v0.7.0: Secure Boot chain, boot rules + decision webhook, tokenized answer files

Three features, all zero-toggle and principle-clean (single static musl binary, container-first, no test certs, no client trust-store changes). Secure Boot via signed shim+GRUB (automatic): - The v0.6.1 escalation ladder gains a third rung: Firmware -> Builtin -> Shim. Secure-Boot firmware downloads our unsigned iPXE but refuses to execute it — indistinguishable from a failed chainload — so after two unconfirmed attempts the MAC is offered Fedora's Microsoft-signed shimx64.efi, which loads the signed GRUB, which fetches a server-rendered grub.cfg. Fully signed chain, SB stays on. - scripts/fetch-shim.sh pulls shim-x64/grub2-efi-x64 (+aa64 best-effort) from the official Fedora 43 packages and ships the EFI binaries byte-for-byte unmodified; Dockerfile fetch stage gained rpm2cpio/cpio. - New grub_script renderer (Linux kernel entries only — signed GRUB only boots signed kernels; sanboot/wimboot have no signed equivalent and are omitted with an explanatory menu line). - TFTP server gains a DynamicAsset hook for server-rendered names (grub.cfg); HTTP serves the same config under /ipxe/grub.cfg for native UEFI HTTP Boot chains. Arch-aware fallback walks back down the ladder where no shim exists (BIOS, IA32). Boot rules + decision webhook (open 'Matrix Boot'): - Ordered first-match-wins rules over MAC prefix + client arch (the DHCP proxy now bakes arch into the boot.ipxe chain URL), generalizing per-MAC pins. Persisted to boot_rules.json; GET/PUT /api/boot-rules; rules editor + webhook field on the Hosts tab. - Optional pixiecore-style webhook: unmatched boots GET <url>?mac=&arch= and 200 {"target":"id"} chains to it. Fail-open with a 2s budget — a dead endpoint can never block PXE. - Decision order: exact pin -> rules -> webhook -> menu. Empty config is byte-for-byte the previous behavior. Tokenized answer files (the post-WDS/CVE-2026-0386 hardening): - Every generated unattended URL (inst.ks / preseed url / autoinstall seed) now carries a 4h boot-scoped token; /unattended/{id} and the cloud-init seed routes require it (or an operator session) once an admin exists. Stops answer-file credential harvesting by anything else on the network. No toggle; setup-mode installs stay open. Validation: clippy clean, fmt clean, 290 workspace tests green (+18 new across boot_tokens, boot_rules, arch ladder, escalation, grub renderer, and four new full-flow integration tests). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-06-09 20:17:18 -04:00
parent 7f25bb681c
commit 3a32d65fb7
21 changed files with 1396 additions and 68 deletions
@@ -212,6 +212,13 @@ pub fn build_router(state: AppState) -> Router {
        // v0.5.0: Wake-on-LAN a bound host. Sends a magic packet to the
        // limited broadcast + the server's own subnet broadcast.
        .route("/api/hosts/{mac}/wol", post(api_hosts_wol))
+        // v0.7.0: ordered boot rules (MAC prefix / arch → target) + the
+        // boot-decision webhook. The UI saves the whole config at once
+        // because rule order is significant.
+        .route(
+            "/api/boot-rules",
+            get(api_boot_rules_get).put(api_boot_rules_put),
+        )
        // Rolling "host log" of boot events: what image actually
        // started installing on what MAC/IP, and when. Persisted to disk.
        .route("/api/boot-log", get(api_boot_log))
@@ -570,17 +577,105 @@ async fn boot_top_menu(
            // `?mac=` so the per-entry handler can record the boot into
            // the Host log without depending on iPXE substitution at
            // this stage.
-            return text_plain(format!(
-                "#!ipxe\n\
-                 echo OpenPXE: per-MAC binding -> {target}\n\
-                 chain {base}/boot/{target}.ipxe?mac={bound_mac} || chain {base}/boot.ipxe\n"
-            ));
+            return text_plain(chain_script(base, &target, &bound_mac, "per-MAC binding"));
+        }
+
+        // v0.7.0 step 2: ordered boot rules (MAC prefix / arch).
+        let mac_norm = openpxe_core::normalize_mac(mac);
+        if let Some(target) = state.boot_rules.match_target(&mac_norm, p.arch.as_deref()) {
+            tracing::info!(
+                target: "openpxe::http",
+                mac = %mac_norm, target = %target, "boot rule matched"
+            );
+            record_pre_boot(&state, &isos, &mac_norm, peer_ip, &target);
+            return text_plain(chain_script(base, &target, &mac_norm, "boot rule"));
+        }
+
+        // v0.7.0 step 3: boot-decision webhook (fail-open — any error,
+        // timeout, or non-200 falls through to the menu so a dead
+        // automation endpoint can never block PXE for the network).
+        if let Some(url) = state.boot_rules.webhook_url() {
+            if let Some(target) = webhook_decide(&url, &mac_norm, p.arch.as_deref()).await {
+                tracing::info!(
+                    target: "openpxe::http",
+                    mac = %mac_norm, target = %target, "boot webhook decided"
+                );
+                record_pre_boot(&state, &isos, &mac_norm, peer_ip, &target);
+                return text_plain(chain_script(base, &target, &mac_norm, "boot webhook"));
+            }
        }
    }

