fix: Only connections from localhost are allowed

This is a breaking change as the return type of cluster.nodes has
changed, resulting in old templates potentially no longer working.

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "ipxe/ipxe"]
+	path = ipxe/ipxe
+	url = git@github.com:rkubes/ipxe

Cargo.lock

@@ -2,6 +2,15 @@
 # It is not intended for manual editing.
 version = 4
 
+[[package]]
+name = "aho-corasick"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c982642fa9e8606056828ee9a8505737230110bb1099153c79efe865c59d12ba"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "anstream"
 version = "1.0.0"
@@ -160,6 +169,12 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "build-print"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8e6738dfb11354886f890621b4a34c0b177f75538023f7100b608ab9adbd66b"
+
 [[package]]
 name = "bumpalo"
 version = "3.20.3"
@@ -295,10 +310,12 @@ dependencies = [
  "clap_complete",
  "futures",
  "gix-discover",
+ "ipxe",
  "minijinja",
  "netascii",
  "num_enum",
  "optional_struct",
+ "regex",
  "reqwest",
  "schemars",
  "semver",
@@ -1035,6 +1052,25 @@ dependencies = [
  "icu_properties",
 ]
 
+[[package]]
+name = "include_dir"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "923d117408f1e49d914f1a379a309cffe4f18c05cf4e3d12e613a15fc81bd0dd"
+dependencies = [
+ "include_dir_macros",
+]
+
+[[package]]
+name = "include_dir_macros"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cab85a7ed0bd5f0e76d93846e0147172bed2e2d3f859bcc33a8d9699cad1a75"
+dependencies = [
+ "proc-macro2",
+ "quote",
+]
+
 [[package]]
 name = "indexmap"
 version = "2.14.0"
@@ -1051,6 +1087,14 @@ version = "2.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6a756c3fac73139e83f14c2d742155dd2b78d3ee56597b419a0579b7bdd6dd78"
 
+[[package]]
+name = "ipxe"
+version = "0.1.0"
+dependencies = [
+ "build-print",
+ "include_dir",
+]
+
 [[package]]
 name = "is_terminal_polyfill"
 version = "1.70.2"
@@ -1511,11 +1555,34 @@ dependencies = [
  "syn 3.0.4",
 ]
 
+[[package]]
+name = "regex"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f020237b6c8eed93db2e2cb53c00c60a8e1bc73da7d073199a1180401450218d"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
 [[package]]
 name = "regex-automata"
 version = "0.4.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
 
 [[package]]
 name = "repo_path"
@@ -1554,9 +1621,7 @@ checksum = "219c5811de6525e5416c7d5d53bb656d3afdbc6c5af816e0802bcfa42dbdc1c3"
 dependencies = [
  "base64",
  "bytes",
- "futures-channel",
  "futures-core",
- "futures-util",
  "http",
  "http-body",
  "http-body-util",
@@ -1572,14 +1637,12 @@ dependencies = [
  "sync_wrapper",
  "tokio",
  "tokio-native-tls",
- "tokio-util",
  "tower",
  "tower-http",
  "tower-service",
  "url",
  "wasm-bindgen",
  "wasm-bindgen-futures",
- "wasm-streams",
  "web-sys",
 ]
 
@@ -1976,19 +2039,6 @@ dependencies = [
  "tokio",
 ]
 
-[[package]]
-name = "tokio-util"
-version = "0.7.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "494815d09bf52b5548659851081238f0ca39ff638363907596da739561c62c52"
-dependencies = [
- "bytes",
- "futures-core",
- "futures-sink",
- "pin-project-lite",
- "tokio",
-]
-
 [[package]]
 name = "toml_datetime"
 version = "1.1.1+spec-1.1.0"
@@ -2232,19 +2282,6 @@ dependencies = [
  "unicode-ident",
 ]
 
-[[package]]
-name = "wasm-streams"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d1ec4f6517c9e11ae630e200b2b65d193279042e28edd4a2cda233e46670bbb"
-dependencies = [
- "futures-util",
- "js-sys",
- "wasm-bindgen",
- "wasm-bindgen-futures",
- "web-sys",
-]
-
 [[package]]
 name = "web-sys"
 version = "0.3.104"

