From 01eef7d88d78f51fed9314436bfecb3cb4341f17 Mon Sep 17 00:00:00 2001
From: Jonathon Anderson <janderson@ciq.com>
Date: Tue, 17 Feb 2026 21:30:11 -0700
Subject: [PATCH] Restore dracut's ability to download the runtime overlay

Signed-off-by: Jonathon Anderson <janderson@ciq.com>
---
 dracut/modules.d/90wwinit/load-wwinit.sh  | 33 ++++++++++++++++++-----
 overlays/wwinit/internal/wwinit_test.go   |  5 ++++
 overlays/wwinit/rootfs/warewulf/config.ww |  3 +++
 3 files changed, 35 insertions(+), 6 deletions(-)

diff --git a/dracut/modules.d/90wwinit/load-wwinit.sh b/dracut/modules.d/90wwinit/load-wwinit.sh
index e15d1ef2..a40ef978 100644
--- a/dracut/modules.d/90wwinit/load-wwinit.sh
+++ b/dracut/modules.d/90wwinit/load-wwinit.sh
@@ -4,6 +4,8 @@
 
 get_stage() {
     stage="${1}"
+    uri="${2:-${wwinit_uri}}"
+    cacert="${3}"
     info "warewulf: loading stage: ${stage}"
     # Load runtime overlay from a static privledged port.
     # Others use default settings.
@@ -11,24 +13,28 @@ get_stage() {
     if [ "${stage}" = "runtime" ]; then
         localport="--local-port 1-1023"
     fi
+    cacert_opt=""
+    if [ -n "${cacert}" ]; then
+        cacert_opt="--cacert ${cacert}"
+    fi
     (
-        curl --location --silent --get ${localport} \
+        curl --location --silent --get ${localport} ${cacert_opt} \
             --retry 60 --retry-connrefused --retry-delay 1 \
             --data-urlencode "assetkey=${wwinit_assetkey}" \
             --data-urlencode "uuid=${wwinit_uuid}" \
             --data-urlencode "stage=${stage}" \
             --data-urlencode "compress=gz" \
-            "${wwinit_uri}" \
+            "${uri}" \
         | gzip -d \
         | cpio -ium --directory="${NEWROOT}"
-    ) || die "Unable to load stage: ${stage}"
+    )
 }
 
 mkdir /tmp/wwinit
 (
     # fetch the system overlay into /tmp/wwinit
     local NEWROOT=/tmp/wwinit
-    get_stage "system"
+    get_stage "system" || die "Unable to load stage: system"
 )
 if [ -x /tmp/wwinit/warewulf/run-wwinit.d ]; then
         PREFIX=/tmp/wwinit /tmp/wwinit/warewulf/run-wwinit.d
@@ -43,10 +49,25 @@ info "warewulf: mounting ${wwinit_root_device} at ${NEWROOT}"
     fi
 ) || die "warewulf: failed to mount ${wwinit_root_device} at ${NEWROOT}"
 
-for stage in "image" "system" ; do
-    get_stage "${stage}"
+for stage in "image" "system"; do
+    get_stage "${stage}" || die "Unable to load stage: ${stage}"
 done
 
+# Fetch runtime overlay (non-fatal)
+# Source config from system overlay for TLS settings
+. /tmp/wwinit/warewulf/config
+cert_file="/tmp/wwinit/warewulf/tls/warewulf.crt"
+if [ "${WWTLS}" = "true" ] && [ -f "$cert_file" ]; then
+    # TLS enabled: build HTTPS URI using wwid from kernel cmdline
+    # (mirrors wwclient URL construction in internal/app/wwclient/root.go)
+    wwid=$(getarg wwid)
+    runtime_uri="https://${WWIPADDR}:${WWSECUREPORT}/provision/${wwid}"
+    get_stage "runtime" "${runtime_uri}" "${cert_file}" || warn "warewulf: unable to load runtime overlay over HTTPS (ignored)"
+else
+    # No TLS: fetch runtime over HTTP
+    get_stage "runtime" || warn "warewulf: unable to load runtime overlay (ignored)"
+fi
+
 # Copy /warewulf/run from initramfs to NEWROOT
 # This preserves state files created by wwinit.d scripts (e.g., ignition marker)
 if [ -d /tmp/wwinit/warewulf/run ]; then
diff --git a/overlays/wwinit/internal/wwinit_test.go b/overlays/wwinit/internal/wwinit_test.go
index 708fe255..368ed72b 100644
--- a/overlays/wwinit/internal/wwinit_test.go
+++ b/overlays/wwinit/internal/wwinit_test.go
@@ -15,6 +15,8 @@ func Test_wwinitOverlay(t *testing.T) {
 	defer env.RemoveAll()
 	env.ImportFile("etc/warewulf/warewulf.conf", "warewulf.conf")
 	env.ImportFile("etc/warewulf/nodes.conf", "nodes.conf")
+	env.Configure() // Reload configuration to pick up the changes to warewulf.conf and nodes.conf
+
 	env.ImportFile("var/lib/warewulf/overlays/wwinit/rootfs/etc/warewulf/warewulf.conf.ww", "../rootfs/etc/warewulf/warewulf.conf.ww")
 	env.ImportFile("var/lib/warewulf/overlays/wwinit/rootfs/warewulf/config.ww", "../rootfs/warewulf/config.ww")
 	env.ImportFile("var/lib/warewulf/overlays/wwinit/rootfs/warewulf/init.d/50-ipmi.ww", "../rootfs/warewulf/init.d/50-ipmi.ww")
@@ -100,6 +102,9 @@ WWIPMI_GATEWAY="192.168.4.1"
 WWIPMI_USER="user"
 WWIPMI_PASSWORD="password"
 WWIPMI_WRITE="true"
+WWTLS=false
+WWSECUREPORT=9874
+WWIPADDR=192.168.0.1
 `
 
 const wwinit_50_ipmi string = `backupFile: true
diff --git a/overlays/wwinit/rootfs/warewulf/config.ww b/overlays/wwinit/rootfs/warewulf/config.ww
index ae9600f6..36e19fca 100644
--- a/overlays/wwinit/rootfs/warewulf/config.ww
+++ b/overlays/wwinit/rootfs/warewulf/config.ww
@@ -11,3 +11,6 @@ WWIPMI_WRITE="{{$.Ipmi.Write.Bool}}"
 {{- if $.Ipmi.Tags.vlan }}
 WWIPMI_VLAN="{{$.Ipmi.Tags.vlan}}"
 {{- end }}
+WWTLS={{$.Warewulf.EnableTLS}}
+WWSECUREPORT={{$.Warewulf.SecurePort}}
+WWIPADDR={{$.Ipaddr}}