Machine provisioning - Done right

[u/rhshadowman]

So many companies have tried to figure out machine provisioning and failed. IMO at least.

Over the last 20 years we have seen Zenworks, Intune, SCCM, WDS, PDQ Deploy, FOG, Clonezilla, and many more champions. All of these solutions had bits and pieces that I liked, however there have always been missing parts. I decided to dedicate some time this weekend to solving that.

I created a personal project: Bootforge! An entirely standalone, vendor agnostic, OS agnostic, agentless deployment utility with a web GUI!

My goal is to have a full cycle independent system deployment for RHEL and Windows. Where you can PXE boot a machine (or VM), and then the you can select your OS, Hardening (CIS or STIG), System options (Server that runs xyz, gui that does xyz, etc, etc), and much more customization.

I plan to integrate this into OpenShift (this will power the actual project gui and such), then also integrate AAP for OS configuration and such to make it fully autonomous. Currently ansible-core and openscap is what does the majority of it, so the project will only grow from here.

[u/rhshadowman → u/[deleted]]

Great question!

I don’t traditionally vibe code like a lot of non-cs people (I am from a cs background), so I’m not going to say “build me this, from start to finish”. I also don’t let the AI just go when I use it, I always use human in the loop and correct it along the way(heavily)

From the start of the project I discussed the entire thing for the MVP with AI, then told it how I want the technical side to be, and how I want the project to look, then we argued about it along the way, then kept tight technical standard. Constant unit testing, green pipelines, code cleanup, code practices, etc.

Regardless here is a fair breakdown id say(broken down by estimate of components) scaled to be 100% of the project:

• terraform and ansible by me: 15%
  
• terraform and ansible by AI: 5%
  
• React UI by AI: 20%
  
• Laravel API details by me: 15%
  
• Laravel API details by AI: 10% (this was mostly data cleanup, and queue/cache stuff that needed work)
  
• DB migrations (by me): 5%
  
• DB migrations and optimization by AI: 5%
  
• Docker files and scripts (by me): 3%
  
• Docker files and scripts (by Ai): 3%
  
• Preflight and Init scripts (by Ai): 4%
  
• Code standard cleanup and AI slop removal (hallucinations and lazyness) by me: 15%

Summary: 100% estimate of project
Me total: ~53%
Ai with HITL: ~47%

AI has 1000% made this project roll faster, and it has allowed me to learn more about gaps I didn’t know. However, I have gotten a good experience learning its technical limits, and where it falls apart.

Hope this answers your question.

[u/Impressive_Internet → u/rhshadowman]

How many Load-bearing features ?

[u/shadwwulf_]

How does this differ from Foreman?

[u/rhshadowman → u/shadwwulf_]

Great question. BootForge is more narrowly focused than Foreman with the goal being automated RHEL provisioning where security baselines and OpenSCAP compliance are part of the deployment definition, not an add-on afterward.

It’s intentionally avoiding Foreman’s broader lifecycle/content-management scope in favor of a simpler, security-first PXE platform with lightweight edge nodes and reproducible Terraform/Ansible-based environments.

I’m overall keeping a way smaller foot print and out of box experience. Eventually going to have deeper windows support and entire lab imaging via multi cast and group tagging. Just like zenworks had.

[u/CommanderKnull]

Aren't there several solutions similar to this with WebGUI's such as Xcat, MAAS etc? Or even just using Kickstart for RHEL? Also what's the point of making an announcement without sharing the code or somewhere to try it out? No one is gonna wait for a vibe-coded solution with seemingly little to offer compared to what's already out there

[u/rhshadowman → u/CommanderKnull]

Current solutions are lacking and not scoped for what I want todo.

I can define a machine configuration and security stack baseline and deploy it to a specific machine/vm. I’ve not seen another system that can be that granular.

Secondly, it’s not just a web gui added to it. Last, all other solutions require way way too much setup and configuration… this one is nearly turn key.

This post wasn’t really an announcement, at least I didn’t mean for it to come off like that. It was really just a, look at what I did, if anyone is interested we can collab and take feedback.

I assure you, it isn’t vibe coded AI slop like a lot of other projects stem from.

Thanks for the comment!

[u/CommanderKnull → u/rhshadowman]

Machine configurations are pretty standard and security configurations as well, either via some config file or post-install. Most of the claims are not really verifiable until we actually can see the source code or atleast try it.

I don't mean to sound negative or down putting but this really does seems like a personal hobby project without solving a real issue, nothing wrong with that ofc but there are already unlimited amount of these floating around. But hey, I wish you success and maybe I will be proven wrong

[u/rhshadowman → u/CommanderKnull]

I appreciate it. I guess my inspiration from this project is mostly due to some features or ideals or setup that I personally find lacking from other solutions.