Cargo.toml

@@ -7,7 +7,7 @@ publish = ["infra"]
 license = "GPL-3.0-or-later"
 
 [workspace]
-members = ["xtask"]
+members = ["ipxe", "xtask"]
 
 [workspace.dependencies]
 schemars = { version = "1.2.1", features = ["semver1"] }
@@ -24,9 +24,8 @@ minijinja = { version = "2.18.0", features = ["json", "loader"] }
 netascii = "0.1.0"
 num_enum = "0.7.6"
 optional_struct = "0.5.2"
+regex = "1.13.1"
 reqwest = { version = "0.13.2", default-features = false, features = [
-  "blocking",
-  "stream",
   "native-tls",
 ] }
 schemars = { workspace = true }
@@ -36,6 +35,7 @@ serde_json = { workspace = true }
 serde_yaml = "0.9.34"
 thiserror = "2.0.18"
 tokio = { version = "1.52.1", features = ["full"] }
+ipxe = { path = "./ipxe" }
 
 [lib]
 test = false

ipxe/Cargo.toml

@@ -0,0 +1,10 @@
+[package]
+name = "ipxe"
+version = "0.1.0"
+edition = "2024"
+
+[build-dependencies]
+build-print = "1.0.1"
+
+[dependencies]
+include_dir = "0.7.4"

ipxe/build.rs

@@ -0,0 +1,57 @@
+use std::env;
+use std::path::PathBuf;
+use std::process::{Command, Stdio};
+
+use build_print::error;
+
+fn main() {
+    let manifest_dir = PathBuf::from(env::var("CARGO_MANIFEST_DIR").unwrap())
+        .canonicalize()
+        .unwrap();
+    let src_dir = manifest_dir.join("ipxe").join("src");
+
+    let mut command = Command::new("make");
+    command
+        .stdout(Stdio::piped())
+        .current_dir(&src_dir)
+        .env_remove("DEBUG")
+        .env_remove("PROFILE")
+        .args([
+            "-j",
+            &std::thread::available_parallelism()
+                .unwrap()
+                .get()
+                .to_string(),
+        ])
+        .arg(format!(
+            "EMBED={}",
+            manifest_dir
+                .join("src")
+                .join("embed.ipxe")
+                .to_string_lossy(),
+        ));
+
+    let files = ["bin/ipxe.pxe", "bin-x86_64-efi/ipxe.efi"].map(PathBuf::from);
+    for file in &files {
+        command.arg(file);
+    }
+
+    let output = command.output().unwrap();
+    if !output.status.success() {
+        error!("{}", String::from_utf8_lossy(&output.stderr));
+    }
+
+    let out_dir = PathBuf::from(env::var("OUT_DIR").unwrap())
+        .canonicalize()
+        .unwrap()
+        .join("ipxe");
+
+    std::fs::remove_dir_all(&out_dir).ok();
+    for file in &files {
+        let input = src_dir.join(file);
+        let output = out_dir.join(file.file_name().unwrap());
+
+        std::fs::create_dir_all(output.parent().unwrap()).unwrap();
+        std::fs::copy(input, output).unwrap();
+    }
+}

ipxe/src/embed.ipxe

@@ -0,0 +1,5 @@
+#!ipxe
+
+dhcp
+
+echo "Hello, World!"

ipxe/src/lib.rs

@@ -0,0 +1,3 @@
+use include_dir::{Dir, include_dir};
+
+pub static IPXE_DIR: Dir<'_> = include_dir!("$OUT_DIR/ipxe");

src/cli.rs

@@ -49,4 +49,6 @@ pub enum Commands {
     Generate,
     /// Generate completions for your current shell
     ShellCompletions,
+    /// Serve config files over tftp
+    Serve,
 }

src/cluster.rs

@@ -1,10 +1,10 @@
+use std::collections::HashMap;
 use std::net::Ipv4Addr;
 use std::path::PathBuf;
 use std::str::FromStr;
 