    text_plain(render_menu(&isos, &settings, base))
 }

+/// The short-circuit script all three decision sources (binding, rule,
+/// webhook) emit: chain to the target's boot script, falling back to the
+/// interactive menu so a stale target can't lock a client out.
+fn chain_script(base: &str, target: &str, mac: &str, source: &str) -> String {
+    format!(
+        "#!ipxe\n\
+         echo OpenPXE: {source} -> {target}\n\
+         chain {base}/boot/{target}.ipxe?mac={mac} || chain {base}/boot.ipxe\n"
+    )
+}
+
+/// Pre-record a decision-driven boot into the Host log, mirroring what
+/// the per-MAC binding path does: reserved `_xxx` targets are operator
+/// conveniences, not imaging events, so they're skipped.
+fn record_pre_boot(
+    state: &AppState,
+    isos: &[openpxe_iso_store::IsoMeta],
+    mac: &str,
+    peer_ip: Option<std::net::IpAddr>,
+    target: &str,
+) {
+    if target.starts_with('_') {
+        return;
+    }
+    let title = lookup_entry_title(isos, target);
+    state.boot_log.record(&BootEvent {
+        timestamp: time::OffsetDateTime::now_utc(),
+        mac: Some(mac.to_string()),
+        ip: peer_ip,
+        target_id: target.to_string(),
+        target_title: title,
+    });
+}
+
+/// Ask the operator's boot-decision webhook for a target. `200` with
+/// `{"target": "<id>"}` chains to that target; anything else (including
+/// an empty target) means "no opinion". Two-second budget — a booting
+/// machine is sitting at a black screen while this runs.
+async fn webhook_decide(url: &str, mac: &str, arch: Option<&str>) -> Option<String> {
+    #[derive(Deserialize)]
+    struct Decision {
+        target: String,
+    }
+    let client = reqwest::Client::builder()
+        .timeout(std::time::Duration::from_secs(2))
+        .build()
+        .ok()?;
+    let resp = match client
+        .get(url)
+        .query(&[("mac", mac), ("arch", arch.unwrap_or(""))])
+        .send()
+        .await
+    {
+        Ok(r) => r,
+        Err(e) => {
+            tracing::warn!(target: "openpxe::http", "boot webhook unreachable: {e}");
+            return None;
+        }
+    };
+    if !resp.status().is_success() {
+        return None;
+    }
+    let d: Decision = resp.json().await.ok()?;
+    let t = d.target.trim().to_string();
+    (!t.is_empty()).then_some(t)
+}
+
 /// Best-effort human title for a boot entry id — falls back to the id
 /// itself if the ISO has been deleted between record-time and now.
 fn lookup_entry_title(isos: &[openpxe_iso_store::IsoMeta], target_id: &str) -> String {
@@ -603,6 +698,11 @@ struct BootMenuParams {
    /// `chain ${prefix}/boot.ipxe?mac=${mac}`. Optional — if absent we
    /// fall back to the menu unconditionally.
    mac: Option<String>,
+    /// v0.7.0: client architecture (`ClientArch::as_str()` form), baked
+    /// literally into the chain URL by the DHCP proxy, which knows it
+    /// from option 93. Lets boot rules select on architecture. Absent on
+    /// chains rendered by older binaries — arch rules simply don't match.
+    arch: Option<String>,
 }

 #[derive(Debug, Deserialize)]
@@ -750,7 +850,13 @@ async fn boot_sub(
                                    .as_deref()
                                    .and_then(|fid| state.unattended.get(fid))
                                    .and_then(|meta| {
-                                        build_unattended_args(base, &meta, Some(m), &p)
+                                        build_unattended_args(
+                                            base,
+                                            &meta,
+                                            Some(m),
+                                            &p,
+                                            &state.boot_tokens,
+                                        )
                                    })
                            })
                        });
@@ -771,10 +877,19 @@ async fn boot_sub(

 // ─── bundled iPXE binaries (memtest lives here too) ───────────────────────

-async fn ipxe_binary(AxumPath(name): AxumPath<String>) -> Response {
+async fn ipxe_binary(State(state): State<AppState>, AxumPath(name): AxumPath<String>) -> Response {
    if name.contains('/') || name.contains('\\') {
        return (StatusCode::BAD_REQUEST, "invalid name").into_response();
    }
+    // v0.7.0: when the whole Secure Boot chain rides HTTP (native UEFI
+    // HTTP Boot), GRUB resolves `$prefix` to this directory and fetches
+    // its config from here — rendered live, same as the TFTP path.
+    if name == "grub.cfg" || name.starts_with("grub.cfg-") {
+        return text_plain(crate::grub_script::render_grub_menu(
+            &state.iso_store.list(),
+            &state.public_base_url,
+        ));
+    }
    let Some(data) = asset_slice(&name) else {
        return (StatusCode::NOT_FOUND, "no such ipxe asset").into_response();
    };
@@ -1382,17 +1497,54 @@ struct UnattendedServeQuery {
    hostname: Option<String>,
    #[serde(default)]
    ip: Option<String>,
+    /// v0.7.0: short-lived access token minted into the generated URL.
+    #[serde(default)]
+    t: Option<String>,
 }