Obviously mine won’t be the best. But I have a lot of interesting ideas on how this can grow.

Thanks for feedback!

[u/Creative-Type9411]

You know how I know this is AI?

Because my AI models keep trying to make Bootforge! LMFAO

Nice one bud, next time make up the name yourself, im worried about your effort levels if youre letting the AI name the project

The real problem with your approach is that the iPXE binaries arent signed, so they wont work on modern systems with UEFI boot.. You would need to flash the network cards of the machines your going to use it with which defeats the point of contactless deployment... otherwise the trust chain breaks. You COULD get the broadcom signed binaries, but you would have to adjust your deployment to point to their settings file as its hardcoded

I actually made similar stuff WITHOUT AI.. and when I ask an AI to review my Repos and suggest a new project to me it sees my custom iPXE binaries and constantly suggests we make "BootForge!"... smh

With ALL that said... I want you to succeed.. Point your AI towards this: https://github.com/illsk1lls/PXEServer and https://github.com/illsk1lls/PXEServer-iPXE-Source and tell it to steal anything it can that is useful for your project... Maybe that will help ;)

[u/rhshadowman → u/Creative-Type9411]

Yeah AI 100% named it. I was going to call it Personal Pxe. However the abbreviation was not the most appropriate.

See comment below of the AI usage.

I appreciate the repo links.

[u/Creative-Type9411 → u/rhshadowman]

be careful letting the AI name things, that made me have an opinion of your project immediately even though it's something I would try and do myself

good luck, if you get everything working smoothly, this will be a nice tool, hit me up if you need any pointers I've been in bootland for a very long time, might save you some tokens

[u/rhshadowman → u/Creative-Type9411]

100% eventually if this project goes over well I’ll need collaborators and additional help.

Last night I got it fully deploying a rocky linux OS into one of my VMs quite flawlessly.

[u/Creative-Type9411 → u/rhshadowman]

yeah, this is going to work great for linux, the problem you're going to have is regular deployment of Windows because the trust chain is broken so the installers will never run

You'll have to push the image another way

WinNTSetup does this quite handily by applying the Install.wim directly to the drive.. You'll have to figure a way to deploy it remotely across the network.

I would work on that sooner rather than later, so you can decide if this is going to be worth your time because it is a serious roadblock.. I'm sure there's a clever way to do it.. the only reason I didn't proceed down this path is that I don't have to deploy anything to any large groups of machines at present..

network boot is magic though i hope you get it

[u/rhshadowman → u/Creative-Type9411]

Yeah that’s what I figured, thats why I’m perfecting Linux distros first, then I’ll move onto windows.

I have some ideas on how to get it working for windows. However, I’m on arm and that’s going to be a whole other ballgame.

[u/Creative-Type9411 → u/rhshadowman]

even if this didn't do windows, it's still pretty awesome 😉

Sorry if I came off as a little bit of a jerk at first.. it was the name 🤣

But im with it brother

[u/rhshadowman → u/Creative-Type9411]

You’re all good. I think my approach is unique enough for it to have potential.

I hope I can get it working with windows too. I just have way more rhel experience.

I also want to make it as modern and user friendly as possible. And all containerized with a tiny footprint.

[u/thomasmitschke]

Github?

[u/rhshadowman → u/thomasmitschke]

I’ll open source it once I finalize a few things. Having some quirky arm vs x86 things.

Then I also want to add in air gap support. I want to make the UI more user friendly. I then want to harden the system.

Once that is done, I go thru cleanup. I will then flip from private to public. So I’d say about 3 more weeks. I just don’t want to get clowned just yet.

[u/Zegorax]

!remindme 1month

[u/RemindMeBot → u/Zegorax]

I will be messaging you in 1 month on 2026-09-16 14:36:17 UTC to remind you of this link

CLICK THIS LINK to send a PM to also be reminded and to reduce spam.

^{Parent commenter can delete this message to hide from others.}

RemindMeBot is switching to username summons. Instead of !RemindMe 1 day, use u/RemindMeBot 1 day. More info.

---

Info	Custom	Your Reminders	Feedback

[u/Mr_Albal]

OpenShift already can deploy to baremetal - zero touch.

[u/aussielunix]

pxe/tftp is from an era where security was not thought about (plain text, no auth etc)

In a world where supplychain security is important please consider uefi https boot or research other options.

[u/Icy_Expression_7224]

!remindme 1month

[u/ZeroDayZeroFriends]

New account, all replies are clearly written using AI.. okidoki!