feat!: move modern boot endpoints from /boot/v1/* to /*

[synackd]

Description

Fixes #15

Formerly, the boot-service exposed /boot/v1/* endpoints (e.g. /boot/v1/bootscript) whether or not enable_legacy_api was enabled. This change moves these endpoints to the root (/). To discourage legacy API usage, /boot/v1/* endpoints are only exposed when enable_legacy_api is true (it is false by default). The regular, "modern" endpoints are exposed no matter the setting.

In short, the boot-service now exposes a "modern" api at / and only exposes /boot/v1/* only when enable_legacy_api is true.

BREAKING CHANGE: /boot/v1/* disabled unless enable_legacy_api is true (false by default)

Checklist

• My code follows the style guidelines of this project
• I have added/updated comments where needed
• I have added tests that prove my fix is effective or my feature works
• I have run make test (or equivalent) locally and all tests pass
• DCO Sign-off: All commits are signed off (git commit -s) with my real name and email
• REUSE Compliance:
  • Each new/modified source file has SPDX copyright and license headers
  • Any non-commentable files include a <filename>.license sidecar
  • All referenced licenses are present in the LICENSES/ directory

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update

---

For more info, see Contributing Guidelines.

[davidallendj]

Looks good. I ran this locally and this is what I'm seeing when it's enabled (ignore the /boot/v1 call):

[rocky@openchami-testing boot-service]$ go run ./cmd/server serve --enable-auth=false --enable-legacy-api=true
2026/07/15 20:44:00 Starting boot service with configuration:
2026/07/15 20:44:00   Server: 0.0.0.0:8080
2026/07/15 20:44:00   Storage: file (./data)
2026/07/15 20:44:00   Features: auth=false, hsm=false, metrics=false, legacy-api=true
2026/07/15 20:44:00 Legacy BSS API enabled at: /boot/v1/*
2026/07/15 20:44:00 Note: Both modern and legacy endpoints are available for BSS compatibility
2026/07/15 20:44:00 Server starting on 0.0.0.0:8080
2026/07/15 20:44:00 Modern API available at: /nodes, /bootconfigurations
2026/07/15 20:44:04 [openchami-testing.novalocal/FFFj7b2lRf-000001] "GET http://0.0.0.0:8080/boot/v1 HTTP/1.1" from 127.0.0.1:51612 - 404 19B in 61.466µs
2026/07/15 20:44:14 [openchami-testing.novalocal/FFFj7b2lRf-000002] "GET http://0.0.0.0:8080/boot/v1/bootscript HTTP/1.1" from 127.0.0.1:35834 - 400 147B in 306.075µs

This is what I see disabled:

[rocky@openchami-testing boot-service]$ go run ./cmd/server serve --enable-auth=false --enable-legacy-api=false
2026/07/15 20:44:24 Starting boot service with configuration:
2026/07/15 20:44:24   Server: 0.0.0.0:8080
2026/07/15 20:44:24   Storage: file (./data)
2026/07/15 20:44:24   Features: auth=false, hsm=false, metrics=false, legacy-api=false
2026/07/15 20:44:24 Legacy BSS API disabled (set enable_legacy_api to true to enable /boot/v1/* endpoints)
2026/07/15 20:44:24 Server starting on 0.0.0.0:8080
2026/07/15 20:44:24 Modern API available at: /nodes, /bootconfigurations
2026/07/15 20:44:27 [openchami-testing.novalocal/GPJ1noL5ee-000001] "GET http://0.0.0.0:8080/boot/v1 HTTP/1.1" from 127.0.0.1:46036 - 404 19B in 84.248µs
2026/07/15 20:44:30 [openchami-testing.novalocal/GPJ1noL5ee-000002] "GET http://0.0.0.0:8080/boot/v1/bootscript HTTP/1.1" from 127.0.0.1:46048 - 404 19B in 39.153µs

Edit: I should probably also add that I'm able to include the MAC address in the query params and it returns a boot script like expected too when enabled. I didn't have any nodes discovered or boot configs set up for this local build hence the generic script be returned.

[rocky@openchami-testing ~]$ curl http://0.0.0.0:8080/boot/v1/bootscript?mac=de:ca:fc:0f:fe:e1
#!ipxe
# Error iPXE Boot Script
# Error: Node resolution failed: node not found for identifier de:ca:fc:0f:fe:e1

echo Boot script generation failed
echo Error: Node resolution failed: node not found for identifier de:ca:fc:0f:fe:e1
echo Please contact system administrator

# Halt system to prevent boot loops
halt

[synackd]

@davidallendj Thanks for the review! Looks like your approval coincided with my addition of "needs testing". I am attempting to test using this PR combined with the linked CoreSMD one above to boot nodes to make sure it works.

[davidallendj]

@davidallendj Thanks for the review! Looks like your approval coincided with my addition of "needs testing". I am attempting to test using this PR combined with the linked CoreSMD one above to boot nodes to make sure it works.

Ah I see. I only tested boot-service on its own, but I can test with coresmd as well since I still have everything set up.

[synackd]

I have tested this by booting a VM with both the modern and legacy APIs. I've also tested that using the legacy API when not enabled returns a 404. I am going to merge this.