OpenPXE

mward4/OpenPXE

Fork 0

Commit Graph

Author	SHA1	Message	Date
Miles Ward	9c6903351f	v0.3.1: per-ISO boot password gate Operators can now lock individual ISOs behind a password set in the WebUI. Picking a locked image at the PXE menu prompts the operator on the client console; the boot script is only released after a correct match. The plaintext never leaves the request — server stores bcrypt hashes, scripts never echo the candidate. ## Backend - New optional `password_hash: Option<String>` on `IsoMeta`. Skipped during serialize when None, so existing meta.json files don't grow a noisy `null` field. - `IsoStore::set_password(id, Some("pw"))` hashes via bcrypt `DEFAULT_COST` (10 — fast enough for an interactive iPXE prompt, expensive enough to be hostile to brute force on a leaked meta.json). `set_password(id, None)` and `set_password(id, Some(""))` both clear. - `IsoStore::verify_password` returns Ok(true) when no password is set, so the gate stays open for the common case. - `IsoMeta::is_password_protected()` predicate the HTTP layer + UI share. - NFS-sourced ISOs persist their hash in memory only — the share is the source of truth for those, and it doesn't carry hash sidecars. ## HTTP API - `PUT /api/isos/:id/password` body `{ "password": "..." }` to set, `{ "password": null }` (or empty string) to clear. - `DELETE /api/isos/:id/password` for the explicit clear. - Both 204 on success, 404 for unknown ids. - `/boot/<entry>.ipxe` now intercepts: - no `?token=` -> render password-prompt script - `?token=<wrong>` -> render auth-fail script (sleeps 2s, chains back to the entry which re-prompts) - `?token=<correct>` -> render the real boot script - ISO without password ignores token entirely (per-MAC bookmarks still work without changes). ## iPXE prompt `render_password_prompt`: - `set password ` then `read --secret password` — accepts input without echoing. - Empty input chains back to the main menu (lets the operator back out of a misclick). - Submit chains `?token=${password:uristring}`. The `:uristring` modifier URL-encodes the value, so passwords with `&`, `?`, `=`, spaces, etc. survive transport. `render_password_failed`: - Single line saying so + 2s sleep, then re-chains the entry. - Server-side WARN log records the entry id only, never the candidate value (verified in smoke test). ## UI Storage tab's image table grows an `Auth` column showing `protected` / `open`, plus a 🔒 next to the filename when locked. Per-row "Set password" / "Password ✎" button toggles an inline editor in the next table row containing: - a "Password protect this image" checkbox - a `<input type=password autocomplete=new-password>` (hidden when the checkbox is off) - a Save button Save calls PUT or DELETE on `/api/isos/:id/password` based on the checkbox state and clears the input field before re-rendering, so the plaintext doesn't sit in the DOM longer than needed. ## Menu indicator `render_family_menu` adds a `` prefix immediately before the size box on protected entries — ASCII only because some firmware menu consoles mangle non-ASCII glyphs. Looks like: item --key 1 win11_test-winpe [ 5234 MB] Windows 11 Test ISO ## Tests 74 passing across the workspace (was 66 in v0.3.0): - 3 new store unit tests (bcrypt round-trip, unknown-id error, meta.json persistence across restart) - 2 new ipxe_script unit tests (prompt/auth-fail invariants: read --secret, uristring, no candidate echo) - 3 new HTTP integration tests (full gate flow upload-set-prompt- fail-success-clear, null/empty bodies, 404 on unknown id) cargo clippy --workspace --all-targets clean. Local smoke verified upload + lock + prompt + auth-fail + correct + menu indicator + log scrub on a real release binary. ## Operational notes - HTTP, not HTTPS — token rides in the query string. Acceptable on a trusted boot VLAN; do NOT expose OpenPXE to untrusted networks with this feature relied on for security. Reverse-proxy in front of OpenPXE will end up with the token in access logs. - bcrypt cost is `DEFAULT_COST` (10). One verify takes ~50ms on modern x86, which is the worst-case latency added to a correct boot. Tunable via the bcrypt crate if needed.	2026-05-06 22:35:11 -04:00
