Refactor dnsmasq to build as a container. Add signed iPXE image build

serving/docker-compose.yml

@@ -37,7 +37,12 @@
 services:
   # --- DHCP + DNS ------------------------------------------------------------
   dnsmasq:
-    build: ./dnsmasq
+    # Prebuilt by CI (.gitea/workflows/dnsmasq-image.yaml) and pulled here, like
+    # the SPDK image — the serving host no longer builds it at deploy time. The
+    # image is GENERIC (no Secure Boot keys, no iPXE binary): the signed iPXE
+    # bootloader rides the separate, per-environment fleet-ipxe image mounted at
+    # /ipxe below. Local-dev alternative: replace this line with `build: ./dnsmasq`.
+    image: ${DNSMASQ_IMAGE}:${DNSMASQ_VERSION}
     network_mode: host
     cap_add:
       - NET_ADMIN          # DHCP raw sockets
@@ -48,11 +53,19 @@ services:
       # + DNS A/PTR. Auto-populated by fleet-namer (creative names per MAC); add
       # manual lines to pin specific hosts. RW so fleet-namer can append.
       - ./dnsmasq/dhcp-hosts:/etc/dnsmasq-hosts
-      # iPXE binary source (read-only) for the PXE-only chainload (firmware without
-      # UEFI HTTP boot, e.g. EliteBook 820 G4). Drop ipxe.efi here — see
-      # serving/tftp/README. The entrypoint copies it into /srv/tftp and renders
-      # boot.ipxe alongside it (the actual TFTP root is container-internal).
-      - ./tftp:/tftp-src:ro
+      # Signed iPXE bootloader for the PXE-only chainload (firmware without UEFI
+      # HTTP boot, e.g. EliteBook 820 G4). Mounted from the separate, signed,
+      # digest-pinnable fleet-ipxe image (.gitea/workflows/ipxe-image.yaml); the
+      # entrypoint copies /ipxe/snponly.efi into /srv/tftp. Kept OUT of the dnsmasq
+      # image so the daemon image stays generic/key-agnostic — see serving/tftp/README.
+      - type: image
+        source: ${IPXE_IMAGE}:${IPXE_VERSION}
+        target: /ipxe
+        image:
+          subpath: ipxe
+      # Fallback (Docker < 28 / offline / lab): drop snponly.efi in ./tftp and bind
+      # it instead (the entrypoint prefers /ipxe, then falls back to /tftp-src):
+      # - ./tftp:/tftp-src:ro
       # The release artifacts (same image volume as the http service), read-only,
       # so the entrypoint can objcopy the UKI's .cmdline section into boot.ipxe
       # (Secure Boot OFF needs the real cmdline fed to iPXE — see entrypoint.sh).
@@ -137,11 +150,11 @@ services:
       # snponly.efi = UEFI x64 iPXE that rides the FIRMWARE's NIC driver (UEFI SNP)
       # instead of iPXE's own — works on virtio VMs AND real hardware where the
       # native driver won't bind (e.g. EliteBook 820 G4 / Intel I219-LM, which
-      # fails ipxe.efi with "No configurable methods"). Ships in Ubuntu's `ipxe`
-      # package; see serving/tftp/README.md.
-      # NOTE (lab): the iPXE binary is UNSIGNED, so this path needs Secure Boot OFF.
-      # For production, sign it with the fleet db key (then SB stays enforced
-      # end-to-end) — see docs/secure-boot-keys.md.
+      # fails ipxe.efi with "No configurable methods"). Built + signed by CI into
+      # the fleet-ipxe image (mounted at /ipxe); see serving/tftp/README.md.
+      # The fleet-ipxe image is signed with the fleet db key when CI has the
+      # secrets, so this path stays Secure-Boot-enforced end-to-end; an unsigned
+      # (lab) fleet-ipxe build needs Secure Boot OFF — see docs/secure-boot-keys.md.
       - --enable-tftp
       - --tftp-root=/srv/tftp
       - --dhcp-vendorclass=set:pxe,PXEClient