v0.4.65: swap kernel-mount NFS for userspace SMB (smbclient)

v0.4.64's NFS path didn't work on Unraid even with --privileged
because Unraid's base kernel ships without the nfs/nfsv4 client
modules — and no container-side configuration can load a host kernel
module. SMB has the same kernel-mount problem (`mount -t cifs` needs
the cifs module) but it also has a usable *userspace* client: Samba's
`smbclient` CLI, which speaks the SMB protocol over a plain TCP socket
with no kernel involvement. This is the same approach Bootimus uses,
and works in every container regardless of host kernel modules or
container capabilities.

What's gone:

* `crates/iso-store/src/nfs.rs` (in entirety)
* `NfsManager`, `NfsMount`, `NfsAddRequest`, `NfsVersion` types
* `IsoSource::Nfs` variant
* `IsoStore::nfs_root` / `IsoStore::set_nfs_root`
* `/api/nfs`, `/api/nfs/:id`, `/api/nfs/:id/scan` routes
* `nfs` terminal command
* Storage tab's NFS shares card and the v0.4.64 fstab-options
  diagnostics work (the whole error path is moot now)

What's new:

* `crates/iso-store/src/smb_share.rs` — `SmbShareManager` that drives
  `smbclient` as a subprocess. Indexes shares via `smbclient -c "ls
  *.iso"` and streams files via `smbclient -c "get file -"` piped
  straight into HTTP response bodies. No local cache, no double disk
  usage.
* `IsoSource::Smb { share_id, relative_path }` variant.
* `IsoStore::iso_path_for` returns None for SMB sources — the HTTP
  ISO download handler dispatches on the source kind and streams via
  the SmbShareManager when it's SMB.
* `/api/smb-shares` + `/api/smb-shares/:id` + `/api/smb-shares/:id/scan`
  routes.
* `share` terminal command (`list | add //srv/share [auth] | remove |
  scan`). Auth spec is `guest` or `user:password`.
* Storage tab: SMB shares card replaces the NFS one. Two-column form
  for server + share name, three-column form for guest checkbox /
  username / password. Username and password fields auto-disable when
  Guest is checked.
* Credentials live under <work_dir>/smb_creds/<id>.cred at 0600
  permissions so they don't leak through `ps`. Persisted state at
  <work_dir>/smb_shares.json (sans password — re-entered on add /
  re-scan).

Why subprocess and not a Rust crate:

* The Debian runtime image already ships the `samba` package
  (Dockerfile line 84) — `smbclient` is right there.
* Library options (pavao, etc.) wrap libsmbclient so they still pull
  in the same C library at runtime.
* Subprocess gives operators a verifiable mental model — anything
  OpenPXE can do over SMB, they can reproduce by running `smbclient`
  manually at a shell.

Range-request limitation, called out in the smb_share.rs module docs
and the UI explainer: `smbclient -c 'get file -'` is a sequential
whole-file stream. HTTP range requests on SMB-sourced ISOs return
416. PXE workloads (iPXE chain, casper sanboot, wimboot) do
whole-file sequential reads, so this works in practice. A follow-up
release can add libsmbclient-based seek if a real workload needs it.

Stderr-to-hint translation patterns mirror v0.4.64's NFS work:
NT_STATUS_LOGON_FAILURE → "check credentials", BAD_NETWORK_NAME →
"check share name", connection refused / timeout → "verify
reachability + firewall", etc. UI renders the raw smbclient error
plus the hint as two lines.

Tests (149 total, was 142 in v0.4.64):
* smb_share parser tests covering ISO + skipped directory, filenames
  with spaces, non-ISO filtering.
* hint_for() translation tests for the dominant NT_STATUS codes.
* Server normalization (smb://, cifs://, \\, // prefixes all stripped).
* HTTP integration: shares list starts empty, invalid server / missing
  username / path in share name all rejected with actionable hints.