-/// Public: serve a Kickstart/Preseed/answer file with `{{HOSTNAME}}` /
+/// v0.7.0: answer files routinely embed credentials, so once an admin
+/// account exists they're only served to (a) the boot that the URL was
+/// minted for — proven by the token OpenPXE put in that URL — or (b) a
+/// logged-in operator (browser testing). Pre-setup installs stay open,
+/// matching the auth middleware's bootstrap behavior.
+fn unattended_access_allowed(
+    state: &AppState,
+    headers: &HeaderMap,
+    token: Option<&str>,
+    file_id: &str,
+) -> bool {
+    if !state.admin.is_configured() {
+        return true;
+    }
+    if token.is_some_and(|t| state.boot_tokens.check(t, file_id)) {
+        return true;
+    }
+    crate::auth::session_authenticated(state, headers)
+}
+
+fn unattended_denied() -> Response {
+    (
+        StatusCode::UNAUTHORIZED,
+        "answer files require the boot-scoped token OpenPXE mints into \
+         generated URLs (or an operator session)",
+    )
+        .into_response()
+}
+
+/// Serve a Kickstart/Preseed/answer file with `{{HOSTNAME}}` /
 /// `{{IP}}` / `{{MAC}}` substituted from the query string. Returns
 /// `text/plain` so installers (anaconda, debian-installer, Windows setup
-/// fetching over HTTP) read it verbatim.
+/// fetching over HTTP) read it verbatim. Token-gated since v0.7.0 — see
+/// [`unattended_access_allowed`].
 async fn serve_unattended(
    State(state): State<AppState>,
    AxumPath(id): AxumPath<String>,
+    headers: HeaderMap,
    Query(q): Query<UnattendedServeQuery>,
 ) -> Response {
+    if !unattended_access_allowed(&state, &headers, q.t.as_deref(), &id) {
+        return unattended_denied();
+    }
    let Ok(bytes) = state.unattended.read(&id).await else {
        return (StatusCode::NOT_FOUND, "no such unattended file").into_response();
    };
@@ -1414,8 +1566,15 @@ async fn serve_unattended(
 async fn serve_unattended_seed(
    State(state): State<AppState>,
    AxumPath((id, ctx, sub)): AxumPath<(String, String, String)>,
+    headers: HeaderMap,
 ) -> Response {
-    let (mac, hostname, ip) = decode_seed_ctx(&ctx);
+    let (mac, hostname, ip, token) = decode_seed_ctx(&ctx);
+    // v0.7.0: the seed ctx carries the access token (the seedfrom URL
+    // can't take a query string). Same gate as the flat answer-file
+    // route — see `unattended_access_allowed`.
+    if !unattended_access_allowed(&state, &headers, token.as_deref(), &id) {
+        return unattended_denied();
+    }
    match sub.as_str() {
        "user-data" => {
            let Ok(bytes) = state.unattended.read(&id).await else {
@@ -1439,6 +1598,22 @@ async fn serve_unattended_seed(
    }
 }

+// ─── Boot rules (v0.7.0) ───────────────────────────────────────────────────
+
+async fn api_boot_rules_get(State(state): State<AppState>) -> Json<openpxe_core::BootRulesConfig> {
+    Json(state.boot_rules.snapshot())
+}
+
+async fn api_boot_rules_put(
+    State(state): State<AppState>,
+    Json(cfg): Json<openpxe_core::BootRulesConfig>,
+) -> StatusCode {
+    let n = cfg.rules.len();
+    state.boot_rules.replace(cfg);
+    tracing::info!(target: "openpxe::http", rules = n, "boot rules replaced");
+    StatusCode::NO_CONTENT
+}
+
 /// Resolve the deployment profile for a booting MAC: a host pin wins, else
 /// a queued device's Profile. `None` when neither carries one.
 fn resolve_profile(state: &AppState, mac: &str) -> Option<DeployProfile> {
@@ -1458,12 +1633,23 @@ fn build_unattended_args(
    meta: &UnattendedMeta,
    mac: Option<&str>,
    profile: &DeployProfile,
+    tokens: &openpxe_core::BootTokens,
 ) -> Option<String> {
    let base = base.trim_end_matches('/');
    let id = &meta.id;
    let host = profile.auto_hostname.as_deref();
    let ip = profile.auto_ip.as_deref();
-    let query = build_query(&[("mac", mac), ("hostname", host), ("ip", ip)]);
+    // v0.7.0: every generated answer-file URL carries a fresh boot-scoped
+    // token; the serving endpoint requires it. See `crate::auth` and
+    // `openpxe_core::boot_tokens` for the threat model (CVE-2026-0386-
+    // style credential harvesting from openly-served answer files).
+    let token = tokens.mint(id);
+    let query = build_query(&[
+        ("mac", mac),
+        ("hostname", host),
+        ("ip", ip),
+        ("t", Some(&token)),
+    ]);
    match meta.kind {
        UnattendedKind::Kickstart => Some(format!("inst.ks={base}/unattended/{id}{query}")),
        UnattendedKind::Preseed => {
@@ -1475,7 +1661,7 @@ fn build_unattended_args(
            Some(s)
        }
        UnattendedKind::Autoinstall => {
-            let ctx = encode_seed_ctx(mac, host, ip);
+            let ctx = encode_seed_ctx(mac, host, ip, &token);
            Some(format!(
                "autoinstall ds=nocloud-net;s={base}/unattended/{id}/{ctx}/"
            ))
@@ -1500,12 +1686,19 @@ fn build_query(pairs: &[(&str, Option<&str>)]) -> String {

 // `pct_encode` lives in `openpxe_core::encoding` (v0.5.4) — imported above.

