test --workspace` — **66 tests passing**, same as v0.2.0.
- Local smoke run against the rebuilt release binary verifies:
- `/boot.ipxe` emits `Queued Deployment` + `item queue` + chains
`/boot/_queue.ipxe`
- `/api/queue` returns `{count, entries}`
- `/metrics` emits `openpxe_queue_count` (renamed)
- `/assets/logo.svg` and `/assets/loader.svg` serve the new
rainbow brand SVGs
- `/api/status` reports version `0.3.0`
## Migration notes for operators on v0.2.0
- Container image path changed: pull
`gitea.milesward.dev/mward4/openpxe:0.3.0` (not `pxeforge:`).
- Bind mounts: `/var/lib/openpxe/{isos,work,smb}` (not `pxeforge`).
Move the host path or update the template.
- Env vars: replace `PXEFORGE_*` with `OPENPXE_*`. The Unraid
template at `deploy/unraid/openpxe.xml` is already updated.
- `settings.json` carries over transparently — the
`gated_deployment` value is accepted as an alias.
- HTTP API: any external scripts that hit `/api/gate/*` need to
switch to `/api/queue/*`. The JSON envelope key is `entries`
instead of `gates`.
This commit is contained in:
Miles Ward
+19
-19
@@ -1,6 +1,6 @@
|
||||
# syntax=docker/dockerfile:1.7
|
||||
#
|
||||
# PXEForge — multi-stage build.
|
||||
# OpenPXE — multi-stage build.
|
||||
#
|
||||
# Design:
|
||||
# - stage `fetch`: runs scripts/fetch-ipxe.sh to pull official iPXE binaries
|
||||
@@ -8,7 +8,7 @@
|
||||
# - stage `build`: compiles the workspace with cargo in release mode.
|
||||
# - stage `runtime`: Debian slim image with setcap for NET_BIND_SERVICE,
|
||||
# running as a non-root UID. No shell in PATH for the service user;
|
||||
# attacker surface is just the pxeforge binary + libc.
|
||||
# attacker surface is just the openpxe binary + libc.
|
||||
#
|
||||
# Why not distroless? We want setcap support and easy debug (`oc rsh`).
|
||||
# Debian slim at ~75 MB + binary ~25 MB is fine for a PXE server that
|
||||
@@ -24,7 +24,7 @@ WORKDIR /src
|
||||
COPY scripts/fetch-ipxe.sh scripts/fetch-ipxe.sh
|
||||
RUN mkdir -p assets/ipxe && bash scripts/fetch-ipxe.sh
|
||||
|
||||
########## build pxeforge ##########
|
||||
########## build openpxe ##########
|
||||
FROM rust:${RUST_VERSION}-bookworm AS build
|
||||
WORKDIR /src
|
||||
|
||||
@@ -43,9 +43,9 @@ COPY --from=fetch /src/assets/ipxe /src/assets/ipxe
|
||||
RUN --mount=type=cache,target=/usr/local/cargo/registry \
|
||||
--mount=type=cache,target=/src/target,sharing=locked \
|
||||
find crates -name '*.rs' -exec touch {} + && \
|
||||
cargo build --release --bin pxeforge && \
|
||||
cp target/release/pxeforge /pxeforge && \
|
||||
ls -l /pxeforge
|
||||
cargo build --release --bin openpxe && \
|
||||
cp target/release/openpxe /openpxe && \
|
||||
ls -l /openpxe
|
||||
|
||||
########## runtime ##########
|
||||
FROM debian:12-slim AS runtime
|
||||
@@ -54,13 +54,13 @@ RUN apt-get update \
|
||||
ca-certificates libcap2-bin tini gosu iproute2 \
|
||||
wimtools samba nfs-common \
|
||||
&& rm -rf /var/lib/apt/lists/* \
|
||||
&& useradd --system --uid 10001 --home-dir /var/lib/pxeforge --shell /usr/sbin/nologin pxeforge \
|
||||
&& mkdir -p /var/lib/pxeforge/isos /var/lib/pxeforge/work /var/lib/pxeforge/smb \
|
||||
&& chown -R pxeforge:pxeforge /var/lib/pxeforge
|
||||
&& useradd --system --uid 10001 --home-dir /var/lib/openpxe --shell /usr/sbin/nologin openpxe \