`cargo clippy --workspace --all-targets -- -D warnings` clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

crates/http-api/src/app.rs

@@ -35,7 +35,7 @@ use openpxe_core::{
     MAX_LOGO_BYTES,
 };
 use openpxe_ipxe_assets::asset_bytes;
-use openpxe_iso_store::{IsoCategory, IsoMeta, NfsAddRequest};
+use openpxe_iso_store::{IsoCategory, IsoMeta, IsoSource, SmbAddRequest};
 use serde::Deserialize;
 use serde_json::json;
 use std::net::SocketAddr;
@@ -132,10 +132,15 @@ pub fn build_router(state: AppState) -> Router {
         .route("/api/queue/poll/:entry_id", get(api_queue_poll))
         .route("/api/queue/assign", post(api_queue_assign))
         .route("/api/queue/:entry_id", delete(api_queue_release))
-        // Phase 4: NFS share manager.
-        .route("/api/nfs", get(api_nfs_list).post(api_nfs_add))
-        .route("/api/nfs/:id", delete(api_nfs_remove))
-        .route("/api/nfs/:id/scan", post(api_nfs_scan))
+        // v0.4.65: SMB share manager (userspace via smbclient). The
+        // kernel-mount NFS routes that v0.4.64 shipped are gone — they
+        // didn't work on hosts whose kernel lacked the nfs client
+        // modules (Unraid), and no container-side configuration could
+        // load a host kernel module. `smbclient` speaks SMB over a
+        // plain TCP socket in userspace, works in every container.
+        .route("/api/smb-shares", get(api_smb_shares_list).post(api_smb_shares_add))
+        .route("/api/smb-shares/:id", delete(api_smb_shares_remove))
+        .route("/api/smb-shares/:id/scan", post(api_smb_shares_scan))
         // Phase 4: Network info (read-only) + DNS edit.
         .route("/api/network", get(api_network).put(api_network_put))
         // Phase 4: live-log stream + recent buffer for the Terminal tab.
@@ -638,12 +643,59 @@ async fn iso_raw(
     headers: HeaderMap,
 ) -> Response {
     let id = filename.strip_suffix(".iso").unwrap_or(&filename);
-    let Some(path) = state.iso_store.iso_path_for(id) else {
+    // v0.4.65: SMB-sourced ISOs have no on-disk path — they're
+    // streamed live from the remote share via `smbclient`. We look
+    // up the meta first to decide whether to take the path-based
+    // local route or the subprocess-based SMB route.
+    let Some(meta) = state.iso_store.get(id) else {
         return (StatusCode::NOT_FOUND, "no such iso").into_response();
     };
-    match stream_file_range(&path, headers.get(header::RANGE)).await {
-        Ok(r) => r,
-        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
+    match &meta.source {
+        IsoSource::Local => {
+            let Some(path) = state.iso_store.iso_path_for(id) else {
+                return (StatusCode::NOT_FOUND, "no such iso").into_response();
+            };
+            match stream_file_range(&path, headers.get(header::RANGE)).await {
+                Ok(r) => r,
+                Err(e) => {
+                    (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response()
+                }
+            }
+        }
+        IsoSource::Smb {
+            share_id,
+            relative_path,
+        } => {
+            // Range requests aren't supported for SMB sources in
+            // v0.4.65 — smbclient's CLI can't seek mid-stream. iPXE
+            // chain loading and ISO sanboot do whole-file sequential
+            // reads, so this works in practice. A 416 here lets the
+            // client fall back to a full GET if it tried a range.
+            if headers.get(header::RANGE).is_some() {
+                return Response::builder()
+                    .status(StatusCode::RANGE_NOT_SATISFIABLE)
+                    .header(header::CONTENT_RANGE, format!("bytes */{}", meta.size_bytes))
+                    .body(Body::empty())
+                    .unwrap();
+            }
+            match state.smb_shares.stream_iso(share_id, relative_path).await {
+                Ok(stream) => {
+                    let reader = stream.stdout;
+                    let body_stream = tokio_util::io::ReaderStream::new(reader);
+                    Response::builder()
+                        .status(StatusCode::OK)
+                        .header(header::CONTENT_TYPE, "application/octet-stream")
+                        .header(header::CONTENT_LENGTH, meta.size_bytes)
+                        // Tell intermediaries we don't support
+                        // ranges on this resource; saves them from
+                        // even trying.
+                        .header(header::ACCEPT_RANGES, "none")
+                        .body(Body::from_stream(body_stream))
+                        .unwrap()
+                }
+                Err(e) => (StatusCode::BAD_GATEWAY, format!("smb stream: {e}")).into_response(),
+            }
+        }
     }
 }
 
