Serve PXE k3s credentials on pxe_web_port (8080) to avoid Traefik port 80 clash

[KerwinTsaiii]

Summary

The pxe_controller role served the k3s token/kubeconfig over Apache on host port 80. When the PXE controller is co-located on a k3s node (e.g. the single-machine 3-node mini-cluster example), that collides with k3s Traefik / ServiceLB, which binds host ports 80/443 for cluster ingress.

This moves the credential endpoint to a dedicated, configurable port (pxe_web_port, default 8080):

• Add templates/apache-ports.conf.j2 (Listen {{ pxe_web_port }}) and a dedicated templates/pxe-http-vhost.conf.j2.
• Disable the default Apache site (000-default) to free host port 80, enable the PXE vhost, and flush the Apache handler.
• Point the agent k3s-auto-join.sh token/kubeconfig URLs, plus the role's verification task and summary, at pxe_web_port.
• Expose pxe_web_port in role defaults and the PXE playbook vars.

The /k3s/ endpoint is internal-only (reached by PXE agents on the node subnet), so the port is arbitrary and 80/443 are left entirely to Traefik. Set pxe_web_port: 80 to restore the old behaviour on a dedicated service machine.

Notes

• Docs for the 3-node example are updated to :8080 in the docs-multi-node-pxe-example branch PR (docs: fix multi-AIPC deployment guide gaps and align k3s endpoint port #122).

Test plan

• Run pb-pxe-controller.yml; confirm apache2 is active and curl -I http://127.0.0.1:8080/k3s/ returns 403
• Confirm host port 80 is free for k3s Traefik on the co-located node
• Netboot an agent and confirm it fetches the token from :8080 and joins the cluster

Made with Cursor