Miles Ward	e3452fe976	v0.3.0 — rebrand: PXEForge → OpenPXE, Gated → Queued Deployment Full rename to match the openpxe.com brand. The product now reads as a polished open-source project rather than a personal-tool nickname: the anvil/forge metaphor is gone, replaced with the rainbow-horizon brand mark from the marketing site. ## Naming changes PXEForge → OpenPXE everywhere it's user-visible or developer- facing: - All 8 crate package names (`pxeforge-` → `openpxe-`). - The bin crate dir + binary (`crates/pxeforge` → `crates/openpxe`, `bin = "openpxe"`). - Env vars: `PXEFORGE_` → `OPENPXE_` (no compat shim — pre-beta). - Tracing targets: `pxeforge::` → `openpxe::`. - Prometheus metrics: `pxeforge_` → `openpxe_` (pre-beta; nobody has dashboards on these yet). - Container image: `gitea.milesward.dev/mward4/openpxe:0.3.0`. - All in-tree paths: `/var/lib/openpxe/{isos,work,smb}`, `/usr/share/openpxe/ipxe`, `/etc/openpxe/...`. - Unraid template renamed `pxeforge.xml` → `openpxe.xml`. - README, NEXT_PHASE.md, architecture.md, comments, and the WebUI brand string. Gated Deployment → Queued Deployment as the user-facing concept: - `Settings::TimeoutAction::GatedDeployment` → `QueuedDeployment` (with `#[serde(alias = "gated_deployment")]` so v0.2.0 settings.json files keep deserializing). - Rust types: `Gate` → `QueueEntry`, `GateQueue` → `DeploymentQueue`, `GateInner` → `QueueEntryInner`. - File: `crates/core/src/gate.rs` → `crates/core/src/queue.rs`. - HTTP routes: `/api/gate/` → `/api/queue/`. The JSON list key flipped from `"gates"` to `"entries"` to match. - iPXE shortcut: `/boot/_gate.ipxe` → `/boot/_queue.ipxe`. The top-level menu's item id is now `queue` instead of `gate`. - WebUI sidebar tab: "Forge Gate" → "Queue". - Field on `AppState`: `gates` → `queue`. ## Brand assets The anvil + forging-sparks logos are dropped: - `logo.svg` is now a 24×24 medallion filled with the `rainbow-horizon` gradient from openpxe.com (sliding hue rotation via SMIL on the gradient stops, no JS needed). - `anvil-forge.svg` renamed to `loader.svg` and rebuilt as a 64×64 louder version of the same disc — used for page-load transitions and the imaging-progress widget. Adds a subtle scale pulse and a white inner-glow so it has dimensionality on either theme. ## CSS rename - `.forge-progress` → `.queue-progress` - `.forge-progress .anvil` → `.queue-progress .mark` - `@keyframes forge-sheen` → `queue-sheen` - `.loader .anvil` → `.loader .mark` - "Heating the forge…" loader text → "Loading…" The rest of the layout is untouched. Light/dark theme tokens and the sidebar/topbar structure carry over from v0.2.0 unchanged — the brief was "keeping the UI similar." ## Validation - `cargo build --workspace` — clean. - `cargo clippy --workspace --all-targets` — no warnings. - `cargo test --workspace` — 66 tests passing, same as v0.2.0. - Local smoke run against the rebuilt release binary verifies: - `/boot.ipxe` emits `Queued Deployment` + `item queue` + chains `/boot/_queue.ipxe` - `/api/queue` returns `{count, entries}` - `/metrics` emits `openpxe_queue_count` (renamed) - `/assets/logo.svg` and `/assets/loader.svg` serve the new rainbow brand SVGs - `/api/status` reports version `0.3.0` ## Migration notes for operators on v0.2.0 - Container image path changed: pull `gitea.milesward.dev/mward4/openpxe:0.3.0` (not `pxeforge:`). - Bind mounts: `/var/lib/openpxe/{isos,work,smb}` (not `pxeforge`). Move the host path or update the template. - Env vars: replace `PXEFORGE_` with `OPENPXE_`. The Unraid template at `deploy/unraid/openpxe.xml` is already updated. - `settings.json` carries over transparently — the `gated_deployment` value is accepted as an alias. - HTTP API: any external scripts that hit `/api/gate/` need to switch to `/api/queue/`. The JSON envelope key is `entries` instead of `gates`.	2026-05-06 14:13:38 -04:00
