ESX boot server

Generate a Linux netboot server for the ESX 9 installer: one installer script for the web server, PXE or UEFI HTTP boot and DHCP, a kickstart per host, a verify script, a status page and a day-2 host manager.

ESX 9Runs in your browser

Open the tool

When to use it

You need to install ESX 9 on several hosts before there is a vCenter, and you don't want to mount an ISO on each one.
You want every host to come up with its own static management IP, FQDN, DNS, NTP and a certificate that matches its name, ready to commission in VCF.
You are building a lab or a dark-site deployment and need a boot server that runs from files you can move to an isolated network.

UEFI only. The tool doesn't offer legacy BIOS netboot. Its hint gives the reason: VMware deprecated BIOS boot in vSphere 8, and PXE-booting ESX that way needs SYSLINUX 3.86.

How it works

You describe the boot server (FQDN, IP, provisioning NIC, boot subnet, web and TFTP roots), the ESX image, the Linux family and web server, the boot method, DHCP, TLS, the hosts and the kickstart settings. The files update as you type, in seven tabs:

Installer — setup-esx-boot-server.sh, a one-shot root script in seven stages: packages, directory layout, copy the installer from the ISO, patch boot.cfg, per-host boot configs by MAC, SELinux and firewall, then service configs and start.
Web config — only the nginx or Apache site, to drop in by hand.
PXE / DHCP — the dnsmasq config, an ISC dhcpd snippet or the bare option values, and what goes into boot.cfg.
Kickstarts — one ks-<hostname>.cfg per host. Pick the host from the Host list above the file.
Verify — verify-boot-server.sh, which walks the chain on the server (services, ports, a real fetch of mboot.efi, each host's boot.cfg and kickstart) and exits non-zero on any failure.
Status page — the index.html the installer writes to the web root, with live checks and a host table.
Guide — a Markdown guide for your settings: folder layout, how to boot the hosts, Secure Boot, the air-gapped path and troubleshooting.

The key file is boot.cfg. The installer sets its prefix= to the version folder, strips the leading slash from the kernel and module paths, and rewrites kernelopt to runweasel ks=<url>, which makes the install unattended. With Per-host configs by MAC on, each host gets its own 01-<mac> folder with its own boot.cfg pointing at its own kickstart.

Each kickstart sets a static IP on vmnic0, then in %firstboot follows the order VCF needs: hostname, DNS servers and search domain, NTP through esxcli system ntp set, then a new certificate once the FQDN is set, and SSH enabled. The installer also adds esx-bootctl to arm and disarm hosts, and esx-boot-manager, a small service behind /api/ that the status page uses to add and re-generate hosts.

Every field is held to a strict character set, because it ends up in a root shell script or a config file. A field outside it blocks all output until you fix it.

Step by step

Describe the boot serverFill in Server FQDN, Server IP and Boot subnet. Provisioning NIC is only a default: when you run the script on a terminal it lists the real interfaces, asks which to bind dnsmasq to, and offers to use that interface's address if it differs from the server IP.
Point at the ESX imageSet Version folder to match the ISO build; it names the installer folder and the boot.cfg prefix. Set Installer ISO path to where the ISO will sit on the server; the script loop-mounts it and copies its contents.
Pick the platform and boot methodChoose OS family and Web server. PXE, UEFI over TFTP has the widest firmware support. UEFI HTTP boot loads mboot.efi over HTTP and adds two options: UEFI HTTPS boot and IPv6 HTTP boot (experimental).
Choose DHCPdnsmasq proxyDHCP works beside your existing DHCP server and only hands out the boot path. dnsmasq full DHCP is authoritative and works across routers with an IP helper; it needs Pool start, Pool end and Gateway. ISC dhcpd snippet and I'll configure DHCP myself give you the options to add elsewhere.
Pick a certificateHTTP only, no TLS, Self-signed certificate, Let's Encrypt or Your own certificate. On an isolated VLAN use self-signed; Let's Encrypt needs public DNS and stops the install if certbot fails.
List the hostsOne row per host: hostname, PXE NIC MAC and management IP. Use Add host, Import JSON, or From bootstrap tool to pull the host list the ESX host bootstrap tool saved in this browser. Importing keeps MACs you already entered.
Fill in the kickstart settingsManagement domain, DNS 1, NTP 1, Management gateway, Prefix length, and Management VLAN if the management network is tagged. Type a Root password; it is hashed in the browser.
Clear the warningsRed notes are settings that would produce a broken kickstart or config. Yellow notes are things to confirm.
DeployDownload deploy bundle gives one script with the installer and every kickstart. Copy it and the ISO to the server and run it as root. Then run the Verify script and open http://<server>/.
Boot the hosts, then disarm themNetwork-boot each host once. When its install completes, run esx-bootctl disarm <host>, or esx-bootctl disarm all when the cluster is up, so a host that boots from the network again doesn't reinstall.

