rescriptum

An HTTP server that compiles and renders the configuration files for automated OS installs.

English · Français · 📖 Documentation · Quick start · Development

---

Provision a fleet without writing a file per machine - one config, and only the differences. It answers any unattended installer: Proxmox, Debian, RHEL, Ubuntu, Flatcar, SUSE, Windows. It recognises the machine from its MAC address, serial number or hardware inventory, stacks the layers that apply to it, and returns the result. Whatever a machine is about to receive, you can read it before you power the machine on.

Installers ask in one of two shapes, and rescriptum answers both, on any path:

• They POST what they found. Proxmox VE, since 8.2, sends a JSON inventory — NICs and their MAC addresses, disks, DMI — and expects the answer file in the response body.
• They GET with their identity in the query string. Kickstart, preseed, Ubuntu autoinstall, Ignition, AutoYaST: iPXE substitutes the MAC or the serial into the URL before fetching it.

$ RESCRIPTUM_ANSWERS_DIR=/srv/answers rescriptum
2026-08-24T08:43:36Z - rescriptum 0.1.0 listening on 0.0.0.0:8000 — store=files:/srv/answers workers=8 max_conn=2048 timeout=10s
2026-08-24T08:43:37Z 10.0.0.42:51234 POST /answer body=1876 200 format=toml machine=98fa9b50d810 group=rack-a bytes=431

• Any installer that fetches its config. Proxmox answer.toml, Ubuntu autoinstall, kickstart, preseed, Ignition, AutoYaST, Windows unattend.xml, iPXE scripts. The extension is the format, the URL decides which may answer, and the structured ones really merge.
• One small static binary. No runtime, no interpreter, no container — as happy on a 512 MB ARM NAS as on a datacenter host absorbing a provisioning burst.
• Configuration is files. A directory of documents — greppable, diffable, in git if you like. Or SQLite, when tooling manages it rather than a person.
• Configuration composes. A rack shares one group file; a machine that differs carries only its difference.
• Built to be leaned on. Async, bounded concurrency, timeouts on every stage, and answers you can validate before they are served.

Thirty seconds

$ mkdir -p answers/groups/rack-a
$ cat > answers/groups/rack-a/proxmox.toml <<'TOML'
members = ["98:fa:9b:50:d8:10", "98:fa:9b:50:d8:11"]

[global]
keyboard = "fr"
timezone = "Europe/Paris"

[disk-setup]
filesystem = "zfs"
zfs.raid   = "raid1"
TOML

$ RESCRIPTUM_ANSWERS_DIR=answers rescriptum render 98:fa:9b:50:d8:10
# format=toml group=rack-a
[global]
keyboard = "fr"
timezone = "Europe/Paris"
…

That is one rack as Proxmox. The same directory holds groups/rack-a/rhel.ks for the RHEL nodes and groups/rack-a/debian.preseed for the Debian ones — same directory, different extension. A document is keyed by (machine, format), so one machine can be several operating systems at once and the URL picks between them.

Then point whatever you are installing at its own URL — one server answers them all:

Installing	Point it at	Serves
Proxmox VE	--url http://SERVER:8000/proxmox/answer	.toml
RHEL · CentOS · Fedora · Alma · Rocky	inst.ks=http://SERVER:8000/rhel/ks?mac=${net0/mac}	.ks
Debian	url=http://SERVER:8000/debian/preseed?mac=${net0/mac}	.preseed
Ubuntu	ds=nocloud-net;s=http://SERVER:8000/ubuntu/?mac=${net0/mac}	.yaml
Flatcar · Fedora CoreOS	ignition.config.url=http://SERVER:8000/flatcar/config	.ign
openSUSE · SLES	autoyast=http://SERVER:8000/suse/profile	.autoyast
Windows	your own tooling, from http://SERVER:8000/windows/unattend	.unattend
anything line-oriented	http://SERVER:8000/cfg/…, /ipxe/…	.cfg, .ipxe

→ Full quick start · preparing installer media

What it does

Each of these is a link into the documentation — go deep only where you are curious.

• Picks the right answer — by directory name, by a group's member list, or by a [match] block claiming a machine for what it is. Deterministic: naming beats matching, more criteria beats fewer, ties break on sorted name.
• One document per operating system — 98fa9b50d810/proxmox.toml is that machine as Proxmox, 98fa9b50d810/debian.preseed the same hardware as Debian. Both exist at once; the URL chooses.
• Answers that compose — group chains via extends, machine documents on top. Maps merge, arrays replace, the machine always wins.
• Templating — fqdn = "node-{{ serial }}.example.com", filled from the request. Substitution happens on parsed values, so the format's own serializer does the escaping.
• Validation — render prints what a machine would receive, check renders everything and calls the installer's own validator where one is on PATH.
• A SQLite store and an admin API — for a fleet administered by tooling. Its own listener, and a write that rolls itself back rather than leaving the answer set broken.
• Request capture — record what machines actually send, replay it offline with render --body.
• Small enough for a NAS — builds for ARMv7, aarch64 and x86_64 — static musl, except ARMv7, which targets DSM's own glibc because musl 1.2 cannot run on Synology's 3.10 kernels — plus a DSM 7 package that creates the shared folder, registers the port with the firewall, starts at boot, and puts a desktop application on DSM for the configuration, the status and the log. Everywhere else it is a systemd unit or a container.

Install

Download a binary from the releases page — armv7, aarch64 and x86_64 Linux (musl, static), plus macOS — check its SHA-256, and run it. There is nothing to install.

On a Synology, take the .spk instead and use Package Center → Manual Install.

$ RESCRIPTUM_ANSWERS_DIR=/srv/answers ./rescriptum
$ curl http://localhost:8000/health
OK

→ Install guide · Configuration reference

Repository layout

• src/ — the crate. main.rs is a thin binary over lib.rs.
• examples/ — a commented, working example of every supported format.
• docs/ — this documentation, in English and French, rendered and published by notabene.
• tests/ — the real binary over a socket and on its command line, plus the conformance suite that runs every behaviour against both stores.

Contributing

cargo test                                                    # 308 tests
cargo clippy --all-targets --all-features -- -D warnings
RESCRIPTUM_ANSWERS_DIR=examples cargo run -- check

CONTRIBUTING.md has the branching model and the conventions; the Development space is the honest architecture document — the constraints, the internals, and a list of traps so nobody hits them twice.

Licence

MIT