-/// Encode `(hostname, ip, mac)` into a single base64url path segment for
-/// the cloud-init seed directory. Empty values become empty fields.
-fn encode_seed_ctx(mac: Option<&str>, hostname: Option<&str>, ip: Option<&str>) -> String {
+/// Encode `(hostname, ip, mac, token)` into a single base64url path
+/// segment for the cloud-init seed directory. Empty values become empty
+/// fields. The access token rides in here (v0.7.0) because the
+/// `seedfrom` URL can't carry a query string.
+fn encode_seed_ctx(
+    mac: Option<&str>,
+    hostname: Option<&str>,
+    ip: Option<&str>,
+    token: &str,
+) -> String {
    use base64::Engine as _;
    let raw = format!(
-        "{}\n{}\n{}",
+        "{}\n{}\n{}\n{token}",
        hostname.unwrap_or(""),
        ip.unwrap_or(""),
        mac.unwrap_or("")
@@ -1513,21 +1706,30 @@ fn encode_seed_ctx(mac: Option<&str>, hostname: Option<&str>, ip: Option<&str>)
    base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(raw.as_bytes())
 }

-/// Inverse of [`encode_seed_ctx`]; returns `(mac, hostname, ip)`. A bad
-/// or empty segment yields all-`None` so the seed still serves (just
-/// without per-host substitution).
-fn decode_seed_ctx(ctx: &str) -> (Option<String>, Option<String>, Option<String>) {
+/// Inverse of [`encode_seed_ctx`]; returns `(mac, hostname, ip, token)`.
+/// A bad or empty segment yields all-`None`; a pre-v0.7.0 three-field
+/// ctx decodes with `token: None` (and the gate then rejects it once an
+/// admin exists — stale URLs are exactly what tokens invalidate).
+fn decode_seed_ctx(
+    ctx: &str,
+) -> (
+    Option<String>,
+    Option<String>,
+    Option<String>,
+    Option<String>,
+) {
    use base64::Engine as _;
    let Ok(bytes) = base64::engine::general_purpose::URL_SAFE_NO_PAD.decode(ctx.as_bytes()) else {
-        return (None, None, None);
+        return (None, None, None, None);
    };
    let s = String::from_utf8_lossy(&bytes).into_owned();
-    let mut it = s.splitn(3, '\n');
+    let mut it = s.splitn(4, '\n');
    let clean = |v: Option<&str>| v.map(str::to_string).filter(|x| !x.is_empty());
    let hostname = clean(it.next());
    let ip = clean(it.next());
    let mac = clean(it.next());
-    (mac, hostname, ip)
+    let token = clean(it.next());
+    (mac, hostname, ip, token)
 }

 // ─── API reference (Settings → bottom) ────────────────────────────────────
@@ -1709,6 +1911,10 @@ async fn api_docs() -> Json<serde_json::Value> {
                     "summary": "Pin a MAC to a boot target. Body: { mac, target, label, auto_hostname?, auto_ip?, unattended_file? }."},
                    {"method": "DELETE", "path": "/api/hosts/{mac}",
                     "summary": "Remove a binding."},
+                    {"method": "GET", "path": "/api/boot-rules",
+                     "summary": "Boot rules + decision-webhook config (v0.7.0)."},
+                    {"method": "PUT", "path": "/api/boot-rules",
+                     "summary": "Replace the whole boot-rules config (rules are ordered)."},
                    {"method": "POST", "path": "/api/hosts/{mac}/wol",
                     "summary": "Send a Wake-on-LAN magic packet to a bound MAC (limited + subnet broadcast)."},
                    {"method": "GET", "path": "/api/boot-log",
@@ -2942,11 +3148,13 @@ mod tests {
            auto_ip: Some("10.0.0.7".into()),
            unattended_file: Some("ks1".into()),
        };
+        let tokens = openpxe_core::BootTokens::new();
        let a = build_unattended_args(
            "http://h",
            &meta(UnattendedKind::Kickstart),
            Some("aa:bb:cc:dd:ee:ff"),
            &p,
+            &tokens,
        )
        .unwrap();
        assert!(a.starts_with("inst.ks=http://h/unattended/ks1?"), "{a}");
@@ -2954,6 +3162,9 @@ mod tests {
        assert!(a.contains("ip=10.0.0.7"), "{a}");
        // MAC colons are percent-encoded.
        assert!(a.contains("mac=aa%3Abb%3Acc%3Add%3Aee%3Aff"), "{a}");
+        // v0.7.0: a live access token rides in the generated URL.
+        let tok = a.rsplit("t=").next().unwrap();
+        assert!(tokens.check(tok, "ks1"), "minted token must be live: {a}");
    }

