v0.4.0: upload telemetry, host log, jet-black UI

- Upload reliability + diagnostics:
  - api_upload_iso now distinguishes clean EOF from mid-stream errors;
    a truncated multipart body (proxy buffer cap, network drop) returns
    400 with the cause and a "try the LAN IP" hint instead of silently
    finalising a partial file.
  - Per-stage tracing (begin/MB-watermark/finish/abort) so a stuck
    upload is debuggable from the Terminal tab.
  - Web upload UI surfaces bytes/total, percent, throughput, ETA, and
    maps 413/502/504/network-drop to actionable hints.
- New BootLog feature under Hosts:
  - openpxe-core::BootLog — bounded in-memory ring (500) + append-only
    JSONL on disk, recording (timestamp, mac, ip, target_id,
    target_title) every time a boot entry script is served.
  - iPXE per-entry chain URLs grow ?mac=${mac}; password prompt
    submission carries it through; host-binding short-circuit uses the
    bound MAC. ConnectInfo<SocketAddr> wired for peer IP capture (with
    optional fallback so tower::oneshot in tests still works).
  - GET /api/boot-log endpoint + Host log table under the Hosts tab.
- UI changes:
  - Queue card header "Forge" → "Status".
  - Removed Tinkerbell attribution sentence from Hosts tab.
  - Topbar readiness chip moved into the sidebar footer as
    "Service status: Ready / Advertised to clients / <url>", grouping
    advertised PXE URL with operator-relevant status.
  - Jet-black dark palette (#000 / #0a0a0a / #141414 / #1c1c1c)
    replacing the blue-tinted ramp; terminal toolbar/input recoloured
    to match.
- 89 tests passing (was 85 in v0.3.2); cargo clippy --workspace
  --all-targets clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

Cargo.toml

@@ -12,7 +12,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.3.2"
+version = "0.4.0"
 edition = "2021"
 rust-version = "1.80"
 license = "MIT OR Apache-2.0"