@@ -651,6 +703,10 @@ async fn iso_file(
     State(state): State<AppState>,
     AxumPath((id, path)): AxumPath<(String, String)>,
 ) -> Response {
+    // In-ISO file extraction is only supported for local ISOs — it
+    // needs random-access reads into the ISO9660 directory tree, which
+    // smbclient's whole-file streaming can't do efficiently. SMB-
+    // sourced ISOs use the raw streaming endpoint above instead.
     let Some(iso_path) = state.iso_store.iso_path_for(&id) else {
         return (StatusCode::NOT_FOUND, "no such iso").into_response();
     };
@@ -1027,16 +1083,16 @@ async fn api_docs() -> Json<serde_json::Value> {
                 ],
             },
             {
-                "name": "NFS shares",
+                "name": "SMB shares",
                 "endpoints": [
-                    {"method": "GET", "path": "/api/nfs",
-                     "summary": "List configured NFS shares with mount state and iso counts."},
-                    {"method": "POST", "path": "/api/nfs",
-                     "summary": "Mount an NFS share. Body: { server, export, version, read_only }."},
-                    {"method": "DELETE", "path": "/api/nfs/:id",
-                     "summary": "Unmount a share and drop its entries from the ISO store."},
-                    {"method": "POST", "path": "/api/nfs/:id/scan",
-                     "summary": "Re-walk a mounted share for ISOs."},
+                    {"method": "GET", "path": "/api/smb-shares",
+                     "summary": "List configured SMB shares with connection state and iso counts."},
+                    {"method": "POST", "path": "/api/smb-shares",
+                     "summary": "Register an SMB share. Body: { server, share, guest, username?, password?, port? }."},
+                    {"method": "DELETE", "path": "/api/smb-shares/:id",
+                     "summary": "Forget a share and drop its entries from the ISO store."},
+                    {"method": "POST", "path": "/api/smb-shares/:id/scan",
+                     "summary": "Re-list a share for new ISOs."},
                 ],
             },
             {
@@ -1453,8 +1509,11 @@ async fn api_list_clients(State(state): State<AppState>) -> Json<serde_json::Val
 
 async fn api_status(State(state): State<AppState>) -> Json<serde_json::Value> {
     let smb = state.smb.as_ref().map(|s| s.snapshot());
-    let nfs = state.nfs.list();
-    let nfs_active = nfs.iter().filter(|m| m.mounted).count();
+    // v0.4.65: NFS replaced with SMB shares. The dashboard metric
+    // shape stays similar (count + reachable) so the UI doesn't have
+    // to change its top-line tiles.
+    let smb_shares = state.smb_shares.list();
+    let smb_reachable = smb_shares.iter().filter(|m| m.reachable).count();
     let isos = state.iso_store.list();
     let clients = state.clients.list();
     let queue_entries = state.queue.list();
@@ -1473,7 +1532,7 @@ async fn api_status(State(state): State<AppState>) -> Json<serde_json::Value> {
     state
         .metrics
         .set_queue_counts(queue_entries.len() as u64, imaging as u64);
-    state.metrics.set_nfs_active(nfs_active as u64);
+    state.metrics.set_nfs_active(smb_reachable as u64);
     state.metrics.record_http(openpxe_core::HttpRoute::Api);
     let now = time::OffsetDateTime::now_utc();
     let uptime_secs = (now - state.started_at).whole_seconds().max(0);
@@ -1488,8 +1547,12 @@ async fn api_status(State(state): State<AppState>) -> Json<serde_json::Value> {
         "ipxe_assets": openpxe_ipxe_assets::list_assets(),
         "settings": state.settings.snapshot(),
         "smb": smb,
-        "nfs_count": nfs.len(),
-        "nfs_active": nfs_active,
+        // Keep the field names for now so existing UI bindings on
+        // `iso_count2` / `client_count2` / sidebar counters keep
+        // working. They cover "external storage shares" generically;
+        // v0.4.65 the source is SMB instead of NFS.
+        "smb_share_count": smb_shares.len(),
+        "smb_share_reachable": smb_reachable,
         "host_bindings": state.hosts.len(),
         "custom_logo": state.branding.has_logo(),
         "uptime_secs": uptime_secs,
@@ -1704,33 +1767,42 @@ async fn api_queue_release(
     }
 }
 
-// ─── NFS share API ─────────────────────────────────────────────────────────
+// ─── SMB share API (v0.4.65) ───────────────────────────────────────────────
+//
+// Replaces the NFS share manager from v0.4.64. The wire shape is similar
+// — a {shares: [...]} list, a POST that returns either the share or a
+// structured {error, stderr, hint} body — so the UI can render both the
+// same way.
 