    #[test]
@@ -2962,8 +3173,15 @@ mod tests {
            auto_hostname: Some("deb1".into()),
            ..Default::default()
        };
-        let a =
-            build_unattended_args("http://h/", &meta(UnattendedKind::Preseed), None, &p).unwrap();
+        let tokens = openpxe_core::BootTokens::new();
+        let a = build_unattended_args(
+            "http://h/",
+            &meta(UnattendedKind::Preseed),
+            None,
+            &p,
+            &tokens,
+        )
+        .unwrap();
        assert!(
            a.starts_with("auto=true priority=critical url=http://h/unattended/ks1"),
            "{a}"
@@ -2978,11 +3196,13 @@ mod tests {
            auto_ip: Some("10.1.1.5".into()),
            unattended_file: Some("ks1".into()),
        };
+        let tokens = openpxe_core::BootTokens::new();
        let a = build_unattended_args(
            "http://h",
            &meta(UnattendedKind::Autoinstall),
            Some("aa:bb"),
            &p,
+            &tokens,
        )
        .unwrap();
        assert!(
@@ -2992,10 +3212,12 @@ mod tests {
        assert!(a.ends_with('/'), "seed URL must end with '/': {a}");
        // The ctx segment round-trips back to the per-host values.
        let ctx = a.trim_end_matches('/').rsplit('/').next().unwrap();
-        let (mac, host, ip) = decode_seed_ctx(ctx);
+        let (mac, host, ip, token) = decode_seed_ctx(ctx);
        assert_eq!(mac.as_deref(), Some("aa:bb"));
        assert_eq!(host.as_deref(), Some("u1"));
        assert_eq!(ip.as_deref(), Some("10.1.1.5"));
+        // v0.7.0: the ctx carries a live access token for the file.
+        assert!(tokens.check(token.as_deref().unwrap(), "ks1"));
    }

    #[test]
@@ -3004,20 +3226,26 @@ mod tests {
            unattended_file: Some("ks1".into()),
            ..Default::default()
        };
-        assert!(
-            build_unattended_args("http://h", &meta(UnattendedKind::AnswerFile), None, &p)
-                .is_none()
-        );
+        let tokens = openpxe_core::BootTokens::new();
+        assert!(build_unattended_args(
+            "http://h",
+            &meta(UnattendedKind::AnswerFile),
+            None,
+            &p,
+            &tokens
+        )
+        .is_none());
    }

    #[test]
    fn seed_ctx_empty_segment_decodes_to_none() {
-        let ctx = encode_seed_ctx(None, None, None);
-        let (m, h, i) = decode_seed_ctx(&ctx);
+        let ctx = encode_seed_ctx(None, None, None, "tok");
+        let (m, h, i, t) = decode_seed_ctx(&ctx);
        assert!(m.is_none() && h.is_none() && i.is_none());
+        assert_eq!(t.as_deref(), Some("tok"));
        // Garbage decodes safely to all-None.
-        let (m2, h2, i2) = decode_seed_ctx("!!!not-base64!!!");
-        assert!(m2.is_none() && h2.is_none() && i2.is_none());
+        let (m2, h2, i2, t2) = decode_seed_ctx("!!!not-base64!!!");
+        assert!(m2.is_none() && h2.is_none() && i2.is_none() && t2.is_none());
    }

    #[test]
@@ -169,6 +169,13 @@ fn parse_cookie(headers: &axum::http::HeaderMap) -> Option<String> {
    None
 }

+/// Does this request carry a live operator session? Used by endpoints
+/// outside the `/api/*` middleware that still want to honor a logged-in
+/// operator (e.g. browser-testing a token-gated answer file, v0.7.0).
+pub(crate) fn session_authenticated(state: &AppState, headers: &axum::http::HeaderMap) -> bool {
+    parse_cookie(headers).is_some_and(|t| state.sessions.touch(&t).is_some())
+}
+
 // ── Middleware ────────────────────────────────────────────────────────────