crates/core/src/boot_log.rs

@@ -0,0 +1,249 @@
+//! Boot-event log — "who installed what, when, from where".
+//!
+//! Each `/boot/<entry>.ipxe` fetch that actually goes on to serve a boot
+//! script lands an entry here. The log is bounded in memory (newest-first,
+//! ring-buffered at [`BootLog::CAP`]) and is mirrored append-only to
+//! `<work_dir>/boot_log.jsonl`. Mirrors `HostBindings`'s "in-memory is
+//! authoritative, disk is a cache" policy — a corrupt log file should
+//! never block PXE for the network.
+//!
+//! We deliberately don't push these onto the `LogBus` (the operator
+//! terminal stream). The terminal already shows the http traces; the
+//! Host log is a curated, persistent, easy-to-scan view of "what got
+//! imaged on what hardware" and conflating the two would be noisy.
+
+use parking_lot::RwLock;
+use serde::{Deserialize, Serialize};
+use std::collections::VecDeque;
+use std::io::Write;
+use std::net::IpAddr;
+use std::path::PathBuf;
+use std::sync::Arc;
+use time::OffsetDateTime;
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct BootEvent {
+    #[serde(with = "time::serde::rfc3339")]
+    pub timestamp: OffsetDateTime,
+    /// Lowercase, colon-separated. `None` when iPXE didn't supply
+    /// `?mac=${mac}` in the chain URL (older bookmarks, custom scripts).
+    pub mac: Option<String>,
+    /// Connecting peer's IP — taken from the TCP socket when available
+    /// (PXE clients connect direct, no reverse proxy), and falls back to
+    /// `X-Forwarded-For` for the rare case where one is present.
+    pub ip: Option<IpAddr>,
+    /// `BootEntry::id` — the same id used in `/boot/<id>.ipxe`.
+    pub target_id: String,
+    /// Human-friendly label: the ISO's filename / volume label / entry
+    /// title. Pre-resolved at log time so the UI can render without
+    /// joining against the ISO store (and so "what image was installed?"
+    /// survives the operator deleting the ISO later).
+    pub target_title: String,
+}
+
+/// In-memory ring + disk-backed append log of boot events. Cheap to
+/// clone; the inner state is `Arc<RwLock<_>>`.
+#[derive(Debug, Clone)]
+pub struct BootLog {
+    path: Arc<PathBuf>,
+    inner: Arc<RwLock<VecDeque<BootEvent>>>,
+}
+
+impl BootLog {
+    /// Newest entries we retain in memory. Past this, the oldest gets
+    /// evicted — the on-disk JSONL keeps the full history for offline
+    /// inspection. 500 covers a typical install-day's worth without
+    /// turning the Hosts tab into a wall of text.
+    pub const CAP: usize = 500;
+
+    /// Load up to `CAP` newest events from `<work_dir>/boot_log.jsonl`,
+    /// or start empty if the file is missing / unreadable.
+    #[must_use]
+    pub fn load_or_default(work_dir: &std::path::Path) -> Self {
+        let path = work_dir.join("boot_log.jsonl");
+        let mut events = VecDeque::with_capacity(Self::CAP);
+        if let Ok(text) = std::fs::read_to_string(&path) {
+            for line in text.lines() {
+                if line.trim().is_empty() {
+                    continue;
+                }
+                match serde_json::from_str::<BootEvent>(line) {
+                    Ok(ev) => {
+                        if events.len() == Self::CAP {
+                            events.pop_front();
+                        }
+                        events.push_back(ev);
+                    }
+                    Err(e) => {
+                        tracing::warn!(
+                            target: "openpxe::boot_log",
+                            "skipping unparseable boot_log line: {e}"
+                        );
+                    }
+                }
+            }
+        }
+        Self {
+            path: Arc::new(path),
+            inner: Arc::new(RwLock::new(events)),
+        }
+    }
+
+    /// Append an event. Persistence is best-effort and never blocks the
+    /// caller on a failed write (the in-memory copy is the source of
+    /// truth for the live UI; the JSONL is just for crash survival).
+    pub fn record(&self, ev: &BootEvent) {
+        // Push into the ring first so a slow / failing disk doesn't lose
+        // events for the live UI.
+        {
+            let mut g = self.inner.write();
+            if g.len() == Self::CAP {
+                g.pop_front();
+            }
+            g.push_back(ev.clone());
+        }
+        tracing::info!(
+            target: "openpxe::boot_log",
+            mac = ev.mac.as_deref().unwrap_or("?"),
+            ip = ev.ip.map(|i| i.to_string()).as_deref().unwrap_or("?"),
+            target = %ev.target_id,
+            "boot event"
+        );
+        // Append to disk. We tolerate write failures — they'd show up as
+        // missing entries on the next restart only.
+        let mut line = match serde_json::to_string(ev) {
+            Ok(s) => s,
+            Err(e) => {
+                tracing::warn!(target: "openpxe::boot_log", "serialize boot event: {e}");
+                return;
+            }
+        };
+        line.push('\n');
+        if let Some(parent) = self.path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        match std::fs::OpenOptions::new()
+            .create(true)
+            .append(true)
+            .open(self.path.as_path())
+        {
+            Ok(mut f) => {
+                if let Err(e) = f.write_all(line.as_bytes()) {
+                    tracing::warn!(target: "openpxe::boot_log", "append boot_log.jsonl: {e}");
+                }
+            }
+            Err(e) => {
+                tracing::warn!(target: "openpxe::boot_log", "open boot_log.jsonl: {e}");
+            }
+        }
+    }
+
+    /// Newest-first snapshot, up to `CAP` entries.
+    #[must_use]
+    pub fn list(&self) -> Vec<BootEvent> {
+        let g = self.inner.read();
+        // VecDeque preserves insertion order; reverse so newest is first.
+        g.iter().rev().cloned().collect()
+    }
+
+    #[must_use]
+    pub fn len(&self) -> usize {
+        self.inner.read().len()
+    }
+
+    #[must_use]
+    pub fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+
+    /// Wipe in-memory + the on-disk file. Used by the `terminal clear`
+    /// equivalent or future operator action; not currently wired to a UI
+    /// button but exposed for completeness.
+    pub fn clear(&self) {
+        self.inner.write().clear();
+        let _ = std::fs::remove_file(self.path.as_path());
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::tempdir;
+
+    fn ev(target: &str, mac: Option<&str>) -> BootEvent {
+        BootEvent {
+            timestamp: OffsetDateTime::now_utc(),
+            mac: mac.map(str::to_string),
+            ip: Some("10.0.0.42".parse().unwrap()),
+            target_id: target.into(),
+            target_title: format!("{target}.iso"),
+        }
+    }
+
+    #[test]
+    fn record_then_list_is_newest_first() {
+        let dir = tempdir().unwrap();
+        let log = BootLog::load_or_default(dir.path());
+        assert!(log.is_empty());
+        log.record(&ev("alpha", Some("aa:bb:cc:00:00:01")));
+        log.record(&ev("beta", Some("aa:bb:cc:00:00:02")));
+        let list = log.list();
+        assert_eq!(list.len(), 2);
+        assert_eq!(list[0].target_id, "beta");
+        assert_eq!(list[1].target_id, "alpha");
+    }
+
+    #[test]
+    fn round_trip_through_disk() {
+        let dir = tempdir().unwrap();
+        let log = BootLog::load_or_default(dir.path());
+        log.record(&ev("alpha", Some("aa:bb:cc:00:00:01")));
+        log.record(&ev("beta", None));
+        drop(log);
+        let log2 = BootLog::load_or_default(dir.path());
+        assert_eq!(log2.len(), 2);
+        let list = log2.list();
+        assert_eq!(list[0].target_id, "beta");
+        assert_eq!(list[1].target_id, "alpha");
+        assert!(list[0].mac.is_none());
+        assert_eq!(list[1].mac.as_deref(), Some("aa:bb:cc:00:00:01"));
+    }
+
+    #[test]
+    fn ring_evicts_oldest_past_cap() {
+        let dir = tempdir().unwrap();
+        let log = BootLog::load_or_default(dir.path());
+        for i in 0..(BootLog::CAP + 5) {
+            log.record(&ev(&format!("e{i}"), None));
+        }
+        assert_eq!(log.len(), BootLog::CAP);
+        let list = log.list();
+        // Newest first; the most recent push is the last index inserted.
+        assert_eq!(list[0].target_id, format!("e{}", BootLog::CAP + 4));
+        // Oldest in-memory should be the 6th push (0..5 were evicted).
+        assert_eq!(list[BootLog::CAP - 1].target_id, "e5");
+    }
+
+    #[test]
+    fn clear_wipes_memory_and_disk() {
+        let dir = tempdir().unwrap();
+        let log = BootLog::load_or_default(dir.path());
+        log.record(&ev("alpha", None));
+        log.clear();
+        assert!(log.is_empty());
+        let log2 = BootLog::load_or_default(dir.path());
+        assert!(log2.is_empty());
+    }
+
+    #[test]
+    fn corrupt_disk_lines_are_skipped_not_fatal() {
+        // Write a file with one valid + one garbage line; loader should
+        // surface the valid one and skip the garbage.
+        let dir = tempdir().unwrap();
+        let path = dir.path().join("boot_log.jsonl");
+        let valid = serde_json::to_string(&ev("ok", Some("aa:bb:cc:00:00:09"))).unwrap();
+        std::fs::write(&path, format!("{valid}\nNOT_JSON\n{valid}\n")).unwrap();
+        let log = BootLog::load_or_default(dir.path());
+        assert_eq!(log.len(), 2);
+    }
+}

crates/core/src/lib.rs

@@ -3,6 +3,7 @@
 #![forbid(unsafe_code)]
 
 pub mod arch;
+pub mod boot_log;
 pub mod client;
 pub mod config;
 pub mod error;
@@ -13,6 +14,7 @@ pub mod queue;
 pub mod settings;
 
 pub use arch::{ClientArch, FirmwareClass};
+pub use boot_log::{BootEvent, BootLog};
 pub use client::{ClientEvent, ClientRegistry, ClientSnapshot};
 pub use config::{Config, DhcpMode, NetworkConfig, Paths, ServerConfig};
 pub use error::{Error, Result};