-async fn api_nfs_list(State(state): State<AppState>) -> Json<serde_json::Value> {
-    Json(json!({ "mounts": state.nfs.list() }))
+async fn api_smb_shares_list(State(state): State<AppState>) -> Json<serde_json::Value> {
+    Json(json!({ "shares": state.smb_shares.list() }))
 }
 
-async fn api_nfs_add(State(state): State<AppState>, Json(req): Json<NfsAddRequest>) -> Response {
-    match state.nfs.add(req).await {
-        Ok(m) => (StatusCode::CREATED, Json(m)).into_response(),
-        // v0.4.64: the manager returns a structured `NfsMountError` with
-        // `error` + optional `hint` + the raw `stderr`, so the UI can
-        // show both — the raw message for completeness, the hint for
-        // "what to fix next". Previously this was a plain text body
-        // which collapsed both bits of information into one line.
+async fn api_smb_shares_add(
+    State(state): State<AppState>,
+    Json(req): Json<SmbAddRequest>,
+) -> Response {
+    match state.smb_shares.add(req).await {
+        Ok(s) => (StatusCode::CREATED, Json(s)).into_response(),
         Err(err) => (StatusCode::BAD_REQUEST, Json(err)).into_response(),
     }
 }
 
-async fn api_nfs_remove(State(state): State<AppState>, AxumPath(id): AxumPath<String>) -> Response {
-    match state.nfs.remove(&id).await {
+async fn api_smb_shares_remove(
+    State(state): State<AppState>,
+    AxumPath(id): AxumPath<String>,
+) -> Response {
+    match state.smb_shares.remove(&id).await {
         Ok(()) => StatusCode::NO_CONTENT.into_response(),
         Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
     }
 }
 
-async fn api_nfs_scan(State(state): State<AppState>, AxumPath(id): AxumPath<String>) -> Response {
-    match state.nfs.rescan(&id).await {
+async fn api_smb_shares_scan(
+    State(state): State<AppState>,
+    AxumPath(id): AxumPath<String>,
+) -> Response {
+    match state.smb_shares.rescan(&id).await {
         Ok(n) => Json(json!({ "ok": true, "iso_count": n })).into_response(),
         Err(e) => (StatusCode::BAD_REQUEST, format!("{e}")).into_response(),
     }
@@ -1850,9 +1922,11 @@ async fn api_metrics(State(state): State<AppState>) -> Response {
     state
         .metrics
         .set_queue_counts(queue_entries.len() as u64, imaging as u64);
+    // v0.4.65: gauge tracks reachable external-storage shares. With
+    // NFS removed it now reflects SMB share reachability instead.
     state
         .metrics
-        .set_nfs_active(state.nfs.list().iter().filter(|m| m.mounted).count() as u64);
+        .set_nfs_active(state.smb_shares.list().iter().filter(|m| m.reachable).count() as u64);
 
     let now = time::OffsetDateTime::now_utc();
     let uptime = (now - state.started_at).whole_seconds().max(0) as u64;

crates/http-api/src/state.rs

@@ -4,7 +4,7 @@ use openpxe_core::{
     AdminStore, BootLog, BrandingStore, ClientRegistry, DeploymentQueue, HostBindings, LogBus,
     Metrics, SettingsStore, SsoStore,
 };
-use openpxe_iso_store::{IsoStore, NfsManager, SmbManager};
+use openpxe_iso_store::{IsoStore, SmbManager, SmbShareManager};
 use std::sync::Arc;
 use time::OffsetDateTime;
 
