Name update

This is the bulk pre-beta cleanup pass. Bumps the workspace to 0.2.0.
Test count is 56 -> 66 (+10), clippy is fully clean across the
workspace (was several dozen warnings).

## New features

**Per-MAC host bindings** (Tinkerbell smee pattern). New
`HostBindings` registry maps a MAC -> preferred boot target, persisted
to <work_dir>/hosts.json. The DHCP reply now embeds `?mac=${mac}` in
the boot.ipxe URL; iPXE substitutes the literal MAC client-side, so
the HTTP layer can short-circuit straight to the bound target instead
of rendering the menu. Reserved menu shortcuts (`_local`, `_gate`,
`_tools_menu`) are valid targets too. New /api/hosts CRUD + a Hosts
tab in the sidebar.

**Prometheus `/metrics`** endpoint. Tiny lock-free implementation —
just AtomicU64s and a Display impl, no `prometheus` / `metrics-rs`
dep. Counters: DHCP replies (per arch label), DHCP declined, TFTP
transfers (per status), TFTP bytes, HTTP requests (per route).
Gauges: ISO count, client count, gate count, gate-imaging, NFS active
mounts, uptime, build info. Plain text exposition format,
text/plain;version=0.0.4 content-type, no auth (all metric values are
non-sensitive counts).

**Light + dark themes**. CSS tokens on `:root` and
`:root[data-theme=light]`, swap by toggle button (top-right) or `T`
hotkey. Persisted in localStorage; pre-paint inline script avoids
dark<->light flash. Light palette designed against the Netbox Labs
reference screenshot — near-white surfaces, soft grey dividers,
accent unchanged for brand consistency. Terminal pane stays dark in
both themes (it's a console, that's the right read).

**Animated SVG logo + forge widget**. New `logo.svg` is a refined
silver/grey anvil. New `anvil-forge.svg` adds rising sparks and a
pulsing underglow via SMIL — pure SVG, no GIF, no JS animation loop.
Used:
  - in the **forge progress** widget on Dashboard + Forge Gate, paired
    with a `linear-gradient(warn -> accent)` bar with a moving sheen;
    goes idle (greyscale, no sheen) at zero imaging load
  - in the page-load `<div class=loader>` that replaces the old
    "Loading..." text

## Code cleanup pass

`cargo clippy --workspace --all-targets` is now warning-free. Spot
fixes across the tree:
  - `format!()`-into-`String` -> `std::fmt::Write::write!`
  - manual reverse comparators -> `Reverse`
  - `map_or(false, ...)` -> `is_some_and`
  - redundant closures -> method references
  - `r#"..."#` raw strings without `"` -> `r"..."`
  - `std::io::Error::new(Other, ...)` -> `Error::other`
  - `as i32` on `c.id()` -> `cast_signed()`
  - merged identical match arms

## Windows workflow validation

New integration test synthesizes an ISO9660 with the SOURCES\\BOOT.WIM
sentinel, uploads it, asserts:
  1. introspection labels it `windows_pe` with has_boot_wim=true,
  2. the boot entry is `BootKind::Wimboot` with all five canonical
     files (bootmgr, bootmgr.efi, bcd, boot.sdi, boot.wim),
  3. the rendered iPXE script chains wimboot with `initrd --name`
     entries for each file, and
  4. NO trust-store strings appear in the rendered output: bcdedit,
     testsigning, certutil, httpdisk, and test-signed are all
     explicitly forbidden as a hard guarantee.

WinPE bootstrap (startnet.cmd) picks up the Bootimus v0.1.58 lessons:
explicit `net start Workstation` before `net use` to avoid the SMB
client lazy-init race, and surfaces errors instead of blind retries.

## Docs

architecture.md gains a "Phase 5" section explaining the host-bindings
+ metrics + theming + Windows-test work, plus a refreshed "deferred
to Phase 6" list (real-hardware integration, autounattend library,
distro profile manifest, WoL trigger, syslog receiver, IPv6).
README updates the status line, the "what it does" list, and adds
the new Hosts/Terminal tab names.

.claude/settings.json

@@ -1,16 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "Bash(cargo check *)",
-      "Bash(cargo build *)",
-      "Bash(cargo clippy *)",
-      "Bash(cargo fmt *)",
-      "Bash(cargo tree *)",
-      "Bash(cargo doc *)",
-      "Bash(cargo test --workspace --lib)",
-      "Bash(cargo test --workspace)",
-      "Bash(cargo --version)",
-      "Bash(rustc --version)"
-    ]
-  }
-}

.gitignore

@@ -1,4 +1,5 @@
 /target
+Cargo.lock
 data/isos/*.iso
 data/isos/*.partial
 data/isos/*.meta.json

Cargo.toml

@@ -12,9 +12,9 @@ members = [
 ]
 
 [workspace.package]
-version = "0.5.1"
+version = "0.3.0"
 edition = "2021"
-rust-version = "1.95"
+rust-version = "1.80"
 license = "MIT OR Apache-2.0"
 repository = "https://gitea.milesward.dev/mward4/OpenPXE"
 authors = ["OpenPXE contributors"]
@@ -35,7 +35,7 @@ axum = { version = "0.7", features = ["macros", "multipart", "http2"] }
 tower = "0.5"
 tower-http = { version = "0.6", features = ["fs", "trace", "cors", "limit"] }
 hyper = "1.4"
-reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "stream", "json"] }
+reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "stream"] }
 mime = "0.3"
 mime_guess = "2.0"
 
@@ -53,38 +53,10 @@ uuid = { version = "1.10", features = ["v4", "serde"] }
 time = { version = "0.3", features = ["serde", "serde-human-readable", "formatting", "macros"] }
 sha2 = "0.10"
 hex = "0.4"
-bcrypt = "0.15"
 once_cell = "1.19"
 parking_lot = "0.12"
 rust-embed = { version = "8.5", features = ["include-exclude"] }
 
-# v0.4.67: pure-Rust NFSv3 client. Replaces the (deleted-in-v0.4.65)
-# kernel-mount NFS path with an in-process implementation that works
-# in any container — no kernel modules, no CAP_SYS_ADMIN, no
-# subprocess. Ships alongside the userspace SMB consumer; operators
-# pick whichever protocol their NAS prefers.
-nfs3_client = { version = "0.9", features = ["tokio"] }
-nfs3_types = "0.5"
-
-# v0.5.0: SMTP for webhook notifications (Slack/Teams/Discord go over
-# plain HTTP via reqwest; email needs a real SMTP client). rustls TLS
-# to match reqwest and stay musl-static-friendly — no OpenSSL.
-lettre = { version = "0.11", default-features = false, features = ["smtp-transport", "tokio1-rustls-tls", "builder", "hostname"] }
-
-# v0.5.1: pure-Rust SAML 2.0 Service Provider. bergshamra does XML-DSig
-# verification + exclusive c14n with RustCrypto (no OpenSSL/xmlsec/libxml2
-# C deps), so the static musl binary stays OpenSSL-free — samael was
-# rejected precisely because it hard-requires OpenSSL. We build the thin
-# SP layer (AuthnRequest, metadata parse, SAMLResponse semantics) on top.
-bergshamra = "0.4"
-roxmltree = "0.21"
-quick-xml = "0.40"
-x509-parser = "0.18"
-# flate2 default backend is miniz_oxide (pure Rust) — do NOT enable the
-# zlib/zlib-ng C backends, which would break the musl-static build.
-flate2 = "1.1"
-base64 = "0.22"
-
 openpxe-core = { path = "crates/core" }
 openpxe-dhcp-proxy = { path = "crates/dhcp-proxy" }
 openpxe-tftp = { path = "crates/tftp" }

README.md

@@ -5,12 +5,12 @@ Container-native PXE boot server. A Rust reimplementation of
 for Docker/OCI and OpenShift. Upload `.iso` files via the web UI; network
 clients PXE-boot them.
 
-> **Status:** v0.4.1 / pre-beta. Phases 1–5 complete: full PXE stack,
+> **Status:** v0.2.0 / pre-beta. Phases 1–5 complete: full PXE stack,
 > Queued Deployment queue, NFS-share ISO sources, live tracing log + an
-> operator terminal, per-MAC host bindings, Prometheus `/metrics`,
-> light/dark theme toggle, animated OpenPXE imaging-progress widget,
-> chunked ISO uploads, and per-ISO boot passwords. The test suite and
-> clippy are part of the release checklist. Ready for real-hardware validation.
+> operator terminal, per-MAC host bindings (Tinkerbell-style),
+> Prometheus `/metrics`, light/dark theme toggle, animated anvil
+> imaging-progress widget. **66 tests passing**, clippy clean. Ready
+> for real-hardware validation.
 
 ## Design non-negotiables
 
@@ -41,17 +41,18 @@ clients PXE-boot them.
    Tools          > Utilities / OpenPXE Shell / Network Card Info
    Queued Deployment
    ```
-6. **Queued Deployment queue** — the coordinated launch flow. A client that
+6. **Queued Deployment queue** — the "horse race" launch flow. A client that
    selects *Queued Deployment* gets a numbered position and waits. The
    operator picks an ISO in the web UI and fires it to every waiting
    client simultaneously.
-7. **Web UI** (Netbox-style): sidebar nav (Dashboard / Network / Queue /
-   Storage / Hosts / Terminal / About), light + dark themes
-   (toggle top-right or press `T`), animated OpenPXE progress
+7. **Web UI** (Netbox-style): sidebar nav (Dashboard / Network / Forge
+   Gate / Storage / Hosts / Terminal / About), light + dark themes
+   (toggle top-right or press `T`), animated anvil "forge progress"
    widget when devices are imaging. All assets served from the binary —
    no external requests.
 8. **Per-MAC host bindings.** Pin a MAC to a boot target and the client
-   skips the menu, chains straight through.
+   skips the menu, chains straight through. Inspired by Tinkerbell's
+   `smee` MAC-prepended URL pattern.
 9. **Prometheus metrics** at `/metrics` — DHCP replies by arch, TFTP
    transfer counts and bytes, HTTP request counts by route, queue /
    imaging gauges, uptime, build info. Plain text exposition format,
@@ -80,7 +81,7 @@ skip TFTP and respond with an HTTP URL.
 ./scripts/fetch-ipxe.sh
 
 # 2. Build the container image (~3 min first time).
-docker buildx build -f deploy/docker/Dockerfile -t openpxe:0.4.1 --load .
+docker buildx build -f deploy/docker/Dockerfile -t openpxe:0.1.0 --load .
 
 # 3. Run it on the box plugged into your PXE network. Set PUBLIC_IP to
 #    this host's LAN address so advertised iPXE URLs are reachable.
@@ -90,7 +91,7 @@ docker run -d --name openpxe \
   -e OPENPXE_DHCP_MODE=proxy \
   -v $PWD/data/isos:/var/lib/openpxe/isos \
   -v $PWD/data/work:/var/lib/openpxe/work \
-  openpxe:0.4.1
+  openpxe:0.1.0
 
 # 4. Open the UI and drop an ISO in.
 open http://10.0.0.5
@@ -121,7 +122,7 @@ docker buildx create --name openpxe-multi --driver docker-container --use
 # Build + push both linux/amd64 and linux/arm64 under one tag.
 docker buildx build --builder openpxe-multi \
   --platform linux/amd64,linux/arm64 \
-  -t ghcr.io/YOUR-ORG/openpxe:0.4.1 \
+  -t ghcr.io/YOUR-ORG/openpxe:0.1.0 \
   --push \
   -f deploy/docker/Dockerfile .
 ```
@@ -154,10 +155,10 @@ docker run --rm \
   -v /my/iso-library:/seed:ro \
   -v openpxe-data:/var/lib/openpxe/isos \
   -e OPENPXE_PUBLIC_IP=10.0.0.5 \
-  openpxe:0.4.1 seed --from /seed
+  openpxe:0.1.0 seed --from /seed
 
 # Dry run first to see what would be imported:
-docker run --rm -v /my/iso-library:/seed:ro openpxe:0.4.1 seed --from /seed --dry-run
+docker run --rm -v /my/iso-library:/seed:ro openpxe:0.1.0 seed --from /seed --dry-run
 ```
 
 ### Environment overrides
@@ -272,7 +273,7 @@ operational constraints inherited from the design:
 
 ## Queued Deployment
 
-The coordinated launch flow, end to end:
+The "horse race" launch flow, end to end:
 
 1. A client boots and picks **Queued Deployment** in the PXE menu (or falls
    through on timeout with the default `timeout_action`).
@@ -284,9 +285,8 @@ The coordinated launch flow, end to end:
    The server broadcasts the assignment to every queued client via a
    `tokio::sync::Notify`; each client's next poll returns the boot script
    for the chosen image.
-5. Every client chains the same image at effectively the same moment. The
-   queue stays visible until the operator releases entries, which keeps a
-   useful audit trail during hardware testing.
+5. Every client chains the same image at effectively the same moment — the
+   queue releases and the horses run together.
 
 No user-facing iPXE anywhere in this flow. The client only ever runs
 scripts we generate; the operator only interacts with the web UI.

crates/core/Cargo.toml

@@ -21,23 +21,6 @@ time.workspace = true
 uuid.workspace = true
 parking_lot.workspace = true
 tokio = { workspace = true, features = ["sync", "rt", "macros", "time"] }
-# bcrypt for the admin Forms auth (v0.4.5). Already in the workspace
-# for per-ISO boot passwords; just re-exported here.
-bcrypt.workspace = true
-
-# v0.5.1: pure-Rust SAML 2.0 SP. bergshamra = XML-DSig verify + exclusive
-# c14n (no OpenSSL/C). roxmltree/quick-xml parse + build SAML XML;
-# x509-parser pulls the IdP signing cert out of metadata; flate2+base64
-# encode the HTTP-Redirect binding's SAMLRequest.
-bergshamra.workspace = true
-roxmltree.workspace = true
-quick-xml.workspace = true
-x509-parser.workspace = true
-flate2.workspace = true
-base64.workspace = true
 
 [dev-dependencies]
 tempfile = "3.12"
-# v0.5.1: generate a throwaway self-signed signing cert/key so SAML
-# verification tests can produce genuinely signed SAMLResponses.
-rcgen = "0.13"

crates/core/src/arch.rs

@@ -126,10 +126,7 @@ mod tests {
     fn bootfile_names_stable() {
         assert_eq!(ClientArch::LegacyX86.ipxe_bootfile(), Some("undionly.kpxe"));
         assert_eq!(ClientArch::X64Uefi.ipxe_bootfile(), Some("snponly.efi"));
-        assert_eq!(
-            ClientArch::Arm64Uefi.ipxe_bootfile(),
-            Some("snponly-arm64.efi")
-        );
+        assert_eq!(ClientArch::Arm64Uefi.ipxe_bootfile(), Some("snponly-arm64.efi"));
         assert_eq!(ClientArch::Unknown(0xFFFF).ipxe_bootfile(), None);
     }
 

crates/core/src/auth.rs

@@ -1,353 +0,0 @@
-//! Operator authentication — Sonarr/Radarr-style single-admin Forms model.
-//!
-//! On a fresh install, no admin account exists; the WebUI's first-run
-//! flow prompts the operator to create one. After that the chosen
-//! credentials gate `/api/*` access. The admin can rotate username +
-//! password from Settings → Account.
-//!
-//! Multi-user RBAC isn't a goal for OpenPXE — the user explicitly asked
-//! for "you have access or you don't". When SSO is configured, additional
-//! users come in through the IdP; the locally-stored admin is the
-//! fallback owner who can change SSO config or the seal-breaker for an
-//! IdP outage. So one record is enough.
-//!
-//! Storage policy mirrors [`crate::host_bindings::HostBindings`] and
-//! [`crate::boot_log::BootLog`]: in-memory authoritative; disk is the
-//! crash-survival cache; a corrupt `auth.json` falls back to "no admin
-//! configured" rather than blocking startup, which puts the UI back
-//! into setup mode rather than locking the operator out.
-
-use parking_lot::RwLock;
-use serde::{Deserialize, Serialize};
-use std::path::PathBuf;
-use std::sync::Arc;
-use time::OffsetDateTime;
-
-use crate::{Error, Result};
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct AdminAccount {
-    pub username: String,
-    /// bcrypt hash (cost 10). The plaintext password never leaves the
-    /// request that set it — same discipline as the per-ISO boot password.
-    pub password_hash: String,
-    #[serde(with = "time::serde::rfc3339")]
-    pub created_at: OffsetDateTime,
-    #[serde(with = "time::serde::rfc3339")]
-    pub updated_at: OffsetDateTime,
-}
-
-/// Public projection — no hash, safe to ship to the WebUI.
-#[derive(Debug, Clone, Serialize)]
-pub struct AdminPublic {
-    pub username: String,
-    #[serde(with = "time::serde::rfc3339")]
-    pub created_at: OffsetDateTime,
-    #[serde(with = "time::serde::rfc3339")]
-    pub updated_at: OffsetDateTime,
-}
-
-impl From<&AdminAccount> for AdminPublic {
-    fn from(a: &AdminAccount) -> Self {
-        Self {
-            username: a.username.clone(),
-            created_at: a.created_at,
-            updated_at: a.updated_at,
-        }
-    }
-}
-
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-struct Inner {
-    admin: Option<AdminAccount>,
-}
-
-/// In-memory + on-disk admin registry. Cheap to clone.
-#[derive(Debug, Clone)]
-pub struct AdminStore {
-    path: Arc<PathBuf>,
-    inner: Arc<RwLock<Inner>>,
-}
-
-impl AdminStore {
-    /// Load from `<work_dir>/auth.json`, or start empty. A bad file
-    /// logs a warning and falls back to "no admin configured" — better
-    /// to surface the setup flow than lock the operator out of their
-    /// own install.
-    #[must_use]
-    pub fn load_or_default(work_dir: &std::path::Path) -> Self {
-        let path = work_dir.join("auth.json");
-        let inner = match std::fs::read_to_string(&path) {
-            Ok(text) => match serde_json::from_str::<Inner>(&text) {
-                Ok(parsed) => parsed,
-                Err(e) => {
-                    tracing::warn!(
-                        target: "openpxe::auth",
-                        "auth.json present but unreadable ({e}); starting in setup mode"
-                    );
-                    Inner::default()
-                }
-            },
-            Err(_) => Inner::default(),
-        };
-        Self {
-            path: Arc::new(path),
-            inner: Arc::new(RwLock::new(inner)),
-        }
-    }
-
-    /// Has an admin been bootstrapped? Drives the first-run / login
-    /// fork in the HTTP layer.
-    #[must_use]
-    pub fn is_configured(&self) -> bool {
-        self.inner.read().admin.is_some()
-    }
-
-    /// Public-safe snapshot for the WebUI.
-    #[must_use]
-    pub fn snapshot(&self) -> Option<AdminPublic> {
-        self.inner.read().admin.as_ref().map(AdminPublic::from)
-    }
-
-    /// First-run setup: create the admin account. Fails if one already
-    /// exists — the HTTP layer surfaces that as 409.
-    pub fn bootstrap(&self, username: &str, password: &str) -> Result<AdminPublic> {
-        validate_username(username)?;
-        validate_password(password)?;
-        let hash = bcrypt_hash(password)?;
-        let now = OffsetDateTime::now_utc();
-        let admin = AdminAccount {
-            username: username.trim().to_string(),
-            password_hash: hash,
-            created_at: now,
-            updated_at: now,
-        };
-        {
-            let mut g = self.inner.write();
-            if g.admin.is_some() {
-                return Err(Error::Invalid(
-                    "admin account already configured".into(),
-                ));
-            }
-            g.admin = Some(admin.clone());
-        }
-        self.persist();
-        tracing::info!(
-            target: "openpxe::auth",
-            username = %admin.username,
-            "admin account created (first-run setup)"
-        );
-        Ok((&admin).into())
-    }
-
-    /// Verify credentials. Returns the admin record (public projection)
-    /// on success, `Ok(None)` on mismatch, `Err` on systemic bcrypt
-    /// failure (treated as "auth not available right now" by callers).
-    pub fn verify(&self, username: &str, password: &str) -> Result<Option<AdminPublic>> {
-        let Some(admin) = self.inner.read().admin.clone() else {
-            return Ok(None);
-        };
-        if username.trim() != admin.username {
-            return Ok(None);
-        }
-        // bcrypt compares in constant time relative to the same hash.
-        // Doing the username check first is fine — a username mismatch
-        // returns immediately, but the only thing leaked is "this isn't
-        // the admin's username" which the operator already knows.
-        match bcrypt::verify(password, &admin.password_hash) {
-            Ok(true) => Ok(Some((&admin).into())),
-            Ok(false) => Ok(None),
-            Err(e) => Err(Error::Other(e.into())),
-        }
-    }
-
-    /// Rotate username and/or password. `current_password` must match
-    /// the *existing* hash — same flow as Sonarr's "current password
-    /// required to change". `new_username`/`new_password` are optional:
-    /// pass only what you want to change.
-    pub fn update_credentials(
-        &self,
-        current_password: &str,
-        new_username: Option<&str>,
-        new_password: Option<&str>,
-    ) -> Result<AdminPublic> {
-        // Re-check ownership before any state mutation.
-        let existing = self
-            .inner
-            .read()
-            .admin
-            .clone()
-            .ok_or_else(|| Error::Invalid("no admin configured".into()))?;
-        match bcrypt::verify(current_password, &existing.password_hash) {
-            Ok(true) => {}
-            Ok(false) => return Err(Error::Invalid("current password is incorrect".into())),
-            Err(e) => return Err(Error::Other(e.into())),
-        }
-
-        let mut updated = existing.clone();
-        if let Some(u) = new_username {
-            validate_username(u)?;
-            updated.username = u.trim().to_string();
-        }
-        if let Some(p) = new_password {
-            validate_password(p)?;
-            updated.password_hash = bcrypt_hash(p)?;
-        }
-        updated.updated_at = OffsetDateTime::now_utc();
-
-        {
-            let mut g = self.inner.write();
-            g.admin = Some(updated.clone());
-        }
-        self.persist();
-        tracing::info!(
-            target: "openpxe::auth",
-            username = %updated.username,
-            "admin credentials updated"
-        );
-        Ok((&updated).into())
-    }
-
-    fn persist(&self) {
-        let snap = self.inner.read().clone();
-        let body = match serde_json::to_vec_pretty(&snap) {
-            Ok(b) => b,
-            Err(e) => {
-                tracing::warn!(target: "openpxe::auth", "serialize auth.json: {e}");
-                return;
-            }
-        };
-        if let Some(parent) = self.path.parent() {
-            let _ = std::fs::create_dir_all(parent);
-        }
-        let tmp = self.path.with_extension("json.tmp");
-        if let Err(e) = std::fs::write(&tmp, body) {
-            tracing::warn!(target: "openpxe::auth", "write auth.json tmp: {e}");
-            return;
-        }
-        if let Err(e) = std::fs::rename(&tmp, self.path.as_path()) {
-            tracing::warn!(target: "openpxe::auth", "rename auth.json: {e}");
-        }
-    }
-}
-
-fn validate_username(u: &str) -> Result<()> {
-    let u = u.trim();
-    if u.is_empty() {
-        return Err(Error::Invalid("username must not be empty".into()));
-    }
-    if u.len() > 64 {
-        return Err(Error::Invalid("username must be 64 chars or fewer".into()));
-    }
-    if !u.chars().all(|c| c.is_ascii_graphic() && c != ':') {
-        return Err(Error::Invalid(
-            "username must be ASCII printable with no ':' character".into(),
-        ));
-    }
-    Ok(())
-}
-
-fn validate_password(p: &str) -> Result<()> {
-    if p.len() < 8 {
-        return Err(Error::Invalid(
-            "password must be at least 8 characters".into(),
-        ));
-    }
-    if p.len() > 256 {
-        return Err(Error::Invalid(
-            "password must be 256 characters or fewer".into(),
-        ));
-    }
-    Ok(())
-}
-
-fn bcrypt_hash(password: &str) -> Result<String> {
-    bcrypt::hash(password, bcrypt::DEFAULT_COST).map_err(|e| Error::Other(e.into()))
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use tempfile::tempdir;
-
-    #[test]
-    fn empty_after_load_when_no_file() {
-        let dir = tempdir().unwrap();
-        let s = AdminStore::load_or_default(dir.path());
-        assert!(!s.is_configured());
-        assert!(s.snapshot().is_none());
-    }
-
-    #[test]
-    fn bootstrap_then_verify_round_trip() {
-        let dir = tempdir().unwrap();
-        let s = AdminStore::load_or_default(dir.path());
-        let pub_ = s.bootstrap("admin", "hunter2hunter2").unwrap();
-        assert_eq!(pub_.username, "admin");
-        assert!(s.is_configured());
-
-        // Correct creds match; wrong creds don't.
-        assert!(s.verify("admin", "hunter2hunter2").unwrap().is_some());
-        assert!(s.verify("admin", "wrong").unwrap().is_none());
-        assert!(s.verify("nobody", "hunter2hunter2").unwrap().is_none());
-    }
-
-    #[test]
-    fn bootstrap_rejects_second_call() {
-        let dir = tempdir().unwrap();
-        let s = AdminStore::load_or_default(dir.path());
-        s.bootstrap("admin", "hunter2hunter2").unwrap();
-        let r = s.bootstrap("other", "anotherpass1");
-        assert!(matches!(r, Err(Error::Invalid(_))));
-    }
-
-    #[test]
-    fn round_trip_survives_disk_reload() {
-        let dir = tempdir().unwrap();
-        let s = AdminStore::load_or_default(dir.path());
-        s.bootstrap("admin", "hunter2hunter2").unwrap();
-        drop(s);
-        let s2 = AdminStore::load_or_default(dir.path());
-        assert!(s2.is_configured());
-        assert!(s2.verify("admin", "hunter2hunter2").unwrap().is_some());
-    }
-
-    #[test]
-    fn update_credentials_requires_current_password() {
-        let dir = tempdir().unwrap();
-        let s = AdminStore::load_or_default(dir.path());
-        s.bootstrap("admin", "hunter2hunter2").unwrap();
-        // Wrong current password → no change.
-        let r = s.update_credentials("nope", None, Some("newpassword1"));
-        assert!(matches!(r, Err(Error::Invalid(_))));
-        assert!(s.verify("admin", "hunter2hunter2").unwrap().is_some());
-
-        // Correct current password rotates only what's supplied.
-        s.update_credentials("hunter2hunter2", Some("alice"), Some("newpassword1"))
-            .unwrap();
-        assert!(s.verify("admin", "hunter2hunter2").unwrap().is_none());
-        assert!(s.verify("alice", "newpassword1").unwrap().is_some());
-    }
-
-    #[test]
-    fn update_credentials_partial_password_only_keeps_username() {
-        let dir = tempdir().unwrap();
-        let s = AdminStore::load_or_default(dir.path());
-        s.bootstrap("admin", "hunter2hunter2").unwrap();
-        s.update_credentials("hunter2hunter2", None, Some("newpassword1"))
-            .unwrap();
-        assert!(s.verify("admin", "newpassword1").unwrap().is_some());
-    }
-
-    #[test]
-    fn validates_username_and_password() {
-        let dir = tempdir().unwrap();
-        let s = AdminStore::load_or_default(dir.path());
-        assert!(s.bootstrap("", "hunter2hunter2").is_err());
-        assert!(s.bootstrap("ad:min", "hunter2hunter2").is_err()); // ':' reserved
-        assert!(s.bootstrap("admin", "short").is_err()); // <8 chars
-        // 65-char username is too long.
-        let long = "a".repeat(65);
-        assert!(s.bootstrap(&long, "hunter2hunter2").is_err());
-    }
-}