crates/http-api/src/app.rs

@@ -23,13 +23,14 @@ use crate::state::AppState;
 use crate::terminal;
 use axum::{
     body::Body,
-    extract::{DefaultBodyLimit, Multipart, Path as AxumPath, Query, State},
+    extract::{ConnectInfo, DefaultBodyLimit, Multipart, Path as AxumPath, Query, State},
     http::{header, HeaderMap, HeaderValue, StatusCode},
     response::{IntoResponse, Response},
     routing::{delete, get, post},
     Json, Router,
 };
-use openpxe_core::{ClientEvent, Settings};
+use openpxe_core::{BootEvent, ClientEvent, Settings};
+use std::net::SocketAddr;
 use openpxe_ipxe_assets::asset_bytes;
 use openpxe_iso_store::{IsoMeta, NfsAddRequest};
 use serde::Deserialize;
@@ -91,6 +92,9 @@ pub fn build_router(state: AppState) -> Router {
         // pins a MAC to a boot entry; /boot.ipxe?mac=... chains directly.
         .route("/api/hosts", get(api_hosts_list).post(api_hosts_upsert))
         .route("/api/hosts/:mac", delete(api_hosts_remove))
+        // v0.4.0: rolling "host log" of boot events — what image actually
+        // started installing on what MAC/IP, and when. Persisted to disk.
+        .route("/api/boot-log", get(api_boot_log))
         // Phase 5: Prometheus scrape endpoint. Plain text exposition
         // format. No auth — the metrics surface is intentionally
         // boring (counts, no payloads).
@@ -173,7 +177,16 @@ fn text_plain(body: String) -> Response {
 /// requesting client carries a `?mac=...` query param (iPXE's `${mac}`
 /// substitution) and that MAC has a binding, we short-circuit straight
 /// to the bound target instead of rendering the menu.
-async fn boot_top_menu(State(state): State<AppState>, Query(p): Query<BootMenuParams>) -> Response {
+async fn boot_top_menu(
+    State(state): State<AppState>,
+    peer: Option<ConnectInfo<SocketAddr>>,
+    Query(p): Query<BootMenuParams>,
+) -> Response {
+    // `ConnectInfo` is only populated when axum was started with
+    // `into_make_service_with_connect_info` (production path). Tests
+    // call the router via `oneshot`, which skips that wiring — we
+    // tolerate it by treating the peer as unknown rather than 500ing.
+    let peer_ip = peer.map(|c| c.0.ip());
     state
         .metrics
         .record_http(openpxe_core::HttpRoute::BootScript);
@@ -192,14 +205,33 @@ async fn boot_top_menu(State(state): State<AppState>, Query(p): Query<BootMenuPa
                 mac = %binding.mac, target = %binding.target,
                 "host binding applied"
             );
+            // Pre-record the host-binding event. Reserved menu shortcuts
+            // (`_local`, `_queue`, …) are operator-driven non-imaging
+            // targets — recording them would clutter the Host log with
+            // routine console activity, so we skip those and only record
+            // for real boot-entry ids.
+            if !binding.target.starts_with('_') {
+                let title = lookup_entry_title(&isos, &binding.target);
+                state.boot_log.record(&BootEvent {
+                    timestamp: time::OffsetDateTime::now_utc(),
+                    mac: Some(binding.mac.clone()),
+                    ip: peer_ip,
+                    target_id: binding.target.clone(),
+                    target_title: title,
+                });
+            }
             let target = binding.target;
+            let bound_mac = binding.mac;
             // Reserved menu shortcuts are emitted as `_xxx`; per-entry
             // boot scripts are at `/boot/<id>.ipxe`. Both share the same
-            // `/boot/<name>` route, so the URL is identical.
+            // `/boot/<name>` route, so the URL is identical. We forward
+            // `?mac=` so the per-entry handler can record the boot into
+            // the Host log without depending on iPXE substitution at
+            // this stage.
             return text_plain(format!(
                 "#!ipxe\n\
                  echo OpenPXE: per-MAC binding -> {target}\n\
-                 chain {base}/boot/{target}.ipxe || chain {base}/boot.ipxe\n"
+                 chain {base}/boot/{target}.ipxe?mac={bound_mac} || chain {base}/boot.ipxe\n"
             ));
         }
     }
@@ -207,6 +239,22 @@ async fn boot_top_menu(State(state): State<AppState>, Query(p): Query<BootMenuPa
     text_plain(render_menu(&isos, &settings, base))
 }
 
+/// Best-effort human title for a boot entry id — falls back to the id
+/// itself if the ISO has been deleted between record-time and now.
+fn lookup_entry_title(isos: &[openpxe_iso_store::IsoMeta], target_id: &str) -> String {
+    for iso in isos {
+        for e in &iso.boot_entries {
+            if e.id == target_id {
+                // ISO filename plus the entry title gives the operator
+                // both "which image" and "which variant" (e.g. wimboot
+                // vs sanboot) at a glance.
+                return format!("{} — {}", iso.filename, e.title);
+            }
+        }
+    }
+    target_id.to_string()
+}
+
 #[derive(Debug, Deserialize)]
 struct BootMenuParams {
     /// Client MAC, supplied by iPXE via `${mac}` variable in
@@ -222,13 +270,19 @@ struct BootSubParams {
     /// encoding. Absent on the first request — that's how we know the
     /// client hasn't been prompted yet.
     token: Option<String>,
+    /// Client MAC, supplied by iPXE via `${mac}` in the chain URLs we
+    /// render. Optional — older bookmarks may omit it; the boot log
+    /// just records `None` in that case rather than refusing to boot.
+    mac: Option<String>,
 }
 
 async fn boot_sub(
     State(state): State<AppState>,
+    peer: Option<ConnectInfo<SocketAddr>>,
     AxumPath(filename): AxumPath<String>,
     Query(p): Query<BootSubParams>,
 ) -> Response {
+    let peer_ip = peer.map(|c| c.0.ip());
     // `/boot/<name>.ipxe` where `<name>` is either one of our reserved
     // submenu names (prefixed `_`) or a boot entry id.
     let name = filename.strip_suffix(".ipxe").unwrap_or(&filename);
@@ -300,6 +354,22 @@ async fn boot_sub(
                                 }
                             }
                         }
+                        // Record the boot event. This is the canonical
+                        // moment: password gate (if any) passed, and the
+                        // script is about to be served — i.e. the client
+                        // is genuinely about to start imaging.
+                        let mac_normalized = p
+                            .mac
+                            .as_deref()
+                            .map(openpxe_core::normalize_mac)
+                            .filter(|m| !m.is_empty());
+                        state.boot_log.record(&BootEvent {
+                            timestamp: time::OffsetDateTime::now_utc(),
+                            mac: mac_normalized,
+                            ip: peer_ip,
+                            target_id: entry.id.clone(),
+                            target_title: format!("{} — {}", iso.filename, entry.title),
+                        });
                         return text_plain(render_entry(entry, &settings, base));
                     }
                 }
@@ -546,31 +616,146 @@ async fn api_clear_iso_password(
 }
 
