Plug in ethernet, power on, and the machine boots straight from the network. It gets discovered by its MAC, an operator assigns it a role, and it installs itself unattended — each step gated a little more tightly than the last. Here's the whole chain, and exactly what is trusted where.
Each hop hands off to the next. The early hops carry nothing secret; trust tightens as the machine proves who it is.
On power-on the machine's PXE firmware broadcasts a DHCP request. The bootstrap container answers in proxy DHCP mode — it runs alongside whatever real DHCP server already hands out IP addresses and never assigns one itself. It only says: here is a boot filename, and here is the TFTP server to get it from — and it says so only to MACs on its BOOTSTRAP_ALLOWED_MACS list. Every other PXE request on the LAN goes unanswered.
The firmware pulls an iPXE binary over TFTP. The container picks the right one from the PXE client-architecture option — undionly.kpxe for BIOS x86, ipxe.efi for UEFI x86-64, ipxe-arm64.efi for UEFI ARM64. These are our reproducible iPXE builds (pinned TLS roots, an embedded "chain to whatever DHCP names" script) with no secret baked in; nothing secret rides this hop, which is why TFTP having no transport security is acceptable here.
iPXE runs its own second DHCP round (user-class iPXE) and is handed a short, non-secret bootstrap.ipxe over TFTP. That script chains to the bootstrap container's boot proxy on the LAN with the machine's architecture and MAC. The proxy checks the client is inside BOOTSTRAP_CLIENT_CIDR and the MAC is allowlisted, then fetches /boot.ipxe from the Worker over HTTPS with Authorization: Bearer <BOOTSTRAP_TOKEN> — a long-lived secret held only by the container and the Worker. The device never sees it. The bearer proves the request crossed the managed bootstrap; it is not the machine's identity, and the MAC stays a selector, not proof.
If the request carries the bootstrap bearer and the machine's MAC is already assigned a role, the Worker serves the role script — an unattended install, or the diskless RAM boot for RAM roles — carrying a short-lived, one-use nonce (with an escape hatch: press ESC to force the menu). Otherwise it renders the boot menu — a list of operating systems plus Discovery, the ephemeral RAM node that registers the machine. The menu is public: a downloaded ISO, a USB stick, UEFI HTTP boot, or a direct chain to the Worker all reach it, and none of them can select a role — without the bearer an assigned MAC gets the menu, and no nonce is minted.
Discovery is a small Alpine image that boots entirely into RAM, reads the hardware inventory, and posts it with the MAC. The first machine to claim a MAC is minted a per-machine token — returned exactly once, and only its SHA-256 hash is stored. Any later claim on that MAC must present the token; one that doesn't is rejected and logged as a spoof attempt. The machine lands in the registry as discovered.
From the fleet dashboard, an operator picks a role (what to name it, what packages to fold in). This is the one human decision in the loop, gated by the dashboard bearer token. The machine moves to assigned.
The assigned machine reboots into the install script, which carries a single-use, one-hour nonce in the preseed URL — the installer can't send an auth header, so the nonce is the gate. Fetching the preseed consumes the nonce, rotates the machine's token (the fresh one is delivered exactly once, baked into the installed OS), and advances it to installing. The preseed installs the operator's SSH key and locks the root password, so the key is the only way in.
On first boot the installed OS checks in with its rotated token and the machine flips to active. From here it authenticates with a token the registration flow never saw, and state only ever moves forward — a replayed check-in can't walk it backward.
The system splits along a clean seam: a small container that lives on the boot network and knows nothing about your fleet, and a stateless Worker at the edge that holds all the identity, state, and logic.
A dnsmasq proxy-DHCP + TFTP server plus a small boot proxy. It answers PXE requests alongside your existing DHCP — only for allowlisted MACs — hands out iPXE binaries, and relays each machine's boot request to the Worker with a server-side bearer. It holds no fleet state: just the allowlist and the bearer.
A Hono app on Cloudflare Workers. It generates the boot menus and install scripts, serves binaries, and is the source of truth for machine identity and provisioning state.
bootstrap.ipxe → local boot proxy → HTTPS + bearer to ipxe.cloudcompute.com ← everything past here is the Worker
Every machine walks the same one-way path. It can skip ahead — a freshly discovered box can jump straight to installing — but it can never regress, so a spoofed or replayed check-in cannot walk an active machine back to discovered.
Roles can only be assigned from discovered or pending — never mid-install.
PXE is unauthenticated by design — the firmware has no credentials, and the earliest hops carry nothing worth stealing. Authentication is layered in exactly as soon as something secret is at stake, and each credential is used for one job.
| Hop | Authenticated? | What guards it |
|---|---|---|
| DHCP + TFTP | none | Inherent to PXE. Only a public iPXE binary and a non-secret bootstrap script cross here — no secret to protect. Offers go only to allowlisted MACs. |
| iPXE → boot proxy | LAN allowlist | Plain HTTP on the PXE LAN, gated by source CIDR and the MAC allowlist. The LAN is a trust boundary: an on-path host could observe or race the one-use nonce in the returned script, so keep the proxy on a boot VLAN or trusted LAN and the CIDR narrow. |
| boot proxy → Worker | bootstrap bearer | HTTPS to ipxe.cloudcompute.com with a long-lived bearer shared only by the container and the Worker (a Worker secret), constant-time compared. The menu is public; the role/install branch and its nonce exist only behind the bearer. Missing or wrong bearer fails closed to the menu. A MAC remains a selector, never proof. |
| register | TOFU token | First claim on a MAC mints a token (hash stored, plaintext returned once). Later claims must present it; failures are logged as spoofs. Rate-limited per IP. |
| assign | dashboard token | Operator bearer token (a Worker secret), constant-time compared, fails closed if unset. |
| preseed fetch | one-time nonce | Single-use, 1-hour nonce in the URL — the installer can't send headers. Consumed atomically; the assigned→installing transition is a second gate so a leftover nonce can't re-rotate the token. |
| token rotation | delivered once | At preseed time the token is rotated and baked into the installed OS. The registration token is retired; the machine authenticates with the new one thereafter. |
| check-in | rotated token | Per-machine rotated token, constant-time compared. Forward-only state transitions blunt replay. |
Live lifecycle board, boot feed, and health. Needs the dashboard token.