crates/core/src/boot_log.rs

@@ -1,249 +0,0 @@
-//! Boot-event log — "who installed what, when, from where".
-//!
-//! Each `/boot/<entry>.ipxe` fetch that actually goes on to serve a boot
-//! script lands an entry here. The log is bounded in memory (newest-first,
-//! ring-buffered at [`BootLog::CAP`]) and is mirrored append-only to
-//! `<work_dir>/boot_log.jsonl`. Mirrors `HostBindings`'s "in-memory is
-//! authoritative, disk is a cache" policy — a corrupt log file should
-//! never block PXE for the network.
-//!
-//! We deliberately don't push these onto the `LogBus` (the operator
-//! terminal stream). The terminal already shows the http traces; the
-//! Host log is a curated, persistent, easy-to-scan view of "what got
-//! imaged on what hardware" and conflating the two would be noisy.
-
-use parking_lot::RwLock;
-use serde::{Deserialize, Serialize};
-use std::collections::VecDeque;
-use std::io::Write;
-use std::net::IpAddr;
-use std::path::PathBuf;
-use std::sync::Arc;
-use time::OffsetDateTime;
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct BootEvent {
-    #[serde(with = "time::serde::rfc3339")]
-    pub timestamp: OffsetDateTime,
-    /// Lowercase, colon-separated. `None` when iPXE didn't supply
-    /// `?mac=${mac}` in the chain URL (older bookmarks, custom scripts).
-    pub mac: Option<String>,
-    /// Connecting peer's IP — taken from the TCP socket when available
-    /// (PXE clients connect direct, no reverse proxy), and falls back to
-    /// `X-Forwarded-For` for the rare case where one is present.
-    pub ip: Option<IpAddr>,
-    /// `BootEntry::id` — the same id used in `/boot/<id>.ipxe`.
-    pub target_id: String,
-    /// Human-friendly label: the ISO's filename / volume label / entry
-    /// title. Pre-resolved at log time so the UI can render without
-    /// joining against the ISO store (and so "what image was installed?"
-    /// survives the operator deleting the ISO later).
-    pub target_title: String,
-}
-
-/// In-memory ring + disk-backed append log of boot events. Cheap to
-/// clone; the inner state is `Arc<RwLock<_>>`.
-#[derive(Debug, Clone)]
-pub struct BootLog {
-    path: Arc<PathBuf>,
-    inner: Arc<RwLock<VecDeque<BootEvent>>>,
-}
-
-impl BootLog {
-    /// Newest entries we retain in memory. Past this, the oldest gets
-    /// evicted — the on-disk JSONL keeps the full history for offline
-    /// inspection. 500 covers a typical install-day's worth without
-    /// turning the Hosts tab into a wall of text.
-    pub const CAP: usize = 500;
-
-    /// Load up to `CAP` newest events from `<work_dir>/boot_log.jsonl`,
-    /// or start empty if the file is missing / unreadable.
-    #[must_use]
-    pub fn load_or_default(work_dir: &std::path::Path) -> Self {
-        let path = work_dir.join("boot_log.jsonl");
-        let mut events = VecDeque::with_capacity(Self::CAP);
-        if let Ok(text) = std::fs::read_to_string(&path) {
-            for line in text.lines() {
-                if line.trim().is_empty() {
-                    continue;
-                }
-                match serde_json::from_str::<BootEvent>(line) {
-                    Ok(ev) => {
-                        if events.len() == Self::CAP {
-                            events.pop_front();
-                        }
-                        events.push_back(ev);
-                    }
-                    Err(e) => {
-                        tracing::warn!(
-                            target: "openpxe::boot_log",
-                            "skipping unparseable boot_log line: {e}"
-                        );
-                    }
-                }
-            }
-        }
-        Self {
-            path: Arc::new(path),
-            inner: Arc::new(RwLock::new(events)),
-        }
-    }
-
-    /// Append an event. Persistence is best-effort and never blocks the
-    /// caller on a failed write (the in-memory copy is the source of
-    /// truth for the live UI; the JSONL is just for crash survival).
-    pub fn record(&self, ev: &BootEvent) {
-        // Push into the ring first so a slow / failing disk doesn't lose
-        // events for the live UI.
-        {
-            let mut g = self.inner.write();
-            if g.len() == Self::CAP {
-                g.pop_front();
-            }
-            g.push_back(ev.clone());
-        }
-        tracing::info!(
-            target: "openpxe::boot_log",
-            mac = ev.mac.as_deref().unwrap_or("?"),
-            ip = ev.ip.map(|i| i.to_string()).as_deref().unwrap_or("?"),
-            target = %ev.target_id,
-            "boot event"
-        );
-        // Append to disk. We tolerate write failures — they'd show up as
-        // missing entries on the next restart only.
-        let mut line = match serde_json::to_string(ev) {
-            Ok(s) => s,
-            Err(e) => {
-                tracing::warn!(target: "openpxe::boot_log", "serialize boot event: {e}");
-                return;
-            }
-        };
-        line.push('\n');
-        if let Some(parent) = self.path.parent() {
-            let _ = std::fs::create_dir_all(parent);
-        }
-        match std::fs::OpenOptions::new()
-            .create(true)
-            .append(true)
-            .open(self.path.as_path())
-        {
-            Ok(mut f) => {
-                if let Err(e) = f.write_all(line.as_bytes()) {
-                    tracing::warn!(target: "openpxe::boot_log", "append boot_log.jsonl: {e}");
-                }
-            }
-            Err(e) => {
-                tracing::warn!(target: "openpxe::boot_log", "open boot_log.jsonl: {e}");
-            }
-        }
-    }
-
-    /// Newest-first snapshot, up to `CAP` entries.
-    #[must_use]
-    pub fn list(&self) -> Vec<BootEvent> {
-        let g = self.inner.read();
-        // VecDeque preserves insertion order; reverse so newest is first.
-        g.iter().rev().cloned().collect()
-    }
-
-    #[must_use]
-    pub fn len(&self) -> usize {
-        self.inner.read().len()
-    }
-
-    #[must_use]
-    pub fn is_empty(&self) -> bool {
-        self.len() == 0
-    }
-
-    /// Wipe in-memory + the on-disk file. Used by the `terminal clear`
-    /// equivalent or future operator action; not currently wired to a UI
-    /// button but exposed for completeness.
-    pub fn clear(&self) {
-        self.inner.write().clear();
-        let _ = std::fs::remove_file(self.path.as_path());
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use tempfile::tempdir;
-
-    fn ev(target: &str, mac: Option<&str>) -> BootEvent {
-        BootEvent {
-            timestamp: OffsetDateTime::now_utc(),
-            mac: mac.map(str::to_string),
-            ip: Some("10.0.0.42".parse().unwrap()),
-            target_id: target.into(),
-            target_title: format!("{target}.iso"),
-        }
-    }
-
-    #[test]
-    fn record_then_list_is_newest_first() {
-        let dir = tempdir().unwrap();
-        let log = BootLog::load_or_default(dir.path());
-        assert!(log.is_empty());
-        log.record(&ev("alpha", Some("aa:bb:cc:00:00:01")));
-        log.record(&ev("beta", Some("aa:bb:cc:00:00:02")));
-        let list = log.list();
-        assert_eq!(list.len(), 2);
-        assert_eq!(list[0].target_id, "beta");
-        assert_eq!(list[1].target_id, "alpha");
-    }
-
-    #[test]
-    fn round_trip_through_disk() {
-        let dir = tempdir().unwrap();
-        let log = BootLog::load_or_default(dir.path());
-        log.record(&ev("alpha", Some("aa:bb:cc:00:00:01")));
-        log.record(&ev("beta", None));
-        drop(log);
-        let log2 = BootLog::load_or_default(dir.path());
-        assert_eq!(log2.len(), 2);
-        let list = log2.list();
-        assert_eq!(list[0].target_id, "beta");
-        assert_eq!(list[1].target_id, "alpha");
-        assert!(list[0].mac.is_none());
-        assert_eq!(list[1].mac.as_deref(), Some("aa:bb:cc:00:00:01"));
-    }
-
-    #[test]
-    fn ring_evicts_oldest_past_cap() {
-        let dir = tempdir().unwrap();
-        let log = BootLog::load_or_default(dir.path());
-        for i in 0..(BootLog::CAP + 5) {
-            log.record(&ev(&format!("e{i}"), None));
-        }
-        assert_eq!(log.len(), BootLog::CAP);
-        let list = log.list();
-        // Newest first; the most recent push is the last index inserted.
-        assert_eq!(list[0].target_id, format!("e{}", BootLog::CAP + 4));
-        // Oldest in-memory should be the 6th push (0..5 were evicted).
-        assert_eq!(list[BootLog::CAP - 1].target_id, "e5");
-    }
-
-    #[test]
-    fn clear_wipes_memory_and_disk() {
-        let dir = tempdir().unwrap();
-        let log = BootLog::load_or_default(dir.path());
-        log.record(&ev("alpha", None));
-        log.clear();
-        assert!(log.is_empty());
-        let log2 = BootLog::load_or_default(dir.path());
-        assert!(log2.is_empty());
-    }
-
-    #[test]
-    fn corrupt_disk_lines_are_skipped_not_fatal() {
-        // Write a file with one valid + one garbage line; loader should
-        // surface the valid one and skip the garbage.
-        let dir = tempdir().unwrap();
-        let path = dir.path().join("boot_log.jsonl");
-        let valid = serde_json::to_string(&ev("ok", Some("aa:bb:cc:00:00:09"))).unwrap();
-        std::fs::write(&path, format!("{valid}\nNOT_JSON\n{valid}\n")).unwrap();
-        let log = BootLog::load_or_default(dir.path());
-        assert_eq!(log.len(), 2);
-    }
-}

crates/core/src/branding.rs

@@ -1,375 +0,0 @@
-//! Operator-controlled branding overrides.
-//!
-//! The browser tab's logo (`/assets/logo.svg`) defaults to the bundled
-//! rainbow-horizon mark. Operators who deploy OpenPXE behind their own
-//! branding can upload a replacement that lives at
-//! `<work_dir>/branding/logo.<ext>` and is served in preference to the
-//! bundled SVG when present. Borrowed-from-FleetDM: tenant chrome, same
-//! product.
-//!
-//! Storage policy mirrors `HostBindings` / `BootLog`: in-memory cache is
-//! authoritative for the current process, disk is the source of truth on
-//! restart, and a corrupt cache file falls back to the bundled default
-//! rather than blocking startup.
-
-use parking_lot::RwLock;
-use serde::{Deserialize, Serialize};
-use std::path::{Path, PathBuf};
-use std::sync::Arc;
-
-/// Allowed MIME types for an uploaded logo. We deliberately keep this
-/// narrow — anything that can be `<img src="...">`'d into the brand
-/// block, no scripts. SVG carries the obvious XSS risk for raw inline
-/// HTML; we always serve the bytes as a separate asset with a strict
-/// content-type rather than inlining, so SVG is safe.
-pub const ALLOWED_LOGO_MIMES: &[&str] = &[
-    "image/svg+xml",
-    "image/png",
-    "image/jpeg",
-    "image/webp",
-    "image/gif",
-];
-
-/// Disk cap for an uploaded logo. PXE WebUIs are operator-facing — even
-/// a generous 2 MB cap is comfortable for any reasonable brand mark and
-/// puts a clear bound on memory + serialization cost.
-pub const MAX_LOGO_BYTES: usize = 2 * 1024 * 1024;
-
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-struct Inner {
-    /// File name (relative to the branding dir) for the active logo, if
-    /// any. Always under `<work_dir>/branding/`; never an absolute path
-    /// from the operator.
-    logo_filename: Option<String>,
-    /// MIME of the active logo, mirroring `logo_filename`. Cached here
-    /// so the HTTP layer can set Content-Type without re-sniffing.
-    logo_mime: Option<String>,
-    /// Monotonic counter bumped on every set/clear. Surfaces as a
-    /// cache-bust token (`/assets/logo.svg?r=<rev>`) so the browser
-    /// fetches the new bytes the moment the operator swaps the logo —
-    /// the app version alone can't do this since it doesn't change on
-    /// upload. Persisted so the token stays stable across restarts and
-    /// keeps climbing across multiple swaps.
-    #[serde(default)]
-    rev: u64,
-}
-
-/// In-memory + on-disk override registry. Cheap to clone; locks are
-/// brief. The `branding.json` cache lives alongside the active asset
-/// inside `<work_dir>/branding/`.
-#[derive(Debug, Clone)]
-pub struct BrandingStore {
-    /// Root directory: `<work_dir>/branding/`. Created on first write.
-    dir: Arc<PathBuf>,
-    inner: Arc<RwLock<Inner>>,
-}
-
-impl BrandingStore {
-    /// Load (or initialise empty) from `<work_dir>/branding/`. Tolerates
-    /// missing directories, partial state, and corrupt JSON — a bad
-    /// cache should never block PXE for the network.
-    #[must_use]
-    pub fn load_or_default(work_dir: &Path) -> Self {
-        let dir = work_dir.join("branding");
-        let path = dir.join("branding.json");
-        let mut inner = Inner::default();
-        if let Ok(text) = std::fs::read_to_string(&path) {
-            match serde_json::from_str::<Inner>(&text) {
-                Ok(parsed) => {
-                    // Sanity: if the JSON says we have a logo but the
-                    // file is gone, clear the in-memory pointer so
-                    // /assets/logo.svg falls back to the bundled SVG
-                    // rather than 500ing on a missing file.
-                    if let Some(name) = parsed.logo_filename.as_deref() {
-                        if dir.join(name).is_file() {
-                            inner = parsed;
-                        } else {
-                            tracing::warn!(
-                                target: "openpxe::branding",
-                                file = %name,
-                                "branding.json points at missing file; clearing"
-                            );
-                        }
-                    } else {
-                        inner = parsed;
-                    }
-                }
-                Err(e) => {
-                    tracing::warn!(
-                        target: "openpxe::branding",
-                        "branding.json present but unreadable ({e}); starting empty"
-                    );
-                }
-            }
-        }
-        Self {
-            dir: Arc::new(dir),
-            inner: Arc::new(RwLock::new(inner)),
-        }
-    }
-
-    /// Absolute path to the active logo, if one is set and present on
-    /// disk. `None` means the HTTP layer should serve the bundled SVG.
-    #[must_use]
-    pub fn logo_path(&self) -> Option<PathBuf> {
-        let g = self.inner.read();
-        g.logo_filename.as_deref().map(|n| self.dir.join(n))
-    }
-
-    /// MIME of the active logo, if any. The HTTP layer pairs this with
-    /// the bytes returned by [`Self::logo_path`].
-    #[must_use]
-    pub fn logo_mime(&self) -> Option<String> {
-        self.inner.read().logo_mime.clone()
-    }
-
-    /// Replace the active logo. Returns the chosen on-disk filename so
-    /// the caller can echo it back in the API response. Old logos are
-    /// removed best-effort.
-    pub fn set_logo(&self, mime: &str, ext: &str, bytes: &[u8]) -> std::io::Result<String> {
-        std::fs::create_dir_all(self.dir.as_path())?;
-        // Single canonical filename per upload — overwriting the old one
-        // (after clearing it) keeps the directory tidy and avoids any
-        // path-traversal concern: the operator never supplies the name.
-        let safe_ext = sanitize_ext(ext);
-        let filename = format!("logo.{safe_ext}");
-        let final_path = self.dir.join(&filename);
-        // Atomic write: tmp -> rename. Guarantees the file is either
-        // entirely the old logo or entirely the new one.
-        let tmp = final_path.with_extension(format!("{safe_ext}.tmp"));
-        std::fs::write(&tmp, bytes)?;
-        std::fs::rename(&tmp, &final_path)?;
-        // Clean up any sibling logo.<otherext> so there's exactly one
-        // canonical file at any time.
-        if let Ok(entries) = std::fs::read_dir(self.dir.as_path()) {
-            for e in entries.flatten() {
-                let p = e.path();
-                let name = p
-                    .file_name()
-                    .and_then(|s| s.to_str())
-                    .unwrap_or("");
-                if name.starts_with("logo.") && name != filename {
-                    let _ = std::fs::remove_file(&p);
-                }
-            }
-        }
-
-        {
-            let mut g = self.inner.write();
-            g.logo_filename = Some(filename.clone());
-            g.logo_mime = Some(mime.to_string());
-            g.rev = g.rev.wrapping_add(1);
-        }
-        self.persist();
-        tracing::info!(
-            target: "openpxe::branding",
-            file = %filename, mime = %mime, size = bytes.len(),
-            "custom logo installed"
-        );
-        Ok(filename)
-    }
-
-    /// Drop the override and return to the bundled SVG.
-    pub fn clear_logo(&self) -> std::io::Result<()> {
-        let removed = {
-            let mut g = self.inner.write();
-            let removed = g.logo_filename.take();
-            g.logo_mime = None;
-            g.rev = g.rev.wrapping_add(1);
-            removed
-        };
-        if let Some(name) = removed {
-            let p = self.dir.join(&name);
-            let _ = std::fs::remove_file(&p);
-            tracing::info!(target: "openpxe::branding", file = %name, "custom logo cleared");
-        }
-        self.persist();
-        Ok(())
-    }
-
-    /// Convenience: true if a custom logo is configured. Surfaces on
-    /// `/api/status` so the WebUI can show "Custom logo: yes" without
-    /// fetching the asset itself.
-    #[must_use]
-    pub fn has_logo(&self) -> bool {
-        self.inner.read().logo_filename.is_some()
-    }
-
-    /// Cache-bust token for the logo asset URL. Changes on every
-    /// set/clear so `/assets/logo.svg?r=<rev>` resolves to a fresh URL
-    /// whenever the operator swaps the brand mark. Stable otherwise.
-    #[must_use]
-    pub fn logo_rev(&self) -> u64 {
-        self.inner.read().rev
-    }
-
-    fn persist(&self) {
-        let snap = self.inner.read().clone();
-        let body = match serde_json::to_vec_pretty(&snap) {
-            Ok(b) => b,
-            Err(e) => {
-                tracing::warn!(target: "openpxe::branding", "serialize branding.json: {e}");
-                return;
-            }
-        };
-        if let Err(e) = std::fs::create_dir_all(self.dir.as_path()) {
-            tracing::warn!(target: "openpxe::branding", "mkdir branding/: {e}");
-            return;
-        }
-        let path = self.dir.join("branding.json");
-        let tmp = path.with_extension("json.tmp");
-        if let Err(e) = std::fs::write(&tmp, body) {
-            tracing::warn!(target: "openpxe::branding", "write branding.json tmp: {e}");
-            return;
-        }
-        if let Err(e) = std::fs::rename(&tmp, &path) {
-            tracing::warn!(target: "openpxe::branding", "rename branding.json: {e}");
-        }
-    }
-}
-
-/// Trim arbitrary operator-supplied extension strings to a small, safe
-/// alphanumeric form. Anything weird collapses to `bin`. We never let
-/// the extension affect the path beyond the final segment of `logo.<x>`.
-fn sanitize_ext(ext: &str) -> String {
-    let lc: String = ext
-        .chars()
-        .filter(char::is_ascii_alphanumeric)
-        .map(|c| c.to_ascii_lowercase())
-        .collect();
-    if lc.is_empty() || lc.len() > 5 {
-        "bin".into()
-    } else {
-        lc
-    }
-}
-
-/// Pick a safe filesystem extension from a MIME type. Returns `None`
-/// if the MIME isn't on the [`ALLOWED_LOGO_MIMES`] allowlist.
-#[must_use]
-pub fn ext_for_mime(mime: &str) -> Option<&'static str> {
-    match mime {
-        "image/svg+xml" => Some("svg"),
-        "image/png" => Some("png"),
-        "image/jpeg" => Some("jpg"),
-        "image/webp" => Some("webp"),
-        "image/gif" => Some("gif"),
-        _ => None,
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use tempfile::tempdir;
-
-    #[test]
-    fn empty_after_load_when_no_branding_dir() {
-        let dir = tempdir().unwrap();
-        let b = BrandingStore::load_or_default(dir.path());
-        assert!(!b.has_logo());
-        assert!(b.logo_path().is_none());
-        assert!(b.logo_mime().is_none());
-    }
-
-    #[test]
-    fn set_clear_round_trip_persists() {
-        let dir = tempdir().unwrap();
-        let b = BrandingStore::load_or_default(dir.path());
-        let name = b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake").unwrap();
-        assert_eq!(name, "logo.png");
-        assert!(b.has_logo());
-        assert_eq!(b.logo_mime().as_deref(), Some("image/png"));
-        let p = b.logo_path().unwrap();
-        assert!(p.is_file());
-
-        // Re-open and confirm the override survives a restart.
-        drop(b);
-        let b2 = BrandingStore::load_or_default(dir.path());
-        assert!(b2.has_logo());
-        assert_eq!(b2.logo_mime().as_deref(), Some("image/png"));
-
-        // Clear; the file goes away and has_logo flips off.
-        b2.clear_logo().unwrap();
-        assert!(!b2.has_logo());
-        assert!(!p.exists());
-    }
-
-    #[test]
-    fn replacing_logo_removes_old_extension_sibling() {
-        // PNG then SVG; only the SVG should remain on disk.
-        let dir = tempdir().unwrap();
-        let b = BrandingStore::load_or_default(dir.path());
-        b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake").unwrap();
-        b.set_logo("image/svg+xml", "svg", br#"<svg xmlns="http://www.w3.org/2000/svg"/>"#).unwrap();
-        let entries: Vec<_> = std::fs::read_dir(dir.path().join("branding"))
-            .unwrap()
-            .filter_map(|e| e.ok().map(|e| e.file_name().to_string_lossy().into_owned()))
-            .collect();
-        assert!(entries.iter().any(|n| n == "logo.svg"), "got {entries:?}");
-        assert!(!entries.iter().any(|n| n == "logo.png"), "stale PNG left over: {entries:?}");
-    }
-
-    #[test]
-    fn logo_rev_bumps_on_each_set_and_clear() {
-        let dir = tempdir().unwrap();
-        let b = BrandingStore::load_or_default(dir.path());
-        assert_eq!(b.logo_rev(), 0);
-        b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake").unwrap();
-        assert_eq!(b.logo_rev(), 1);
-        b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake2").unwrap();
-        assert_eq!(b.logo_rev(), 2);
-        b.clear_logo().unwrap();
-        assert_eq!(b.logo_rev(), 3);
-        // Survives a restart.
-        drop(b);
-        let b2 = BrandingStore::load_or_default(dir.path());
-        assert_eq!(b2.logo_rev(), 3);
-    }
-
-    #[test]
-    fn sanitize_ext_strips_separators_and_path_chars() {
-        assert_eq!(sanitize_ext("svg"), "svg");
-        // Path separators and non-alphanumerics filter out, leaving just
-        // letters. The remaining "etcpasswd" exceeds the 5-char cap so
-        // it collapses to `bin` rather than producing `etcpa`.
-        assert_eq!(sanitize_ext("../etc/passwd"), "bin");
-        // Short alphanumeric strip-through stays itself.
-        assert_eq!(sanitize_ext("../svg"), "svg");
-        assert_eq!(sanitize_ext(""), "bin");
-        assert_eq!(sanitize_ext("PNG"), "png");
-        // Anything past five chars is suspicious — collapse to `bin`.
-        assert_eq!(sanitize_ext("svgvvvv"), "bin");
-    }
-
-    #[test]
-    fn missing_file_referenced_by_json_resolves_to_empty() {
-        // If the operator nukes the file out from under the JSON cache,
-        // we should silently fall back to no-override rather than
-        // hanging on to a bogus path.
-        let dir = tempdir().unwrap();
-        let brand_dir = dir.path().join("branding");
-        std::fs::create_dir_all(&brand_dir).unwrap();
-        // Hand-write a branding.json claiming logo.png exists.
-        let inner = Inner {
-            logo_filename: Some("logo.png".into()),
-            logo_mime: Some("image/png".into()),
-            rev: 0,
-        };
-        std::fs::write(
-            brand_dir.join("branding.json"),
-            serde_json::to_vec_pretty(&inner).unwrap(),
-        )
-        .unwrap();
-        let b = BrandingStore::load_or_default(dir.path());
-        assert!(!b.has_logo(), "should fall back when referenced file is missing");
-    }
-
-    #[test]
-    fn ext_for_mime_only_accepts_known_types() {
-        assert_eq!(ext_for_mime("image/png"), Some("png"));
-        assert_eq!(ext_for_mime("image/svg+xml"), Some("svg"));
-        assert_eq!(ext_for_mime("application/octet-stream"), None);
-        assert_eq!(ext_for_mime("text/html"), None);
-    }
-}