 /// Return `true` if `path` is on the allowlist and should bypass the
@@ -0,0 +1,156 @@
+//! GRUB menu rendering for the Secure Boot chain (v0.7.0).
+//!
+//! Secure-Boot-enabled firmware refuses our unsigned iPXE, so those
+//! clients are automatically escalated (see `openpxe_dhcp_proxy::
+//! escalation`) to the Microsoft-signed Fedora `shim` → signed `grub`
+//! chain. GRUB then fetches `grub.cfg` from this server (TFTP `$prefix`
+//! resolution, or HTTP when the whole chain came over HTTP Boot) — and
+//! this module renders that config from the same boot-entry model that
+//! renders `boot.ipxe`.
+//!
+//! Scope: **Linux kernel entries only.** A signed GRUB will only execute
+//! kernels that pass shim verification — i.e. distro-signed kernels —
+//! which is exactly what `LinuxKernel` boot entries point at. `sanboot`
+//! ISO emulation and `wimboot` are iPXE mechanisms with no signed
+//! equivalent; those entries are omitted here, and the menu says so.
+//! (Windows deployment under Secure Boot has no legitimate unsigned
+//! path — per project policy we never ship test-signed binaries or touch
+//! client trust stores.)
+//!
+//! The kernel/initrd lines use GRUB's `(http,host:port)` device syntax;
+//! Fedora's signed netboot GRUB carries the `http`, `tftp` and `efinet`
+//! modules built in, so no unsigned module loading is required.
+
+use openpxe_iso_store::{BootKind, IsoMeta};
+use std::fmt::Write as _;
+
+/// Render the full `grub.cfg` for the signed-GRUB menu.
+///
+/// `base_url` is the public HTTP base (`http://10.0.0.5` or
+/// `http://10.0.0.5:8080`) — converted to GRUB's `(http,host:port)`
+/// device prefix for kernel/initrd fetches.
+#[must_use]
+pub fn render_grub_menu(isos: &[IsoMeta], base_url: &str) -> String {
+    let base = base_url.trim_end_matches('/');
+    let dev = grub_http_device(base);
+    let mut s = String::new();
+    let _ = writeln!(s, "# OpenPXE — Secure Boot menu (signed shim+GRUB chain)");
+    let _ = writeln!(s, "set timeout=30");
+    let _ = writeln!(s, "set default=0");
+    let _ = writeln!(s);
+
+    let mut entries = 0usize;
+    for iso in isos {
+        for entry in &iso.boot_entries {
+            let BootKind::LinuxKernel {
+                kernel_url,
+                initrd_urls,
+                args,
+            } = &entry.kind
+            else {
+                continue;
+            };
+            // GRUB menu titles: keep quotes out of the label.
+            let title = entry.title.replace('"', "'");
+            let cmdline = args.cmdline.replace("${base-url}", base);
+            let _ = writeln!(s, "menuentry \"{} — {title}\" {{", iso.filename);
+            let _ = writeln!(s, "    linux {dev}/{kernel_url} {cmdline}");
+            if !initrd_urls.is_empty() {
+                let _ = write!(s, "    initrd");
+                for u in initrd_urls {
+                    let _ = write!(s, " {dev}/{u}");
+                }
+                let _ = writeln!(s);
+            }
+            let _ = writeln!(s, "}}");
+            let _ = writeln!(s);
+            entries += 1;
+        }
+    }
+
+    if entries == 0 {
+        let _ = writeln!(
+            s,
+            "menuentry \"No Secure-Boot-bootable images on this server yet\" {{ true }}"
+        );
+        let _ = writeln!(s);
+    }
+    // Always give the operator a way off this screen.
+    let _ = writeln!(s, "menuentry \"Boot from local disk\" {{");
+    let _ = writeln!(s, "    exit");
+    let _ = writeln!(s, "}}");
+    s
+}
+
+/// `http://10.0.0.5:8080` → `(http,10.0.0.5:8080)`. GRUB wants the
+/// scheme as the device type and host[:port] as the device address.
+fn grub_http_device(base: &str) -> String {
+    let host = base
+        .trim_start_matches("http://")
+        .trim_start_matches("https://");
+    format!("(http,{host})")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use openpxe_iso_store::{BootEntry, IsoSource, KernelArgs};
+
+    fn linux_iso() -> IsoMeta {
+        IsoMeta {
+            id: "alp".into(),
+            filename: "alpine.iso".into(),
+            size_bytes: 1,
+            sha256_hex: None,
+            uploaded_at: time::OffsetDateTime::UNIX_EPOCH,
+            source: IsoSource::Local,
+            introspection: openpxe_iso_store::IntrospectionReport::default(),
+            boot_entries: vec![BootEntry {
+                id: "alp-linux".into(),
+                title: "Linux installer".into(),
+                kind: BootKind::LinuxKernel {
+                    kernel_url: "iso/alp/boot/vmlinuz".into(),
+                    initrd_urls: vec!["iso/alp/boot/initrd".into()],
+                    args: KernelArgs {
+                        cmdline: "quiet repo=${base-url}/iso/alp.iso".into(),
+                    },
+                },
+            }],
+            category: openpxe_iso_store::IsoCategory::default(),