|
||||
&& mkdir -p /var/lib/openpxe/isos /var/lib/openpxe/work /var/lib/openpxe/smb \
|
||||
&& chown -R openpxe:openpxe /var/lib/openpxe
|
||||
# Runtime deps explained:
|
||||
# wimtools - provides `wimlib-imagex`, used to inject startnet.cmd into boot.wim.
|
||||
# samba - `smbd` serves extracted Windows install media on :445 for WinPE
|
||||
# to `net use`. Guest read-only, scoped to /var/lib/pxeforge/smb.
|
||||
# to `net use`. Guest read-only, scoped to /var/lib/openpxe/smb.
|
||||
# nfs-common - provides `mount.nfs` / `mount.nfs4` for the Storage tab's
|
||||
# NFS share manager. Mount also requires the container to run
|
||||
# with CAP_SYS_ADMIN — without it, mount(2) returns EPERM and
|
||||
@@ -74,23 +74,23 @@ RUN apt-get update \
|
||||
# bind-mount ownership (common OpenShift/Docker UX issue).
|
||||
# Windows-specific tools only activate when the WebUI toggle is on.
|
||||
|
||||
COPY --from=build /pxeforge /usr/local/bin/pxeforge
|
||||
COPY --from=build /openpxe /usr/local/bin/openpxe
|
||||
COPY deploy/docker/entrypoint.sh /usr/local/bin/entrypoint.sh
|
||||
RUN chmod +x /usr/local/bin/entrypoint.sh
|
||||
|
||||
# Grant the binary the ability to bind <1024 ports as a non-root user.
|
||||
# This is the only capability PXEForge needs for proxy-mode DHCP + TFTP + HTTP.
|
||||
RUN setcap cap_net_bind_service=+ep /usr/local/bin/pxeforge
|
||||
# This is the only capability OpenPXE needs for proxy-mode DHCP + TFTP + HTTP.
|
||||
RUN setcap cap_net_bind_service=+ep /usr/local/bin/openpxe
|
||||
|
||||
# IMPORTANT: we do NOT `USER pxeforge` here. The entrypoint runs as root,
|
||||
# chowns the mounted data dirs, then execs the binary via gosu as pxeforge.
|
||||
# IMPORTANT: we do NOT `USER openpxe` here. The entrypoint runs as root,
|
||||
# chowns the mounted data dirs, then execs the binary via gosu as openpxe.
|
||||
# OpenShift ignores USER directives anyway (it injects its own uid), and
|
||||
# there entrypoint.sh's non-root branch just execs directly.
|
||||
WORKDIR /var/lib/pxeforge
|
||||
WORKDIR /var/lib/openpxe
|
||||
|
||||
ENV PXEFORGE_ISO_DIR=/var/lib/pxeforge/isos \
|
||||
PXEFORGE_WORK_DIR=/var/lib/pxeforge/work \
|
||||
PXEFORGE_LOG=info,pxeforge=info
|
||||
ENV OPENPXE_ISO_DIR=/var/lib/openpxe/isos \
|
||||
OPENPXE_WORK_DIR=/var/lib/openpxe/work \
|
||||
OPENPXE_LOG=info,openpxe=info
|
||||
|
||||
EXPOSE 67/udp 69/udp 4011/udp 80/tcp 445/tcp
|
||||
|
||||
|
||||
@@ -2,9 +2,9 @@
|
||||
# Container entrypoint that handles the common bind-mount-as-root case.
|
||||
#
|
||||
# When volumes are bind-mounted into the container (e.g. `-v ./data/isos:...`),
|
||||
# they come up owned by the host uid:gid — often root:root. The pxeforge
|
||||
# they come up owned by the host uid:gid — often root:root. The openpxe
|
||||
# binary runs as uid 10001 and can't write there. This script, when started
|
||||
# as root, chowns the two state dirs to the pxeforge user, then drops
|
||||
# as root, chowns the two state dirs to the openpxe user, then drops
|
||||
# privileges via gosu before execing the binary.
|
||||
#
|
||||
# If the container is already running as non-root (OpenShift does this via
|
||||
@@ -13,20 +13,20 @@
|
||||
# or the operator is on their own for permissions.
|
||||
set -e
|
||||
|
||||
PXEFORGE_UID=${PXEFORGE_UID:-10001}
|
||||
PXEFORGE_GID=${PXEFORGE_GID:-10001}
|
||||
DATA_DIRS="/var/lib/pxeforge/isos /var/lib/pxeforge/work /var/lib/pxeforge/smb"
|
||||
OPENPXE_UID=${OPENPXE_UID:-10001}
|
||||
OPENPXE_GID=${OPENPXE_GID:-10001}
|
||||
DATA_DIRS="/var/lib/openpxe/isos /var/lib/openpxe/work /var/lib/openpxe/smb"
|
||||
|
||||
if [ "$(id -u)" = "0" ]; then
|
||||
for d in $DATA_DIRS; do
|
||||
if [ -d "$d" ]; then
|
||||
chown -R "${PXEFORGE_UID}:${PXEFORGE_GID}" "$d" 2>/dev/null || true
|
||||
chown -R "${OPENPXE_UID}:${OPENPXE_GID}" "$d" 2>/dev/null || true
|
||||
fi
|
||||
done
|
||||
# Re-exec ourselves under the pxeforge user so the binary inherits a
|
||||
# Re-exec ourselves under the openpxe user so the binary inherits a
|
||||
# clean process environment and a predictable umask.
|
||||
exec gosu "${PXEFORGE_UID}:${PXEFORGE_GID}" /usr/local/bin/pxeforge "$@"
|
||||
exec gosu "${OPENPXE_UID}:${OPENPXE_GID}" /usr/local/bin/openpxe "$@"
|
||||
fi
|
||||
|
||||
# Non-root: straight exec, no chown attempt.
|
||||
exec /usr/local/bin/pxeforge "$@"
|
||||
exec /usr/local/bin/openpxe "$@"
|
||||
|
||||
Reference in New Issue
Block a user