Restore dracut's ability to download the runtime overlay

Signed-off-by: Jonathon Anderson <janderson@ciq.com>

dracut/modules.d/90wwinit/load-wwinit.sh

@@ -4,6 +4,8 @@
 
 get_stage() {
     stage="${1}"
+    uri="${2:-${wwinit_uri}}"
+    cacert="${3}"
     info "warewulf: loading stage: ${stage}"
     # Load runtime overlay from a static privledged port.
     # Others use default settings.
@@ -11,24 +13,28 @@ get_stage() {
     if [ "${stage}" = "runtime" ]; then
         localport="--local-port 1-1023"
     fi
+    cacert_opt=""
+    if [ -n "${cacert}" ]; then
+        cacert_opt="--cacert ${cacert}"
+    fi
     (
-        curl --location --silent --get ${localport} \
+        curl --location --silent --get ${localport} ${cacert_opt} \
             --retry 60 --retry-connrefused --retry-delay 1 \
             --data-urlencode "assetkey=${wwinit_assetkey}" \
             --data-urlencode "uuid=${wwinit_uuid}" \
             --data-urlencode "stage=${stage}" \
             --data-urlencode "compress=gz" \
-            "${wwinit_uri}" \
+            "${uri}" \
         | gzip -d \
         | cpio -ium --directory="${NEWROOT}"
-    ) || die "Unable to load stage: ${stage}"
+    )
 }
 
 mkdir /tmp/wwinit
 (
     # fetch the system overlay into /tmp/wwinit
     local NEWROOT=/tmp/wwinit
-    get_stage "system"
+    get_stage "system" || die "Unable to load stage: system"
 )
 if [ -x /tmp/wwinit/warewulf/run-wwinit.d ]; then
         PREFIX=/tmp/wwinit /tmp/wwinit/warewulf/run-wwinit.d
@@ -43,10 +49,25 @@ info "warewulf: mounting ${wwinit_root_device} at ${NEWROOT}"
     fi
 ) || die "warewulf: failed to mount ${wwinit_root_device} at ${NEWROOT}"
 
-for stage in "image" "system" ; do
-    get_stage "${stage}"
+for stage in "image" "system"; do
+    get_stage "${stage}" || die "Unable to load stage: ${stage}"
 done
 
+# Fetch runtime overlay (non-fatal)
+# Source config from system overlay for TLS settings
+. /tmp/wwinit/warewulf/config
+cert_file="/tmp/wwinit/warewulf/tls/warewulf.crt"
+if [ "${WWTLS}" = "true" ] && [ -f "$cert_file" ]; then
+    # TLS enabled: build HTTPS URI using wwid from kernel cmdline
+    # (mirrors wwclient URL construction in internal/app/wwclient/root.go)
+    wwid=$(getarg wwid)
+    runtime_uri="https://${WWIPADDR}:${WWSECUREPORT}/provision/${wwid}"
+    get_stage "runtime" "${runtime_uri}" "${cert_file}" || warn "warewulf: unable to load runtime overlay over HTTPS (ignored)"
+else
+    # No TLS: fetch runtime over HTTP
+    get_stage "runtime" || warn "warewulf: unable to load runtime overlay (ignored)"
+fi
+
 # Copy /warewulf/run from initramfs to NEWROOT
 # This preserves state files created by wwinit.d scripts (e.g., ignition marker)
 if [ -d /tmp/wwinit/warewulf/run ]; then