PXE-FABRIC 0C: site UEFI ARM64 DHCP/ProxyDHCP edge + reachability

dag/extdeps/firmware/ipxe.dag

@@ -0,0 +1,36 @@
+module extdeps.firmware.ipxe
+
+import std.types { NonEmptyStr }
+import extdeps.uri { Uri, Https }
+import extdeps.external_authority { ExternalAuthority }
+
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https
+    locator: "ipxe.org/docs"
+  }
+}
+
+data ipxe_chainloading_authority: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https
+    locator: "ipxe.org/howto/chainloading"
+  }
+}
+
+// iPXE's own build grammar: `make <platform>/<image>` from src/, e.g. bin-arm64-efi/snponly.efi.
+// snponly.efi drives the NIC through the firmware's SNP protocol instead of a native iPXE driver,
+// which is the image the chainloading how-to names for UEFI.
+type IpxeBuildTarget {
+  platform: NonEmptyStr
+  image: NonEmptyStr
+}
+
+data ipxe_arm64_efi_snponly: IpxeBuildTarget = IpxeBuildTarget {
+  platform: "bin-arm64-efi",
+  image: "snponly.efi",
+}
+
+fn ipxe_build_target_path(target: IpxeBuildTarget) -> NonEmptyStr {
+  join([target.platform as String, "/", target.image as String], "") as NonEmptyStr
+}

dag/extdeps/formats/dnsmasq.dag

@@ -17,13 +17,17 @@ data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
   }
 }
 
+// A TAGGED dhcp-boot CARRIES AT LEAST ONE TAG BY CONSTRUCTION (first_tag): an untagged dhcp-boot
+// applies to every client on the segment, so an empty tag list would silently invert a restricted
+// boot line into a permissive one.
 type DnsmasqDirective =
     DnsmasqComment { text: String }
   | DnsmasqPort { value: Int }
   | DnsmasqDhcpRangeProxy { network_address: String }
   | DnsmasqDhcpMatchSet { tag: String, option: String, value: String }
   | DnsmasqDhcpOptionForceTag { tag: String, option: String, value: String }
-  | DnsmasqDhcpBootTag { tag: String, target: String }
+  | DnsmasqDhcpHostSetTag { mac: String, tag: String }
+  | DnsmasqDhcpBootTags { first_tag: String, more_tags: List<String>, target: String, server_name: String, server_address: String }
 
 data dnsmasq_protocol: LayoutProtocol = LayoutProtocol { indent_unit: "" }
 
@@ -36,8 +40,14 @@ fn dnsmasq_directive_line(d: DnsmasqDirective) -> String {
       concat(concat(concat("dhcp-match=set:", tag), concat(",", option)), concat(",", value))
     DnsmasqDhcpOptionForceTag { tag: tag, option: option, value: value } =>
       concat(concat(concat("dhcp-option-force=tag:", tag), concat(",", option)), concat(",", value))
-    DnsmasqDhcpBootTag { tag: tag, target: target } =>
-      concat(concat("dhcp-boot=tag:", tag), concat(",", target))
+    DnsmasqDhcpHostSetTag { mac: mac, tag: tag } =>
+      concat(concat("dhcp-host=", mac), concat(",set:", tag))
+    DnsmasqDhcpBootTags { first_tag: first, more_tags: more, target: target, server_name: name, server_address: address } =>
+      join([
+        "dhcp-boot=tag:", first, ",",
+        fold(more, init: "", f: (acc, t) => concat(acc, concat(concat("tag:", t), ","))),
+        target, ",", name, ",", address,
+      ], "")
   }
 }
 

dag/gunbc/census_closure_frontier.dag

@@ -49,6 +49,7 @@ import gunbc.cloudflare.r2_token_mint { cloudflare_r2_token_mint_frontier_rows }
 import extdeps.cloudflare.account_api_tokens { cloudflare_account_api_tokens_frontier_rows }
 import extdeps.cloudflare.r2 { cloudflare_r2_frontier_rows }
 import gunbc.network_boot_delivery { network_boot_delivery_frontier_rows }
+import gunbc.site_uefi_arm64_pxe_edge { site_uefi_arm64_pxe_edge_frontier_rows }
 import product.supplier.cloudflare_r2 { cloudflare_r2_supplier_frontier_rows }
 import extdeps.backblaze.b2 { backblaze_b2_frontier_rows }
 import extdeps.cloud.gcp.storage { gcs_storage_frontier_rows }
@@ -112,6 +113,7 @@ fn census_closure_frontier_row_groups() -> List<List<FrontierRow>> {
     cloudflare_account_api_tokens_frontier_rows,
     cloudflare_r2_frontier_rows,
     network_boot_delivery_frontier_rows,
+    site_uefi_arm64_pxe_edge_frontier_rows,
     cloudflare_r2_supplier_frontier_rows,
     backblaze_b2_frontier_rows,
     gcs_storage_frontier_rows,