crates/core/src/client.rs

@@ -56,9 +56,7 @@ impl ClientRegistry {
     ) {
         let mut guard = self.inner.write();
         let now = OffsetDateTime::now_utc();
-        let entry = guard
-            .entry(mac.to_string())
-            .or_insert_with(|| ClientSnapshot {
+        let entry = guard.entry(mac.to_string()).or_insert_with(|| ClientSnapshot {
             mac: mac.to_string(),
             last_ip: ip,
             arch,
@@ -69,12 +67,8 @@ impl ClientRegistry {
             selected_target: None,
         });
         entry.last_seen = now;
-        if ip.is_some() {
-            entry.last_ip = ip;
-        }
-        if arch.is_some() {
-            entry.arch = arch;
-        }
+        if ip.is_some() { entry.last_ip = ip; }
+        if arch.is_some() { entry.arch = arch; }
         entry.events.push((now, event));
         // Cap event history per client to keep memory bounded.
         const MAX_EVENTS: usize = 64;

crates/core/src/config.rs

@@ -68,7 +68,7 @@ pub struct Paths {
     pub work_dir: PathBuf,
     /// Directory containing bundled iPXE binaries (undionly.kpxe, snponly.efi, ...).
     pub ipxe_dir: PathBuf,
-    /// Path to the wimboot binary for Windows ISOs (optional — feature-controlled).
+    /// Path to the wimboot binary for Windows ISOs (optional — feature-gated).
     pub wimboot_path: Option<PathBuf>,
     /// Directory under which Windows ISOs are extracted and served via SMB.
     /// Only used when `settings.windows_enabled = true`. Defaults to
@@ -128,24 +128,16 @@ impl Config {
     /// Call this after loading the TOML file so env takes precedence.
     pub fn apply_env(&mut self) {
         if let Ok(v) = std::env::var("OPENPXE_HTTP_PORT") {
-            if let Ok(p) = v.parse() {
-                self.server.http_port = p;
-            }
+            if let Ok(p) = v.parse() { self.server.http_port = p; }
         }
         if let Ok(v) = std::env::var("OPENPXE_TFTP_PORT") {
-            if let Ok(p) = v.parse() {
-                self.server.tftp_port = p;
-            }
+            if let Ok(p) = v.parse() { self.server.tftp_port = p; }
         }
         if let Ok(v) = std::env::var("OPENPXE_DHCP_PORT") {
-            if let Ok(p) = v.parse() {
-                self.network.dhcp_port = p;
-            }
+            if let Ok(p) = v.parse() { self.network.dhcp_port = p; }
         }
         if let Ok(v) = std::env::var("OPENPXE_PUBLIC_IP") {
-            if let Ok(ip) = v.parse() {
-                self.server.public_ip = Some(ip);
-            }
+            if let Ok(ip) = v.parse() { self.server.public_ip = Some(ip); }
         }
         if let Ok(v) = std::env::var("OPENPXE_DHCP_MODE") {
             self.network.dhcp_mode = match v.to_ascii_lowercase().as_str() {

crates/core/src/host_bindings.rs

@@ -1,9 +1,10 @@
 //! Per-MAC host bindings.
 //!
-//! Operators can attach a preferred boot target (a `BootEntry::id`) to a
-//! specific MAC address. When a client with that MAC arrives, the top-level
-//! boot script chains straight to that target instead of showing the
-//! interactive menu.
+//! Inspired by the Tinkerbell `smee` "MAC-prepended URL" pattern: an
+//! operator can attach a preferred boot target (a `BootEntry::id`) to a
+//! specific MAC address. When a client with that MAC arrives, the
+//! top-level boot script chains straight to that target instead of
+//! showing the interactive menu.
 //!
 //! Use cases:
 //! - "This rack of Dell servers always images with Ubuntu Server 24.04"
@@ -28,7 +29,7 @@ pub struct HostBinding {
     /// don't have to worry about case.
     pub mac: String,
     /// Preferred boot entry id (matches a `BootEntry::id` in the iso
-    /// store) OR one of the reserved menu names: `_local`, `_queue`,
+    /// store) OR one of the reserved menu names: `_local`, `_gate`,
     /// `_tools_menu`. Empty string falls back to the menu.
     pub target: String,
     /// Optional human-readable label shown in the UI (`"Tom's laptop"`,

crates/core/src/lib.rs

@@ -3,34 +3,21 @@
 #![forbid(unsafe_code)]
 
 pub mod arch;
-pub mod auth;
-pub mod boot_log;
-pub mod branding;
 pub mod client;
 pub mod config;
 pub mod error;
+pub mod queue;
 pub mod host_bindings;
 pub mod log_bus;
 pub mod metrics;
-pub mod notify;
-pub mod queue;
-pub mod saml;
 pub mod settings;
-pub mod sso;
-pub mod wol;
 
 pub use arch::{ClientArch, FirmwareClass};
-pub use auth::{AdminAccount, AdminPublic, AdminStore};
-pub use boot_log::{BootEvent, BootLog};
-pub use branding::{ext_for_mime, BrandingStore, ALLOWED_LOGO_MIMES, MAX_LOGO_BYTES};
 pub use client::{ClientEvent, ClientRegistry, ClientSnapshot};
 pub use config::{Config, DhcpMode, NetworkConfig, Paths, ServerConfig};
 pub use error::{Error, Result};
+pub use queue::{Gate, DeploymentQueue};
 pub use host_bindings::{normalize_mac, HostBinding, HostBindings};
 pub use log_bus::{LogBus, LogBusLayer, LogLine};
 pub use metrics::{HttpRoute, Metrics};
-pub use notify::{NotifyConfig, NotifyKind, NotifyStore};
-pub use queue::{DeploymentQueue, QueueEntry};
-pub use saml::{IdpMetadata, SamlError, SpParams, VerifiedPrincipal, VerifiedResponse};
 pub use settings::{Settings, SettingsStore, TimeoutAction};
-pub use sso::{SsoConfig, SsoStore};

crates/core/src/metrics.rs

@@ -87,9 +87,7 @@ impl Metrics {
     }
 
     pub fn record_tftp_err(&self) {
-        self.inner
-            .tftp_transfers_err
-            .fetch_add(1, Ordering::Relaxed);
+        self.inner.tftp_transfers_err.fetch_add(1, Ordering::Relaxed);
     }
 
     // ── HTTP ───────────────────────────────────────────────────────────
@@ -183,10 +181,7 @@ impl Metrics {
             "",
         );
 
-        let _ = writeln!(
-            out,
-            "# HELP openpxe_tftp_transfers_total TFTP transfers, by status."
-        );
+        let _ = writeln!(out, "# HELP openpxe_tftp_transfers_total TFTP transfers, by status.");
         let _ = writeln!(out, "# TYPE openpxe_tftp_transfers_total counter");
         let _ = writeln!(
             out,
@@ -206,10 +201,7 @@ impl Metrics {
             "",
         );
 
-        let _ = writeln!(
-            out,
-            "# HELP openpxe_http_requests_total HTTP requests served, by route family."
-        );
+        let _ = writeln!(out, "# HELP openpxe_http_requests_total HTTP requests served, by route family.");
         let _ = writeln!(out, "# TYPE openpxe_http_requests_total counter");
         for (label, counter) in [
             ("boot_script", &i.http_boot_script),
@@ -226,53 +218,14 @@ impl Metrics {
         }
 
         // Gauges.
-        write_gauge(
-            &mut out,
-            "openpxe_iso_count",
-            "ISOs currently registered (local + NFS).",
-            i.iso_count.load(Ordering::Relaxed),
-            "",
-        );
-        write_gauge(
-            &mut out,
-            "openpxe_client_count",
-            "PXE clients seen this process lifetime.",
-            i.client_count.load(Ordering::Relaxed),
-            "",
-        );
-        write_gauge(
-            &mut out,
-            "openpxe_queue_count",
-            "Clients currently waiting at the deployment queue.",
-            i.queue_count.load(Ordering::Relaxed),
-            "",
-        );
-        write_gauge(
-            &mut out,
-            "openpxe_queue_imaging",
-            "Clients currently imaging (queue + assigned target).",
-            i.queue_imaging.load(Ordering::Relaxed),
-            "",
-        );
-        write_gauge(
-            &mut out,
-            "openpxe_nfs_mounts_active",
-            "NFS shares currently mounted.",
-            i.nfs_mounts_active.load(Ordering::Relaxed),
-            "",
-        );
-        write_gauge(
-            &mut out,
-            "openpxe_uptime_seconds",
-            "Seconds since this OpenPXE instance started.",
-            uptime_secs,
-            "",
-        );
+        write_gauge(&mut out, "openpxe_iso_count", "ISOs currently registered (local + NFS).", i.iso_count.load(Ordering::Relaxed), "");
+        write_gauge(&mut out, "openpxe_client_count", "PXE clients seen this process lifetime.", i.client_count.load(Ordering::Relaxed), "");
+        write_gauge(&mut out, "openpxe_queue_count", "Clients currently waiting at the deployment queue.", i.queue_count.load(Ordering::Relaxed), "");
+        write_gauge(&mut out, "openpxe_queue_imaging", "Clients currently imaging (queue + assigned target).", i.queue_imaging.load(Ordering::Relaxed), "");
+        write_gauge(&mut out, "openpxe_nfs_mounts_active", "NFS shares currently mounted.", i.nfs_mounts_active.load(Ordering::Relaxed), "");
+        write_gauge(&mut out, "openpxe_uptime_seconds", "Seconds since this OpenPXE instance started.", uptime_secs, "");
 
-        let _ = writeln!(
-            out,
-            "# HELP openpxe_build_info Build metadata. Always 1; the version is in the label."
-        );
+        let _ = writeln!(out, "# HELP openpxe_build_info Build metadata. Always 1; the version is in the label.");
         let _ = writeln!(out, "# TYPE openpxe_build_info gauge");
         let _ = writeln!(out, "openpxe_build_info{{version=\"{version}\"}} 1");
 
@@ -306,11 +259,7 @@ mod tests {
         m.record_http(HttpRoute::Api);
         m.set_iso_count(3);
         let out = m.render("0.2.0", 42);
-        assert_eq!(
-            out.matches("# TYPE openpxe_dhcp_replies_total counter")
-                .count(),
-            1
-        );
+        assert_eq!(out.matches("# TYPE openpxe_dhcp_replies_total counter").count(), 1);
         assert_eq!(out.matches("# TYPE openpxe_iso_count gauge").count(), 1);
         assert!(out.contains("openpxe_dhcp_replies_total{arch=\"uefi\"} 1"));
         assert!(out.contains("openpxe_dhcp_replies_total{arch=\"bios\"} 1"));

crates/core/src/notify.rs

@@ -1,362 +0,0 @@
-//! Webhook / email notification configuration.
-//!
-//! v0.5.0: OpenPXE can ping a chat webhook or send an email when
-//! something noteworthy happens (a machine PXE-booted an image, a
-//! deployment was assigned, a WoL was sent). One active provider at a
-//! time, chosen by `kind` — dead-simple for an L1 tech: pick Slack,
-//! paste the incoming-webhook URL, done.
-//!
-//! This module owns only the *configuration* (validation + persistence
-//! to `<work_dir>/notify.json`). The actual sending — HTTP POST for the
-//! chat providers, SMTP for email — lives in the http-api crate, which
-//! already carries an HTTP client and the SMTP dependency. Keeping the
-//! network I/O out of `core` matches how `BrandingStore`/`SsoStore`
-//! stay pure config stores.
-//!
-//! Secrets note: the SMTP password is persisted in `notify.json`
-//! alongside the rest of the config (0644 like the other state files).
-//! It is never echoed back through the API — the snapshot used for the
-//! GET response blanks it (see `Self::redacted`).
-
-use parking_lot::RwLock;
-use serde::{Deserialize, Serialize};
-use std::path::PathBuf;
-use std::sync::Arc;
-
-use crate::{Error, Result};
-
-const MAX_URL_LEN: usize = 2048;
-const MAX_FIELD_LEN: usize = 512;
-
-/// Which notification transport is active.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Serialize, Deserialize)]
-#[serde(rename_all = "lowercase")]
-pub enum NotifyKind {
-    /// Slack incoming webhook (`{ "text": ... }`).
-    #[default]
-    Slack,
-    /// Discord webhook (`{ "content": ... }`).
-    Discord,
-    /// Microsoft Teams incoming webhook (legacy MessageCard JSON).
-    Teams,
-    /// Email via SMTP.
-    Smtp,
-}
-
-impl NotifyKind {
-    /// True when this kind drives a chat webhook (POST a JSON body to a
-    /// single URL) rather than SMTP.
-    #[must_use]
-    pub fn is_webhook(self) -> bool {
-        matches!(self, Self::Slack | Self::Discord | Self::Teams)
-    }
-}
-
-/// Operator-configurable notification settings. Single provider active
-/// at a time; the inactive fields are kept so switching providers
-/// doesn't wipe the other one's values.
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-pub struct NotifyConfig {
-    #[serde(default)]
-    pub enabled: bool,
-    #[serde(default)]
-    pub kind: NotifyKind,
-    /// Incoming-webhook URL for Slack / Discord / Teams.
-    #[serde(default)]
-    pub webhook_url: String,
-
-    // ── SMTP fields (used when kind == Smtp) ──
-    #[serde(default)]
-    pub smtp_host: String,
-    #[serde(default = "default_smtp_port")]
-    pub smtp_port: u16,
-    #[serde(default)]
-    pub smtp_username: String,
-    #[serde(default)]
-    pub smtp_password: String,
-    /// `From:` address. Falls back to `smtp_username` when blank.
-    #[serde(default)]
-    pub smtp_from: String,
-    /// `To:` address (single recipient — keep it simple).
-    #[serde(default)]
-    pub smtp_to: String,
-    /// Use implicit TLS (port 465). When false we use STARTTLS on the
-    /// configured port (587 typical). Either way the connection is
-    /// encrypted — we never offer plaintext SMTP.
-    #[serde(default)]
-    pub smtp_implicit_tls: bool,
-}
-
-fn default_smtp_port() -> u16 {
-    587
-}
-
-impl NotifyConfig {
-    /// True when enabled and the active provider has the fields it
-    /// needs to actually send.
-    #[must_use]
-    pub fn is_usable(&self) -> bool {
-        if !self.enabled {
-            return false;
-        }
-        if self.kind.is_webhook() {
-            !self.webhook_url.trim().is_empty()
-        } else {
-            !self.smtp_host.trim().is_empty() && !self.smtp_to.trim().is_empty()
-        }
-    }
-
-    /// A copy safe to return over the API: the SMTP password is blanked
-    /// (replaced with a non-empty sentinel only when one is set, so the
-    /// UI can show "configured" without leaking it).
-    #[must_use]
-    pub fn redacted(&self) -> NotifyConfig {
-        let mut c = self.clone();
-        if !c.smtp_password.is_empty() {
-            c.smtp_password = SECRET_SENTINEL.to_string();
-        }
-        c
-    }
-}
-
-/// Returned by the API in place of a stored password. When the UI PUTs
-/// this value back unchanged we keep the existing password rather than
-/// overwriting it with the sentinel.
-pub const SECRET_SENTINEL: &str = "__keep__";
-
-/// In-memory + on-disk notification config registry.
-#[derive(Debug, Clone)]
-pub struct NotifyStore {
-    path: Arc<PathBuf>,
-    inner: Arc<RwLock<NotifyConfig>>,
-}
-
-impl NotifyStore {
-    #[must_use]
-    pub fn load_or_default(work_dir: &std::path::Path) -> Self {
-        let path = work_dir.join("notify.json");
-        let cfg = match std::fs::read_to_string(&path) {
-            Ok(text) => serde_json::from_str::<NotifyConfig>(&text).unwrap_or_else(|e| {
-                tracing::warn!(
-                    target: "openpxe::notify",
-                    "notify.json unreadable ({e}); starting with defaults"
-                );
-                NotifyConfig::default()
-            }),
-            Err(_) => NotifyConfig::default(),
-        };
-        Self {
-            path: Arc::new(path),
-            inner: Arc::new(RwLock::new(cfg)),
-        }
-    }
-
-    #[must_use]
-    pub fn snapshot(&self) -> NotifyConfig {
-        self.inner.read().clone()
-    }
-
-    /// Replace the whole config. `incoming.smtp_password == SECRET_SENTINEL`
-    /// is treated as "keep the existing password" so the UI never has to
-    /// round-trip the real secret.
-    pub fn replace(&self, mut incoming: NotifyConfig) -> Result<NotifyConfig> {
-        incoming.webhook_url = incoming.webhook_url.trim().to_string();
-        incoming.smtp_host = incoming.smtp_host.trim().to_string();
-        incoming.smtp_username = incoming.smtp_username.trim().to_string();
-        incoming.smtp_from = incoming.smtp_from.trim().to_string();
-        incoming.smtp_to = incoming.smtp_to.trim().to_string();
-
-        // Preserve the stored password when the UI sends the sentinel.
-        if incoming.smtp_password == SECRET_SENTINEL {
-            incoming
-                .smtp_password
-                .clone_from(&self.inner.read().smtp_password);
-        }
-
-        // Length caps.
-        if incoming.webhook_url.len() > MAX_URL_LEN {
-            return Err(Error::Invalid(format!(
-                "webhook URL exceeds {MAX_URL_LEN}-char cap"
-            )));
-        }
-        for (name, v) in [
-            ("smtp_host", &incoming.smtp_host),
-            ("smtp_username", &incoming.smtp_username),
-            ("smtp_from", &incoming.smtp_from),
-            ("smtp_to", &incoming.smtp_to),
-        ] {
-            if v.len() > MAX_FIELD_LEN {
-                return Err(Error::Invalid(format!(
-                    "{name} exceeds {MAX_FIELD_LEN}-char cap"
-                )));
-            }
-        }
-
-        // Validate the active provider only when enabling.
-        if incoming.enabled {
-            if incoming.kind.is_webhook() {
-                if incoming.webhook_url.is_empty() {
-                    return Err(Error::Invalid(
-                        "a webhook URL is required to enable chat notifications".into(),
-                    ));
-                }
-                if !incoming.webhook_url.starts_with("https://")
-                    && !incoming.webhook_url.starts_with("http://")
-                {
-                    return Err(Error::Invalid(
-                        "webhook URL must start with http:// or https://".into(),
-                    ));
-                }
-            } else {
-                if incoming.smtp_host.is_empty() {
-                    return Err(Error::Invalid(
-                        "SMTP host is required to enable email notifications".into(),
-                    ));
-                }
-                if incoming.smtp_to.is_empty() {
-                    return Err(Error::Invalid(
-                        "a recipient (To) is required to enable email notifications".into(),
-                    ));
-                }
-                if incoming.smtp_port == 0 {
-                    return Err(Error::Invalid("SMTP port must be non-zero".into()));
-                }
-            }
-        }
-
-        {
-            let mut g = self.inner.write();
-            *g = incoming.clone();
-        }
-        self.persist();
-        tracing::info!(
-            target: "openpxe::notify",
-            enabled = incoming.enabled, kind = ?incoming.kind,
-            "notification configuration updated"
-        );
-        Ok(incoming)
-    }
-
-    fn persist(&self) {
-        let snap = self.inner.read().clone();
-        let body = match serde_json::to_vec_pretty(&snap) {
-            Ok(b) => b,
-            Err(e) => {
-                tracing::warn!(target: "openpxe::notify", "serialize notify.json: {e}");
-                return;
-            }
-        };
-        if let Some(parent) = self.path.parent() {
-            let _ = std::fs::create_dir_all(parent);
-        }
-        let tmp = self.path.with_extension("json.tmp");
-        if let Err(e) = std::fs::write(&tmp, body) {
-            tracing::warn!(target: "openpxe::notify", "write notify.json tmp: {e}");
-            return;
-        }
-        if let Err(e) = std::fs::rename(&tmp, self.path.as_path()) {
-            tracing::warn!(target: "openpxe::notify", "rename notify.json: {e}");
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use tempfile::tempdir;
-
-    #[test]
-    fn default_disabled_not_usable() {
-        let dir = tempdir().unwrap();
-        let s = NotifyStore::load_or_default(dir.path());
-        assert!(!s.snapshot().enabled);
-        assert!(!s.snapshot().is_usable());
-    }
-
-    #[test]
-    fn slack_requires_url_when_enabled() {
-        let dir = tempdir().unwrap();
-        let s = NotifyStore::load_or_default(dir.path());
-        let r = s.replace(NotifyConfig {
-            enabled: true,
-            kind: NotifyKind::Slack,
-            ..Default::default()
-        });
-        assert!(matches!(r, Err(Error::Invalid(_))));
-        s.replace(NotifyConfig {
-            enabled: true,
-            kind: NotifyKind::Slack,
-            webhook_url: "https://hooks.slack.com/services/XXX".into(),
-            ..Default::default()
-        })
-        .unwrap();
-        assert!(s.snapshot().is_usable());
-    }
-
-    #[test]
-    fn smtp_requires_host_and_recipient() {
-        let dir = tempdir().unwrap();
-        let s = NotifyStore::load_or_default(dir.path());
-        let r = s.replace(NotifyConfig {
-            enabled: true,
-            kind: NotifyKind::Smtp,
-            smtp_host: "smtp.example.com".into(),
-            ..Default::default()
-        });
-        assert!(matches!(r, Err(Error::Invalid(_))), "missing recipient should reject");
-        s.replace(NotifyConfig {
-            enabled: true,
-            kind: NotifyKind::Smtp,
-            smtp_host: "smtp.example.com".into(),
-            smtp_port: 587,
-            smtp_to: "[email protected]".into(),
-            smtp_from: "[email protected]".into(),
-            ..Default::default()
-        })
-        .unwrap();
-        assert!(s.snapshot().is_usable());
-    }
-
-    #[test]
-    fn password_sentinel_preserves_stored_secret() {
-        let dir = tempdir().unwrap();
-        let s = NotifyStore::load_or_default(dir.path());
-        s.replace(NotifyConfig {
-            enabled: true,
-            kind: NotifyKind::Smtp,
-            smtp_host: "smtp.example.com".into(),
-            smtp_port: 587,
-            smtp_to: "[email protected]".into(),
-            smtp_password: "s3cret".into(),
-            ..Default::default()
-        })
-        .unwrap();
-        // Redacted snapshot hides the password behind the sentinel.
-        assert_eq!(s.snapshot().redacted().smtp_password, SECRET_SENTINEL);
-        // PUTting the sentinel back keeps the real password.
-        s.replace(NotifyConfig {
-            enabled: true,
-            kind: NotifyKind::Smtp,
-            smtp_host: "smtp.example.com".into(),
-            smtp_port: 587,
-            smtp_to: "[email protected]".into(),
-            smtp_password: SECRET_SENTINEL.into(),
-            ..Default::default()
-        })
-        .unwrap();
-        assert_eq!(s.snapshot().smtp_password, "s3cret");
-    }
-
-    #[test]
-    fn webhook_url_scheme_enforced() {
-        let dir = tempdir().unwrap();
-        let s = NotifyStore::load_or_default(dir.path());
-        let r = s.replace(NotifyConfig {
-            enabled: true,
-            kind: NotifyKind::Discord,
-            webhook_url: "ftp://example.com/hook".into(),
-            ..Default::default()
-        });
-        assert!(matches!(r, Err(Error::Invalid(_))));
-    }
-}