Miles Ward	cc309da062	Initial commit: PXEForge Phases 1-4 Container-native PXE boot server in Rust, designed as a clean-room alternative to iVentoy that never touches the client OS trust store. This is the first commit of the project; it lands the full output of Phases 1, 2, 3, and 4 in one shot. ## Phase 1 — protocol stack - 8-crate workspace (core, dhcp-proxy, tftp, http-api, iso-store, ipxe-assets, webui, pxeforge bin). - DHCP proxy (RFC 4578): replies with boot info only, never leases — sidesteps CAP_NET_RAW. Architecture-aware bootfile selection from option 93 (BIOS, IA32, x64-UEFI alias 0x0007/0x0009, ARM64). - TFTP server with full OACK negotiation: blksize, tsize, windowsize. Without it a 1 MiB iPXE binary takes 2000 packets and unusably long. - Two-stage iPXE chain: firmware PXE -> TFTP iPXE binary -> iPXE re-DHCPs with user-class iPXE -> HTTP /boot.ipxe -> kernel+initrd. - HTTP server (axum) with byte-Range ISO streaming and an in-place ISO9660 lookup so kernel/initrd are served from inside the ISO without ever extracting it to disk. - Linux ISOs boot via kernel+initrd extraction (memdisk/sanboot fail for >1-2 GiB modern distros). Distro-family detection drives the cmdline (Debian/Ubuntu, RHEL/Fedora, openSUSE, Arch, Alpine). ## Phase 2 — UX + Windows - Hierarchical PXE menu (Default / Installers / Tools / Gated Deployment) generated from settings — no hand-written .ipxe paths surface in the UI. Number-key + letter hotkeys, BIOS+UEFI variants for some RHEL ISOs. - Gated Deployment "horse-race" queue: clients join, operator picks one ISO, every gate launches simultaneously via tokio::sync::Notify. - Bootimus-pattern Windows: WimPatcher injects a CRLF startnet.cmd into boot.wim so vanilla WinPE net-uses an SMB share and runs setup.exe. All Microsoft-signed; no test certs, no testsigning, no httpdisk.sys. SmbManager supervises smbd start/stop/SIGHUP. - Netbox-style dark UI, fully offline (no CDN, no external fonts). ## Phase 3 — MVP hardening - TFTP retransmit rewrite with explicit window tracking — UEFI SNP clients no longer hang on files that end mid-window. 4 new tests. - DHCP broadcast-flag honored per RFC 2131 §4.1. - Multi-arch container (linux/amd64 + linux/arm64). Entrypoint chowns bind-mounts as root then drops to uid 10001 via gosu. - /healthz + /readyz split from /api/status — readyz fails if no iPXE binaries are bundled. - pxeforge seed --from <path> CLI: same pipeline as web upload (slug, sha256, introspection, boot-entry). - All timestamps RFC 3339 (browser Date couldn't parse the 9-tuple). - Gate poll retains assignment until operator releases — clients that retry on transient network errors reuse the assignment instead of falling back to the menu. - Custom OpenShift SCC: hostNetwork + NET_BIND_SERVICE only, no NET_RAW. ## Phase 4 — UI restructure + remote storage - Web UI rebuilt around six tabs inspired by the iVentoy layout: Dashboard / Network / Forge Gate / Storage / Terminal / About. Old "Monitoring/Content/Configuration" sidebar groups are gone. - NFS share manager (crates/iso-store/src/nfs.rs): mount NFSv3 or NFSv4.1 shares as ISO sources instead of uploading every file into the PVC. New IsoSource enum on IsoMeta lets the store resolve Local vs NFS lazily. Persisted to <work_dir>/nfs.json; failed mounts surface in the UI rather than blocking startup. - Dockerfile gains nfs-common + iproute2; mounting NFS in-container also requires CAP_SYS_ADMIN. Documented in docs/architecture.md. - LogBus + tracing layer in core: 500-line ring buffer + broadcast channel feed an SSE endpoint at /api/log/stream. - Operator terminal at /api/terminal: whitelisted commands (status, isos, clients, gate, nfs, smb, log) — deliberately not a shell. Output mirrored onto the LogBus so the live tail and the terminal pane share one timeline. - Network tab: read-only nic_name / subnet_mask / gateway probed from `ip` at startup; only DNS server is editable. Editing IP/mask on a hot UI would silently break PXE for every client mid-boot. - Bootimus parity (releases v0.1.55 -> v0.1.62): amber row tint on un-bootable ISOs with inline reasons, dashboard "won't boot" panel. ## Tests 56 tests passing across the workspace: - 16 core (LogBus, gate, settings, arch, client) - 1 dhcp-proxy (raw option-93 extraction) - 8 http-api unit (range parsing, terminal split/format) - 13 http-api integration (gated deployment, range, settings, NFS, terminal, log SSE, network endpoint, ui assets, no-external-urls) - 12 iso-store (introspect, slugify, smb, windows wim, NFS options) - 6 tftp (RRQ parsing, plan_window edges) cargo build --workspace and cargo clippy --workspace --all-targets both finish clean (warnings only, no errors).	2026-04-29 02:47:00 -04:00