 async fn api_upload_iso(State(state): State<AppState>, mut multipart: Multipart) -> Response {
-    while let Ok(Some(mut field)) = multipart.next_field().await {
+    // Walk multipart parts until we find the file. Each branch logs so an
+    // operator chasing a "stuck" upload in the Terminal tab can see
+    // exactly which stage failed (no field, wrong field name, parser
+    // error, mid-stream drop, sha mismatch on finish, etc.).
+    loop {
+        let field_res = multipart.next_field().await;
+        match field_res {
+            Ok(Some(mut field)) => {
                 if field.name() != Some("file") {
+                    tracing::debug!(
+                        target: "openpxe::http::upload",
+                        field = field.name().unwrap_or("?"),
+                        "skipping non-file multipart part"
+                    );
                     continue;
                 }
                 let filename = field.file_name().unwrap_or("uploaded.iso").to_string();
                 if !filename.to_ascii_lowercase().ends_with(".iso") {
-            return (StatusCode::BAD_REQUEST, "only .iso uploads accepted").into_response();
+                    tracing::warn!(
+                        target: "openpxe::http::upload",
+                        filename = %filename, "rejecting non-.iso upload"
+                    );
+                    return (StatusCode::BAD_REQUEST, "only .iso uploads accepted")
+                        .into_response();
                 }
+                tracing::info!(
+                    target: "openpxe::http::upload",
+                    filename = %filename, "upload started"
+                );
                 let mut handle = match state.iso_store.begin_upload(&filename).await {
                     Ok(h) => h,
-            Err(e) => return (StatusCode::CONFLICT, format!("{e}")).into_response(),
+                    Err(e) => {
+                        tracing::warn!(
+                            target: "openpxe::http::upload",
+                            filename = %filename, error = %e,
+                            "begin_upload rejected (likely duplicate name)"
+                        );
+                        return (StatusCode::CONFLICT, format!("{e}")).into_response();
+                    }
                 };
-        while let Ok(Some(chunk)) = field.chunk().await {
+                // Streamed reader loop. We use an explicit `match` instead
+                // of `while let Ok(Some(_))` so a mid-stream `Err(_)` (a
+                // truncated body from a reverse proxy 524 / network drop)
+                // is treated as a failure rather than silently completing
+                // with a partial file.
+                let mut bytes: u64 = 0;
+                let mut next_log_at: u64 = 64 * 1024 * 1024;
+                loop {
+                    match field.chunk().await {
+                        Ok(Some(chunk)) => {
                             if let Err(e) = handle.write_chunk(&chunk).await {
+                                tracing::error!(
+                                    target: "openpxe::http::upload",
+                                    filename = %filename, bytes,
+                                    error = %e, "write_chunk failed; aborting"
+                                );
                                 let _ = handle.abort().await;
-                return (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response();
+                                return (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}"))
+                                    .into_response();
+                            }
+                            bytes += chunk.len() as u64;
+                            if bytes >= next_log_at {
+                                tracing::info!(
+                                    target: "openpxe::http::upload",
+                                    filename = %filename,
+                                    received_bytes = bytes,
+                                    "upload streaming"
+                                );
+                                // Backoff log cadence: 64 MB, 128, 256, …
+                                next_log_at = next_log_at.saturating_mul(2);
                             }
                         }
+                        Ok(None) => break,
+                        Err(e) => {
+                            tracing::error!(
+                                target: "openpxe::http::upload",
+                                filename = %filename, received_bytes = bytes,
+                                error = %e,
+                                "multipart stream ended with error (likely client \
+                                 disconnect or reverse-proxy buffer cap); aborting"
+                            );
+                            let _ = handle.abort().await;
+                            return (
+                                StatusCode::BAD_REQUEST,
+                                format!(
+                                    "upload truncated after {bytes} bytes: {e}. \
+                                     If you went through a reverse proxy, try the \
+                                     LAN IP directly — large body buffering caps \
+                                     (Cloudflare free tier is 100 MB) commonly \
+                                     cause this."
+                                ),
+                            )
+                                .into_response();
+                        }
+                    }
+                }
+                tracing::info!(
+                    target: "openpxe::http::upload",
+                    filename = %filename, received_bytes = bytes,
+                    "upload body complete; introspecting"
+                );
                 let meta = match handle.finish(&state.iso_store).await {
                     Ok(m) => m,
-            Err(e) => return (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
+                    Err(e) => {
+                        tracing::error!(
+                            target: "openpxe::http::upload",
+                            filename = %filename, error = %e,
+                            "finish failed (rename/introspect)"
+                        );
+                        return (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}"))
+                            .into_response();
+                    }
                 };
+                tracing::info!(
+                    target: "openpxe::http::upload",
+                    iso = %meta.id, size = meta.size_bytes,
+                    family = ?meta.introspection.family,
+                    entries = meta.boot_entries.len(),
+                    "upload finished"
+                );
                 return (StatusCode::CREATED, Json(meta)).into_response();
             }
-    (StatusCode::BAD_REQUEST, "no 'file' part").into_response()
+            Ok(None) => {
+                tracing::warn!(target: "openpxe::http::upload", "upload had no 'file' part");
+                return (StatusCode::BAD_REQUEST, "no 'file' part").into_response();
+            }
+            Err(e) => {
+                tracing::error!(
+                    target: "openpxe::http::upload",
+                    error = %e,
+                    "multipart parser error before reading any field"
+                );
+                return (
+                    StatusCode::BAD_REQUEST,
+                    format!("multipart parse error: {e}"),
+                )
+                    .into_response();
+            }
+        }
+    }
 }
 
 // ─── health / readiness ───────────────────────────────────────────────────
@@ -988,6 +1173,12 @@ async fn api_hosts_remove(
     }
 }
 