crates/core/src/queue.rs

@@ -1,16 +1,16 @@
 //! Queued Deployment queue.
 //!
 //! When a client selects "Queued Deployment" at the PXE menu, iPXE POSTs to
-//! `/api/queue/join` and receives a queue position. It then enters a poll
+//! `/api/queue/join` and receives a gate position. It then enters a poll
 //! loop hitting `/api/queue/poll/<id>`; the server holds the request open
 //! until either (a) the operator assigns an ISO from the WebUI, in which
 //! case the poll returns an iPXE `chain` URL, or (b) the poll times out
 //! (iPXE's HTTP client has its own timeout), in which case iPXE re-POSTs.
 //!
-//! The WebUI shows the queue (`GET /api/queue`) and issues
+//! The WebUI shows the queue (`GET /api/gate`) and issues
 //! `POST /api/queue/assign { iso_id, entry_ids: [...] }` to launch a single
-//! ISO across many queued clients at once. Every waiting machine receives
-//! the assignment without operator visits at the rack.
+//! ISO across many gated clients at once. This is the "horse-race gate"
+//! UX the user asked for — every horse leaves the line simultaneously.
 
 use parking_lot::RwLock;
 use serde::{Deserialize, Serialize};
@@ -23,11 +23,11 @@ use uuid::Uuid;
 
 use crate::ClientArch;
 
-/// Per-client queue state visible to the WebUI.
+/// Per-gate state visible to the WebUI.
 #[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct QueueEntry {
+pub struct Gate {
     pub id: String,
-    /// 1-based queue position — position 1 is whoever got there first.
+    /// 1-based race-gate position — position 1 is whoever got there first.
     pub position: u32,
     pub mac: String,
     pub ip: Option<IpAddr>,
@@ -55,8 +55,8 @@ struct QueueEntryInner {
 }
 
 impl QueueEntryInner {
-    fn snapshot(&self) -> QueueEntry {
-        QueueEntry {
+    fn snapshot(&self) -> Gate {
+        Gate {
             id: self.id.clone(),
             position: self.position,
             mac: self.mac.clone(),
@@ -80,25 +80,21 @@ impl DeploymentQueue {
         Arc::new(Self::default())
     }
 
-    /// Add a client to the queue. Returns the current queue snapshot. If the
-    /// MAC is already queued, the existing entry is returned unchanged —
+    /// Add a client to the gate. Returns the new `Gate` snapshot. If the
+    /// MAC is already queued, the existing gate is returned unchanged —
     /// retrying iPXE clients don't duplicate their slot.
-    pub fn join(&self, mac: &str, ip: Option<IpAddr>, arch: Option<ClientArch>) -> QueueEntry {
+    pub fn join(&self, mac: &str, ip: Option<IpAddr>, arch: Option<ClientArch>) -> Gate {
         let now = OffsetDateTime::now_utc();
         let mut guard = self.inner.write();
 
         if let Some(existing) = guard.values_mut().find(|g| g.mac == mac) {
             existing.last_poll_at = now;
-            if ip.is_some() {
-                existing.ip = ip;
-            }
-            if arch.is_some() {
-                existing.arch = arch;
-            }
+            if ip.is_some() { existing.ip = ip; }
+            if arch.is_some() { existing.arch = arch; }
             return existing.snapshot();
         }
 
-        // Queue position = max(position) + 1, or 1 if empty.
+        // Race position = max(position) + 1, or 1 if empty.
         let next_pos = guard.values().map(|g| g.position).max().unwrap_or(0) + 1;
         let id = Uuid::new_v4().to_string();
         let inner = QueueEntryInner {
@@ -117,24 +113,24 @@ impl DeploymentQueue {
         snap
     }
 
-    /// Look up the `Notify` primitive for a given queue entry id, for long-polling.
+    /// Look up the `Notify` primitive for a given gate id, for long-polling.
     #[must_use]
     pub fn notifier(&self, entry_id: &str) -> Option<Arc<Notify>> {
         self.inner.read().get(entry_id).map(|g| g.notify.clone())
     }
 
-    /// Update the last-poll timestamp (keeps the queue's "live" indicator
+    /// Update the last-poll timestamp (keeps the gate's "live" indicator
     /// fresh in the UI) and return the current snapshot. Returns None if
-    /// the entry was released/expired between requests.
-    pub fn touch(&self, entry_id: &str) -> Option<QueueEntry> {
+    /// the gate was released/expired between requests.
+    pub fn touch(&self, entry_id: &str) -> Option<Gate> {
         let mut guard = self.inner.write();
         let g = guard.get_mut(entry_id)?;
         g.last_poll_at = OffsetDateTime::now_utc();
         Some(g.snapshot())
     }
 
-    /// Operator assigns an ISO entry (boot_entry id) to one or more clients.
-    /// Returns the number of queue entries that were updated. Entries not in the
+    /// Operator assigns an ISO entry (boot_entry id) to one or more gates.
+    /// Returns the number of gates that were updated. Gates not in the
     /// queue are silently skipped.
     pub fn assign(&self, entry_ids: &[String], target: &str) -> usize {
         let mut guard = self.inner.write();
@@ -149,9 +145,9 @@ impl DeploymentQueue {
         updated
     }
 
-    /// Remove a queue entry and return its final snapshot. Called after the client
+    /// Remove a gate and return its final snapshot. Called after the client
     /// has successfully chained onto its assignment.
-    pub fn release(&self, entry_id: &str) -> Option<QueueEntry> {
+    pub fn release(&self, entry_id: &str) -> Option<Gate> {
         let mut guard = self.inner.write();
         let g = guard.remove(entry_id)?;
         g.notify.notify_waiters();
@@ -166,7 +162,7 @@ impl DeploymentQueue {
     }
 
     #[must_use]
-    pub fn list(&self) -> Vec<QueueEntry> {
+    pub fn list(&self) -> Vec<Gate> {
         let guard = self.inner.read();
         let mut v: Vec<_> = guard.values().map(QueueEntryInner::snapshot).collect();
         v.sort_by_key(|g| g.position);

crates/core/src/saml/authn_request.rs

@@ -1,188 +0,0 @@
-//! AuthnRequest construction + HTTP-Redirect binding encoding.
-//!
-//! For SP-initiated login we build an `<AuthnRequest>`, then encode it for the
-//! HTTP-Redirect binding: raw DEFLATE (RFC 1951) → base64 → percent-encode,
-//! appended as the `SAMLRequest` query parameter. AuthnRequests are sent
-//! unsigned in this release (the IdP must not require client signatures).
-
-use std::fmt::Write as _;
-use std::io::Write as _;
-
-use base64::Engine;
-use flate2::write::DeflateEncoder;
-use flate2::Compression;
-use time::format_description::well_known::Rfc3339;
-use time::OffsetDateTime;
-
-use super::{SamlError, SpParams};
-
-const NS_PROTOCOL: &str = "urn:oasis:names:tc:SAML:2.0:protocol";
-const NS_ASSERTION: &str = "urn:oasis:names:tc:SAML:2.0:assertion";
-const NAMEID_EMAIL: &str = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress";
-const BINDING_POST: &str = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST";
-
-/// A built AuthnRequest, ready to redirect the browser to the IdP.
-#[derive(Debug, Clone)]
-pub struct AuthnRequest {
-    /// The request `ID` — the caller records this so the matching response's
-    /// `InResponseTo` can be correlated (replay/CSRF protection).
-    pub id: String,
-    /// The full IdP URL to 302 the browser to (includes `SAMLRequest` and,
-    /// when supplied, `RelayState`).
-    pub location: String,
-}
-
-/// Build an AuthnRequest targeting `idp_sso_url` and encode it for the
-/// HTTP-Redirect binding. `relay_state`, if given, round-trips back to us via
-/// the response (we use it to send the operator to their intended page).
-pub fn build(
-    sp: &SpParams,
-    idp_sso_url: &str,
-    relay_state: Option<&str>,
-) -> Result<AuthnRequest, SamlError> {
-    let id = format!("_{}", uuid::Uuid::new_v4().simple());
-    let issue_instant = OffsetDateTime::now_utc()
-        .replace_nanosecond(0)
-        .unwrap_or_else(|_| OffsetDateTime::now_utc())
-        .format(&Rfc3339)
-        .map_err(|e| SamlError::Timestamp(e.to_string()))?;
-
-    let xml = format!(
-        r#"<samlp:AuthnRequest xmlns:samlp="{NS_PROTOCOL}" xmlns:saml="{NS_ASSERTION}" ID="{id}" Version="2.0" IssueInstant="{instant}" Destination="{dest}" ProtocolBinding="{BINDING_POST}" AssertionConsumerServiceURL="{acs}"><saml:Issuer>{issuer}</saml:Issuer><samlp:NameIDPolicy Format="{NAMEID_EMAIL}" AllowCreate="true"/></samlp:AuthnRequest>"#,
-        instant = issue_instant,
-        dest = xml_escape(idp_sso_url),
-        acs = xml_escape(&sp.acs_url),
-        issuer = xml_escape(&sp.entity_id),
-    );
-
-    let encoded = deflate_base64(&xml)?;
-
-    let sep = if idp_sso_url.contains('?') { '&' } else { '?' };
-    let mut location = format!("{idp_sso_url}{sep}SAMLRequest={}", pct_encode(&encoded));
-    if let Some(rs) = relay_state {
-        location.push_str("&RelayState=");
-        location.push_str(&pct_encode(rs));
-    }
-
-    Ok(AuthnRequest { id, location })
-}
-
-/// Raw-DEFLATE then base64 — the HTTP-Redirect binding's `SAMLRequest` payload.
-fn deflate_base64(xml: &str) -> Result<String, SamlError> {
-    let mut enc = DeflateEncoder::new(Vec::new(), Compression::default());
-    enc.write_all(xml.as_bytes())
-        .and_then(|()| enc.try_finish())
-        .map_err(|e| SamlError::Xml(format!("deflate: {e}")))?;
-    let compressed = enc
-        .finish()
-        .map_err(|e| SamlError::Xml(format!("deflate: {e}")))?;
-    Ok(base64::engine::general_purpose::STANDARD.encode(compressed))
-}
-
-/// Percent-encode a query-string component (RFC 3986 unreserved set passes
-/// through; everything else is `%XX`).
-fn pct_encode(s: &str) -> String {
-    let mut out = String::with_capacity(s.len() * 3);
-    for b in s.bytes() {
-        match b {
-            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => {
-                out.push(b as char);
-            }
-            _ => {
-                let _ = write!(out, "%{b:02X}");
-            }
-        }
-    }
-    out
-}
-
-fn xml_escape(s: &str) -> String {
-    let mut out = String::with_capacity(s.len());
-    for c in s.chars() {
-        match c {
-            '&' => out.push_str("&amp;"),
-            '<' => out.push_str("&lt;"),
-            '>' => out.push_str("&gt;"),
-            '"' => out.push_str("&quot;"),
-            '\'' => out.push_str("&apos;"),
-            _ => out.push(c),
-        }
-    }
-    out
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use flate2::read::DeflateDecoder;
-    use std::io::Read;
-
-    fn sp() -> SpParams {
-        SpParams {
-            entity_id: "https://pxe.example.com".into(),
-            acs_url: "https://pxe.example.com/api/sso/acs".into(),
-        }
-    }
-
-    fn pct_decode(s: &str) -> Vec<u8> {
-        let bytes = s.as_bytes();
-        let mut out = Vec::with_capacity(bytes.len());
-        let mut i = 0;
-        while i < bytes.len() {
-            if bytes[i] == b'%' && i + 2 < bytes.len() {
-                let hi = (bytes[i + 1] as char).to_digit(16).unwrap();
-                let lo = (bytes[i + 2] as char).to_digit(16).unwrap();
-                out.push((hi * 16 + lo) as u8);
-                i += 3;
-            } else {
-                out.push(bytes[i]);
-                i += 1;
-            }
-        }
-        out
-    }
-
-    #[test]
-    fn id_is_ncname_and_location_has_request() {
-        let req = build(&sp(), "https://idp.example.com/sso", Some("/dashboard")).unwrap();
-        assert!(req.id.starts_with('_'));
-        assert!(req
-            .location
-            .starts_with("https://idp.example.com/sso?SAMLRequest="));
-        assert!(req.location.contains("&RelayState=%2Fdashboard"));
-    }
-
-    #[test]
-    fn redirect_payload_round_trips_to_our_authn_request() {
-        let req = build(&sp(), "https://idp.example.com/sso", None).unwrap();
-        // Pull SAMLRequest value out of the query string.
-        let q = req.location.split("SAMLRequest=").nth(1).unwrap();
-        let val = q.split('&').next().unwrap();
-        let compressed = base64::engine::general_purpose::STANDARD
-            .decode(pct_decode(val))
-            .unwrap();
-        let mut inflate = DeflateDecoder::new(&compressed[..]);
-        let mut xml = String::new();
-        inflate.read_to_string(&mut xml).unwrap();
-
-        let doc = roxmltree::Document::parse(&xml).unwrap();
-        let root = doc.root_element();
-        assert_eq!(root.tag_name().name(), "AuthnRequest");
-        assert_eq!(root.attribute("ID").unwrap(), req.id);
-        assert_eq!(
-            root.attribute("AssertionConsumerServiceURL").unwrap(),
-            "https://pxe.example.com/api/sso/acs"
-        );
-        let issuer = root
-            .descendants()
-            .find(|n| n.tag_name().name() == "Issuer")
-            .unwrap();
-        assert_eq!(issuer.text().unwrap(), "https://pxe.example.com");
-    }
-
-    #[test]
-    fn existing_query_uses_ampersand_separator() {
-        let req = build(&sp(), "https://idp.example.com/sso?foo=bar", None).unwrap();
-        assert!(req.location.contains("?foo=bar&SAMLRequest="));
-    }
-}

crates/core/src/saml/metadata.rs

@@ -1,241 +0,0 @@
-//! IdP metadata parsing + SP metadata generation.
-//!
-//! We parse only what the SP flow needs: the IdP Entity ID, its
-//! `SingleSignOnService` endpoints (HTTP-Redirect / HTTP-POST), and the
-//! X.509 signing certificate(s). Everything else in the document is ignored.
-
-use base64::Engine;
-
-use super::{SamlError, SpParams};
-
-/// SAML 2.0 binding URIs.
-pub const BINDING_REDIRECT: &str = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect";
-pub const BINDING_POST: &str = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST";
-
-/// The subset of an IdP's `EntityDescriptor` the SP flow consumes.
-#[derive(Debug, Clone)]
-pub struct IdpMetadata {
-    /// The IdP's Entity ID — we require incoming assertions to be issued by it.
-    pub entity_id: String,
-    /// SSO endpoint for the HTTP-Redirect binding (where we send AuthnRequests).
-    pub sso_redirect_url: Option<String>,
-    /// SSO endpoint for the HTTP-POST binding (fallback target).
-    pub sso_post_url: Option<String>,
-    /// DER-encoded X.509 signing certificate(s). More than one appears during
-    /// key rotation; verification tries each.
-    pub signing_certs_der: Vec<Vec<u8>>,
-}
-
-impl IdpMetadata {
-    /// Parse an IdP `EntityDescriptor` document.
-    ///
-    /// Robust to namespace-prefix variation (matches on local element names),
-    /// since IdPs disagree on prefixes (`md:`, `ns0:`, default, …).
-    pub fn parse(xml: &str) -> Result<Self, SamlError> {
-        let doc = roxmltree::Document::parse(xml).map_err(|e| SamlError::Xml(e.to_string()))?;
-        let root = doc.root_element();
-
-        // The signing IDP descriptor. Some metadata wraps multiple
-        // descriptors (AA, SP) in one document; we want IDPSSODescriptor.
-        let idp_desc = root
-            .descendants()
-            .find(|n| n.is_element() && n.tag_name().name() == "IDPSSODescriptor")
-            .ok_or_else(|| SamlError::Metadata("IDPSSODescriptor".into()))?;
-
-        // Entity ID lives on the EntityDescriptor (root, or an ancestor of the
-        // IDPSSODescriptor when several are nested).
-        let entity_id = idp_desc
-            .ancestors()
-            .find_map(|n| {
-                if n.tag_name().name() == "EntityDescriptor" {
-                    n.attribute("entityID")
-                } else {
-                    None
-                }
-            })
-            .or_else(|| root.attribute("entityID"))
-            .map(str::to_owned)
-            .ok_or_else(|| SamlError::Metadata("entityID".into()))?;
-
-        let mut sso_redirect_url = None;
-        let mut sso_post_url = None;
-        for sso in idp_desc
-            .children()
-            .filter(|n| n.is_element() && n.tag_name().name() == "SingleSignOnService")
-        {
-            let binding = sso.attribute("Binding").unwrap_or("");
-            let location = sso.attribute("Location").map(str::to_owned);
-            match binding {
-                BINDING_REDIRECT if sso_redirect_url.is_none() => sso_redirect_url = location,
-                BINDING_POST if sso_post_url.is_none() => sso_post_url = location,
-                _ => {}
-            }
-        }
-
-        // Signing certs: KeyDescriptor with use="signing" or no use attribute
-        // (a bare KeyDescriptor is valid for both signing and encryption).
-        let mut signing_certs_der = Vec::new();
-        for kd in idp_desc
-            .children()
-            .filter(|n| n.is_element() && n.tag_name().name() == "KeyDescriptor")
-        {
-            match kd.attribute("use") {
-                Some("signing") | None => {}
-                Some(_) => continue, // encryption-only key — skip
-            }
-            for cert_node in kd
-                .descendants()
-                .filter(|n| n.is_element() && n.tag_name().name() == "X509Certificate")
-            {
-                let b64: String = node_text(&cert_node)
-                    .chars()
-                    .filter(|c| !c.is_whitespace())
-                    .collect();
-                if b64.is_empty() {
-                    continue;
-                }
-                let der = base64::engine::general_purpose::STANDARD
-                    .decode(b64.as_bytes())
-                    .map_err(|e| SamlError::Base64(e.to_string()))?;
-                signing_certs_der.push(der);
-            }
-        }
-
-        if signing_certs_der.is_empty() {
-            return Err(SamlError::NoSigningCert);
-        }
-
-        Ok(Self {
-            entity_id,
-            sso_redirect_url,
-            sso_post_url,
-            signing_certs_der,
-        })
-    }
-
-    /// Preferred SSO destination for an outbound AuthnRequest: HTTP-Redirect
-    /// if advertised, otherwise HTTP-POST.
-    pub fn sso_destination(&self) -> Option<&str> {
-        self.sso_redirect_url
-            .as_deref()
-            .or(self.sso_post_url.as_deref())
-    }
-}
-
-/// Build our SP `EntityDescriptor` XML so an IdP admin can import OpenPXE as a
-/// relying party. Advertises the ACS URL (HTTP-POST binding) and an emailAddress
-/// NameID format — matching what the response path expects.
-pub fn build_sp_metadata(sp: &SpParams) -> String {
-    let entity = xml_escape(&sp.entity_id);
-    let acs = xml_escape(&sp.acs_url);
-    format!(
-        r#"<?xml version="1.0" encoding="UTF-8"?>
-<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="{entity}">
-  <SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
-    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
-    <AssertionConsumerService Binding="{BINDING_POST}" Location="{acs}" index="0" isDefault="true"/>
-  </SPSSODescriptor>
-</EntityDescriptor>
-"#
-    )
-}
-
-/// Collect the concatenated text of an element's direct text children.
-fn node_text(n: &roxmltree::Node<'_, '_>) -> String {
-    n.children()
-        .filter(roxmltree::Node::is_text)
-        .filter_map(|c| c.text())
-        .collect()
-}
-
-/// Minimal XML attribute/text escaping for the values we interpolate.
-fn xml_escape(s: &str) -> String {
-    let mut out = String::with_capacity(s.len());
-    for c in s.chars() {
-        match c {
-            '&' => out.push_str("&amp;"),
-            '<' => out.push_str("&lt;"),
-            '>' => out.push_str("&gt;"),
-            '"' => out.push_str("&quot;"),
-            '\'' => out.push_str("&apos;"),
-            _ => out.push(c),
-        }
-    }
-    out
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    // A trimmed-down Keycloak-style IdP descriptor (cert body is a stand-in;
-    // signing tests build real certs in the parent module's tests).
-    const SAMPLE: &str = r#"<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
-        xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
-        entityID="https://idp.example.com/realms/fleet">
-      <md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
-        <md:KeyDescriptor use="signing">
-          <ds:KeyInfo><ds:X509Data><ds:X509Certificate>
-            QUJDREVG
-          </ds:X509Certificate></ds:X509Data></ds:KeyInfo>
-        </md:KeyDescriptor>
-        <md:KeyDescriptor use="encryption">
-          <ds:KeyInfo><ds:X509Data><ds:X509Certificate>WlpaWg==</ds:X509Certificate></ds:X509Data></ds:KeyInfo>
-        </md:KeyDescriptor>
-        <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
-            Location="https://idp.example.com/realms/fleet/protocol/saml"/>
-        <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
-            Location="https://idp.example.com/realms/fleet/protocol/saml"/>
-      </md:IDPSSODescriptor>
-    </md:EntityDescriptor>"#;
-
-    #[test]
-    fn parses_entity_sso_and_signing_cert() {
-        let m = IdpMetadata::parse(SAMPLE).unwrap();
-        assert_eq!(m.entity_id, "https://idp.example.com/realms/fleet");
-        assert_eq!(
-            m.sso_redirect_url.as_deref(),
-            Some("https://idp.example.com/realms/fleet/protocol/saml")
-        );
-        assert!(m.sso_post_url.is_some());
-        // Only the signing KeyDescriptor's cert is collected (ABCDEF), not the
-        // encryption one (ZZZZ).
-        assert_eq!(m.signing_certs_der.len(), 1);
-        assert_eq!(m.signing_certs_der[0], b"ABCDEF");
-    }
-
-    #[test]
-    fn missing_signing_cert_is_rejected() {
-        let xml = r#"<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="x">
-            <IDPSSODescriptor>
-              <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://x/sso"/>
-            </IDPSSODescriptor></EntityDescriptor>"#;
-        assert!(matches!(
-            IdpMetadata::parse(xml),
-            Err(SamlError::NoSigningCert)
-        ));
-    }
-
-    #[test]
-    fn missing_idp_descriptor_is_rejected() {
-        let xml = r#"<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="x"></EntityDescriptor>"#;
-        assert!(matches!(
-            IdpMetadata::parse(xml),
-            Err(SamlError::Metadata(_))
-        ));
-    }
-
-    #[test]
-    fn sp_metadata_contains_entity_and_acs() {
-        let sp = SpParams {
-            entity_id: "https://pxe.example.com".into(),
-            acs_url: "https://pxe.example.com/api/sso/acs".into(),
-        };
-        let xml = build_sp_metadata(&sp);
-        assert!(xml.contains(r#"entityID="https://pxe.example.com""#));
-        assert!(xml.contains("https://pxe.example.com/api/sso/acs"));
-        assert!(xml.contains(BINDING_POST));
-        // Must be well-formed.
-        roxmltree::Document::parse(&xml).unwrap();
-    }
-}