Author

SHA1

Message

Date

Miles Ward

9c6903351f

v0.3.1: per-ISO boot password gate

Operators can now lock individual ISOs behind a password set in the
WebUI. Picking a locked image at the PXE menu prompts the operator on
the client console; the boot script is only released after a correct
match. The plaintext never leaves the request — server stores bcrypt
hashes, scripts never echo the candidate.

## Backend

- New optional `password_hash: Option<String>` on `IsoMeta`. Skipped
  during serialize when None, so existing meta.json files don't grow
  a noisy `null` field.
- `IsoStore::set_password(id, Some("pw"))` hashes via bcrypt
  `DEFAULT_COST` (10 — fast enough for an interactive iPXE prompt,
  expensive enough to be hostile to brute force on a leaked
  meta.json). `set_password(id, None)` and `set_password(id, Some(""))`
  both clear.
- `IsoStore::verify_password` returns Ok(true) when no password is
  set, so the gate stays open for the common case.
- `IsoMeta::is_password_protected()` predicate the HTTP layer + UI
  share.
- NFS-sourced ISOs persist their hash in memory only — the share is
  the source of truth for those, and it doesn't carry hash sidecars.

## HTTP API

- `PUT /api/isos/:id/password` body `{ "password": "..." }` to set,
  `{ "password": null }` (or empty string) to clear.
- `DELETE /api/isos/:id/password` for the explicit clear.
- Both 204 on success, 404 for unknown ids.
- `/boot/<entry>.ipxe` now intercepts:
  - no `?token=`        -> render password-prompt script
  - `?token=<wrong>`    -> render auth-fail script (sleeps 2s, chains
                           back to the entry which re-prompts)
  - `?token=<correct>`  -> render the real boot script
  - ISO without password ignores token entirely (per-MAC bookmarks
    still work without changes).

## iPXE prompt

`render_password_prompt`:
- `set password ` then `read --secret password` — accepts input
  without echoing.
- Empty input chains back to the main menu (lets the operator back
  out of a misclick).
- Submit chains `?token=${password:uristring}`. The `:uristring`
  modifier URL-encodes the value, so passwords with `&`, `?`, `=`,
  spaces, etc. survive transport.

`render_password_failed`:
- Single line saying so + 2s sleep, then re-chains the entry.
- Server-side WARN log records the entry id only, never the
  candidate value (verified in smoke test).