@@ -44,11 +44,14 @@ pub struct AppState {
     /// `smb_dir` at startup; `None` in pure-Linux-only deployments where
     /// Windows support is not wired in. Settings toggle drives start/stop.
     pub smb: Option<Arc<SmbManager>>,
-    /// NFS share manager. Always present (mounting is opt-in by the
-    /// operator from the Storage tab); `add()` requires `mount.nfs` to be
-    /// available in the runtime image. Surfaces errors per-mount rather
-    /// than failing the global state.
-    pub nfs: NfsManager,
+    /// v0.4.65: SMB share manager — userspace consumer of remote SMB
+    /// shares via Samba's `smbclient` CLI. Replaces the kernel-mount
+    /// NFS path that v0.4.64 shipped; that path didn't work on hosts
+    /// (Unraid, etc.) whose kernel ships without the nfs/cifs client
+    /// modules, and no container-side configuration could fix it.
+    /// `smbclient` does the SMB protocol over a plain TCP socket in
+    /// userspace — works in any container, no special caps required.
+    pub smb_shares: SmbShareManager,
     /// Browser chunked upload state. Multipart uploads still go straight
     /// through `IsoStore`, but the UI uses sessions so large ISO transfers
     /// can show deterministic progress and leave visible partial files.

crates/http-api/src/terminal.rs

@@ -88,7 +88,11 @@ async fn dispatch(state: &AppState, argv: &[String]) -> Result<String, String> {
         "isos" | "images" => Ok(isos_text(state)),
         "clients" => Ok(clients_text(state)),
         "queue" => queue_command(state, tail).await,
-        "nfs" => nfs_command(state, tail).await,
+        // v0.4.65: `nfs` is gone — replaced with userspace SMB share
+        // consumer. `smb` still controls the outbound Samba server
+        // for Windows install media; `share` lists/manages remote SMB
+        // shares OpenPXE pulls ISOs from.
+        "share" | "smb-share" => smb_share_command(state, tail).await,
         "smb" => smb_command(state, tail).await,
         "log" => log_command(state, tail),
         "whoami" => Ok("operator".to_string()),
@@ -107,18 +111,18 @@ fn status_text(s: &AppState) -> String {
     let clients = s.clients.list();
     let queue_entries = s.queue.list();
     let smb = s.smb.as_ref().map(|m| m.snapshot());
-    let nfs = s.nfs.list();
-    let nfs_active = nfs.iter().filter(|m| m.mounted).count();
+    let smb_shares = s.smb_shares.list();
+    let smb_reachable = smb_shares.iter().filter(|m| m.reachable).count();
     format!(
         "OpenPXE {ver}\n\
          base url:     {base}\n\
          interface:    {nic}\n\
          uptime:       {up}\n\
-         isos:         {n_isos}  (local: {n_local}, nfs: {n_nfs})\n\
+         isos:         {n_isos}  (local: {n_local}, smb: {n_smb})\n\
          clients:      {n_clients}\n\
          queue:        {n_entries}\n\
-         smb:          {smb}\n\
-         nfs mounts:   {n_total} configured ({n_active} active)\n",
+         smb server:   {smb}\n\
+         smb shares:   {n_total} configured ({n_active} reachable)\n",
         ver = env!("CARGO_PKG_VERSION"),
         base = s.public_base_url,
         nic = if s.nic_name.is_empty() {
@@ -132,15 +136,15 @@ fn status_text(s: &AppState) -> String {
             .iter()
             .filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Local))
             .count(),
-        n_nfs = isos
+        n_smb = isos
             .iter()
-            .filter(|i| !matches!(i.source, openpxe_iso_store::IsoSource::Local))
+            .filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Smb { .. }))
             .count(),
         n_clients = clients.len(),
         n_entries = queue_entries.len(),
         smb = smb.map_or_else(|| "(disabled)".into(), |s| format!("{s:?}")),
-        n_total = nfs.len(),
-        n_active = nfs_active,
+        n_total = smb_shares.len(),
+        n_active = smb_reachable,
     )
 }
 
@@ -158,7 +162,8 @@ fn isos_text(s: &AppState) -> String {
     for i in isos {
         let src = match i.source {
             openpxe_iso_store::IsoSource::Local => "local".to_string(),
-            openpxe_iso_store::IsoSource::Nfs { mount_id, .. } => format!("nfs:{mount_id}"),
+            // v0.4.65: SMB userspace consumer replaced kernel-mount NFS.
+            openpxe_iso_store::IsoSource::Smb { share_id, .. } => format!("smb:{share_id}"),
         };
         let _ = writeln!(
             out,
@@ -264,76 +269,83 @@ async fn queue_command(s: &AppState, args: &[String]) -> Result<String, String>
     }
 }
 
