Update dracut scripts, iPXE template, and GRUB config templates

- Update dracut scripts, iPXE template, and GRUB config templates to
  use new route paths and TLS-aware logic
- Minor troubleshooting doc cleanup

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Jonathon Anderson <janderson@ciq.com>

dracut/modules.d/90wwinit/load-wwinit.sh

@@ -2,9 +2,29 @@
 
 [ -z "${wwinit_root_device}" ] && return 0
 
+# Resolve the server base URL and hardware address from kernel parameters.
+# Supports two formats:
+#   New: wwinit.server=http://host:port  (uses wwid kernel param for hwaddr)
+#   Legacy: wwinit.uri=http://host:port/provision/hwaddr  (extracts hwaddr from path)
+# wwinit.server takes precedence over wwinit.uri when both are present.
+resolve_base() {
+    local val="${wwinit_server:-${wwinit_uri}}"
+    if echo "${val}" | grep -q '/provision/'; then
+        # Legacy: http://host:port/provision/hwaddr
+        ww_base="${val%%/provision/*}"
+        ww_hwaddr="${val##*/provision/}"
+    else
+        # New: http://host:port
+        ww_base="${val}"
+        ww_hwaddr="$(getarg wwid)"
+    fi
+}
+
+resolve_base
+
 get_stage() {
     stage="${1}"
-    uri="${2:-${wwinit_uri}}"
+    base="${2:-${ww_base}}"
     cacert="${3}"
     info "warewulf: loading stage: ${stage}"
     # Load runtime overlay from a static privledged port.
@@ -17,12 +37,17 @@ get_stage() {
     if [ -n "${cacert}" ]; then
         cacert_opt="--cacert ${cacert}"
     fi
+    local hwaddr="${ww_hwaddr}"
+    case "${stage}" in
+        image)   uri="${base}/image/${hwaddr}" ;;
+        system)  uri="${base}/system/${hwaddr}" ;;
+        runtime) uri="${base}/runtime/${hwaddr}" ;;
+    esac
     (
         curl --location --silent --get ${localport} ${cacert_opt} \
             --retry 60 --retry-connrefused --retry-delay 1 \
             --data-urlencode "assetkey=${wwinit_assetkey}" \
             --data-urlencode "uuid=${wwinit_uuid}" \
-            --data-urlencode "stage=${stage}" \
             --data-urlencode "compress=gz" \
             "${uri}" \
         | gzip -d \
@@ -58,11 +83,10 @@ done
 . /tmp/wwinit/warewulf/config
 cert_file="/tmp/wwinit/warewulf/tls/warewulf.crt"
 if [ "${WWTLS}" = "true" ] && [ -f "$cert_file" ]; then
-    # TLS enabled: build HTTPS URI using wwid from kernel cmdline
+    # TLS enabled: build HTTPS base URL using server address from kernel cmdline
     # (mirrors wwclient URL construction in internal/app/wwclient/root.go)
-    wwid=$(getarg wwid)
-    runtime_uri="https://${WWIPADDR}:${WWTLSPORT}/provision/${wwid}"
-    get_stage "runtime" "${runtime_uri}" "${cert_file}" || warn "warewulf: unable to load runtime overlay over HTTPS (ignored)"
+    tls_base="https://${WWIPADDR}:${WWTLSPORT}"
+    get_stage "runtime" "${tls_base}" "${cert_file}" || warn "warewulf: unable to load runtime overlay over HTTPS (ignored)"
 else
     # No TLS: fetch runtime over HTTP
     get_stage "runtime" || warn "warewulf: unable to load runtime overlay (ignored)"