crates/core/src/saml/mod.rs

@@ -1,92 +0,0 @@
-//! Pure-Rust SAML 2.0 Service Provider (v0.5.1).
-//!
-//! This module implements the SP half of a SAML Web-Browser-SSO profile:
-//!
-//! * [`metadata`] — parse the IdP's `EntityDescriptor` (SSO URLs + signing
-//!   certificates) and build *our* SP metadata for the IdP admin to import.
-//! * [`authn_request`] — build an `AuthnRequest` and encode it for the
-//!   HTTP-Redirect binding.
-//! * [`response`] — decode a `SAMLResponse`, **verify its XML signature**
-//!   against the IdP's pinned certificate (via the pure-Rust `bergshamra`
-//!   crate — no OpenSSL/libxml2/xmlsec, so the static musl binary stays
-//!   C-free), then enforce the SP-side semantic checks (Status, Destination,
-//!   Audience, time bounds) that are where SAML SPs actually get attacked.
-//!
-//! Stateful checks (replay of assertion IDs, correlating `InResponseTo`
-//! against requests *we* issued, gating IdP-initiated login) live in the
-//! HTTP layer — [`response::consume`] is deliberately stateless and returns
-//! the IDs the caller needs to perform them.
-//!
-//! Access model: any assertion the IdP authenticates and we cryptographically
-//! verify yields an operator [`VerifiedPrincipal`]. OpenPXE is single-tier —
-//! there is no per-user role table — and the local admin account remains a
-//! guaranteed fallback owner regardless of SSO state.
-
-pub mod authn_request;
-pub mod metadata;
-pub mod response;
-
-pub use authn_request::AuthnRequest;
-pub use metadata::IdpMetadata;
-pub use response::{VerifiedPrincipal, VerifiedResponse};
-
-use thiserror::Error;
-
-/// Default clock-skew tolerance applied to assertion time bounds. SAML IdPs
-/// and SPs rarely have perfectly synced clocks; 60s matches common practice
-/// (Shibboleth/FleetDM defaults are in this ballpark).
-pub const DEFAULT_CLOCK_SKEW_SECS: i64 = 60;
-
-/// Runtime SP parameters, derived from [`crate::SsoConfig`] + the advertised
-/// public base URL by the HTTP layer.
-#[derive(Debug, Clone)]
-pub struct SpParams {
-    /// Our SP Entity ID (the `<Issuer>` we send and the `Audience` we require
-    /// in responses). Defaults to the public base URL when the operator left
-    /// the Entity ID field blank.
-    pub entity_id: String,
-    /// The Assertion Consumer Service URL the IdP POSTs the response to —
-    /// `<public_base_url>/api/sso/acs`.
-    pub acs_url: String,
-}
-
-/// Everything that can go wrong consuming a SAML response. Kept coarse on
-/// purpose: the HTTP layer logs the detail and shows the operator a generic
-/// "SSO sign-in failed" — we never leak which specific check tripped to the
-/// browser, since that aids an attacker probing the SP.
-#[derive(Debug, Error)]
-pub enum SamlError {
-    #[error("SAML XML parse error: {0}")]
-    Xml(String),
-    #[error("IdP metadata is missing a required element: {0}")]
-    Metadata(String),
-    #[error("no usable IdP signing certificate in metadata")]
-    NoSigningCert,
-    #[error("signature verification failed: {0}")]
-    Signature(String),
-    #[error("the signature does not cover the assertion we read")]
-    SignatureScope,
-    #[error("SAML response status was not Success: {0}")]
-    Status(String),
-    #[error("response is missing a required element: {0}")]
-    MissingElement(String),
-    #[error("encrypted assertions are not supported in this release")]
-    EncryptedAssertionUnsupported,
-    #[error("expected exactly one assertion, found {0}")]
-    AssertionCount(usize),
-    #[error("issuer mismatch: response was not issued by the configured IdP")]
-    IssuerMismatch,
-    #[error("audience mismatch: assertion is not addressed to this service provider")]
-    AudienceMismatch,
-    #[error("response destination does not match our ACS URL")]
-    DestinationMismatch,
-    #[error("assertion is expired or not yet valid")]
-    TimeBounds,
-    #[error("invalid SAML timestamp: {0}")]
-    Timestamp(String),
-    #[error("base64 decode failed: {0}")]
-    Base64(String),
-}
-
-#[cfg(test)]
-mod tests;

crates/core/src/saml/response.rs

@@ -1,294 +0,0 @@
-//! SAMLResponse consumption: signature verification + SP-side validation.
-//!
-//! [`consume`] is intentionally **stateless** — it verifies the XML signature
-//! against the IdP's pinned certificate(s) and enforces every check that can
-//! be made from the response alone (Status, Destination, Issuer, Audience,
-//! time bounds, signature scope). It then returns the `assertion_id` and
-//! `in_response_to` so the HTTP layer can perform the *stateful* checks it
-//! owns: replay rejection, correlating the request we issued, and gating
-//! IdP-initiated login.
-
-use roxmltree::{Document, Node};
-use time::format_description::well_known::Rfc3339;
-use time::{Duration, OffsetDateTime};
-
-use super::metadata::IdpMetadata;
-use super::{SamlError, SpParams};
-
-const STATUS_SUCCESS: &str = "urn:oasis:names:tc:SAML:2.0:status:Success";
-
-/// The verified subject of a SAML assertion. OpenPXE is single-tier, so this
-/// is all an operator session needs.
-#[derive(Debug, Clone)]
-pub struct VerifiedPrincipal {
-    /// The `<NameID>` value (an email, per our requested NameID format).
-    pub name_id: String,
-    /// Email used as the session identity. Equals `name_id` for the
-    /// emailAddress NameID format.
-    pub email: String,
-    /// Human-readable display name, if the IdP sent one as an attribute.
-    pub display_name: Option<String>,
-}
-
-/// Result of a successful [`consume`]. The IDs/expiry feed the HTTP layer's
-/// stateful checks.
-#[derive(Debug, Clone)]
-pub struct VerifiedResponse {
-    pub principal: VerifiedPrincipal,
-    /// `InResponseTo` from the response, if present. `None` = unsolicited
-    /// (IdP-initiated) — the HTTP layer only accepts that when the operator
-    /// enabled it.
-    pub in_response_to: Option<String>,
-    /// The assertion's `ID` — used by the caller as the replay-guard key.
-    pub assertion_id: String,
-    /// The assertion's expiry (`Conditions/@NotOnOrAfter`) — the replay
-    /// guard can drop the consumed ID after this instant.
-    pub assertion_expiry: OffsetDateTime,
-    /// `AuthnStatement/@SessionIndex`, if present (useful for future SLO).
-    pub session_index: Option<String>,
-}
-
-/// Verify and validate a decoded `SAMLResponse` XML document.
-pub fn consume(
-    xml: &str,
-    sp: &SpParams,
-    idp: &IdpMetadata,
-    now: OffsetDateTime,
-    clock_skew: Duration,
-) -> Result<VerifiedResponse, SamlError> {
-    // 1. Cryptographically verify the signature against the pinned IdP cert(s).
-    //    `trusted_keys_only` ignores any cert embedded in the document's
-    //    KeyInfo, so an attacker can't substitute their own key.
-    let verified_uris = verify_signature(xml, &idp.signing_certs_der)?;
-
-    // 2. Parse for semantic validation.
-    let doc = Document::parse(xml).map_err(|e| SamlError::Xml(e.to_string()))?;
-    let root = doc.root_element();
-    if root.tag_name().name() != "Response" {
-        return Err(SamlError::MissingElement("Response".into()));
-    }
-    let response_id = root.attribute("ID").map(str::to_owned);
-    let in_response_to = root.attribute("InResponseTo").map(str::to_owned);
-
-    // 3. Status must be Success.
-    let status_value = root
-        .descendants()
-        .find(|n| n.is_element() && n.tag_name().name() == "StatusCode")
-        .and_then(|sc| sc.attribute("Value"))
-        .unwrap_or("");
-    if status_value != STATUS_SUCCESS && !status_value.ends_with(":Success") {
-        return Err(SamlError::Status(status_value.to_owned()));
-    }
-
-    // 4. Destination (if the IdP set one) must be our ACS.
-    if let Some(dest) = root.attribute("Destination") {
-        if !urls_equal(dest, &sp.acs_url) {
-            return Err(SamlError::DestinationMismatch);
-        }
-    }
-
-    // 5. Exactly one (unencrypted) Assertion.
-    if root
-        .descendants()
-        .any(|n| n.is_element() && n.tag_name().name() == "EncryptedAssertion")
-    {
-        return Err(SamlError::EncryptedAssertionUnsupported);
-    }
-    let assertions: Vec<Node<'_, '_>> = root
-        .children()
-        .filter(|c| c.is_element() && c.tag_name().name() == "Assertion")
-        .collect();
-    if assertions.len() != 1 {
-        return Err(SamlError::AssertionCount(assertions.len()));
-    }
-    let assertion = assertions[0];
-    let assertion_id = assertion
-        .attribute("ID")
-        .map(str::to_owned)
-        .ok_or_else(|| SamlError::MissingElement("Assertion/@ID".into()))?;
-
-    // 6. The signature must actually cover the assertion we're about to trust:
-    //    either the assertion itself, the enclosing response, or the whole
-    //    document. (bergshamra's strict_verification already constrains where
-    //    the signed element may sit; this ties it to *our* assertion.)
-    let covers_assertion = verified_uris.iter().any(|u| {
-        u.is_empty()
-            || u == &format!("#{assertion_id}")
-            || response_id
-                .as_ref()
-                .is_some_and(|rid| u == &format!("#{rid}"))
-    });
-    if !covers_assertion {
-        return Err(SamlError::SignatureScope);
-    }
-
-    // 7. Issuer must be the configured IdP.
-    let issuer = first_child(assertion, "Issuer")
-        .map(text_of)
-        .unwrap_or_default();
-    if !idp.entity_id.is_empty() && issuer != idp.entity_id {
-        return Err(SamlError::IssuerMismatch);
-    }
-
-    // 8. Subject → NameID + SubjectConfirmationData time/recipient checks.
-    let subject = first_child(assertion, "Subject")
-        .ok_or_else(|| SamlError::MissingElement("Subject".into()))?;
-    let name_id = first_child(subject, "NameID")
-        .map(text_of)
-        .filter(|s| !s.is_empty())
-        .ok_or_else(|| SamlError::MissingElement("NameID".into()))?;
-    if let Some(scd) = subject
-        .descendants()
-        .find(|n| n.is_element() && n.tag_name().name() == "SubjectConfirmationData")
-    {
-        if let Some(recipient) = scd.attribute("Recipient") {
-            if !urls_equal(recipient, &sp.acs_url) {
-                return Err(SamlError::DestinationMismatch);
-            }
-        }
-        if let Some(noa) = scd.attribute("NotOnOrAfter") {
-            let noa = parse_instant(noa)?;
-            if now >= noa + clock_skew {
-                return Err(SamlError::TimeBounds);
-            }
-        }
-    }
-
-    // 9. Conditions: time window + audience.
-    let conditions = first_child(assertion, "Conditions");
-    if let Some(cond) = conditions {
-        if let Some(nb) = cond.attribute("NotBefore") {
-            let nb = parse_instant(nb)?;
-            if now < nb - clock_skew {
-                return Err(SamlError::TimeBounds);
-            }
-        }
-    }
-    let assertion_expiry = conditions
-        .and_then(|c| c.attribute("NotOnOrAfter"))
-        .map(parse_instant)
-        .transpose()?
-        .ok_or_else(|| SamlError::MissingElement("Conditions/@NotOnOrAfter".into()))?;
-    if now >= assertion_expiry + clock_skew {
-        return Err(SamlError::TimeBounds);
-    }
-
-    let audience_ok = conditions.is_some_and(|c| {
-        c.descendants()
-            .filter(|n| n.is_element() && n.tag_name().name() == "Audience")
-            .any(|a| text_of(a) == sp.entity_id)
-    });
-    if !audience_ok {
-        return Err(SamlError::AudienceMismatch);
-    }
-
-    // 10. Optional: SessionIndex + display-name attribute.
-    let session_index = assertion
-        .descendants()
-        .find(|n| n.is_element() && n.tag_name().name() == "AuthnStatement")
-        .and_then(|a| a.attribute("SessionIndex"))
-        .map(str::to_owned);
-
-    let display_name = extract_display_name(assertion);
-
-    Ok(VerifiedResponse {
-        principal: VerifiedPrincipal {
-            email: name_id.clone(),
-            name_id,
-            display_name,
-        },
-        in_response_to,
-        assertion_id,
-        assertion_expiry,
-        session_index,
-    })
-}
-
-/// Verify the document's XML-DSig against each pinned IdP cert in turn
-/// (handles key rotation), returning the verified `<Reference>` URIs.
-fn verify_signature(xml: &str, certs_der: &[Vec<u8>]) -> Result<Vec<String>, SamlError> {
-    let mut last_err = String::from("no signing certificate matched");
-    for der in certs_der {
-        let key = match bergshamra::keys::loader::load_x509_cert_der(der) {
-            Ok(k) => k,
-            Err(e) => {
-                last_err = e.to_string();
-                continue;
-            }
-        };
-        let mut km = bergshamra::keys::KeysManager::new();
-        km.add_key(key);
-        // trusted_keys_only: only ever trust the pinned IdP key, never an
-        // inline KeyInfo cert. strict_verification: XSW positional defense.
-        let ctx = bergshamra::DsigContext::new(km)
-            .with_trusted_keys_only(true)
-            .with_strict_verification(true);
-        match bergshamra::verify(&ctx, xml) {
-            Ok(bergshamra::VerifyResult::Valid { references, .. }) => {
-                return Ok(references.into_iter().map(|r| r.uri).collect());
-            }
-            Ok(bergshamra::VerifyResult::Invalid { reason }) => last_err = reason,
-            Err(e) => last_err = e.to_string(),
-        }
-    }
-    Err(SamlError::Signature(last_err))
-}
-
-/// Pull a display name from the assertion's attribute statement, trying the
-/// common attribute names IdPs use (FleetDM checks the same set).
-fn extract_display_name(assertion: Node<'_, '_>) -> Option<String> {
-    const WANTED: &[&str] = &[
-        "name",
-        "displayname",
-        "cn",
-        "urn:oid:2.5.4.3",
-        "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
-    ];
-    for attr in assertion
-        .descendants()
-        .filter(|n| n.is_element() && n.tag_name().name() == "Attribute")
-    {
-        let key = attr
-            .attribute("Name")
-            .or_else(|| attr.attribute("FriendlyName"))
-            .unwrap_or("")
-            .to_ascii_lowercase();
-        if WANTED.contains(&key.as_str()) {
-            if let Some(val) = attr
-                .descendants()
-                .find(|n| n.is_element() && n.tag_name().name() == "AttributeValue")
-            {
-                let v = text_of(val);
-                if !v.is_empty() {
-                    return Some(v);
-                }
-            }
-        }
-    }
-    None
-}
-
-fn first_child<'a, 'i>(n: Node<'a, 'i>, local: &str) -> Option<Node<'a, 'i>> {
-    n.children()
-        .find(|c| c.is_element() && c.tag_name().name() == local)
-}
-
-fn text_of(n: Node<'_, '_>) -> String {
-    n.children()
-        .filter(Node::is_text)
-        .filter_map(|c| c.text())
-        .collect::<String>()
-        .trim()
-        .to_owned()
-}
-
-/// Parse an `xs:dateTime` (e.g. `2026-05-31T12:00:00.000Z`).
-fn parse_instant(s: &str) -> Result<OffsetDateTime, SamlError> {
-    OffsetDateTime::parse(s.trim(), &Rfc3339).map_err(|e| SamlError::Timestamp(format!("{s}: {e}")))
-}
-
-/// Compare two URLs for SAML endpoint-matching purposes: exact, or differing
-/// only by a single trailing slash.
-fn urls_equal(a: &str, b: &str) -> bool {
-    a == b || a.trim_end_matches('/') == b.trim_end_matches('/')
-}

crates/core/src/saml/tests.rs

@@ -1,287 +0,0 @@
-//! End-to-end SAML SP tests.
-//!
-//! We mint a throwaway self-signed cert/key with `rcgen`, sign a SAML Response
-//! template with `bergshamra::sign` (the same engine that verifies it), and
-//! drive [`response::consume`] through the accept path and every reject path.
-//! This proves both the signature wiring and the SP-semantic checks.
-
-use time::format_description::well_known::Rfc3339;
-use time::{Duration, OffsetDateTime};
-
-use super::metadata::IdpMetadata;
-use super::{response, SamlError, SpParams};
-
-const SP_ENTITY: &str = "https://pxe.example.com";
-const ACS: &str = "https://pxe.example.com/api/sso/acs";
-const IDP_ENTITY: &str = "https://idp.example.com/realms/fleet";
-const EMAIL: &str = "[email protected]";
-
-struct TestIdp {
-    cert_der: Vec<u8>,
-    key_pem: String,
-}
-
-fn test_idp() -> TestIdp {
-    let ck = rcgen::generate_simple_self_signed(vec!["idp.example.com".to_string()]).unwrap();
-    TestIdp {
-        cert_der: ck.cert.der().as_ref().to_vec(),
-        key_pem: ck.key_pair.serialize_pem(),
-    }
-}
-
-fn fmt(t: OffsetDateTime) -> String {
-    t.replace_nanosecond(0).unwrap().format(&Rfc3339).unwrap()
-}
-
-/// Knobs for building a response template — defaults are a valid response.
-struct Resp {
-    issuer: String,
-    audience: String,
-    status: String,
-    not_before: OffsetDateTime,
-    not_on_or_after: OffsetDateTime,
-    in_response_to: Option<String>,
-    recipient: String,
-}
-
-impl Default for Resp {
-    fn default() -> Self {
-        let now = OffsetDateTime::now_utc();
-        Self {
-            issuer: IDP_ENTITY.into(),
-            audience: SP_ENTITY.into(),
-            status: "urn:oasis:names:tc:SAML:2.0:status:Success".into(),
-            not_before: now - Duration::minutes(5),
-            not_on_or_after: now + Duration::hours(1),
-            in_response_to: Some("_req-abc".into()),
-            recipient: ACS.into(),
-        }
-    }
-}
-
-impl Resp {
-    /// The unsigned template (a `<ds:Signature>` with empty values).
-    fn template(&self) -> String {
-        let now = fmt(OffsetDateTime::now_utc());
-        let irt = self
-            .in_response_to
-            .as_ref()
-            .map(|v| format!(r#" InResponseTo="{v}""#))
-            .unwrap_or_default();
-        format!(
-            r##"<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_resp1" Version="2.0" IssueInstant="{now}" Destination="{ACS}"{irt}>
-  <saml:Issuer>{issuer}</saml:Issuer>
-  <samlp:Status><samlp:StatusCode Value="{status}"/></samlp:Status>
-  <saml:Assertion ID="_assertion1" Version="2.0" IssueInstant="{now}">
-    <saml:Issuer>{issuer}</saml:Issuer>
-    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
-      <ds:SignedInfo>
-        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
-        <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256"/>
-        <ds:Reference URI="#_assertion1">
-          <ds:Transforms>
-            <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
-            <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
-          </ds:Transforms>
-          <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
-          <ds:DigestValue></ds:DigestValue>
-        </ds:Reference>
-      </ds:SignedInfo>
-      <ds:SignatureValue></ds:SignatureValue>
-    </ds:Signature>
-    <saml:Subject>
-      <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">{EMAIL}</saml:NameID>
-      <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
-        <saml:SubjectConfirmationData Recipient="{recipient}" NotOnOrAfter="{noa}"{irt}/>
-      </saml:SubjectConfirmation>
-    </saml:Subject>
-    <saml:Conditions NotBefore="{nb}" NotOnOrAfter="{noa}">
-      <saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction>
-    </saml:Conditions>
-    <saml:AuthnStatement AuthnInstant="{now}" SessionIndex="sess-123">
-      <saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef></saml:AuthnContext>
-    </saml:AuthnStatement>
-    <saml:AttributeStatement>
-      <saml:Attribute Name="displayName"><saml:AttributeValue>Miles Ward</saml:AttributeValue></saml:Attribute>
-    </saml:AttributeStatement>
-  </saml:Assertion>
-</samlp:Response>"##,
-            issuer = self.issuer,
-            status = self.status,
-            audience = self.audience,
-            recipient = self.recipient,
-            nb = fmt(self.not_before),
-            noa = fmt(self.not_on_or_after),
-        )
-    }
-}
-
-fn sign(template: &str, key_pem: &str) -> String {
-    let key = bergshamra::keys::loader::load_pem_auto(key_pem.as_bytes(), None)
-        .expect("load test signing key");
-    let mut km = bergshamra::keys::KeysManager::new();
-    km.add_key(key);
-    let ctx = bergshamra::DsigContext::new(km);
-    bergshamra::sign(&ctx, template).expect("sign test response")
-}
-
-fn sp() -> SpParams {
-    SpParams {
-        entity_id: SP_ENTITY.into(),
-        acs_url: ACS.into(),
-    }
-}
-
-fn idp(cert_der: Vec<u8>) -> IdpMetadata {
-    IdpMetadata {
-        entity_id: IDP_ENTITY.into(),
-        sso_redirect_url: None,
-        sso_post_url: None,
-        signing_certs_der: vec![cert_der],
-    }
-}
-
-fn consume(xml: &str, cert_der: Vec<u8>) -> Result<response::VerifiedResponse, SamlError> {
-    response::consume(
-        xml,
-        &sp(),
-        &idp(cert_der),
-        OffsetDateTime::now_utc(),
-        Duration::seconds(60),
-    )
-}
-
-#[test]
-fn good_response_yields_principal() {
-    let t = test_idp();
-    let signed = sign(&Resp::default().template(), &t.key_pem);
-    let out = consume(&signed, t.cert_der).expect("valid response should verify");
-    assert_eq!(out.principal.email, EMAIL);
-    assert_eq!(out.principal.name_id, EMAIL);
-    assert_eq!(out.principal.display_name.as_deref(), Some("Miles Ward"));
-    assert_eq!(out.in_response_to.as_deref(), Some("_req-abc"));
-    assert_eq!(out.assertion_id, "_assertion1");
-    assert_eq!(out.session_index.as_deref(), Some("sess-123"));
-}
-
-#[test]
-fn tampered_assertion_is_rejected() {
-    let t = test_idp();
-    let signed = sign(&Resp::default().template(), &t.key_pem);
-    // Flip the subject email after signing — breaks the digest.
-    let tampered = signed.replace(EMAIL, "[email protected]");
-    assert_ne!(signed, tampered);
-    assert!(matches!(
-        consume(&tampered, t.cert_der),
-        Err(SamlError::Signature(_) | SamlError::SignatureScope)
-    ));
-}
-
-#[test]
-fn unsigned_response_is_rejected() {
-    let t = test_idp();
-    // Feed the *unsigned* template (empty SignatureValue) straight in.
-    let unsigned = Resp::default().template();
-    assert!(matches!(
-        consume(&unsigned, t.cert_der),
-        Err(SamlError::Signature(_))
-    ));
-}
-
-#[test]
-fn wrong_signing_key_is_rejected() {
-    let signer = test_idp();
-    let other = test_idp(); // different keypair pinned as the "IdP" cert
-    let signed = sign(&Resp::default().template(), &signer.key_pem);
-    assert!(matches!(
-        consume(&signed, other.cert_der),
-        Err(SamlError::Signature(_))
-    ));
-}
-
-#[test]
-fn wrong_audience_is_rejected() {
-    let t = test_idp();
-    let r = Resp {
-        audience: "https://someone-else.example".into(),
-        ..Resp::default()
-    };
-    let signed = sign(&r.template(), &t.key_pem);
-    assert!(matches!(
-        consume(&signed, t.cert_der),
-        Err(SamlError::AudienceMismatch)
-    ));
-}
-
-#[test]
-fn expired_assertion_is_rejected() {
-    let t = test_idp();
-    let now = OffsetDateTime::now_utc();
-    let r = Resp {
-        not_before: now - Duration::hours(2),
-        not_on_or_after: now - Duration::hours(1),
-        ..Resp::default()
-    };
-    let signed = sign(&r.template(), &t.key_pem);
-    assert!(matches!(
-        consume(&signed, t.cert_der),
-        Err(SamlError::TimeBounds)
-    ));
-}
-
-#[test]
-fn future_assertion_is_rejected() {
-    let t = test_idp();
-    let now = OffsetDateTime::now_utc();
-    let r = Resp {
-        not_before: now + Duration::hours(1),
-        not_on_or_after: now + Duration::hours(2),
-        ..Resp::default()
-    };
-    let signed = sign(&r.template(), &t.key_pem);
-    assert!(matches!(
-        consume(&signed, t.cert_der),
-        Err(SamlError::TimeBounds)
-    ));
-}
-
-#[test]
-fn wrong_issuer_is_rejected() {
-    let t = test_idp();
-    let r = Resp {
-        issuer: "https://evil-idp.example".into(),
-        ..Resp::default()
-    };
-    let signed = sign(&r.template(), &t.key_pem);
-    assert!(matches!(
-        consume(&signed, t.cert_der),
-        Err(SamlError::IssuerMismatch)
-    ));
-}
-
-#[test]
-fn non_success_status_is_rejected() {
-    let t = test_idp();
-    let r = Resp {
-        status: "urn:oasis:names:tc:SAML:2.0:status:Requester".into(),
-        ..Resp::default()
-    };
-    let signed = sign(&r.template(), &t.key_pem);
-    assert!(matches!(
-        consume(&signed, t.cert_der),
-        Err(SamlError::Status(_))
-    ));
-}
-
-#[test]
-fn idp_initiated_has_no_in_response_to() {
-    // No InResponseTo => the HTTP layer must gate it behind allow_idp_initiated.
-    let t = test_idp();
-    let r = Resp {
-        in_response_to: None,
-        ..Resp::default()
-    };
-    let signed = sign(&r.template(), &t.key_pem);
-    let out = consume(&signed, t.cert_der).expect("unsolicited but otherwise valid");
-    assert!(out.in_response_to.is_none());
-}

