Initial commit: full Phases 1-6 implementation

Post-repair hardware validation pipeline for Proxmox cluster hosts.
Go orchestrator + in-image agent + mkosi live image + bundled dnsmasq
PXE + SQLite + HTMX/SSE UI + notify registry + janitor + full docs.

internal/pxe/ipxe.go

@@ -0,0 +1,88 @@
+package pxe
+
+import (
+	"fmt"
+	"io"
+	"strings"
+
+	"vetting/internal/model"
+)
+
+// IPXEParams is everything an iPXE boot script needs.
+// For Phase 2 the boot target is always "linux" — Memtest chain-load
+// is not required because we replaced Memtest86+ with stress-ng under
+// Linux (see plan §3.2).
+type IPXEParams struct {
+	OrchestratorURL string // e.g. http://10.0.0.5:8080
+	LiveKernelURL   string // e.g. http://10.0.0.5:8080/live/vmlinuz
+	LiveInitrdURL   string // e.g. http://10.0.0.5:8080/live/initrd.img
+	TLSCertFPR      string // optional; empty = skip pin
+	RunID           int64
+	MAC             string
+	Token           string // plaintext, hashed on server side
+}
+
+// BuildScript returns an iPXE script tailored for this run.
+// iPXE scripts are plain text beginning with "#!ipxe".
+func BuildScript(p IPXEParams) string {
+	cmdline := []string{
+		"initrd=initrd.img",
+		fmt.Sprintf("vetting.orchestrator=%s", p.OrchestratorURL),
+		fmt.Sprintf("vetting.run_id=%d", p.RunID),
+		fmt.Sprintf("vetting.mac=%s", p.MAC),
+		fmt.Sprintf("vetting.token=%s", p.Token),
+	}
+	if p.TLSCertFPR != "" {
+		cmdline = append(cmdline, fmt.Sprintf("vetting.cert_fpr=%s", p.TLSCertFPR))
+	}
+	// Reduce kernel log noise during the test run; keep loglevel high enough
+	// for boot failures to still show up on the console.
+	cmdline = append(cmdline,
+		"console=tty0",
+		"console=ttyS0,115200n8",
+		"ip=dhcp",
+		"quiet",
+	)
+
+	var b strings.Builder
+	fmt.Fprintln(&b, "#!ipxe")
+	fmt.Fprintf(&b, "echo Vetting run %d — booting live image for %s\n", p.RunID, p.MAC)
+	fmt.Fprintf(&b, "kernel %s %s\n", p.LiveKernelURL, strings.Join(cmdline, " "))
+	fmt.Fprintf(&b, "initrd %s\n", p.LiveInitrdURL)
+	fmt.Fprintln(&b, "boot")
+	return b.String()
+}
+
+// NotRegisteredScript is served for unknown MACs. The MAC allowlist
+// at the dnsmasq level should prevent this from ever being reachable,
+// but it exists as belt-and-braces.
+func NotRegisteredScript(mac string) string {
+	return fmt.Sprintf("#!ipxe\necho MAC %s not registered for vetting — halting.\nshell\n", mac)
+}
+
+// NoActiveRunScript is served when a registered MAC PXE-boots but has
+// no currently active run. The host is told to shut down rather than
+// loop forever.
+func NoActiveRunScript(mac string) string {
+	return fmt.Sprintf("#!ipxe\necho MAC %s has no active run — powering off in 10s.\nsleep 10\npoweroff\n", mac)
+}
+
+// Used by handlers to compose URLs; exposed for tests.
+func BuildLiveURLs(base string) (kernel, initrd string) {
+	base = strings.TrimRight(base, "/")
+	return base + "/live/vmlinuz", base + "/live/initrd.img"
+}
+
+// WriteNotFound is a small convenience so handlers can return a shell
+// script error directly to iPXE without cluttering handlers with a
+// mime-type dance.
+func WriteNotFound(w io.Writer, mac string) {
+	_, _ = w.Write([]byte(NotRegisteredScript(mac)))
+}
+
+// ScriptMarker is used by iPXE to detect that the response is a script.
+const ScriptMarker = "#!ipxe"
+
+// State returns the compact single-word status used for logging.
+// Takes a Run's state because iPXE handler already looked it up.
+func State(run model.Run) string { return string(run.State) }