## UI

Storage tab's image table grows an `Auth` column showing
`protected` / `open`, plus a 🔒 next to the filename when locked.
Per-row "Set password" / "Password ✎" button toggles an inline
editor in the next table row containing:
- a "Password protect this image" checkbox
- a `<input type=password autocomplete=new-password>` (hidden when
  the checkbox is off)
- a Save button

Save calls PUT or DELETE on `/api/isos/:id/password` based on the
checkbox state and clears the input field before re-rendering, so
the plaintext doesn't sit in the DOM longer than needed.

## Menu indicator

`render_family_menu` adds a `*` prefix immediately before the size
box on protected entries — ASCII only because some firmware menu
consoles mangle non-ASCII glyphs. Looks like:

  item --key 1 win11_test-winpe *[ 5234 MB] Windows 11 Test ISO

## Tests

74 passing across the workspace (was 66 in v0.3.0):
- 3 new store unit tests (bcrypt round-trip, unknown-id error,
  meta.json persistence across restart)
- 2 new ipxe_script unit tests (prompt/auth-fail invariants:
  read --secret, uristring, no candidate echo)
- 3 new HTTP integration tests (full gate flow upload-set-prompt-
  fail-success-clear, null/empty bodies, 404 on unknown id)

cargo clippy --workspace --all-targets clean.

Local smoke verified upload + lock + prompt + auth-fail + correct +
menu indicator + log scrub on a real release binary.

## Operational notes

- HTTP, not HTTPS — token rides in the query string. Acceptable on
  a trusted boot VLAN; do NOT expose OpenPXE to untrusted networks
  with this feature relied on for security. Reverse-proxy in front
  of OpenPXE will end up with the token in access logs.
- bcrypt cost is `DEFAULT_COST` (10). One verify takes ~50ms on
  modern x86, which is the worst-case latency added to a correct
  boot. Tunable via the bcrypt crate if needed.

2026-05-06 22:35:11 -04:00

Miles Ward

e3452fe976

v0.3.0 — rebrand: PXEForge → OpenPXE, Gated → Queued Deployment

Full rename to match the openpxe.com brand. The product now reads as a
polished open-source project rather than a personal-tool nickname:
the anvil/forge metaphor is gone, replaced with the rainbow-horizon
brand mark from the marketing site.

## Naming changes

**PXEForge → OpenPXE** everywhere it's user-visible or developer-
facing:
- All 8 crate package names (`pxeforge-*` → `openpxe-*`).
- The bin crate dir + binary (`crates/pxeforge` → `crates/openpxe`,
  `bin = "openpxe"`).
- Env vars: `PXEFORGE_*` → `OPENPXE_*` (no compat shim — pre-beta).
- Tracing targets: `pxeforge::*` → `openpxe::*`.
- Prometheus metrics: `pxeforge_*` → `openpxe_*` (pre-beta; nobody
  has dashboards on these yet).
- Container image: `gitea.milesward.dev/mward4/openpxe:0.3.0`.
- All in-tree paths: `/var/lib/openpxe/{isos,work,smb}`,
  `/usr/share/openpxe/ipxe`, `/etc/openpxe/...`.
- Unraid template renamed `pxeforge.xml` → `openpxe.xml`.
- README, NEXT_PHASE.md, architecture.md, comments, and the WebUI
  brand string.

**Gated Deployment → Queued Deployment** as the user-facing concept:
- `Settings::TimeoutAction::GatedDeployment` →
  `QueuedDeployment` (with `#[serde(alias = "gated_deployment")]`
  so v0.2.0 settings.json files keep deserializing).
- Rust types: `Gate` → `QueueEntry`, `GateQueue` → `DeploymentQueue`,
  `GateInner` → `QueueEntryInner`.
- File: `crates/core/src/gate.rs` → `crates/core/src/queue.rs`.
- HTTP routes: `/api/gate/*` → `/api/queue/*`. The JSON list key
  flipped from `"gates"` to `"entries"` to match.
- iPXE shortcut: `/boot/_gate.ipxe` → `/boot/_queue.ipxe`. The
  top-level menu's item id is now `queue` instead of `gate`.
- WebUI sidebar tab: "Forge Gate" → "Queue".
- Field on `AppState`: `gates` → `queue`.