crates/core/src/settings.rs

@@ -48,9 +48,9 @@ pub struct Settings {
     pub default_local_hdd: bool,
 
     /// When a client hits the Queued Deployment item, how long (seconds) to
-    /// hold it in queue before giving up and falling back to the menu.
+    /// hold it at the gate before giving up and falling back to the menu.
     /// 0 = forever.
-    pub queue_wait_max_secs: u32,
+    pub gate_wait_max_secs: u32,
 
     /// Optional DNS server advertised on the Network tab. Purely
     /// informational today — OpenPXE does not run a DNS server, but
@@ -67,8 +67,11 @@ pub enum TimeoutAction {
     /// Chain the "Boot from Local HDD" entry.
     LocalHdd,
     /// Put the client into the deployment queue, waiting for operator
-    /// assignment.
+    /// assignment. The serde alias keeps v0.2.0 settings.json files
+    /// readable after the v0.3.0 rename — old `"gated_deployment"`
+    /// values deserialize transparently.
     #[default]
+    #[serde(alias = "gated_deployment")]
     QueuedDeployment,
 }
 
@@ -81,7 +84,7 @@ impl Default for Settings {
             smb_host_override: String::new(),
             extra_kernel_args: String::new(),
             default_local_hdd: true,
-            queue_wait_max_secs: 0,
+            gate_wait_max_secs: 0,
             dns_server: String::new(),
         }
     }
@@ -112,10 +115,7 @@ impl SettingsStore {
             },
             Err(_) => Settings::default(),
         };
-        Arc::new(Self {
-            path,
-            inner: RwLock::new(initial),
-        })
+        Arc::new(Self { path, inner: RwLock::new(initial) })
     }
 
     #[must_use]
@@ -181,12 +181,6 @@ mod tests {
         assert!(s.windows_enabled);
     }
 
-    #[test]
-    fn settings_serialize_queue_naming() {
-        let text = serde_json::to_string(&Settings::default()).unwrap();
-        assert!(text.contains("queue_wait_max_secs"));
-    }
-
     #[test]
     fn corrupt_file_falls_back_to_default() {
         let dir = tempdir().unwrap();

crates/core/src/sso.rs

@@ -1,390 +0,0 @@
-//! SAML SSO configuration — FleetDM-shaped.
-//!
-//! The operator pastes their IdP's metadata XML (or its URL) and a
-//! human-readable label. As of v0.5.1 the SAML login flow is wired
-//! end-to-end (see [`crate::saml`]): SP-initiated AuthnRequest, the ACS
-//! endpoint, pure-Rust signature verification, and operator-session
-//! minting. This module owns only the persisted *configuration*.
-//!
-//! Shape borrowed from <https://github.com/fleetdm/fleet>'s app-config
-//! SSO block, minus the user-RBAC fields (OpenPXE is single-tier: any
-//! IdP-authenticated user the SP cryptographically verifies gets an
-//! operator session; there is no per-user role table). Entity ID is
-//! exposed (FleetDM-style) but defaults to the advertised public base
-//! URL when blank, which is what most IdPs expect anyway.
-
-use parking_lot::RwLock;
-use serde::{Deserialize, Serialize};
-use std::path::PathBuf;
-use std::sync::Arc;
-
-use crate::{Error, Result};
-
-/// The configurable surface. `metadata` and `metadata_url` are mutually
-/// exclusive at apply time (one or the other identifies the IdP); the
-/// store keeps both fields so an operator can switch between them
-/// without losing the inactive one.
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-pub struct SsoConfig {
-    /// Master switch — when false, all SSO machinery (planned for a
-    /// later release) is skipped regardless of the rest of the fields.
-    #[serde(default)]
-    pub enabled: bool,
-    /// Display name shown on the WebUI's login screen as the "Sign in
-    /// with X" button label. Empty/whitespace falls back to "SSO".
-    #[serde(default)]
-    pub idp_name: String,
-    /// Optional HTTPS URL pointing at the IdP's brand logo. Rendered
-    /// next to `idp_name` on the WebUI's login screen (FleetDM-style).
-    /// Length-capped at [`MAX_URL_LEN`]; empty is fine.
-    #[serde(default)]
-    pub idp_logo_url: String,
-    /// Raw SAML metadata XML pasted by the operator. Mutually exclusive
-    /// with `metadata_url`; if both are set, the URL wins at apply time
-    /// (operators typically forget about a stale XML paste).
-    #[serde(default)]
-    pub metadata: String,
-    /// HTTPS URL where the IdP serves its metadata. Loaded lazily by the
-    /// future SAML flow; not validated here beyond a basic length cap.
-    #[serde(default)]
-    pub metadata_url: String,
-    /// SP Entity ID advertised to the IdP — mirrors FleetDM's "Entity ID".
-    /// Must exactly match the SP/Relying-Party entry configured on the IdP.
-    /// Empty falls back to the advertised public base URL at runtime, which
-    /// is what most IdPs expect. Length-capped at [`MAX_URL_LEN`].
-    #[serde(default)]
-    pub entity_id: String,
-    /// Allow IdP-initiated login — an unsolicited `<Response>` POSTed to the
-    /// ACS with no `InResponseTo`. Mirrors FleetDM's "Allow SSO login
-    /// initiated by identity provider". Default off; SP-initiated (the
-    /// "Sign in with X" button) is always allowed regardless.
-    #[serde(default)]
-    pub allow_idp_initiated: bool,
-}
-
-impl SsoConfig {
-    /// Returns `true` only when the config is *usable* — enabled, and
-    /// at least one of metadata/metadata_url is present. The future
-    /// login flow will key off this; for v0.4.5 the WebUI uses it to
-    /// surface a yellow "configured but not live yet" hint.
-    #[must_use]
-    pub fn is_usable(&self) -> bool {
-        self.enabled && (!self.metadata.trim().is_empty() || !self.metadata_url.trim().is_empty())
-    }
-}
-
-/// In-memory + on-disk SSO settings registry.
-#[derive(Debug, Clone)]
-pub struct SsoStore {
-    path: Arc<PathBuf>,
-    inner: Arc<RwLock<SsoConfig>>,
-}
-
-impl SsoStore {
-    /// Load from `<work_dir>/sso.json`, or start with the default empty
-    /// (`enabled = false`) config. A corrupt file falls back to default
-    /// rather than blocking startup.
-    #[must_use]
-    pub fn load_or_default(work_dir: &std::path::Path) -> Self {
-        let path = work_dir.join("sso.json");
-        let cfg = match std::fs::read_to_string(&path) {
-            Ok(text) => match serde_json::from_str::<SsoConfig>(&text) {
-                Ok(parsed) => parsed,
-                Err(e) => {
-                    tracing::warn!(
-                        target: "openpxe::sso",
-                        "sso.json present but unreadable ({e}); starting with default config"
-                    );
-                    SsoConfig::default()
-                }
-            },
-            Err(_) => SsoConfig::default(),
-        };
-        Self {
-            path: Arc::new(path),
-            inner: Arc::new(RwLock::new(cfg)),
-        }
-    }
-
-    #[must_use]
-    pub fn snapshot(&self) -> SsoConfig {
-        self.inner.read().clone()
-    }
-
-    /// Replace the whole config in one shot. Light validation: metadata
-    /// XML and URL are length-capped so an operator can't OOM us by
-    /// pasting a 10 GiB blob; the IdP UI tab clamps the input visually,
-    /// but the server enforces a hard ceiling regardless.
-    pub fn replace(&self, mut cfg: SsoConfig) -> Result<SsoConfig> {
-        cfg.idp_name = cfg.idp_name.trim().to_string();
-        cfg.idp_logo_url = cfg.idp_logo_url.trim().to_string();
-        cfg.metadata = cfg.metadata.trim().to_string();
-        cfg.metadata_url = cfg.metadata_url.trim().to_string();
-        cfg.entity_id = cfg.entity_id.trim().to_string();
-        if cfg.entity_id.len() > MAX_URL_LEN {
-            return Err(Error::Invalid(format!(
-                "entity_id exceeds {MAX_URL_LEN}-char cap"
-            )));
-        }
-        if cfg.metadata.len() > MAX_METADATA_BYTES {
-            return Err(Error::Invalid(format!(
-                "metadata XML exceeds {MAX_METADATA_BYTES}-byte cap"
-            )));
-        }
-        if cfg.metadata_url.len() > MAX_URL_LEN {
-            return Err(Error::Invalid(format!(
-                "metadata_url exceeds {MAX_URL_LEN}-char cap"
-            )));
-        }
-        if cfg.idp_logo_url.len() > MAX_URL_LEN {
-            return Err(Error::Invalid(format!(
-                "idp_logo_url exceeds {MAX_URL_LEN}-char cap"
-            )));
-        }
-        if !cfg.metadata_url.is_empty()
-            && !cfg.metadata_url.starts_with("http://")
-            && !cfg.metadata_url.starts_with("https://")
-        {
-            return Err(Error::Invalid(
-                "metadata_url must start with http:// or https://".into(),
-            ));
-        }
-        if !cfg.idp_logo_url.is_empty()
-            && !cfg.idp_logo_url.starts_with("http://")
-            && !cfg.idp_logo_url.starts_with("https://")
-        {
-            return Err(Error::Invalid(
-                "idp_logo_url must start with http:// or https://".into(),
-            ));
-        }
-        // If they're trying to *enable* the integration but haven't
-        // supplied either source, reject — saves a "configured but
-        // unusable" surprise later.
-        if cfg.enabled && cfg.metadata.is_empty() && cfg.metadata_url.is_empty() {
-            return Err(Error::Invalid(
-                "enable SSO requires either metadata XML or a metadata URL".into(),
-            ));
-        }
-        {
-            let mut g = self.inner.write();
-            *g = cfg.clone();
-        }
-        self.persist();
-        tracing::info!(
-            target: "openpxe::sso",
-            enabled = cfg.enabled,
-            idp = %cfg.idp_name,
-            has_xml = !cfg.metadata.is_empty(),
-            has_url = !cfg.metadata_url.is_empty(),
-            "sso configuration updated"
-        );
-        Ok(cfg)
-    }
-
-    fn persist(&self) {
-        let snap = self.inner.read().clone();
-        let body = match serde_json::to_vec_pretty(&snap) {
-            Ok(b) => b,
-            Err(e) => {
-                tracing::warn!(target: "openpxe::sso", "serialize sso.json: {e}");
-                return;
-            }
-        };
-        if let Some(parent) = self.path.parent() {
-            let _ = std::fs::create_dir_all(parent);
-        }
-        let tmp = self.path.with_extension("json.tmp");
-        if let Err(e) = std::fs::write(&tmp, body) {
-            tracing::warn!(target: "openpxe::sso", "write sso.json tmp: {e}");
-            return;
-        }
-        if let Err(e) = std::fs::rename(&tmp, self.path.as_path()) {
-            tracing::warn!(target: "openpxe::sso", "rename sso.json: {e}");
-        }
-    }
-}
-
-/// Saturation caps. The numbers are generous for any real IdP metadata
-/// document — Okta's largest is ~50 KB, Azure AD's ~30 KB.
-const MAX_METADATA_BYTES: usize = 1024 * 1024;
-const MAX_URL_LEN: usize = 2048;
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use tempfile::tempdir;
-
-    #[test]
-    fn default_is_disabled_and_empty() {
-        let dir = tempdir().unwrap();
-        let s = SsoStore::load_or_default(dir.path());
-        let cfg = s.snapshot();
-        assert!(!cfg.enabled);
-        assert!(cfg.metadata.is_empty());
-        assert!(cfg.metadata_url.is_empty());
-        assert!(!cfg.is_usable());
-    }
-
-    #[test]
-    fn replace_metadata_url_round_trip_via_disk() {
-        let dir = tempdir().unwrap();
-        let s = SsoStore::load_or_default(dir.path());
-        s.replace(SsoConfig {
-            enabled: true,
-            idp_name: "Okta".into(),
-            metadata: String::new(),
-            metadata_url: "https://idp.example.com/metadata".into(),
-            idp_logo_url: String::new(),
-            entity_id: String::new(),
-            allow_idp_initiated: false,
-        })
-        .unwrap();
-        drop(s);
-        let s2 = SsoStore::load_or_default(dir.path());
-        let cfg = s2.snapshot();
-        assert!(cfg.enabled);
-        assert!(cfg.is_usable());
-        assert_eq!(cfg.idp_name, "Okta");
-        assert_eq!(cfg.metadata_url, "https://idp.example.com/metadata");
-    }
-
-    #[test]
-    fn replace_xml_paste_is_accepted() {
-        let dir = tempdir().unwrap();
-        let s = SsoStore::load_or_default(dir.path());
-        let xml = r#"<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata">test</EntityDescriptor>"#;
-        s.replace(SsoConfig {
-            enabled: true,
-            idp_name: "Test IdP".into(),
-            metadata: xml.into(),
-            metadata_url: String::new(),
-            idp_logo_url: String::new(),
-            entity_id: String::new(),
-            allow_idp_initiated: false,
-        })
-        .unwrap();
-        assert!(s.snapshot().is_usable());
-    }
-
-    #[test]
-    fn enable_without_source_is_rejected() {
-        let dir = tempdir().unwrap();
-        let s = SsoStore::load_or_default(dir.path());
-        let r = s.replace(SsoConfig {
-            enabled: true,
-            idp_name: "Okta".into(),
-            metadata: String::new(),
-            metadata_url: String::new(),
-            idp_logo_url: String::new(),
-            entity_id: String::new(),
-            allow_idp_initiated: false,
-        });
-        assert!(matches!(r, Err(Error::Invalid(_))));
-        // …and a disabled blank config is fine.
-        s.replace(SsoConfig::default()).unwrap();
-    }
-
-    #[test]
-    fn metadata_url_must_be_http_scheme() {
-        let dir = tempdir().unwrap();
-        let s = SsoStore::load_or_default(dir.path());
-        let r = s.replace(SsoConfig {
-            enabled: false,
-            idp_name: String::new(),
-            metadata: String::new(),
-            metadata_url: "ftp://idp.example.com/metadata".into(),
-            idp_logo_url: String::new(),
-            entity_id: String::new(),
-            allow_idp_initiated: false,
-        });
-        assert!(matches!(r, Err(Error::Invalid(_))));
-    }
-
-    #[test]
-    fn idp_logo_url_must_be_http_scheme() {
-        // v0.4.6: SSO settings learned an idp_logo_url so the login
-        // screen can render the FleetDM-style "Sign in with <IdP-logo>"
-        // affordance. Same scheme rule as metadata_url.
-        let dir = tempdir().unwrap();
-        let s = SsoStore::load_or_default(dir.path());
-        let r = s.replace(SsoConfig {
-            enabled: false,
-            idp_name: "Okta".into(),
-            metadata: String::new(),
-            metadata_url: String::new(),
-            idp_logo_url: "data:image/png;base64,...".into(),
-            entity_id: String::new(),
-            allow_idp_initiated: false,
-        });
-        assert!(matches!(r, Err(Error::Invalid(_))));
-        // Real HTTPS URL is fine.
-        s.replace(SsoConfig {
-            enabled: false,
-            idp_name: "Okta".into(),
-            metadata: String::new(),
-            metadata_url: String::new(),
-            idp_logo_url: "https://idp.example.com/logo.png".into(),
-            entity_id: String::new(),
-            allow_idp_initiated: false,
-        })
-        .unwrap();
-        assert_eq!(
-            s.snapshot().idp_logo_url,
-            "https://idp.example.com/logo.png"
-        );
-    }
-
-    #[test]
-    fn entity_id_and_idp_initiated_round_trip() {
-        // v0.5.1: SP Entity ID + IdP-initiated toggle persist across reload.
-        let dir = tempdir().unwrap();
-        let s = SsoStore::load_or_default(dir.path());
-        s.replace(SsoConfig {
-            enabled: true,
-            idp_name: "Keycloak".into(),
-            metadata: String::new(),
-            metadata_url: "https://idp.example.com/metadata".into(),
-            idp_logo_url: String::new(),
-            entity_id: "https://pxe.example.com".into(),
-            allow_idp_initiated: true,
-        })
-        .unwrap();
-        drop(s);
-        let cfg = SsoStore::load_or_default(dir.path()).snapshot();
-        assert_eq!(cfg.entity_id, "https://pxe.example.com");
-        assert!(cfg.allow_idp_initiated);
-    }
-
-    #[test]
-    fn entity_id_cap_enforced() {
-        let dir = tempdir().unwrap();
-        let s = SsoStore::load_or_default(dir.path());
-        let r = s.replace(SsoConfig {
-            enabled: false,
-            idp_name: String::new(),
-            metadata: String::new(),
-            metadata_url: String::new(),
-            idp_logo_url: String::new(),
-            entity_id: "x".repeat(MAX_URL_LEN + 1),
-            allow_idp_initiated: false,
-        });
-        assert!(matches!(r, Err(Error::Invalid(_))));
-    }
-
-    #[test]
-    fn metadata_size_cap_enforced() {
-        let dir = tempdir().unwrap();
-        let s = SsoStore::load_or_default(dir.path());
-        let oversize = "a".repeat(MAX_METADATA_BYTES + 1);
-        let r = s.replace(SsoConfig {
-            enabled: false,
-            idp_name: String::new(),
-            metadata: oversize,
-            metadata_url: String::new(),
-            idp_logo_url: String::new(),
-            entity_id: String::new(),
-            allow_idp_initiated: false,
-        });
-        assert!(matches!(r, Err(Error::Invalid(_))));
-    }
-}