-// ── nfs ────────────────────────────────────────────────────────────────
+// ── share (v0.4.65: SMB shares) ─────────────────────────────────────────
 
-async fn nfs_command(s: &AppState, args: &[String]) -> Result<String, String> {
+async fn smb_share_command(s: &AppState, args: &[String]) -> Result<String, String> {
     match args.first().map(String::as_str) {
         None | Some("list") => {
-            let mounts = s.nfs.list();
-            if mounts.is_empty() {
-                return Ok("(no NFS mounts configured)".into());
+            let shares = s.smb_shares.list();
+            if shares.is_empty() {
+                return Ok("(no SMB shares configured)".into());
             }
             let mut out = String::new();
             let _ = writeln!(
                 out,
-                "{:<24} {:<6} {:<7} {:<6} TARGET",
-                "ID", "VER", "STATUS", "ISOS"
+                "{:<24} {:<7} {:<6} {:<6} TARGET",
+                "ID", "STATUS", "AUTH", "ISOS"
             );
-            for m in mounts {
-                let status = if m.mounted { "ok" } else { "down" };
+            for m in shares {
+                let status = if m.reachable { "ok" } else { "down" };
+                let auth = if m.guest { "guest" } else { "user" };
                 let _ = writeln!(
                     out,
-                    "{:<24} {:<6} {:<7} {:<6} {}:{}",
+                    "{:<24} {:<7} {:<6} {:<6} //{}/{}",
                     truncate(&m.id, 24),
-                    match m.version {
-                        openpxe_iso_store::NfsVersion::V3 => "v3",
-                        openpxe_iso_store::NfsVersion::V41 => "v4.1",
-                    },
                     status,
+                    auth,
                     m.iso_count,
                     m.server,
-                    m.export,
+                    m.share,
                 );
                 if let Some(e) = m.last_error {
                     let _ = writeln!(out, "    error: {e}");
                 }
+                if let Some(h) = m.last_hint {
+                    let _ = writeln!(out, "    hint:  {h}");
+                }
             }
             Ok(out)
         }
-        Some("mount") => {
-            // nfs mount <server>:<export> [v3|v41] [ro|rw]
+        Some("add") => {
+            // share add //server/share [guest|user:password]
             let target = args
                 .get(1)
-                .ok_or_else(|| "usage: nfs mount <server>:<export> [v3|v41] [ro|rw]".to_string())?;
-            let (server, export) = target
-                .split_once(':')
-                .ok_or_else(|| "target must be 'server:/export'".to_string())?;
-            let version = match args.get(2).map(String::as_str) {
-                Some("v3") => openpxe_iso_store::NfsVersion::V3,
-                Some("v41") | None => openpxe_iso_store::NfsVersion::V41,
-                Some(other) => {
-                    return Err(format!("unknown nfs version: {other} (expect v3 or v41)"))
-                }
+                .ok_or_else(|| {
+                    "usage: share add //server/share [guest|user:password]".to_string()
+                })?;
+            // Accept either `//server/share` (UNC-style) or
+            // `server:share` (shorter to type).
+            let stripped = target.trim_start_matches('/').trim_start_matches('\\');
+            let (server, share) = if let Some((s, p)) = stripped.split_once('/') {
+                (s, p)
+            } else if let Some((s, p)) = stripped.split_once(':') {
+                (s, p)
+            } else {
+                return Err("target must be '//server/share' or 'server:share'".into());
             };
-            let read_only = !matches!(args.get(3).map(String::as_str), Some("rw"));
-            let req = openpxe_iso_store::NfsAddRequest {
+
+            // Auth spec: "guest" or "user:password". Default: guest.
+            let auth = args.get(2).cloned().unwrap_or_else(|| "guest".into());
+            let (guest, username, password) = if auth == "guest" {
+                (true, None, None)
+            } else if let Some((u, p)) = auth.split_once(':') {
+                (false, Some(u.to_string()), Some(p.to_string()))
+            } else {
+                return Err("auth must be 'guest' or 'user:password'".into());
+            };
+
+            let req = openpxe_iso_store::SmbAddRequest {
                 server: server.to_string(),
-                export: export.to_string(),
-                version,
-                read_only,
-                // v0.4.64: terminal callers can't override the port yet
-                // — keep the default 2049. We could plumb a 4th arg
-                // later if anyone asks.
+                share: share.to_string(),
+                username,
+                password,
+                guest,
                 port: None,
             };
-            match s.nfs.add(req).await {
-                Ok(m) => Ok(format!("mounted {} ({} isos)", m.id, m.iso_count)),
-                // v0.4.64: `add` now returns a structured `NfsMountError`.
-                // We render the raw error plus the hint (if any) on
-                // separate lines so the terminal output mirrors what
-                // the Storage tab shows.
+            match s.smb_shares.add(req).await {
+                Ok(m) => Ok(format!("added {} ({} isos)", m.id, m.iso_count)),
                 Err(e) => {
-                    let mut out = format!("mount failed: {}", e.error);
+                    let mut out = format!("add failed: {}", e.error);
                     if let Some(h) = e.hint {
                         out.push_str("\nhint: ");
                         out.push_str(&h);
@@ -342,26 +354,26 @@ async fn nfs_command(s: &AppState, args: &[String]) -> Result<String, String> {
                 }
             }
         }
-        Some("unmount") => {
+        Some("remove") => {
             let id = args
                 .get(1)
-                .ok_or_else(|| "usage: nfs unmount <id>".to_string())?;
-            match s.nfs.remove(id).await {
-                Ok(()) => Ok(format!("unmounted {id}")),
-                Err(e) => Err(format!("unmount failed: {e}")),
+                .ok_or_else(|| "usage: share remove <id>".to_string())?;
+            match s.smb_shares.remove(id).await {
+                Ok(()) => Ok(format!("removed {id}")),
+                Err(e) => Err(format!("remove failed: {e}")),
             }
         }
         Some("scan") => {
             let id = args
                 .get(1)
-                .ok_or_else(|| "usage: nfs scan <id>".to_string())?;
-            match s.nfs.rescan(id).await {
+                .ok_or_else(|| "usage: share scan <id>".to_string())?;
+            match s.smb_shares.rescan(id).await {
                 Ok(n) => Ok(format!("re-scanned {id}: {n} isos")),
                 Err(e) => Err(format!("scan failed: {e}")),
             }
         }
         Some(other) => Err(format!(
-            "unknown nfs subcommand: {other}\ntry: nfs [list|mount|unmount|scan]"
+            "unknown share subcommand: {other}\ntry: share [list|add|remove|scan]"
         )),
     }
 }
@@ -502,13 +514,13 @@ OpenPXE terminal — available commands:
   queue assign-all <target>         assign every waiting client
   queue release <entry_id>           release one queued client
 