+// ─── Boot event log ───────────────────────────────────────────────────────
+
+async fn api_boot_log(State(state): State<AppState>) -> Json<serde_json::Value> {
+    Json(json!({ "events": state.boot_log.list() }))
+}
+
 // ─── Prometheus metrics ───────────────────────────────────────────────────
 
 async fn api_metrics(State(state): State<AppState>) -> Response {

crates/http-api/src/ipxe_script.rs

@@ -182,7 +182,14 @@ pub fn render_family_menu(isos: &[IsoMeta], base_url: &str, is_windows: bool) ->
         s,
         "iseq ${{target}} back && chain {base}/boot.ipxe || goto menu"
     );
-    let _ = writeln!(s, "chain {base}/boot/${{target}}.ipxe || goto menu");
+    // Pass `?mac=${mac}` so the per-entry handler can record the booting
+    // client into the Host log (v0.4.0). iPXE substitutes `${mac}` before
+    // the HTTP fetch; if the firmware can't resolve it the literal
+    // `${mac}` is sent and the server treats it as "unknown".
+    let _ = writeln!(
+        s,
+        "chain {base}/boot/${{target}}.ipxe?mac=${{mac}} || goto menu"
+    );
     s
 }
 
@@ -461,9 +468,14 @@ pub fn render_password_prompt(entry_id: &str, iso_filename: &str, base_url: &str
     );
     let _ = writeln!(s, ":submit");
     let _ = writeln!(s, "echo Verifying...");
+    // Carry `mac=${mac}` alongside the token so a successful unlock
+    // records the actual client MAC into the Host log (v0.4.0). On
+    // older iPXE that can't resolve `${mac}` the server just stores it
+    // as "unknown" rather than refusing to boot.
     let _ = writeln!(
         s,
-        "chain {base}/boot/{entry_id}.ipxe?token=${{password:uristring}} || chain {base}/boot.ipxe"
+        "chain {base}/boot/{entry_id}.ipxe?token=${{password:uristring}}&mac=${{mac}} \
+         || chain {base}/boot.ipxe"
     );
     s
 }

crates/http-api/src/state.rs

@@ -1,4 +1,6 @@
-use openpxe_core::{ClientRegistry, DeploymentQueue, HostBindings, LogBus, Metrics, SettingsStore};
+use openpxe_core::{
+    BootLog, ClientRegistry, DeploymentQueue, HostBindings, LogBus, Metrics, SettingsStore,
+};
 use openpxe_iso_store::{IsoStore, NfsManager, SmbManager};
 use std::sync::Arc;
 use time::OffsetDateTime;
@@ -13,6 +15,10 @@ pub struct AppState {
     /// these MACs requests `/boot.ipxe`, we chain straight to the
     /// configured target instead of rendering the menu.
     pub hosts: HostBindings,
+    /// Persistent boot-event log surfaced under the Hosts tab. Records
+    /// every `/boot/<entry>.ipxe` chain that goes on to serve a script
+    /// (i.e. an image actually starting to install on a machine).
+    pub boot_log: BootLog,
     /// Lock-free metrics counters surfaced at `/metrics` in Prometheus
     /// text format. Cheap to clone (handles to atomics).
     pub metrics: Metrics,

crates/http-api/tests/full_flow.rs

@@ -98,6 +98,7 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
     iso_store.set_nfs_root(nfs.mount_root());
     let log_bus = LogBus::new(64);
     let hosts = HostBindings::load_or_default(dir.path());
+    let boot_log = openpxe_core::BootLog::load_or_default(dir.path());
     let metrics = Metrics::new();
     let state = AppState {
         iso_store,
@@ -105,6 +106,7 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
         queue,
         settings,
         hosts,
+        boot_log,
         metrics,
         smb: None,
         nfs,
@@ -975,3 +977,109 @@ async fn set_password_for_unknown_iso_returns_404() {
         .unwrap();
     assert_eq!(res.status(), StatusCode::NOT_FOUND);
 }
+
+#[tokio::test]
+async fn boot_log_records_entry_serve_with_mac() {
+    // End-to-end: upload an ISO, fetch the entry's boot script with a
+    // MAC query param, then GET /api/boot-log and assert the event is
+    // there with the supplied mac.
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+
+    let (ct, body) = multipart_iso_body("fake-alpine.iso", &fake_alpine_iso());
+    let upload = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri("/api/isos")
+                .header("content-type", ct)
+                .body(Body::from(body))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(upload.status(), StatusCode::CREATED);
+
+    // Fetch the per-entry script with ?mac=...
+    let (s, _) = get(
+        &app,
+        "/boot/fake-alpine-linux.ipxe?mac=AA:BB:CC:00:00:09",
+    )
+    .await;
+    assert_eq!(s, StatusCode::OK);
+
+    // The boot log should now contain exactly one entry, with the
+    // normalized MAC and our target id.
+    let (s, body) = get(&app, "/api/boot-log").await;
+    assert_eq!(s, StatusCode::OK);
+    let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    let events = v["events"].as_array().expect("events");
+    assert_eq!(events.len(), 1);
+    let ev = &events[0];
+    assert_eq!(ev["target_id"], "fake-alpine-linux");
+    assert_eq!(ev["mac"], "aa:bb:cc:00:00:09"); // normalized
+    // Title should include the filename and entry title.
+    let title = ev["target_title"].as_str().unwrap();
+    assert!(title.contains("fake-alpine.iso"), "title was {title}");
+}
+
+#[tokio::test]
+async fn boot_log_endpoint_empty_when_no_boots() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (s, body) = get(&app, "/api/boot-log").await;
+    assert_eq!(s, StatusCode::OK);
+    let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert!(v["events"].as_array().unwrap().is_empty());
+}
+
+#[tokio::test]
+async fn boot_log_does_not_record_reserved_menu_targets() {
+    // Reserved targets (_local, _queue, …) are operator console actions,
+    // not imaging events. The Hosts log skips them so it stays focused
+    // on "what got installed where".
+    let (state, _dir) = build_state().await;
+    let app = build_router(state.clone());
+
+    // Bind a MAC to the _local shortcut and hit /boot.ipxe.
+    let body = r#"{"mac":"aa:bb:cc:00:00:11","target":"_local","label":"q"}"#;
+    let (s, _) = post_json(&app, "/api/hosts", body).await;
+    assert_eq!(s, StatusCode::CREATED);
+    let (s, _) = get(&app, "/boot.ipxe?mac=aa:bb:cc:00:00:11").await;
+    assert_eq!(s, StatusCode::OK);
+
+    let (_, body) = get(&app, "/api/boot-log").await;
+    let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert!(
+        v["events"].as_array().unwrap().is_empty(),
+        "reserved targets should not appear in boot log; got {v}"
+    );
+}
+
+#[tokio::test]
+async fn upload_rejects_non_iso_filename_with_clear_message() {
+    // Sanity for the upload-logging path: a wrong extension should land
+    // a 400 with the human message rather than silently being eaten by
+    // the multipart loop. (No iso ends up in the store either.)
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (ct, body) = multipart_iso_body("not-an-iso.txt", b"hello world");
+    let res = app
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri("/api/isos")
+                .header("content-type", ct)
+                .body(Body::from(body))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(res.status(), StatusCode::BAD_REQUEST);
+    let body = axum::body::to_bytes(res.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    let text = std::str::from_utf8(&body).unwrap();
+    assert!(text.contains("only .iso uploads accepted"), "got: {text}");
+}