 use async_walkdir::WalkDir;
 use futures::StreamExt;
-use futures::future::join_all;
 use futures::stream::FuturesUnordered;
 use minijinja::Environment;
 use optional_struct::{Applicable, optional_struct};
@@ -77,7 +77,7 @@ struct ClusterDeserialize {
 pub struct Cluster {
     pub(crate) name: String,
     pub(crate) version: Version,
-    nodes: Vec<Node>,
+    nodes: HashMap<String, Node>,
     cluster_env: ClusterEnv,
     pub(crate) control_plane_ip: Ipv4Addr,
     pub(crate) secrets_file: PathBuf,
@@ -122,22 +122,23 @@ impl Cluster {
         let cluster = Self {
             name: cluster_name.into(),
             version: cluster.version,
-            nodes: vec![],
+            nodes: Default::default(),
             cluster_env: cluster.cluster_env,
             control_plane_ip: cluster.control_plane_ip,
             secrets_file,
         };
 
-        let nodes = nodes
-            .iter()
-            .map(|name| async { Node::get(name, env, &cluster, &default, &base).await });
+        let nodes = nodes.iter().map(|name| async {
+            let node = Node::get(name, env, &cluster, &default, &base).await;
+            (node.hostname().to_owned(), node)
+        });
 
         let nodes = FuturesUnordered::from_iter(nodes).collect().await;
 
         Self { nodes, ..cluster }
     }
 
-    pub async fn get_all() -> Vec<Cluster> {
+    pub async fn get_all() -> HashMap<String, Cluster> {
         let env = PathEnvironment::new_patches();
 
         let names: Vec<_> = WalkDir::new(get_talos_path().join("clusters"))
@@ -162,17 +163,26 @@ impl Cluster {
             .await;
 
         // Get the clusters concurrently
-        join_all(names.iter().map(|name| {
+        FuturesUnordered::from_iter(names.iter().map(|name| {
             let env = env.clone();
             let name = name.clone();
 
-            async move { Cluster::get(&name, &env).await }
+            async move {
+                let cluster = Cluster::get(&name, &env).await;
+
+                (name, cluster)
+            }
         }))
+        .collect()
         .await
     }
 
-    pub fn nodes(&self) -> &[Node] {
-        &self.nodes
+    pub fn nodes(&self) -> impl Iterator<Item = &Node> {
+        self.nodes.values()
+    }
+
+    pub fn node(&self, node: &str) -> Option<&Node> {
+        self.nodes.get(node)
     }
 
     pub async fn talosconfig(&self) -> String {

src/lib.rs

@@ -1,4 +1,4 @@
-#![feature(path_absolute_method)]
+#![feature(path_absolute_method, never_type)]
 use std::path::{Path, PathBuf};
 use std::sync::OnceLock;
 

src/main.rs

@@ -7,10 +7,13 @@ use clap_complete::{Shell, generate as generate_complete};
 use crete::cluster::Cluster;
 use crete::environment::PathEnvironment;
 use crete::talosconfig::{get_current_context, set_context};
-use crete::{get_configs_path, get_repo_path, set_repo_path};
+use crete::tftp::ServerError;
+use crete::{get_configs_path, get_repo_path, set_repo_path, tftp};
 use futures::StreamExt;
 use futures::future::join_all;
+use ipxe::IPXE_DIR;
 use minijinja::context;
+use regex::Regex;
 use thiserror::Error;
 
 use crate::cli::{Cli, Commands, GlobalOpts};
@@ -19,11 +22,11 @@ use crate::cli::{Cli, Commands, GlobalOpts};
 enum Error {
     #[error("No clusters where found")]
     NoClustersFound,
+    #[error("Server error: {0}")]
+    ServerError(#[from] ServerError),
 }
 
 async fn generate(opts: &GlobalOpts) -> Result<(), Error> {
-    set_repo_path(&opts.repo);
-
     let clusters = Cluster::get_all().await;
 
     if clusters.is_empty() {
@@ -44,7 +47,7 @@ async fn generate(opts: &GlobalOpts) -> Result<(), Error> {
 
         let content = template
             .render(context! {
-                clusters,
+                clusters => clusters.values().collect::<Vec<_>>(),
                 root => opts.repo
             })
             .unwrap();
@@ -62,8 +65,8 @@ async fn generate(opts: &GlobalOpts) -> Result<(), Error> {
     tokio::fs::create_dir_all(&path).await.unwrap();
 