Worked example

Three hosts with two NTP servers

Start from the defaults: domain vcf.lab.local, prefix length 24, hosts esx01, esx02 and esx03. Set NTP 1 to 10.0.0.10 and NTP 2 to ntp2.lab, DNS 1 to 10.0.0.10, Management gateway to 172.31.140.1, and the management IPs to 172.31.140.21, .22 and .23.

The kickstart for esx01 then contains this network line:

network --bootproto=static --device=vmnic0 --ip=172.31.140.21 --netmask=255.255.255.0 --gateway=172.31.140.1 --nameserver=10.0.0.10 --hostname=esx01.vcf.lab.local --addvmportgroup=0

and sets NTP through esxcli in %firstboot, not by editing /etc/ntp.conf:

esxcli system ntp set --server=10.0.0.10 --server=ntp2.lab --enabled=true

Clear both DNS fields and the --nameserver option disappears from the line; the tool doesn't put the gateway in its place. A yellow note says VCF needs forward and reverse DNS for every host.

Now break the settings on purpose: empty the gateway, set the prefix length to 40, clear both DNS fields, set the VLAN to 5000 and clear esx01's IP. The tool shows four red notes (no valid management gateway, prefix length must be 1–32, esx01 has no management IP so its kickstart says SET-HOST-IP, management VLAN must be 1–4094) and the yellow “No DNS server” note.

What it doesn't do

Run anything. It writes scripts and configs. Nothing is installed until you run the installer on your server, and it can't see your network, DHCP servers or firmware.
Legacy BIOS boot. UEFI only.
Flexible host layouts. Every kickstart installs to the first local disk, overwriting VMFS there, and puts the management IP on vmnic0 with one gateway, prefix length and VLAN for all hosts. Edit the kickstart by hand if a host differs.
Check DNS. It builds each FQDN from the hostname and the management domain; it can't tell whether forward and reverse records exist.
Route proxyDHCP. proxyDHCP needs the same layer-2 segment as the hosts. Across routers you need full DHCP with an IP helper.
Trust your certificate in firmware. With UEFI HTTPS boot and an internal or self-signed CA, you enroll the certificate in each host's firmware yourself. The installer writes it to /trust/ with instructions.

Common mistakes

The reinstall loop. A host left on network-boot-first will boot its config again after installing and wipe itself. Disarm each host when its install completes, and prefer a one-time boot override to a permanent boot order. Unknown MACs get no boot file, so they fall through to local disk.
Full DHCP next to an existing DHCP server. Full DHCP is authoritative; run it only on a dedicated provisioning subnet or VLAN.
One shared boot.cfg for several hosts. With Per-host configs by MAC off, one boot.cfg serves one kickstart, so static-IP kickstarts collide.
A version folder that doesn't match the ISO. Modules then fail to load. The prefix= must point at the installer folder.
Let's Encrypt on an isolated VLAN. certbot can't complete and the install stops. Use a self-signed certificate.
No root password. The kickstarts then ship a CHANGEME placeholder.

Questions

Where does my root password go?

It is hashed in the browser with SHA-512 crypt and only the hash goes into the kickstarts. The hash is kept in this browser with your settings; Copy share link leaves it out.

What does the host manager do?

esx-boot-manager runs as a systemd service on 127.0.0.1:8081, proxied at /api/. From the status page you can add a host, which writes its boot config and kickstart and arms it, or re-generate configs. It needs the token the installer prints, stored in /var/lib/esx-boot/token.

How does the status page know a host finished?

It reads the web server's access log. A host moves through bootloader, boot config, modules and kickstart as it fetches each file, and the kickstart's last step requests /done/<host>. That URL returns 404 on purpose; the log entry is the signal.