crates/openpxe/src/main.rs

@@ -103,6 +103,7 @@ async fn main() -> anyhow::Result<()> {
     let queue = DeploymentQueue::new();
     let settings = SettingsStore::load_or_default(&config.paths.work_dir);
     let hosts = HostBindings::load_or_default(&config.paths.work_dir);
+    let boot_log = openpxe_core::BootLog::load_or_default(&config.paths.work_dir);
     let metrics = Metrics::new();
 
     // Build the SMB manager unconditionally — it starts/stops on the
@@ -140,6 +141,7 @@ async fn main() -> anyhow::Result<()> {
         settings: settings.clone(),
         queue: queue.clone(),
         hosts: hosts.clone(),
+        boot_log: boot_log.clone(),
         metrics: metrics.clone(),
         smb: Some(smb.clone()),
         nfs: nfs.clone(),
@@ -156,7 +158,15 @@ async fn main() -> anyhow::Result<()> {
     let http_task = tokio::spawn(async move {
         let listener = tokio::net::TcpListener::bind(http_addr).await?;
         tracing::info!(target: "openpxe::http", "HTTP listening on {http_addr}");
-        axum::serve(listener, router).await?;
+        // `into_make_service_with_connect_info` is required so per-request
+        // `ConnectInfo<SocketAddr>` extractors can resolve the peer IP —
+        // used by `/boot/<entry>.ipxe` to record the booting client's
+        // address into the Host log. Without this the extractor 500s.
+        axum::serve(
+            listener,
+            router.into_make_service_with_connect_info::<std::net::SocketAddr>(),
+        )
+        .await?;
         Ok::<_, anyhow::Error>(())
     });
 

crates/webui/src/app.css

@@ -8,23 +8,26 @@
  * CSS lands). */
 
 :root {
-  /* Dark palette (default). */
+  /* Jet-black dark palette (default). Modelled on Netbox Labs's
-  --bg:           #0b1018;
+     near-black product chrome — surfaces step from #000 → #0d → #16 → #1c
-  --bg-panel:    #121826;
+     rather than the previous blue-tinted ramp, so the UI reads as a
-  --bg-panel-2:  #1a2334;
+     genuine "dark" rather than "dim navy". */
-  --bg-elev:     #223047;
+  --bg:           #000000;
-  --fg:           #e4e8ef;
+  --bg-panel:    #0a0a0a;
-  --fg-dim:      #8a94a7;
+  --bg-panel-2:  #141414;
-  --fg-dimmer:   #5a6379;
+  --bg-elev:     #1c1c1c;
-  --accent:       #00d4b4;   /* Netbox-ish teal */
+  --fg:           #e8eaed;
+  --fg-dim:      #9aa0a6;
+  --fg-dimmer:   #6b7077;
+  --accent:       #00d4b4;   /* Netbox-ish teal — kept for brand */
   --accent-dim:  #07a38c;
   --warn:         #ffb347;
   --err:          #ef6e6e;
   --ok:           #4ade80;
-  --border:       #223047;
+  --border:       #1f1f1f;
-  --border-soft: #172033;
+  --border-soft: #141414;
-  --terminal-bg: #06090e;
+  --terminal-bg: #000000;
-  --shadow-card: 0 1px 0 rgba(255,255,255,0.02), 0 8px 24px rgba(0,0,0,0.25);
+  --shadow-card: 0 1px 0 rgba(255,255,255,0.02), 0 8px 24px rgba(0,0,0,0.55);
   --radius:      6px;
   --radius-lg:  10px;
   --sidebar-w:  240px;
@@ -113,10 +116,30 @@ code, kbd { font-family: var(--mono); font-size: 12.5px;
 }
 .sidebar nav a.active .count { background: var(--accent); color: #002923; }
 .sidebar .footer {
-  padding: 10px 18px; border-top: 1px solid var(--border);
+  padding: 12px 18px; border-top: 1px solid var(--border);
   color: var(--fg-dimmer); font-size: 11px;
+  display: flex; flex-direction: column; gap: 4px;
 }
-.sidebar .footer code { background: transparent; color: var(--fg-dim); padding: 0; }
+.sidebar .footer code { background: transparent; color: var(--fg-dim); padding: 0;
+  font-size: 11px; word-break: break-all; }
+.sidebar .footer .status-row {
+  display: flex; align-items: center; gap: 8px;
+  margin-bottom: 4px;
+}
+.sidebar .footer .status-row .dot {
+  width: 8px; height: 8px; border-radius: 50%; display: inline-block;
+  background: var(--fg-dimmer); flex: none;
+}
+.sidebar .footer .status-row .dot.ok   { background: var(--ok);
+  box-shadow: 0 0 6px color-mix(in srgb, var(--ok) 60%, transparent); }
+.sidebar .footer .status-row .dot.err  { background: var(--err); }
+.sidebar .footer .status-row .dot.warn { background: var(--warn); }
+.sidebar .footer .status-label { color: var(--fg-dim); }
+.sidebar .footer .status-value { color: var(--fg); font-weight: 600; }
+.sidebar .footer .status-value.ok   { color: var(--ok); }
+.sidebar .footer .status-value.err  { color: var(--err); }
+.sidebar .footer .status-value.warn { color: var(--warn); }
+.sidebar .footer .footer-sub { color: var(--fg-dimmer); margin-top: 2px; }
 
