Reading this for team#41069, I got scared as hell, but I
figured it was safe. Hopefully I was right.

The missing bit here was the use of "initrd=initrd.magic" which is
default in BIOS mode but not UEFI. It also turns out that we don't need
to modify the original initrd.img and instead we can ask iPXE to drop
the ISO directly in the initrd filesystem.

See https://ipxe.org/cmd/imgfetch#notes

this improves the grml build instructions as well.

In my local configuration, the remote VPN was overwriting my local
routes, which was messing with a lot of things. Instead, this only
configures an IP on the interface and lets us configure a route to hop
through the VPN for the private network.