+            password_hash: None,
+        }
+    }
+
+    #[test]
+    fn renders_linux_entries_with_http_device_urls() {
+        let cfg = render_grub_menu(&[linux_iso()], "http://10.0.0.5:8080/");
+        assert!(
+            cfg.contains("menuentry \"alpine.iso — Linux installer\""),
+            "{cfg}"
+        );
+        assert!(
+            cfg.contains("linux (http,10.0.0.5:8080)/iso/alp/boot/vmlinuz quiet repo=http://10.0.0.5:8080/iso/alp.iso"),
+            "{cfg}"
+        );
+        assert!(
+            cfg.contains("initrd (http,10.0.0.5:8080)/iso/alp/boot/initrd"),
+            "{cfg}"
+        );
+        assert!(cfg.contains("Boot from local disk"), "{cfg}");
+    }
+
+    #[test]
+    fn sanboot_and_wimboot_entries_are_omitted() {
+        let mut iso = linux_iso();
+        iso.boot_entries = vec![BootEntry {
+            id: "win".into(),
+            title: "Windows".into(),
+            kind: BootKind::SanBootIso {
+                iso_url: "iso/win.iso".into(),
+            },
+        }];
+        let cfg = render_grub_menu(&[iso], "http://10.0.0.5");
+        assert!(!cfg.contains("Windows"), "{cfg}");
+        assert!(cfg.contains("No Secure-Boot-bootable images"), "{cfg}");
+    }
+}
@@ -16,6 +16,7 @@
 pub mod app;
 pub mod auth;
 pub mod error;
+pub mod grub_script;
 pub mod ipxe_script;
 pub mod iso_fs;
 pub mod log_stream;
@@ -2,8 +2,8 @@ use crate::auth::SessionStore;
 use crate::saml_routes::SamlRuntime;
 use crate::uploads::UploadSessions;
 use openpxe_core::{
-    AdminStore, BootLog, BrandingStore, ClientRegistry, DeploymentQueue, HostBindings, LogBus,
-    Metrics, NotifyStore, SettingsStore, SsoStore,
+    AdminStore, BootLog, BootRulesStore, BootTokens, BrandingStore, ClientRegistry,
+    DeploymentQueue, HostBindings, LogBus, Metrics, NotifyStore, SettingsStore, SsoStore,
 };
 use openpxe_iso_store::{
    IsoStore, NfsShareManager, SftpShareManager, SmbManager, SmbShareManager, UnattendedStore,
@@ -29,6 +29,14 @@ pub struct AppState {
    /// every `/boot/<entry>.ipxe` chain that goes on to serve a script
    /// (i.e. an image actually starting to install on a machine).
    pub boot_log: BootLog,
+    /// v0.7.0: ordered label-based boot rules (MAC prefix / arch →
+    /// target) plus the optional boot-decision webhook. Consulted by the
+    /// top-level boot script after exact host bindings, before the menu.
+    pub boot_rules: BootRulesStore,
+    /// v0.7.0: short-lived access tokens for unattended answer files.
+    /// Minted into every generated answer-file URL; the serving endpoint
+    /// requires one (or an operator session) once an admin exists.
+    pub boot_tokens: BootTokens,
    /// Operator-controlled UI overrides (custom logo). When the
    /// operator hasn't uploaded anything, the WebUI serves the bundled
    /// rainbow-horizon mark.
@@ -115,6 +115,8 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
        settings,
        hosts,
        boot_log,
+        boot_rules: openpxe_core::BootRulesStore::load_or_default(dir.path()),
+        boot_tokens: openpxe_core::BootTokens::new(),
        branding,
        pxe_bg_cache: openpxe_http_api::state::PxeBgCache::default(),
        admin,
@@ -2610,3 +2612,142 @@ async fn acs_garbage_is_rejected_without_500() {
    assert!(location(&resp).contains("sso_error"));
    assert!(!has_session_cookie(&resp));
 }
+
+// ─── v0.7.0: tokenized answer files + boot rules ────────────────────────────
+
+#[tokio::test]
+async fn unattended_requires_token_once_admin_exists() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state.clone());
+    // Upload an answer file while in setup mode (everything open).
+    let (ct, body) =
+        multipart_iso_body("ks.ks", b"install\nrootpw s3cret\n%packages\n@core\n%end\n");
+    let (s, b) = post_multipart(&app, "/api/unattended", &ct, body).await;
+    assert_eq!(s, StatusCode::CREATED);
+    let id = serde_json::from_slice::<serde_json::Value>(&b).unwrap()["id"]
+        .as_str()
+        .unwrap()
+        .to_string();
+    // Pre-setup, the file serves openly (bootstrap parity with the
+    // auth middleware).
+    let (s, _) = get(&app, &format!("/unattended/{id}")).await;
+    assert_eq!(s, StatusCode::OK);
+
+    // Create the admin → the gate arms.
+    let (s, _, cookies) = post_collect(
+        &app,
+        "/api/setup",
+        r#"{"username":"admin","password":"hunter2hunter2"}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::CREATED);
+    let session = session_value(&cookies).unwrap();
+
+    // Bare fetch (the CVE-2026-0386 harvesting pattern) is refused.
+    let (s, _) = get(&app, &format!("/unattended/{id}")).await;
+    assert_eq!(s, StatusCode::UNAUTHORIZED);
+    // Garbage token is refused.
+    let (s, _) = get(&app, &format!("/unattended/{id}?t=bogus")).await;