## Brand assets

The anvil + forging-sparks logos are dropped:
- `logo.svg` is now a 24×24 medallion filled with the
  `rainbow-horizon` gradient from openpxe.com (sliding hue rotation
  via SMIL on the gradient stops, no JS needed).
- `anvil-forge.svg` renamed to `loader.svg` and rebuilt as a 64×64
  louder version of the same disc — used for page-load transitions
  and the imaging-progress widget. Adds a subtle scale pulse and a
  white inner-glow so it has dimensionality on either theme.

## CSS rename

- `.forge-progress` → `.queue-progress`
- `.forge-progress .anvil` → `.queue-progress .mark`
- `@keyframes forge-sheen` → `queue-sheen`
- `.loader .anvil` → `.loader .mark`
- "Heating the forge…" loader text → "Loading…"

The rest of the layout is untouched. Light/dark theme tokens and the
sidebar/topbar structure carry over from v0.2.0 unchanged — the
brief was "keeping the UI similar."

## Validation

- `cargo build --workspace` — clean.
- `cargo clippy --workspace --all-targets` — no warnings.
- `cargo test --workspace` — **66 tests passing**, same as v0.2.0.
- Local smoke run against the rebuilt release binary verifies:
  - `/boot.ipxe` emits `Queued Deployment` + `item queue` + chains
    `/boot/_queue.ipxe`
  - `/api/queue` returns `{count, entries}`
  - `/metrics` emits `openpxe_queue_count` (renamed)
  - `/assets/logo.svg` and `/assets/loader.svg` serve the new
    rainbow brand SVGs
  - `/api/status` reports version `0.3.0`

## Migration notes for operators on v0.2.0

- Container image path changed: pull
  `gitea.milesward.dev/mward4/openpxe:0.3.0` (not `pxeforge:`).
- Bind mounts: `/var/lib/openpxe/{isos,work,smb}` (not `pxeforge`).
  Move the host path or update the template.
- Env vars: replace `PXEFORGE_*` with `OPENPXE_*`. The Unraid
  template at `deploy/unraid/openpxe.xml` is already updated.
- `settings.json` carries over transparently — the
  `gated_deployment` value is accepted as an alias.
- HTTP API: any external scripts that hit `/api/gate/*` need to
  switch to `/api/queue/*`. The JSON envelope key is `entries`
  instead of `gates`.

2026-05-06 14:13:38 -04:00

Miles Ward

cc309da062

Initial commit: PXEForge Phases 1-4

Container-native PXE boot server in Rust, designed as a clean-room
alternative to iVentoy that never touches the client OS trust store.
This is the first commit of the project; it lands the full output of
Phases 1, 2, 3, and 4 in one shot.

## Phase 1 — protocol stack

- 8-crate workspace (core, dhcp-proxy, tftp, http-api, iso-store,
  ipxe-assets, webui, pxeforge bin).
- DHCP proxy (RFC 4578): replies with boot info only, never leases —
  sidesteps CAP_NET_RAW. Architecture-aware bootfile selection from
  option 93 (BIOS, IA32, x64-UEFI alias 0x0007/0x0009, ARM64).
- TFTP server with full OACK negotiation: blksize, tsize, windowsize.
  Without it a 1 MiB iPXE binary takes 2000 packets and unusably long.
- Two-stage iPXE chain: firmware PXE -> TFTP iPXE binary -> iPXE
  re-DHCPs with user-class iPXE -> HTTP /boot.ipxe -> kernel+initrd.
- HTTP server (axum) with byte-Range ISO streaming and an in-place
  ISO9660 lookup so kernel/initrd are served from inside the ISO
  without ever extracting it to disk.
- Linux ISOs boot via kernel+initrd extraction (memdisk/sanboot fail
  for >1-2 GiB modern distros). Distro-family detection drives the
  cmdline (Debian/Ubuntu, RHEL/Fedora, openSUSE, Arch, Alpine).

