Document the install modes and every undocumented installer flag

[darksidemilk]

Part of FOGProject/fogproject#1120 (Phase 3). Depends on #124 for the link target; pairs with FOGProject/fogproject#1199.

Four options existed in the installer and appeared nowhere in these docs at all: --install-mode, --public-web-cert, --rebuild-ipxe-with-my-ca and --https-redirect. Two more, --netboot-proto and --boot-delay, were documented only on other pages. The pasted --help block was old enough to predate all of them.

Regenerated that block from the installer itself rather than editing it by hand — which is also how the ordering bug in usage() got found and fixed upstream of this.

Three things a reader can currently only learn by being bitten

• -S no longer means what it did. Before 1.6 it decided the web protocol, the redirect and whether iPXE was recompiled. It now means only the redirect, which is what its help text always claimed.
• --install-mode does not touch the redirect, despite the prompt describing standard as "no redirect". An upgraded -S server keeps it whichever mode is chosen.
• http-only does not persist. httpProto returns to https on every run, so the flag has to be passed again on each upgrade.

Secure Boot section was pre-PKI

It described a key at /opt/fog/secureboot/MOK.key that is "never regenerated". That layout is gone: there is an enrolled CA in pki/secureboot/ca/ and a rotatable signing leaf in leaf/, which is the whole point of the split and why --secureboot-ca-cert exists. That flag was undocumented here too.

Added

The name-constraint options, including the one an admin supplying an enterprise intermediate needs: iPXE only understands dNSName and iPAddress subtrees, and a CA carrying anything else fails to parse.

Front matter loses in-progress/updating-content and gains a real description; the -S line's "comunication" typo goes with the regenerated block.

Verified

Full Quartz build: no errors, unparsed-wikilink count still 12.

[darksidemilk]

Superseded — closing. The content is carried forward on claude/fogsettings-key-rename-docs-b1i2vg, in the regenerated docs/installation/server/command-line-options.md.

This PR was most of the way there — it is where --install-mode, --netboot-proto, --public-web-cert and --rebuild-ipxe-with-my-ca first got documented, and the four-mode table, the -S-no-longer-means-that note and the FOG_WEB_HOST warning all came across essentially intact. Two things kept it from being mergeable as-is.

It documents two flags that no longer exist. --no-ca-trust and --no-sb-name-constraints were both removed in working-1.6 along with the settings behind them, so this PR's option block, its ### --no-ca-trust and the local trust store section, and its certificate-options and name-constraints tables all describe flags that now fail as unrecognized. Both were opt-outs that put the safe answer behind a flag nobody passes until something has already broken — --no-ca-trust left a server unable to verify its own certificate, and --no-sb-name-constraints guarded the one certificate UEFI and shim actually parse. Constraints are off the Secure Boot zone entirely now; they stay on the Web CA, where iPXE is a verifier FOG can patch and firmware is not.

The key names are the pre-rename spellings. The install-mode table's columns are httpProto / netbootProto / publicWebCert / rebuildIpxeWithMyCA; shipped they are WEB_url_proto / BOOT_url_proto / PKI_web_cert_publicly_trusted / BOOT_rebuild_ipxe_with_my_ca.

One change in approach. The full option list is now rendered from the shipped installer's own --help rather than transcribed by hand. That is what surfaced both retired flags, and it also picked up help text this PR predates — -C implying --recreate-keys, -K's warning that every registered fog-client must be re-pinned, the reworded -F, and --no-secure-boot now declining enrolment rather than signing (binaries are still signed; a signature is inert with Secure Boot off). The page says the two flags were removed, rather than leaving readers to find out by passing them.

---

Generated by Claude Code