+    assert_eq!(s, StatusCode::UNAUTHORIZED);
+    // A token minted for a *different* file is refused.
+    let other = state.boot_tokens.mint("some-other-file");
+    let (s, _) = get(&app, &format!("/unattended/{id}?t={other}")).await;
+    assert_eq!(s, StatusCode::UNAUTHORIZED);
+    // The boot-scoped token OpenPXE mints into generated URLs passes.
+    let tok = state.boot_tokens.mint(&id);
+    let (s, b) = get(&app, &format!("/unattended/{id}?t={tok}")).await;
+    assert_eq!(s, StatusCode::OK);
+    assert!(String::from_utf8_lossy(&b).contains("rootpw"));
+    // A logged-in operator (browser testing) passes too.
+    let (s, _) = get_with_cookie(&app, &format!("/unattended/{id}"), &session).await;
+    assert_eq!(s, StatusCode::OK);
+}
+
+#[tokio::test]
+async fn boot_script_for_pinned_unattended_carries_live_token() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state.clone());
+    let (ct, body) = multipart_iso_body("fake-alpine.iso", &fake_alpine_iso());
+    let (s, _) = post_multipart(&app, "/api/isos", &ct, body).await;
+    assert_eq!(s, StatusCode::CREATED);
+    let (ct, body) = multipart_iso_body("ks.ks", b"install\n%packages\n@core\n%end\n");
+    let (s, b) = post_multipart(&app, "/api/unattended", &ct, body).await;
+    assert_eq!(s, StatusCode::CREATED);
+    let ks_id = serde_json::from_slice::<serde_json::Value>(&b).unwrap()["id"]
+        .as_str()
+        .unwrap()
+        .to_string();
+    let mac = "aa:bb:cc:dd:ee:71";
+    let pin =
+        format!(r#"{{"mac":"{mac}","target":"fake-alpine-linux","unattended_file":"{ks_id}"}}"#);
+    let (s, _) = post_json(&app, "/api/hosts", &pin).await;
+    assert_eq!(s, StatusCode::CREATED);
+    let (s, b) = get(&app, &format!("/boot/fake-alpine-linux.ipxe?mac={mac}")).await;
+    assert_eq!(s, StatusCode::OK);
+    let script = String::from_utf8_lossy(&b).into_owned();
+    // The injected inst.ks URL ends with a token that is live for the file.
+    let tok = script
+        .split("t=")
+        .nth(1)
+        .and_then(|rest| rest.split_whitespace().next())
+        .expect("kernel arg should carry t=<token>");
+    assert!(
+        state.boot_tokens.check(tok, &ks_id),
+        "token in boot script must be live:\n{script}"
+    );
+}
+
+#[tokio::test]
+async fn boot_rules_match_and_persist_via_api() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (ct, body) = multipart_iso_body("fake-alpine.iso", &fake_alpine_iso());
+    let (s, _) = post_multipart(&app, "/api/isos", &ct, body).await;
+    assert_eq!(s, StatusCode::CREATED);
+
+    // Save a rule: any MAC under aa:bb:cc, any arch → the Linux entry.
+    let cfg = r#"{"rules":[{"mac_prefix":"AA-BB-CC","arch":"","target":"fake-alpine-linux","enabled":true,"note":"rack"}],"webhook_url":""}"#;
+    let (s, _) = put_json(&app, "/api/boot-rules", cfg).await;
+    assert_eq!(s, StatusCode::NO_CONTENT);
+    // The config reads back (prefix normalized to colons).
+    let (s, b) = get(&app, "/api/boot-rules").await;
+    assert_eq!(s, StatusCode::OK);
+    let v: serde_json::Value = serde_json::from_slice(&b).unwrap();
+    assert_eq!(v["rules"][0]["mac_prefix"], "aa:bb:cc");
+
+    // A matching client short-circuits to the target...
+    let (s, b) = get(&app, "/boot.ipxe?mac=aa:bb:cc:00:00:09&arch=uefi-x64").await;
+    assert_eq!(s, StatusCode::OK);
+    let script = String::from_utf8_lossy(&b);
+    assert!(
+        script.contains("boot rule -> fake-alpine-linux"),
+        "rule did not chain:\n{script}"
+    );
+    // ...while a non-matching one still gets the menu.
+    let (s, b) = get(&app, "/boot.ipxe?mac=11:22:33:00:00:09&arch=uefi-x64").await;
+    assert_eq!(s, StatusCode::OK);
+    assert!(
+        String::from_utf8_lossy(&b).contains("menu"),
+        "non-matching client should see the menu"
+    );
+}
+
+#[tokio::test]
+async fn arch_selective_rule_ignores_other_arches() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (ct, body) = multipart_iso_body("fake-alpine.iso", &fake_alpine_iso());
+    let (s, _) = post_multipart(&app, "/api/isos", &ct, body).await;
+    assert_eq!(s, StatusCode::CREATED);
+    let cfg = r#"{"rules":[{"mac_prefix":"","arch":"uefi-arm64","target":"fake-alpine-linux","enabled":true,"note":""}],"webhook_url":""}"#;
+    let (s, _) = put_json(&app, "/api/boot-rules", cfg).await;
+    assert_eq!(s, StatusCode::NO_CONTENT);
+    // x64 client: no match → menu.
+    let (s, b) = get(&app, "/boot.ipxe?mac=aa:bb:cc:00:00:01&arch=uefi-x64").await;
+    assert_eq!(s, StatusCode::OK);
+    assert!(!String::from_utf8_lossy(&b).contains("boot rule ->"));
+    // arm64 client: match.
+    let (s, b) = get(&app, "/boot.ipxe?mac=aa:bb:cc:00:00:01&arch=uefi-arm64").await;
+    assert_eq!(s, StatusCode::OK);
+    assert!(String::from_utf8_lossy(&b).contains("boot rule -> fake-alpine-linux"));
+}