 /* ── Top bar ───────────────────────────────────────────────────────── */
 
@@ -431,29 +454,29 @@ tr.unbootable td:first-child { border-left: 3px solid var(--warn); }
 .terminal .input-row {
   display: flex; align-items: center; gap: 8px;
   padding: 8px 14px;
-  background: #0a0e15;
+  background: #050505;
-  border-top: 1px solid #1d2330;
+  border-top: 1px solid #181818;
 }
 .terminal .input-row .prompt { color: var(--accent); font-family: var(--mono); }
 .terminal .input-row input {
-  flex: 1; background: transparent; border: 0; color: #e4e8ef;
+  flex: 1; background: transparent; border: 0; color: var(--fg);
   font: inherit; font-family: var(--mono); font-size: 13px;
   outline: none; padding: 4px 0;
 }
 .terminal .toolbar {
   display: flex; gap: 8px; align-items: center;
   padding: 8px 14px;
-  background: #0a0e15;
+  background: #050505;
-  border-bottom: 1px solid #1d2330;
+  border-bottom: 1px solid #181818;
-  font-size: 12px; color: #8a94a7;
+  font-size: 12px; color: var(--fg-dim);
 }
 .terminal .toolbar .right { margin-left: auto; display: flex; gap: 6px; }
 .terminal .toolbar button {
   padding: 3px 9px; font-size: 11px;
-  background: transparent; color: #8a94a7; border: 1px solid #1d2330;
+  background: transparent; color: var(--fg-dim); border: 1px solid #181818;
   font-weight: 500;
 }
-.terminal .toolbar button:hover { color: #e4e8ef; background: #1d2330; }
+.terminal .toolbar button:hover { color: var(--fg); background: #181818; }
 
 /* ── About card ─────────────────────────────────────────────────── */
 .about-hero { padding: 20px 24px; }

crates/webui/src/app.js

@@ -295,7 +295,7 @@
 
       return el('div', {class:'grid'}, [
         el('div', {class:'card'}, [
-          el('header', {}, el('h2', {}, 'Forge')),
+          el('header', {}, el('h2', {}, 'Status')),
           queueProgressWidget(imaging, entries.length),
         ]),
         el('div', {class:'card'}, [
@@ -346,27 +346,66 @@
       });
       file.onchange = () => { if (file.files[0]) upload(file.files[0]); };
 
+      // Upload telemetry. We surface bytes-sent + percent + ETA so when
+      // an upload stalls (e.g. a reverse proxy is buffering or rejecting
+      // a >100MB body) the operator can see it instead of staring at a
+      // 0% bar. We also tag the most common failure modes — timeout,
+      // network drop, HTTP 413/502/504 — with hints so the path forward
+      // is obvious from the UI.
       function upload(f) {
-        upMsg.textContent = 'Uploading ' + f.name + ' (' + fmtBytes(f.size) + ')…';
+        const started = Date.now();
-        upMsg.className = 'msg';
+        const bar = $('#bar');
+        const setStatus = (text, cls) => { upMsg.textContent = text; upMsg.className = 'msg ' + (cls || ''); };
+        setStatus('Uploading ' + f.name + ' (' + fmtBytes(f.size) + ')…');
         prog.classList.add('active');
+        bar.style.width = '0%';
         const fd = new FormData(); fd.append('file', f);
         const xhr = new XMLHttpRequest();
+        // 4-hour ceiling for very large ISOs over slow links. Browser
+        // default is 0 (never time out); we set an explicit cap so a
+        // stalled connection doesn't masquerade as "still uploading".
+        xhr.timeout = 4 * 60 * 60 * 1000;
         xhr.upload.onprogress = e => {
-          if (e.lengthComputable) $('#bar').style.width = (e.loaded/e.total*100).toFixed(1) + '%';
+          if (!e.lengthComputable) return;
+          const pct = (e.loaded / e.total) * 100;
+          bar.style.width = pct.toFixed(1) + '%';
+          const elapsed = (Date.now() - started) / 1000;
+          const rate = elapsed > 0 ? e.loaded / elapsed : 0;
+          const remain = rate > 0 ? (e.total - e.loaded) / rate : 0;
+          setStatus(
+            'Uploading ' + f.name + ' — ' +
+            fmtBytes(e.loaded) + ' of ' + fmtBytes(e.total) +
+            ' (' + pct.toFixed(1) + '%, ' + fmtBytes(rate) + '/s' +
+            (remain > 0 ? ', ' + Math.ceil(remain) + 's left' : '') + ')');
         };
         xhr.onload = () => {
           prog.classList.remove('active');
-          $('#bar').style.width = '0';
+          bar.style.width = '0';
           if (xhr.status >= 200 && xhr.status < 300) {
-            upMsg.textContent = 'Uploaded & analyzed.'; upMsg.className = 'msg ok';
+            setStatus('Uploaded & analyzed: ' + f.name + ' (' + fmtBytes(f.size) + ')', 'ok');
             render('storage');
-          } else {
+            return;
-            upMsg.textContent = 'Upload failed: ' + xhr.status + ' ' + xhr.responseText;
-            upMsg.className = 'msg err';
           }
+          let hint = '';
+          if (xhr.status === 413)      hint = ' — body too large. A reverse proxy in front of OpenPXE (Cloudflare free tier caps at 100 MB) likely rejected it. Try the LAN IP directly.';
+          else if (xhr.status === 502) hint = ' — bad gateway. Reverse proxy lost the upstream mid-stream.';
+          else if (xhr.status === 504) hint = ' — gateway timeout. The upload took longer than the proxy allows; try the LAN IP.';
+          else if (xhr.status === 409) hint = ' — an ISO with this name already exists. Remove the old one or rename.';
+          setStatus('Upload failed: HTTP ' + xhr.status + ' ' + (xhr.responseText || '').slice(0, 200) + hint, 'err');
+        };
+        xhr.onerror = () => {
+          prog.classList.remove('active');
+          setStatus('Upload failed: network error or connection closed mid-stream. ' +
+                    'If you went through a reverse proxy, try the server\'s LAN IP directly.', 'err');
+        };
+        xhr.ontimeout = () => {
+          prog.classList.remove('active');
+          setStatus('Upload timed out after 4 hours.', 'err');
+        };
+        xhr.onabort = () => {
+          prog.classList.remove('active');
+          setStatus('Upload aborted.', 'err');
         };
-        xhr.onerror = () => { upMsg.textContent = 'Network error.'; upMsg.className = 'msg err'; };
         xhr.open('POST', '/api/isos');
         xhr.send(fd);
       }
@@ -602,9 +641,11 @@
     },
 
