# TODO — diskless fleet boot system

Persistent backlog, kept in sync with the working session task tracker. Status:
`[ ]` pending · `[~]` in progress · `[x]` done.

---

## [ ] 1. Port the dracut module off `network-legacy` → `network-manager`

Durable replacement for the current `dhcp-client` stopgap. `dhclient` is
deprecated in RHEL 9 and will eventually leave the repos; the build only works
today because the provisioner installs `dhcp-client` so `network-legacy` passes
dracut's `check()`.

- Rewrite both network bring-up paths in
  [../files/dracut/95dot1x-macsec/dot1x-macsec-up.sh](../files/dracut/95dot1x-macsec/dot1x-macsec-up.sh):
  the secure path's `ifup macsec0` and the `rd.dot1x=0` bypass path's
  `ifup $NIC` — use `nmcli`/NetworkManager-in-initramfs (or `ip=` cmdline + the
  nm module) instead.
- Change `depends()` `network-legacy` → `network-manager` in
  [../files/dracut/95dot1x-macsec/module-setup.sh](../files/dracut/95dot1x-macsec/module-setup.sh).
- Update `add_dracutmodules` in
  [../files/etc/dracut.conf.d/90-diskless.conf](../files/etc/dracut.conf.d/90-diskless.conf).
- Drop `dhcp-client` from the provisioner `dnf install` in
  [../diskless.pkr.hcl](../diskless.pkr.hcl).
- Re-verify the `lsinitrd` assertion.
- **Gate:** full boot-chain smoke test (swtpm + hostapd + FreeRADIUS) before
  merge, per CLAUDE.md.

## [ ] 2. Apply RHEL9 STIG hardening to the built image

OpenSCAP + SCAP Security Guide (`xccdf_org.ssgproject.content_profile_stig`), run
as a Packer provisioner after `dnf install` and before the dracut/initramfs build
and cleanup.

- **Tailoring** (`autotailor`): unselect rules this architecture can't satisfy —
  separate-partition rules (single erofs root + tmpfs overlay; satisfy intent
  with `nodev,nosuid,noexec` tmpfs mounts), GRUB/kernel-cmdline rules (no GRUB),
  and AIDE/file-integrity rules (dm-verity is the documented compensating
  control).
- **Kernel params → UKI cmdline** in
  [../scripts/extract-artifacts.sh](../scripts/extract-artifacts.sh) before
  signing: `audit=1 audit_backlog_limit=8192 slub_debug=P page_poison=1
  vsyscall=none` (+ `fips=1` if FIPS).
- **Reproducibility guard:** strip non-deterministic remediation output (SSH host
  keys → regen at boot into overlay, AIDE db, timestamps, fresh UUIDs) so the
  verity hash stays stable.
- **Audit logging:** `audisp-remote`/rsyslog to a central collector addressed by
  DNS name (host-generic).
- **Optional FIPS:** `fips=1` cmdline + `01fips` dracut module + FIPS crypto
  policy.
- **CI:** run `oscap eval` (no `--remediate`) to publish an ARF+HTML STIG report
  as a build artifact; optionally hard-fail below a score threshold.
- **Decisions needed before implementing:** FIPS on/off · remote-audit collector
  DNS name (or ephemeral/none for lab) · CI fail-on-score threshold vs
  report-only.
- Note: orthogonal to the `rd.dot1x=0` test toggle, but a full STIG production
  posture wants 802.1X re-enabled.

## [ ] 3. Roll the errata into design doc v3

Once the boot path is validated and item 1 lands, fold
[design-v2-errata.md](design-v2-errata.md) into the source design document and
re-export a **v3** PDF (key change: `rootovl` → `systemd.volatile=overlay` in §3
step 8 and §5). Retire/reset the errata afterward. Needs the design-doc source
(not in this repo).