     // Generate config files
-    join_all(clusters.iter().map(|cluster| async move {
-        join_all(cluster.nodes().iter().map(|node| {
+    join_all(clusters.values().map(|cluster| async move {
+        join_all(cluster.nodes().map(|node| {
             let cluster = cluster.clone();
             async move {
                 node.config_write(&cluster).await;
@@ -79,7 +82,7 @@ async fn generate(opts: &GlobalOpts) -> Result<(), Error> {
 
     // Merge all the cluster talosconfig files into a single file
     // Since this all modifies the same output file this has to happen sequentially
-    for cluster in clusters {
+    for (_, cluster) in clusters {
         cluster.talosconfig_merge().await;
     }
 
@@ -94,6 +97,8 @@ async fn generate(opts: &GlobalOpts) -> Result<(), Error> {
 async fn main() -> Result<(), Error> {
     let cli = Cli::parse();
 
+    set_repo_path(&cli.global_opts.repo);
+
     match cli.command {
         Commands::Generate => generate(&cli.global_opts).await?,
         Commands::ShellCompletions => generate_complete(
@@ -102,6 +107,37 @@ async fn main() -> Result<(), Error> {
             "crete",
             &mut std::io::stdout(),
         ),
+        Commands::Serve => {
+            let re = Regex::new(r"talos/(?<cluster>.+)/(?<node>.+)\.ya?ml")
+                .expect("regex should be valid");
+
+            tftp::serve(move |filename| {
+                let filename = filename.to_owned();
+                let re = re.clone();
+
+                async move {
+                    const IPXE_PATTERN: &str = "ipxe/";
+                    if let Some(filename) = filename.strip_prefix(IPXE_PATTERN) {
+                        Some(IPXE_DIR.get_file(filename)?.contents().to_owned())
+                    } else if let Some(caps) = re.captures(&filename) {
+                        let cluster = &caps["cluster"];
+                        let node = &caps["node"];
+
+                        let clusters = Cluster::get_all().await;
+                        let cluster = clusters.get(cluster)?;
+
+                        let node = cluster.node(node)?;
+
+                        let config = node.config(cluster).await;
+
+                        Some(config.into())
+                    } else {
+                        None
+                    }
+                }
+            })
+            .await?
+        }
     };
 
     Ok(())

src/node.rs

@@ -178,6 +178,10 @@ impl Node {
         Node { patches, ..node }
     }
 
+    pub fn hostname(&self) -> &str {
+        &self.hostname
+    }
+
     pub async fn config(&self, cluster: &Cluster) -> String {
         let mut command = Command::new("talosctl");
         command.args([

src/tftp/server.rs

@@ -37,7 +37,7 @@ where
     F: Fn(&str) -> Fut,
     Fut: Future<Output = Option<Vec<u8>>>,
 {
-    let socket = UdpSocket::bind("127.0.0.1:0").await?;
+    let socket = UdpSocket::bind("0.0.0.0:0").await?;
     println!(
         "{src}: Connecting from {}",
         socket.local_addr().expect("Socket is bound")
@@ -145,12 +145,12 @@ where
     Ok(())
 }
 
-pub async fn serve<F, Fut>(callback: F) -> Result<(), Error>
+pub async fn serve<F, Fut>(callback: F) -> Result<!, Error>
 where
     F: Fn(&str) -> Fut + Clone + Send + 'static,
     Fut: Future<Output = Option<Vec<u8>>> + Send + 'static,
 {
-    let socket = UdpSocket::bind("127.0.0.1:69").await?;
+    let socket = UdpSocket::bind("0.0.0.0:69").await?;
 
     println!("Server started");
     loop {