crates/core/src/wol.rs

@@ -1,210 +0,0 @@
-//! Wake-on-LAN.
-//!
-//! v0.5.0: from the Hosts tab, an operator can wake a bound machine.
-//! WoL is a "magic packet" — six `0xFF` bytes followed by the target
-//! MAC repeated sixteen times (102 bytes total) — broadcast on the
-//! local segment. The NIC's WoL logic matches the repeated MAC and
-//! powers the board on.
-//!
-//! ## Why this is trivial and safe in our container
-//!
-//! - It's a single UDP datagram to a broadcast address. No privileged
-//!   *local* port is needed (we bind an ephemeral source port); the
-//!   destination port is conventionally 9 (discard) or 7 (echo), and
-//!   nothing actually listens there — the magic is in the payload, not
-//!   the port. So WoL works without any extra capability.
-//! - We send to the limited broadcast `255.255.255.255` (stays on the
-//!   local link) and, when the caller knows the server's own subnet
-//!   broadcast, to that too — directed broadcast reaches the right VLAN
-//!   even when the host bridges multiple segments.
-//!
-//! ## Limits
-//!
-//! WoL only crosses L2. If the target is on a different subnet than the
-//! OpenPXE host, the intervening router must be configured to forward
-//! directed broadcasts (most aren't, by design). For the common case —
-//! OpenPXE and its PXE clients on the same VLAN — the limited broadcast
-//! is enough.
-
-use crate::{Error, Result};
-use std::net::{Ipv4Addr, SocketAddrV4, UdpSocket};
-
-/// Conventional WoL destination port. 9 (discard) is the de-facto
-/// default; the port is immaterial since the match is on the payload.
-const WOL_PORT: u16 = 9;
-
-/// Parse a MAC string in any common form (`aa:bb:cc:dd:ee:ff`,
-/// `aa-bb-...`, `aabb.ccdd.eeff`, or bare hex) into six octets.
-///
-/// Returns `Error::Invalid` if it doesn't resolve to exactly six bytes.
-pub fn parse_mac(mac: &str) -> Result<[u8; 6]> {
-    // Strip every non-hex-digit, then expect exactly 12 hex chars.
-    let hex: String = mac.chars().filter(char::is_ascii_hexdigit).collect();
-    if hex.len() != 12 {
-        return Err(Error::Invalid(format!(
-            "invalid MAC '{mac}': expected 6 octets (12 hex digits), got {}",
-            hex.len()
-        )));
-    }
-    let mut out = [0u8; 6];
-    for (i, byte) in out.iter_mut().enumerate() {
-        // Each octet is two hex chars; unwrap is safe — we validated
-        // the length and that every char is a hex digit above.
-        *byte = u8::from_str_radix(&hex[i * 2..i * 2 + 2], 16)
-            .map_err(|e| Error::Invalid(format!("invalid MAC '{mac}': {e}")))?;
-    }
-    Ok(out)
-}
-
-/// Build the 102-byte magic packet for `mac`.
-#[must_use]
-pub fn magic_packet(mac: [u8; 6]) -> [u8; 102] {
-    let mut pkt = [0u8; 102];
-    // 6 bytes of 0xFF.
-    for b in &mut pkt[..6] {
-        *b = 0xFF;
-    }
-    // MAC repeated 16 times.
-    for rep in 0..16 {
-        let start = 6 + rep * 6;
-        pkt[start..start + 6].copy_from_slice(&mac);
-    }
-    pkt
-}
-
-/// Send a Wake-on-LAN magic packet for `mac` to every address in
-/// `broadcasts` (e.g. `255.255.255.255` plus the server's subnet
-/// broadcast). Returns the number of broadcast addresses the packet was
-/// successfully sent to; errors only if the MAC is malformed or the
-/// socket can't be opened at all.
-pub fn wake(mac: &str, broadcasts: &[Ipv4Addr]) -> Result<usize> {
-    let parsed = parse_mac(mac)?;
-    let packet = magic_packet(parsed);
-
-    // Always include the limited broadcast even if the caller didn't —
-    // it's the one that works with zero network configuration.
-    let mut targets: Vec<Ipv4Addr> = vec![Ipv4Addr::BROADCAST];
-    for b in broadcasts {
-        if !targets.contains(b) {
-            targets.push(*b);
-        }
-    }
-
-    let sent = send_magic(&packet, &targets, WOL_PORT)?;
-    tracing::info!(
-        target: "openpxe::wol",
-        mac = %mac, broadcasts = sent,
-        "Wake-on-LAN magic packet sent"
-    );
-    Ok(sent)
-}
-
-/// Open a broadcast-enabled UDP socket and send `packet` to every
-/// `target:port`. Returns how many sends succeeded. Errors if the
-/// socket can't be opened or if *no* target accepted the packet.
-fn send_magic(packet: &[u8], targets: &[Ipv4Addr], port: u16) -> Result<usize> {
-    // Bind an ephemeral local UDP port on all interfaces. SO_BROADCAST
-    // must be enabled to send to a broadcast address.
-    let sock = UdpSocket::bind(SocketAddrV4::new(Ipv4Addr::UNSPECIFIED, 0))
-        .map_err(|e| Error::Invalid(format!("could not open WoL socket: {e}")))?;
-    sock.set_broadcast(true)
-        .map_err(|e| Error::Invalid(format!("could not enable broadcast: {e}")))?;
-
-    let mut sent = 0usize;
-    for &addr in targets {
-        match sock.send_to(packet, SocketAddrV4::new(addr, port)) {
-            Ok(_) => sent += 1,
-            Err(e) => {
-                tracing::warn!(
-                    target: "openpxe::wol",
-                    broadcast = %addr,
-                    "WoL send failed: {e}"
-                );
-            }
-        }
-    }
-    if sent == 0 {
-        return Err(Error::Invalid(
-            "Wake-on-LAN: no broadcast address accepted the packet".into(),
-        ));
-    }
-    Ok(sent)
-}
-
-/// Compute the IPv4 broadcast address for `ip`/`mask`, if both parse.
-/// Used so the caller can include the server's own subnet broadcast
-/// alongside the limited broadcast.
-#[must_use]
-pub fn subnet_broadcast(ip: Ipv4Addr, mask: Ipv4Addr) -> Ipv4Addr {
-    let ip = u32::from(ip);
-    let mask = u32::from(mask);
-    Ipv4Addr::from(ip | !mask)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn parse_mac_accepts_common_forms() {
-        let want = [0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff];
-        assert_eq!(parse_mac("aa:bb:cc:dd:ee:ff").unwrap(), want);
-        assert_eq!(parse_mac("AA-BB-CC-DD-EE-FF").unwrap(), want);
-        assert_eq!(parse_mac("aabb.ccdd.eeff").unwrap(), want);
-        assert_eq!(parse_mac("aabbccddeeff").unwrap(), want);
-    }
-
-    #[test]
-    fn parse_mac_rejects_bad_length() {
-        assert!(parse_mac("aa:bb:cc").is_err());
-        assert!(parse_mac("").is_err());
-        assert!(parse_mac("zz:bb:cc:dd:ee:ff").is_err()); // non-hex stripped → too short
-    }
-
-    #[test]
-    fn magic_packet_shape() {
-        let pkt = magic_packet([0x01, 0x02, 0x03, 0x04, 0x05, 0x06]);
-        assert_eq!(&pkt[..6], &[0xFF; 6]);
-        // First MAC repetition.
-        assert_eq!(&pkt[6..12], &[0x01, 0x02, 0x03, 0x04, 0x05, 0x06]);
-        // Last (16th) repetition ends the packet.
-        assert_eq!(&pkt[96..102], &[0x01, 0x02, 0x03, 0x04, 0x05, 0x06]);
-    }
-
-    #[test]
-    fn subnet_broadcast_computes() {
-        assert_eq!(
-            subnet_broadcast(
-                Ipv4Addr::new(192, 168, 1, 49),
-                Ipv4Addr::new(255, 255, 255, 0)
-            ),
-            Ipv4Addr::new(192, 168, 1, 255)
-        );
-        assert_eq!(
-            subnet_broadcast(
-                Ipv4Addr::new(10, 5, 3, 7),
-                Ipv4Addr::new(255, 255, 0, 0)
-            ),
-            Ipv4Addr::new(10, 5, 255, 255)
-        );
-    }
-
-    #[test]
-    fn send_magic_delivers_intact_packet_over_loopback() {
-        // Deterministic round-trip that doesn't depend on the sandbox
-        // permitting a real L2 broadcast: bind a receiver on loopback
-        // and confirm send_magic transmits the exact 102-byte packet.
-        let rx = UdpSocket::bind(SocketAddrV4::new(Ipv4Addr::LOCALHOST, 0)).unwrap();
-        let port = rx.local_addr().unwrap().port();
-        rx.set_read_timeout(Some(std::time::Duration::from_secs(2))).unwrap();
-
-        let packet = magic_packet([0x0a, 0x1b, 0x2c, 0x3d, 0x4e, 0x5f]);
-        let sent = send_magic(&packet, &[Ipv4Addr::LOCALHOST], port).unwrap();
-        assert_eq!(sent, 1);
-
-        let mut buf = [0u8; 128];
-        let n = rx.recv(&mut buf).unwrap();
-        assert_eq!(n, 102, "magic packet should be 102 bytes");
-        assert_eq!(&buf[..102], &packet[..]);
-    }
-}

crates/dhcp-proxy/src/reply.rs

@@ -56,17 +56,11 @@ pub fn decide(ctx: &ReplyContext<'_>) -> BootDirective {
             // it'll then do the same script-fetch the iPXE path does.
             let name = ctx.arch.ipxe_bootfile().unwrap_or("snponly.efi");
             BootDirective::HttpScript {
-                url: format!(
-                    "{}/ipxe/{}",
-                    ctx.public_base_url.trim_end_matches('/'),
-                    name
-                ),
+                url: format!("{}/ipxe/{}", ctx.public_base_url.trim_end_matches('/'), name),
             }
         }
         FirmwareClass::PxeClient => match ctx.arch.ipxe_bootfile() {
-            Some(name) => BootDirective::TftpIpxe {
-                filename: name.to_string(),
-            },
+            Some(name) => BootDirective::TftpIpxe { filename: name.to_string() },
             None => BootDirective::Ignore,
         },
         FirmwareClass::Other => BootDirective::Ignore,
@@ -113,16 +107,12 @@ pub fn build_reply(ctx: &ReplyContext<'_>, directive: &BootDirective) -> Option<
 
     match directive {
         BootDirective::TftpIpxe { filename } => {
-            opts.insert(DhcpOption::TFTPServerName(
-                ctx.our_ip.to_string().into_bytes(),
-            ));
+            opts.insert(DhcpOption::TFTPServerName(ctx.our_ip.to_string().into_bytes()));
             opts.insert(DhcpOption::BootfileName(filename.as_bytes().to_vec()));
         }
         BootDirective::HttpScript { url } => {
             opts.insert(DhcpOption::BootfileName(url.as_bytes().to_vec()));
-            opts.insert(DhcpOption::TFTPServerName(
-                ctx.our_ip.to_string().into_bytes(),
-            ));
+            opts.insert(DhcpOption::TFTPServerName(ctx.our_ip.to_string().into_bytes()));
         }
         BootDirective::Ignore => return None,
     }

crates/dhcp-proxy/src/server.rs

@@ -4,7 +4,9 @@
 use crate::reply::{build_reply, decide, BootDirective, ReplyContext};
 use dhcproto::v4::{DhcpOption, Message, OptionCode};
 use dhcproto::{Decodable, Decoder, Encodable, Encoder};
-use openpxe_core::{ClientArch, ClientEvent, ClientRegistry, FirmwareClass};
+use openpxe_core::{
+    ClientArch, ClientEvent, ClientRegistry, FirmwareClass,
+};
 use socket2::{Domain, Protocol, Socket, Type};
 use std::net::{IpAddr, Ipv4Addr, SocketAddr, SocketAddrV4};
 use std::sync::Arc;
@@ -84,22 +86,11 @@ impl DhcpProxyServer {
     ) -> anyhow::Result<()> {
         let request = Message::decode(&mut Decoder::new(data))?;
 
-        let vendor_class = request
-            .opts()
-            .get(OptionCode::ClassIdentifier)
-            .and_then(|o| {
-                if let DhcpOption::ClassIdentifier(v) = o {
-                    Some(v.as_slice())
-                } else {
-                    None
-                }
+        let vendor_class = request.opts().get(OptionCode::ClassIdentifier).and_then(|o| {
+            if let DhcpOption::ClassIdentifier(v) = o { Some(v.as_slice()) } else { None }
         });
         let user_class = request.opts().get(OptionCode::UserClass).and_then(|o| {
-            if let DhcpOption::UserClass(v) = o {
-                Some(v.as_slice())
-            } else {
-                None
-            }
+            if let DhcpOption::UserClass(v) = o { Some(v.as_slice()) } else { None }
         });
         let class = FirmwareClass::classify(vendor_class, user_class);
         if matches!(class, FirmwareClass::Other) {
@@ -144,9 +135,7 @@ impl DhcpProxyServer {
         }
         self.metrics.record_dhcp_reply(arch.as_str());
 
-        let Some(reply) = build_reply(&ctx, &directive) else {
-            return Ok(());
-        };
+        let Some(reply) = build_reply(&ctx, &directive) else { return Ok(()); };
         let mut out = Vec::with_capacity(512);
         reply.encode(&mut Encoder::new(&mut out))?;
 
@@ -214,10 +203,7 @@ fn bind_udp(bind: IpAddr, port: u16, broadcast: bool) -> anyhow::Result<UdpSocke
 
 fn format_mac(chaddr: &[u8]) -> String {
     let take = chaddr.iter().take(6).copied().collect::<Vec<_>>();
-    take.iter()
-        .map(|b| format!("{b:02x}"))
-        .collect::<Vec<_>>()
-        .join(":")
+    take.iter().map(|b| format!("{b:02x}")).collect::<Vec<_>>().join(":")
 }
 
 /// Walk raw DHCP options looking for option 93 (Client System Architecture)
@@ -231,17 +217,10 @@ fn extract_raw_arch(packet: &[u8]) -> Option<u16> {
     let mut i = 0;
     while i < opts.len() {
         let code = opts[i];
-        if code == 0xff {
-            return None;
-        } // END
-        if code == 0x00 {
+        if code == 0xff { return None; }     // END
+        if code == 0x00 { i += 1; continue; } // PAD
         i += 1;
-            continue;
-        } // PAD
-        i += 1;
-        if i >= opts.len() {
-            return None;
-        }
+        if i >= opts.len() { return None; }
         let len = opts[i] as usize;
         i += 1;
         if code == 93 && len >= 2 && i + 2 <= opts.len() {

crates/http-api/Cargo.toml

@@ -4,10 +4,6 @@ version.workspace = true
 edition.workspace = true
 license.workspace = true
 authors.workspace = true
-# v0.5.0: inherit the workspace repository so CARGO_PKG_REPOSITORY is
-# populated at build time — the About-tab update check derives the
-# Gitea releases API URL from it.
-repository.workspace = true
 description = "HTTP server: ISO uploads, iPXE script generation, ISO streaming"
 
 [lints]
@@ -35,17 +31,6 @@ bytes.workspace = true
 futures.workspace = true
 mime.workspace = true
 mime_guess.workspace = true
-uuid.workspace = true
-# v0.4.5 Forms auth: lock-free session store and cookie helpers.
-parking_lot.workspace = true
-# v0.5.0: outbound HTTP for chat webhooks (Slack/Teams/Discord) and the
-# About-tab "check for updates" call to the Gitea releases API; SMTP for
-# email notifications. Both use rustls so the static musl binary stays
-# OpenSSL-free.
-reqwest.workspace = true
-lettre.workspace = true
-# v0.5.1: decode the base64 SAMLResponse at the ACS endpoint.
-base64.workspace = true
 
 [dev-dependencies]
 tokio = { workspace = true, features = ["macros", "rt", "rt-multi-thread", "time"] }
@@ -53,11 +38,3 @@ tower = { workspace = true }
 tempfile = "3.12"
 serde_json = { workspace = true }
 time = { workspace = true }
-# v0.4.61: integration tests need to generate real PNG bytes for the
-# `/branding/pxe-logo` compositor; hand-rolled CRCs are too fragile.
-image = { version = "0.25", default-features = false, features = ["png"] }
-# v0.5.1: the SAML ACS integration tests mint a throwaway IdP keypair
-# (rcgen) and sign a SAMLResponse with bergshamra so the happy-path,
-# replay, and IdP-initiated-gating flows exercise real signatures.
-rcgen = "0.13"
-bergshamra = { workspace = true }

crates/http-api/src/auth.rs

@@ -1,516 +0,0 @@
-//! Forms auth layer — sessions, login, setup, middleware.
-//!
-//! Three states:
-//!
-//! * **Unconfigured** (`AdminStore::is_configured() == false`). The
-//!   middleware passes every request through — there's no one to gate
-//!   against. The UI's `/api/me` returns `setup_required: true` and the
-//!   front-end pushes the operator into the first-run flow.
-//! * **Logged in**. The session cookie maps to an in-memory session
-//!   record with an idle expiry; `/api/me` returns the username.
-//! * **Logged out**. The middleware bounces `/api/*` (with the PXE
-//!   allowlist below) to `401 Unauthorized`; the front-end intercepts
-//!   that and shows `/login`.
-//!
-//! Allowlist for unauthenticated access *after* the admin is set up:
-//!
-//! * everything outside `/api/*` (the WebUI bundle, asset chrome, PXE
-//!   script endpoints, the bundled iPXE/wimboot binaries, ISO bytes,
-//!   liveness/readiness probes, the Prometheus scrape) — these are
-//!   read-only or PXE-essential and breaking them locks out booting
-//!   machines that have no way to authenticate;
-//! * `/api/setup`, `/api/login`, `/api/me` (the auth surface itself);
-//! * `/api/queue/join`, `/api/queue/poll/:entry_id` (iPXE long-poll for
-//!   Queued Deployment — the iPXE client can't send a session cookie).
-//!
-//! Everything else inside `/api/*` requires a valid session.
-
-use crate::state::AppState;
-use axum::{
-    body::Body,
-    extract::{Request, State},
-    http::{header, HeaderValue, StatusCode},
-    middleware::Next,
-    response::{IntoResponse, Response},
-    Json,
-};
-use openpxe_core::AdminPublic;
-use parking_lot::RwLock;
-use serde::{Deserialize, Serialize};
-use serde_json::json;
-use std::collections::HashMap;
-use std::sync::Arc;
-use std::time::{Duration, Instant};
-use uuid::Uuid;
-
-/// Idle session lifetime. Sliding — every authenticated request resets
-/// the expiry. 24h is the Sonarr default and matches what most operators
-/// expect for an on-prem admin console.
-const SESSION_TTL: Duration = Duration::from_hours(24);
-
-/// Name of the cookie we set/read. Distinct from a generic `session=`
-/// to avoid collisions with anything else sharing the host.
-pub const SESSION_COOKIE: &str = "openpxe_session";
-
-#[derive(Debug, Clone)]
-struct Session {
-    username: String,
-    expires_at: Instant,
-}
-
-/// In-memory session table. Cheap to clone (Arc-shared) and contention
-/// is rare — operators sign in once per browser session.
-#[derive(Debug, Clone, Default)]
-pub struct SessionStore {
-    inner: Arc<RwLock<HashMap<String, Session>>>,
-}
-
-impl SessionStore {
-    /// Mint a fresh session for `username` and return the opaque cookie
-    /// value. UUID v4 gives us 122 random bits — comfortably more than
-    /// the 64-128 bits typical for session IDs.
-    #[must_use]
-    pub fn create(&self, username: &str) -> String {
-        let id = Uuid::new_v4().simple().to_string();
-        let session = Session {
-            username: username.to_string(),
-            expires_at: Instant::now() + SESSION_TTL,
-        };
-        self.inner.write().insert(id.clone(), session);
-        id
-    }
-
-    /// Resolve a cookie value to the owning username, refreshing the
-    /// idle timer. Returns `None` for missing / expired sessions and
-    /// proactively evicts the expired entry so the map doesn't grow
-    /// unbounded across long-lived deployments.
-    pub fn touch(&self, id: &str) -> Option<String> {
-        let mut g = self.inner.write();
-        let s = g.get_mut(id)?;
-        if s.expires_at <= Instant::now() {
-            g.remove(id);
-            return None;
-        }
-        s.expires_at = Instant::now() + SESSION_TTL;
-        Some(s.username.clone())
-    }
-
-    /// Invalidate one session (the user's `/api/logout`).
-    pub fn revoke(&self, id: &str) {
-        self.inner.write().remove(id);
-    }
-
-    /// Invalidate every session — used after a credentials rotation so
-    /// stale cookies for the old password can't keep operating.
-    pub fn revoke_all(&self) {
-        self.inner.write().clear();
-    }
-
-    /// Periodic / opportunistic GC. Not currently scheduled (we evict
-    /// on touch), but exposed for a future janitor task.
-    pub fn gc(&self) {
-        let now = Instant::now();
-        self.inner.write().retain(|_, s| s.expires_at > now);
-    }
-
-    #[must_use]
-    pub fn len(&self) -> usize {
-        self.inner.read().len()
-    }
-
-    #[must_use]
-    pub fn is_empty(&self) -> bool {
-        self.len() == 0
-    }
-}
-
-// ── Cookie helpers ────────────────────────────────────────────────────────
-
-fn cookie_attrs(value: &str, max_age: Option<i64>) -> String {
-    // Same flags FleetDM and Sonarr ship by default:
-    //   - HttpOnly: blocks JS access (XSS containment)
-    //   - SameSite=Lax: allows top-level GET navigations from the IdP
-    //     to land authenticated when SSO arrives, but blocks
-    //     cross-site POST CSRF;
-    //   - Path=/: the cookie applies to the whole app;
-    //   - no Secure flag yet — many operators host on plain http://
-    //     LAN IPs (Unraid templates default to that); we'll add Secure
-    //     opportunistically when we add a TLS terminator option.
-    // SESSION_TTL fits in 32 bits comfortably (24h ≈ 86400 seconds); we
-    // never overflow i64, but clippy's `cast_possible_wrap` lint wants
-    // us to be explicit. `cast_signed` is the documented form.
-    let lifetime = max_age.unwrap_or_else(|| SESSION_TTL.as_secs().cast_signed());
-    format!("{SESSION_COOKIE}={value}; Path=/; HttpOnly; SameSite=Lax; Max-Age={lifetime}")
-}
-
-/// Build the `Set-Cookie` header value that establishes a fresh operator
-/// session with the default 24h TTL. Exposed so the SAML ACS handler can
-/// attach an operator session to its post-login redirect, exactly as the
-/// Forms-login path does via [`login_response`].
-#[must_use]
-pub fn session_cookie(session: &str) -> String {
-    cookie_attrs(session, None)
-}
-
-fn parse_cookie(headers: &axum::http::HeaderMap) -> Option<String> {
-    // `Cookie: a=b; c=d` parsing — small enough not to drag in a crate.
-    let raw = headers.get(header::COOKIE)?.to_str().ok()?;
-    for part in raw.split(';') {
-        let part = part.trim();
-        if let Some(v) = part.strip_prefix(&format!("{SESSION_COOKIE}=")) {
-            return Some(v.to_string());
-        }
-    }
-    None
-}
-
-// ── Middleware ────────────────────────────────────────────────────────────
-
-/// Return `true` if `path` is on the allowlist and should bypass the
-/// session check. The middleware applies this rule only when the admin
-/// account is configured; before then everything is open.
-fn is_public_path(path: &str) -> bool {
-    // Non-API paths: WebUI bundle, PXE chain, ISO bytes, health probes,
-    // metrics. All read-only / PXE-essential.
-    if !path.starts_with("/api/") {
-        return true;
-    }
-    // Auth surface and iPXE long-poll endpoints (no cookie available).
-    // The SAML SP endpoints are pre-auth by nature — the operator hasn't a
-    // session yet when they start (or arrive from) the IdP. `/api/sso`
-    // (the config GET/PUT, no trailing slash) stays gated.
-    matches!(
-        path,
-        "/api/setup"
-            | "/api/login"
-            | "/api/logout"
-            | "/api/me"
-            | "/api/sso/login"
-            | "/api/sso/acs"
-            | "/api/sso/metadata"
-    ) || path.starts_with("/api/queue/join")
-        || path.starts_with("/api/queue/poll/")
-}
-
-/// Axum middleware: gate `/api/*` behind a valid session, with the
-/// allowlist above. `State<AppState>` reaches in for the admin store +
-/// session store.
-pub async fn require_auth(
-    State(state): State<AppState>,
-    req: Request<Body>,
-    next: Next,
-) -> Response {
-    // Bypass entirely while unconfigured. The /api/setup endpoint is
-    // the only one that can flip this back to "configured", and it
-    // refuses to run a second time. Tests + fresh installs ride this
-    // path.
-    if !state.admin.is_configured() {
-        return next.run(req).await;
-    }
-    let path = req.uri().path();
-    if is_public_path(path) {
-        return next.run(req).await;
-    }
-    // Authenticated path. The cookie must be present, map to a live
-    // session, and the TTL refresh happens as a side-effect.
-    let token = parse_cookie(req.headers());
-    if let Some(t) = token {
-        if state.sessions.touch(&t).is_some() {
-            return next.run(req).await;
-        }
-    }
-    (
-        StatusCode::UNAUTHORIZED,
-        Json(json!({ "error": "authentication required" })),
-    )
-        .into_response()
-}
-
-// ── Handlers ──────────────────────────────────────────────────────────────
-
-#[derive(Debug, Deserialize)]
-pub struct SetupBody {
-    pub username: String,
-    pub password: String,
-}
-
-/// First-run setup. Refuses to run once an admin already exists — that
-/// guards against a leaked WebUI being re-bootstrapped by an attacker
-/// who's seen the deployment URL. After bootstrap, the new session
-/// cookie is set so the operator goes straight to the dashboard.
-pub async fn api_setup(State(state): State<AppState>, Json(body): Json<SetupBody>) -> Response {
-    if state.admin.is_configured() {
-        return (
-            StatusCode::CONFLICT,
-            Json(json!({ "error": "admin account already configured" })),
-        )
-            .into_response();
-    }
-    match state.admin.bootstrap(&body.username, &body.password) {
-        Ok(pub_) => {
-            let session = state.sessions.create(&pub_.username);
-            login_response(StatusCode::CREATED, &pub_, &session)
-        }
-        Err(openpxe_core::Error::Invalid(msg)) => {
-            (StatusCode::BAD_REQUEST, Json(json!({ "error": msg }))).into_response()
-        }
-        Err(e) => (
-            StatusCode::INTERNAL_SERVER_ERROR,
-            Json(json!({ "error": format!("{e}") })),
-        )
-            .into_response(),
-    }
-}
-
-#[derive(Debug, Deserialize)]
-pub struct LoginBody {
-    pub username: String,
-    pub password: String,
-}
-
-pub async fn api_login(State(state): State<AppState>, Json(body): Json<LoginBody>) -> Response {
-    // Brief, deliberately vague — "invalid credentials" rather than
-    // "no such user" / "wrong password". Same anti-enumeration posture
-    // as Sonarr/Radarr.
-    let pub_ = match state.admin.verify(&body.username, &body.password) {
-        Ok(Some(u)) => u,
-        Ok(None) => {
-            return (
-                StatusCode::UNAUTHORIZED,
-                Json(json!({ "error": "invalid username or password" })),
-            )
-                .into_response();
-        }
-        Err(e) => {
-            return (
-                StatusCode::INTERNAL_SERVER_ERROR,
-                Json(json!({ "error": format!("{e}") })),
-            )
-                .into_response();
-        }
-    };
-    let session = state.sessions.create(&pub_.username);
-    login_response(StatusCode::OK, &pub_, &session)
-}
-
-pub async fn api_logout(State(state): State<AppState>, headers: axum::http::HeaderMap) -> Response {
-    if let Some(t) = parse_cookie(&headers) {
-        state.sessions.revoke(&t);
-    }
-    // Stomp the cookie unconditionally — even if the request didn't
-    // carry one, the browser shouldn't keep a stale value.
-    let mut resp = StatusCode::NO_CONTENT.into_response();
-    resp.headers_mut().insert(
-        header::SET_COOKIE,
-        HeaderValue::from_str(&cookie_attrs("", Some(0))).unwrap(),
-    );
-    resp
-}
-
-/// Status surface for the front-end shell. Returns four cases:
-///
-/// * `setup_required: true` — no admin yet; show first-run page.
-/// * `authenticated: false` — admin exists, no session; show login.
-/// * `authenticated: true` + `user` — let the dashboard load.
-pub async fn api_me(State(state): State<AppState>, headers: axum::http::HeaderMap) -> Response {
-    // v0.5.0: include branding bootstrap so the pre-auth login/setup
-    // screens can render the FleetDM-style full-width custom logo (and
-    // cache-bust it) without an extra round trip. `/api/me` is public,
-    // and the logo asset is public, so this leaks nothing sensitive.
-    let has_custom_logo = state.branding.has_logo();
-    let logo_rev = state.branding.logo_rev();
-    if !state.admin.is_configured() {
-        return (
-            StatusCode::OK,
-            Json(json!({
-                "setup_required": true,
-                "authenticated": false,
-                "has_custom_logo": has_custom_logo,
-                "logo_rev": logo_rev,
-            })),
-        )
-            .into_response();
-    }
-    let token = parse_cookie(&headers);
-    let username = token.as_deref().and_then(|t| state.sessions.touch(t));
-    match username {
-        Some(u) => (
-            StatusCode::OK,
-            Json(json!({
-                "setup_required": false,
-                "authenticated": true,
-                "user": state.admin.snapshot(),
-                "session_user": u,
-                "has_custom_logo": has_custom_logo,
-                "logo_rev": logo_rev,
-            })),
-        )
-            .into_response(),
-        None => (
-            StatusCode::OK,
-            Json(json!({
-                "setup_required": false,
-                "authenticated": false,
-                "has_custom_logo": has_custom_logo,
-                "logo_rev": logo_rev,
-            })),
-        )
-            .into_response(),
-    }
-}
-
-#[derive(Debug, Deserialize)]
-pub struct UpdateCredentialsBody {
-    pub current_password: String,
-    #[serde(default)]
-    pub new_username: Option<String>,
-    #[serde(default)]
-    pub new_password: Option<String>,
-}
-
-/// Rotate the admin's username and/or password. Auth middleware has
-/// already proved the caller owns a session; we additionally require
-/// the *current* password to prove "person at the keyboard right now".
-/// On success we issue a fresh session cookie keyed to the (possibly
-/// new) username and revoke every prior session so a stolen cookie
-/// from before the rotation stops working.
-pub async fn api_update_credentials(
-    State(state): State<AppState>,
-    Json(body): Json<UpdateCredentialsBody>,
-) -> Response {
-    if !state.admin.is_configured() {
-        return (
-            StatusCode::CONFLICT,
-            Json(json!({ "error": "no admin configured" })),
-        )
-            .into_response();
-    }
-    let result = state.admin.update_credentials(
-        &body.current_password,
-        body.new_username.as_deref(),
-        body.new_password.as_deref(),
-    );
-    match result {
-        Ok(pub_) => {
-            state.sessions.revoke_all();
-            let session = state.sessions.create(&pub_.username);
-            login_response(StatusCode::OK, &pub_, &session)
-        }
-        Err(openpxe_core::Error::Invalid(msg)) => {
-            (StatusCode::BAD_REQUEST, Json(json!({ "error": msg }))).into_response()
-        }
-        Err(e) => (
-            StatusCode::INTERNAL_SERVER_ERROR,
-            Json(json!({ "error": format!("{e}") })),
-        )
-            .into_response(),
-    }
-}
-
-#[derive(Debug, Serialize)]
-struct LoginPayload<'a> {
-    user: &'a AdminPublic,
-    authenticated: bool,
-}
-
-fn login_response(status: StatusCode, user: &AdminPublic, session: &str) -> Response {
-    let body = Json(LoginPayload {
-        user,
-        authenticated: true,
-    });
-    let mut resp = (status, body).into_response();
-    resp.headers_mut().insert(
-        header::SET_COOKIE,
-        HeaderValue::from_str(&cookie_attrs(session, None)).unwrap(),
-    );
-    resp
-}
-
-// ── Tests ─────────────────────────────────────────────────────────────────
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn session_create_touch_revoke() {
-        let s = SessionStore::default();
-        assert!(s.is_empty());
-        let t = s.create("admin");
-        assert_eq!(s.len(), 1);
-        assert_eq!(s.touch(&t).as_deref(), Some("admin"));
-        s.revoke(&t);
-        assert!(s.is_empty());
-        // Stale token doesn't error, just returns None.
-        assert!(s.touch(&t).is_none());
-    }
-
-    #[test]
-    fn session_revoke_all_clears() {
-        let s = SessionStore::default();
-        let _ = s.create("a");
-        let _ = s.create("b");
-        assert_eq!(s.len(), 2);
-        s.revoke_all();
-        assert!(s.is_empty());
-    }
-
-    #[test]
-    fn public_path_allowlist() {
-        // PXE + chrome paths bypass auth.
-        for p in [
-            "/",
-            "/assets/app.js",
-            "/boot.ipxe",
-            "/boot/fake.ipxe",
-            "/iso/fake.iso",
-            "/ipxe/snponly.efi",
-            "/healthz",
-            "/readyz",
-            "/metrics",
-            // v0.4.6: iPXE fetches this for `console --picture` before
-            // it can possibly have a session cookie.
-            "/branding/pxe-logo",
-        ] {
-            assert!(is_public_path(p), "expected {p} to be public");
-        }
-        // Auth surface itself is public.
-        for p in ["/api/setup", "/api/login", "/api/logout", "/api/me"] {
-            assert!(is_public_path(p), "expected {p} to be public");
-        }
-        // v0.5.1: SAML SP endpoints are pre-auth (no session yet).
-        for p in ["/api/sso/login", "/api/sso/acs", "/api/sso/metadata"] {
-            assert!(is_public_path(p), "expected {p} to be public");
-        }
-        // iPXE long-poll endpoints are public (no cookie available).
-        assert!(is_public_path("/api/queue/join"));
-        assert!(is_public_path("/api/queue/poll/abc"));
-        // Everything else under /api/* must auth.
-        for p in [
-            "/api/isos",
-            "/api/isos/x/category",
-            "/api/storage/disk",
-            "/api/branding/logo",
-            "/api/sso",
-            "/api/hosts",
-        ] {
-            assert!(!is_public_path(p), "expected {p} to require auth");
-        }
-    }
-
-    #[test]
-    fn cookie_parse_picks_session_value() {
-        let mut h = axum::http::HeaderMap::new();
-        h.insert(
-            header::COOKIE,
-            HeaderValue::from_str(&format!("foo=bar; {SESSION_COOKIE}=abc123; baz=qux")).unwrap(),
-        );
-        assert_eq!(parse_cookie(&h).as_deref(), Some("abc123"));
-        // Different name → None.
-        let mut h2 = axum::http::HeaderMap::new();
-        h2.insert(header::COOKIE, HeaderValue::from_str("foo=bar").unwrap());
-        assert!(parse_cookie(&h2).is_none());
-        // No cookie header at all → None.
-        assert!(parse_cookie(&axum::http::HeaderMap::new()).is_none());
-    }
-}