     hosts: async () => {
-      const [{ hosts = [] }, isos] = await Promise.all([
+      const [{ hosts = [] }, isos, bootLogRes] = await Promise.all([
         getJSON('/api/hosts'), getJSON('/api/isos'),
+        getJSON('/api/boot-log').catch(() => ({ events: [] })),
       ]);
+      const bootEvents = bootLogRes.events || [];
       const targets = isos.flatMap(i => i.boot_entries.map(e => ({
         id: e.id, title: e.title + '  — ' + familyLabel(i.introspection.family),
       })));
@@ -680,8 +721,7 @@
             upsertBtn, msg,
             el('p', {class:'msg', style:'margin-top:14px'},
               'When a client with a bound MAC requests boot.ipxe, OpenPXE ' +
-              'short-circuits past the interactive menu and chains directly. ' +
+              'short-circuits past the interactive menu and chains directly.'),
-              'Inspired by Tinkerbell smee\'s MAC-prepended URL pattern.'),
           ]),
         ]),
         el('div', {class:'card'}, [
@@ -691,6 +731,37 @@
           ]),
           table,
         ]),
+        el('div', {class:'card'}, [
+          el('header', {}, [
+            el('h2', {}, 'Host log'),
+            el('span', {class:'sub'},
+              bootEvents.length + ' event' + (bootEvents.length === 1 ? '' : 's')),
+          ]),
+          bootEvents.length
+            ? el('table', {}, [
+                el('thead', {}, el('tr', {}, [
+                  el('th', {}, 'Time'),
+                  el('th', {}, 'MAC'),
+                  el('th', {}, 'IP'),
+                  el('th', {}, 'Image'),
+                ])),
+                el('tbody', {},
+                  bootEvents.map(e => el('tr', {}, [
+                    el('td', {}, fmtAgo(e.timestamp)),
+                    el('td', {class:'mono'}, e.mac || el('span', {class:'tag'}, '(unknown)')),
+                    el('td', {class:'mono'}, e.ip ? String(e.ip) : '—'),
+                    el('td', {}, [
+                      el('span', {style:'font-weight:600'}, e.target_title || e.target_id),
+                      el('div', {class:'meta',
+                        style:'color:var(--fg-dim);font-size:11.5px;margin-top:2px'},
+                        e.target_id),
+                    ]),
+                  ]))),
+              ])
+            : el('div', {class:'empty'},
+                'No boot events yet. When a PXE client chains a boot entry, ' +
+                'it lands here with the MAC, IP, and image it received.'),
+        ]),
       ]);
     },
 
@@ -915,6 +986,24 @@
     }
   }
 
+  // Set the sidebar footer "Service status:" line. The chip itself moved
+  // off the topbar in v0.4.0 — operators wanted readiness, advertised
+  // URL, and the boot IP grouped together as the bottom-left summary.
+  function setReady(state) {
+    const dot = $('[data-bind=ready_dot]');
+    const lbl = $('[data-bind=ready_label]');
+    if (!dot || !lbl) return;
+    const map = {
+      ready:       { cls: 'ok',  text: 'Ready' },
+      notready:    { cls: 'err', text: 'Not ready' },
+      unreachable: { cls: 'err', text: 'Unreachable' },
+    };
+    const m = map[state] || { cls: 'warn', text: 'Checking…' };
+    dot.className = 'dot ' + m.cls;
+    lbl.className = 'status-value ' + m.cls;
+    lbl.textContent = m.text;
+  }
+
   async function refreshChips() {
     try {
       const s = await getJSON('/api/status');
@@ -924,14 +1013,9 @@
       $$('[data-bind=client_count],[data-bind=client_count2]').forEach(n => n.textContent = String(s.client_count));
       $$('[data-bind=queue_count],[data-bind=queue_count2]').forEach(n => n.textContent = String(s.queue_count));
       $$('[data-bind=host_count]').forEach(n => n.textContent = String(s.host_bindings || 0));
-      const chip = $('[data-bind=ready_chip]');
+      setReady(r.ok ? 'ready' : 'notready');
-      if (chip) {
-        if (r.ok) { chip.textContent = '● ready'; chip.className = 'chip ready'; }
-        else      { chip.textContent = '● not ready'; chip.className = 'chip notready'; }
-      }
     } catch {
-      const chip = $('[data-bind=ready_chip]');
+      setReady('unreachable');
-      if (chip) { chip.textContent = '● unreachable'; chip.className = 'chip notready'; }
     }
   }
 

crates/webui/src/index.html

@@ -29,7 +29,7 @@
       <img src="/assets/logo.svg" alt="" />
       <div>
         <strong>OpenPXE</strong>
-        <div class="sub">v<span data-bind="version">0.3.2</span></div>
+        <div class="sub">v<span data-bind="version">0.4.0</span></div>
       </div>
     </div>
     <nav>
@@ -51,7 +51,12 @@
       <a data-view="about">About</a>
     </nav>
     <div class="footer">
-      Advertised to clients<br/>
+      <div class="status-row">
+        <span class="dot" data-bind="ready_dot" title="Server readiness"></span>
+        <span class="status-label">Service status:</span>
+        <span class="status-value" data-bind="ready_label">checking…</span>
+      </div>
+      <div class="footer-sub">Advertised to clients</div>
       <code>{{BASE_URL}}</code>
     </div>
   </aside>
@@ -59,7 +64,6 @@
   <header class="topbar">
     <h1 data-bind="view_title">Dashboard</h1>
     <div class="spacer"></div>
-    <span class="chip" data-bind="ready_chip" title="Server readiness">checking…</span>
     <span class="chip"><strong data-bind="iso_count2">0</strong>&nbsp;images</span>
     <span class="chip"><strong data-bind="client_count2">0</strong>&nbsp;clients</span>
     <span class="chip"><strong data-bind="queue_count2">0</strong>&nbsp;in queue</span>