-  nfs list                          list NFS mounts
-  nfs mount <s>:<e> [v3|v41] [ro|rw]  add and mount an NFS share
-  nfs unmount <id>                  unmount and forget a share
-  nfs scan <id>                     re-scan a share for new ISOs
+  share list                        list configured SMB shares
+  share add //srv/share [auth]      add an SMB share; auth = 'guest' or 'user:pass'
+  share remove <id>                 forget an SMB share
+  share scan <id>                   re-list a share for new ISOs
 
-  smb status                        SMB (Samba) state
-  smb start | stop | reload         control smbd
+  smb status                        outbound Samba state (Windows install media)
+  smb start | stop | reload         control the outbound smbd
 
   log clear                         drop the in-memory log ring buffer
   log tail [n]                      show the last n buffered lines (default 20)
@@ -523,10 +535,10 @@ mod tests {
     #[test]
     fn shell_split_basic() {
         assert_eq!(shell_split(""), Vec::<String>::new());
-        assert_eq!(shell_split("nfs list"), vec!["nfs", "list"]);
+        assert_eq!(shell_split("share list"), vec!["share", "list"]);
         assert_eq!(
-            shell_split("nfs mount 10.0.0.5:/srv v41 ro"),
-            vec!["nfs", "mount", "10.0.0.5:/srv", "v41", "ro"]
+            shell_split("share add //nas/isos guest"),
+            vec!["share", "add", "//nas/isos", "guest"]
         );
     }