## Phase 2 — UX + Windows

- Hierarchical PXE menu (Default / Installers / Tools / Gated
  Deployment) generated from settings — no hand-written .ipxe paths
  surface in the UI. Number-key + letter hotkeys, BIOS+UEFI variants
  for some RHEL ISOs.
- Gated Deployment "horse-race" queue: clients join, operator picks
  one ISO, every gate launches simultaneously via tokio::sync::Notify.
- Bootimus-pattern Windows: WimPatcher injects a CRLF startnet.cmd
  into boot.wim so vanilla WinPE net-uses an SMB share and runs
  setup.exe. All Microsoft-signed; no test certs, no testsigning,
  no httpdisk.sys. SmbManager supervises smbd start/stop/SIGHUP.
- Netbox-style dark UI, fully offline (no CDN, no external fonts).

## Phase 3 — MVP hardening

- TFTP retransmit rewrite with explicit window tracking — UEFI SNP
  clients no longer hang on files that end mid-window. 4 new tests.
- DHCP broadcast-flag honored per RFC 2131 §4.1.
- Multi-arch container (linux/amd64 + linux/arm64). Entrypoint chowns
  bind-mounts as root then drops to uid 10001 via gosu.
- /healthz + /readyz split from /api/status — readyz fails if no
  iPXE binaries are bundled.
- pxeforge seed --from <path> CLI: same pipeline as web upload (slug,
  sha256, introspection, boot-entry).
- All timestamps RFC 3339 (browser Date couldn't parse the 9-tuple).
- Gate poll retains assignment until operator releases — clients that
  retry on transient network errors reuse the assignment instead of
  falling back to the menu.
- Custom OpenShift SCC: hostNetwork + NET_BIND_SERVICE only, no
  NET_RAW.

## Phase 4 — UI restructure + remote storage

- Web UI rebuilt around six tabs inspired by the iVentoy layout:
  Dashboard / Network / Forge Gate / Storage / Terminal / About.
  Old "Monitoring/Content/Configuration" sidebar groups are gone.
- NFS share manager (crates/iso-store/src/nfs.rs): mount NFSv3 or
  NFSv4.1 shares as ISO sources instead of uploading every file
  into the PVC. New IsoSource enum on IsoMeta lets the store resolve
  Local vs NFS lazily. Persisted to <work_dir>/nfs.json; failed
  mounts surface in the UI rather than blocking startup.
- Dockerfile gains nfs-common + iproute2; mounting NFS in-container
  also requires CAP_SYS_ADMIN. Documented in docs/architecture.md.
- LogBus + tracing layer in core: 500-line ring buffer + broadcast
  channel feed an SSE endpoint at /api/log/stream.
- Operator terminal at /api/terminal: whitelisted commands (status,
  isos, clients, gate, nfs, smb, log) — deliberately not a shell.
  Output mirrored onto the LogBus so the live tail and the terminal
  pane share one timeline.
- Network tab: read-only nic_name / subnet_mask / gateway probed
  from `ip` at startup; only DNS server is editable. Editing IP/mask
  on a hot UI would silently break PXE for every client mid-boot.
- Bootimus parity (releases v0.1.55 -> v0.1.62): amber row tint on
  un-bootable ISOs with inline reasons, dashboard "won't boot" panel.

## Tests

56 tests passing across the workspace:
- 16 core (LogBus, gate, settings, arch, client)
- 1 dhcp-proxy (raw option-93 extraction)
- 8 http-api unit (range parsing, terminal split/format)
- 13 http-api integration (gated deployment, range, settings, NFS,
  terminal, log SSE, network endpoint, ui assets, no-external-urls)
- 12 iso-store (introspect, slugify, smb, windows wim, NFS options)
- 6 tftp (RRQ parsing, plan_window edges)

cargo build --workspace and cargo clippy --workspace --all-targets
both finish clean (warnings only, no errors).

2026-04-29 02:47:00 -04:00