crates/http-api/src/ipxe_script.rs

@@ -23,22 +23,12 @@
 //! There is intentionally no UI path to upload a custom `.ipxe` script.
 
 use openpxe_core::{Settings, TimeoutAction};
-use openpxe_iso_store::introspect::DistroFamily;
 use openpxe_iso_store::{BootEntry, BootKind, IsoMeta};
+use openpxe_iso_store::introspect::DistroFamily;
 use std::fmt::Write as _;
 
 /// Top-level OpenPXE boot menu. Serialized identically for BIOS and UEFI
 /// clients because iPXE normalises the menu primitives across firmwares.
-///
-/// v0.4.69: rendered with an iVentoy-style graphical frame — a
-/// `console --picture` directive paints a full-screen PNG background
-/// (the operator's uploaded logo on a dark field, or the default
-/// OpenPXE mark) with the menu text overlaid below a reserved top
-/// margin, plus a footer carrying version + arch + firmware kind. On
-/// iPXE binaries built with `IMAGE_PNG` + `CONSOLE_FRAMEBUFFER` (our
-/// x86_64 UEFI binaries, compiled from source) the background paints;
-/// on binaries without PNG support the `|| console` fallback yields a
-/// clean text menu. The old ASCII wordmark has been removed.
 #[must_use]
 pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> String {
     let mut s = String::new();
@@ -57,45 +47,11 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
     let _ = writeln!(s, "set base-url {base}");
     let _ = writeln!(s, "set esc:hex 1b");
     let _ = writeln!(s, "set cls ${{esc:string}}[2J");
-    // v0.4.69: graphical background. `/branding/pxe-logo` always
-    // returns a full-screen 1024×768 PNG now — the operator's logo on a
-    // dark field, or a default OpenPXE mark when none is uploaded. The
-    // `--top 290` reserves the top band (where the logo paints) so the
-    // menu text lands below it. On an iPXE build *with* `IMAGE_PNG` +
-    // `CONSOLE_FRAMEBUFFER` (our x86_64 UEFI binaries, built from source
-    // — see deploy/docker/Dockerfile) this paints the background and
-    // overlays the menu. On a build *without* PNG support (the fetched
-    // BIOS/i386/arm64 binaries) the whole `console --picture …` command
-    // fails and the `|| console` resets to a clean full-screen text
-    // menu. Either way there's no ASCII placeholder anymore.
-    let _ = writeln!(
-        s,
-        "console --picture {base}/branding/pxe-logo --top 290 || console"
-    );
-    // Map iPXE's ${{buildarch}} + ${{platform}} into the human form the
-    // user asked for (e.g. "x86 BIOS", "x86_64 UEFI", "arm64 UEFI").
-    // iPXE evaluates `iseq` lazily, so we only set whichever line
-    // matches. Anything not on the allowlist falls through to a generic
-    // `<buildarch> <platform>` display.
-    let _ = writeln!(s, "set arch-label ${{buildarch}} ${{platform}}");
-    let _ = writeln!(
-        s,
-        "iseq ${{buildarch}} i386   && iseq ${{platform}} pcbios && set arch-label x86 BIOS         || iseq ${{buildarch}} x86_64 && iseq ${{platform}} efi    && set arch-label x86_64 UEFI      || iseq ${{buildarch}} arm64  && iseq ${{platform}} efi    && set arch-label arm64 UEFI       || true"
-    );
     let _ = writeln!(s, ":menu");
     let _ = writeln!(s, "menu OpenPXE - network boot menu");
-    // v0.4.69: the ASCII wordmark is gone — the graphical background
-    // (set via `console --picture` above) carries the branding now.
-    let _ = writeln!(s, "item --gap");
-    let _ = writeln!(
-        s,
-        "item --gap -- ------------------------- Default -------------------------"
-    );
+    let _ = writeln!(s, "item --gap -- ------------------------- Default -------------------------");
     let _ = writeln!(s, "item local            Boot from Local HDD");
-    let _ = writeln!(
-        s,
-        "item --gap -- ----------------------- Installers -----------------------"
-    );
+    let _ = writeln!(s, "item --gap -- ----------------------- Installers -----------------------");
     if has_family(isos, is_linux_family) {
         let _ = writeln!(s, "item linux            Linux Installers  >");
     } else {
@@ -108,67 +64,28 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
     } else {
         let _ = writeln!(s, "item --gap -- (Windows support disabled in Settings)");
     }
-    let _ = writeln!(
-        s,
-        "item --gap -- -------------------------- Tools --------------------------"
-    );
+    let _ = writeln!(s, "item --gap -- -------------------------- Tools --------------------------");
     let _ = writeln!(s, "item tools            Tools  >");
-    let _ = writeln!(
-        s,
-        "item --gap -- ---------------------- Queued Deployment ---------------------"
-    );
+    let _ = writeln!(s, "item --gap -- ---------------------- Queued Deployment ---------------------");
     let _ = writeln!(s, "item queue            Queued Deployment  (join queue)");
     let _ = writeln!(s, "item --gap");
     let _ = writeln!(s, "item --key x exit     Exit iPXE");
-    // v0.4.6 footer line. Sits just above the `choose` line so it's
-    // always visible regardless of how the menu paginates. iPXE
-    // interpolates `${arch-label}` (set near the top of this script)
-    // and `${version}` is the binary-baked iPXE version — *not* the
-    // OpenPXE version — so we hard-code the OpenPXE version string
-    // here.
-    let openpxe_version = env!("CARGO_PKG_VERSION");
-    let _ = writeln!(s, "item --gap");
-    let _ = writeln!(
-        s,
-        "item --gap --                 OpenPXE v{openpxe_version}  -  ${{arch-label}}"
-    );
 
     if matches!(settings.timeout_action, TimeoutAction::Stay) {
         let _ = writeln!(s, "choose --default {default_item} target || goto menu");
     } else {
-        let _ = writeln!(
-            s,
-            "choose --default {default_item} --timeout {timeout_ms} target || goto menu"
-        );
+        let _ = writeln!(s, "choose --default {default_item} --timeout {timeout_ms} target || goto menu");
     }
 
     // iPXE's `||` is strict about what follows. Each test uses `goto menu`
     // as the fallthrough target so the parser never sees a bare `||` with
     // trailing whitespace — some iPXE builds reject that.
-    let _ = writeln!(
-        s,
-        "iseq ${{target}} local   && chain {base}/boot/_local.ipxe        || goto menu"
-    );
-    let _ = writeln!(
-        s,
-        "iseq ${{target}} linux   && chain {base}/boot/_linux_menu.ipxe   || goto menu"
-    );
-    let _ = writeln!(
-        s,
-        "iseq ${{target}} windows && chain {base}/boot/_windows_menu.ipxe || goto menu"
-    );
-    let _ = writeln!(
-        s,
-        "iseq ${{target}} tools   && chain {base}/boot/_tools_menu.ipxe   || goto menu"
-    );
-    let _ = writeln!(
-        s,
-        "iseq ${{target}} queue   && chain {base}/boot/_queue.ipxe         || goto menu"
-    );
-    let _ = writeln!(
-        s,
-        "iseq ${{target}} exit    && exit                                 || goto menu"
-    );
+    let _ = writeln!(s, "iseq ${{target}} local   && chain {base}/boot/_local.ipxe        || goto menu");
+    let _ = writeln!(s, "iseq ${{target}} linux   && chain {base}/boot/_linux_menu.ipxe   || goto menu");
+    let _ = writeln!(s, "iseq ${{target}} windows && chain {base}/boot/_windows_menu.ipxe || goto menu");
+    let _ = writeln!(s, "iseq ${{target}} tools   && chain {base}/boot/_tools_menu.ipxe   || goto menu");
+    let _ = writeln!(s, "iseq ${{target}} queue   && chain {base}/boot/_queue.ipxe         || goto menu");
+    let _ = writeln!(s, "iseq ${{target}} exit    && exit                                 || goto menu");
     let _ = writeln!(s, "goto menu");
     s
 }
@@ -178,51 +95,25 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
 #[must_use]
 pub fn render_family_menu(isos: &[IsoMeta], base_url: &str, is_windows: bool) -> String {
     let base = base_url.trim_end_matches('/');
-    let title = if is_windows {
-        "Windows Installers"
-    } else {
-        "Linux Installers"
-    };
+    let title = if is_windows { "Windows Installers" } else { "Linux Installers" };
     let label = if is_windows { "windows" } else { "linux" };
     let mut s = String::new();
     let _ = writeln!(s, "#!ipxe");
     let _ = writeln!(s, "set base-url {base}");
     let _ = writeln!(s, ":menu");
     let _ = writeln!(s, "menu OpenPXE - {title}");
-    let filter: fn(DistroFamily) -> bool = if is_windows {
-        is_windows_family
-    } else {
-        is_linux_family
-    };
+    let filter: fn(DistroFamily) -> bool =
+        if is_windows { is_windows_family } else { is_linux_family };
     let mut count = 0;
     for iso in isos {
-        if !filter(iso.introspection.family) {
-            continue;
-        }
-        // v0.4.4: ISOs the operator flipped to the Tools category move
-        // out of the OS installer submenus entirely — they only appear
-        // under Tools. Without this filter the operator would see the
-        // same ISO in both menus.
-        if matches!(iso.category, openpxe_iso_store::IsoCategory::Tools) {
-            continue;
-        }
+        if !filter(iso.introspection.family) { continue; }
         for entry in &iso.boot_entries {
             let size_label = fmt_size_mib(iso.size_bytes);
             let key = hotkey_for_index(count);
-            // Visual hint: a leading `*` marks password-protected entries.
-            // ASCII only — iPXE's menu console mangles non-ASCII on some
-            // firmwares.
-            let lock = if iso.is_password_protected() {
-                "*"
-            } else {
-                " "
-            };
             let _ = writeln!(
-                s,
-                "item {}{} {}[{:>6}] {}",
+                s, "item {}{} [{:>6}] {}",
                 key,
                 entry.id,
-                lock,
                 size_label,
                 escape_label(&entry.title),
             );
@@ -235,18 +126,8 @@ pub fn render_family_menu(isos: &[IsoMeta], base_url: &str, is_windows: bool) ->
     let _ = writeln!(s, "item --gap");
     let _ = writeln!(s, "item --key b back   < Back to main menu");
     let _ = writeln!(s, "choose target || goto menu");
-    let _ = writeln!(
-        s,
-        "iseq ${{target}} back && chain {base}/boot.ipxe || goto menu"
-    );
-    // Pass `?mac=${mac}` so the per-entry handler can record the booting
-    // client into the Host log. iPXE substitutes `${mac}` before
-    // the HTTP fetch; if the firmware can't resolve it the literal
-    // `${mac}` is sent and the server treats it as "unknown".
-    let _ = writeln!(
-        s,
-        "chain {base}/boot/${{target}}.ipxe?mac=${{mac}} || goto menu"
-    );
+    let _ = writeln!(s, "iseq ${{target}} back && chain {base}/boot.ipxe || goto menu");
+    let _ = writeln!(s, "chain {base}/boot/${{target}}.ipxe || goto menu");
     s
 }
 
@@ -267,52 +148,15 @@ fn hotkey_for_index(i: usize) -> String {
     }
 }
 
-/// Tools submenu — Utilities, Shell, NIC Info, Reboot, Exit to firmware,
-/// plus any ISOs the operator flipped to [`IsoCategory::Tools`] in the
-/// Storage tab. The category-Tools ISOs render first so frequently used
-/// recovery / hardware tools are reachable with a single number key
-/// before the built-in shortcuts.
+/// Tools submenu — Utilities, Shell, NIC Info, Reboot, Exit to firmware.
 #[must_use]
-pub fn render_tools_menu(isos: &[IsoMeta], base_url: &str) -> String {
+pub fn render_tools_menu(base_url: &str) -> String {
     let base = base_url.trim_end_matches('/');
     let mut s = String::new();
     let _ = writeln!(s, "#!ipxe");
     let _ = writeln!(s, "set base-url {base}");
     let _ = writeln!(s, ":menu");
     let _ = writeln!(s, "menu OpenPXE - Tools");
-
-    // Operator-categorized tool ISOs (hotkeys 1..9), each chained the
-    // same way as a per-family menu pick — through the boot-entry id
-    // route, carrying `?mac=${mac}` for Host log attribution.
-    let mut count = 0;
-    for iso in isos {
-        if !matches!(iso.category, openpxe_iso_store::IsoCategory::Tools) {
-            continue;
-        }
-        for entry in &iso.boot_entries {
-            let size_label = fmt_size_mib(iso.size_bytes);
-            let key = hotkey_for_index(count);
-            let lock = if iso.is_password_protected() {
-                "*"
-            } else {
-                " "
-            };
-            let _ = writeln!(
-                s,
-                "item {}{} {}[{:>6}] {}",
-                key,
-                entry.id,
-                lock,
-                size_label,
-                escape_label(&entry.title),
-            );
-            count += 1;
-        }
-    }
-    if count > 0 {
-        let _ = writeln!(s, "item --gap");
-    }
-
     let _ = writeln!(s, "item --key u util     Utilities  (memtest, ...)");
     let _ = writeln!(s, "item --key s shell    OpenPXE Shell");
     let _ = writeln!(s, "item --key n nic      Network Card Info");
@@ -322,36 +166,13 @@ pub fn render_tools_menu(isos: &[IsoMeta], base_url: &str) -> String {
     let _ = writeln!(s, "item --gap");
     let _ = writeln!(s, "item --key b back     < Back to main menu");
     let _ = writeln!(s, "choose target || goto menu");
-    let _ = writeln!(
-        s,
-        "iseq ${{target}} util     && chain {base}/boot/_util.ipxe  || goto menu"
-    );
-    let _ = writeln!(
-        s,
-        "iseq ${{target}} shell    && chain {base}/boot/_shell.ipxe || goto menu"
-    );
-    let _ = writeln!(
-        s,
-        "iseq ${{target}} nic      && chain {base}/boot/_nic.ipxe   || goto menu"
-    );
-    let _ = writeln!(
-        s,
-        "iseq ${{target}} reboot   && reboot                        || goto menu"
-    );
-    let _ = writeln!(
-        s,
-        "iseq ${{target}} firmware && exit 0                        || goto menu"
-    );
-    let _ = writeln!(
-        s,
-        "iseq ${{target}} back     && chain {base}/boot.ipxe        || goto menu"
-    );
-    // Fall-through for category-Tools ISO ids — same as the family
-    // submenu, carrying `?mac=${mac}` for the boot log.
-    let _ = writeln!(
-        s,
-        "chain {base}/boot/${{target}}.ipxe?mac=${{mac}} || goto menu"
-    );
+    let _ = writeln!(s, "iseq ${{target}} util     && chain {base}/boot/_util.ipxe  || goto menu");
+    let _ = writeln!(s, "iseq ${{target}} shell    && chain {base}/boot/_shell.ipxe || goto menu");
+    let _ = writeln!(s, "iseq ${{target}} nic      && chain {base}/boot/_nic.ipxe   || goto menu");
+    let _ = writeln!(s, "iseq ${{target}} reboot   && reboot                        || goto menu");
+    let _ = writeln!(s, "iseq ${{target}} firmware && exit 0                        || goto menu");
+    let _ = writeln!(s, "iseq ${{target}} back     && chain {base}/boot.ipxe        || goto menu");
+    let _ = writeln!(s, "goto menu");
     s
 }
 
@@ -364,15 +185,8 @@ pub fn render_local_hdd(base_url: &str) -> String {
     let mut s = String::new();
     let _ = writeln!(s, "#!ipxe");
     let _ = writeln!(s, "# Boot from Local HDD - platform-sensitive");
-    let _ = writeln!(
-        s,
-        "iseq ${{platform}} pcbios && sanboot --no-describe --drive 0x80 || goto uefi"
-    );
-    let _ = writeln!(s, ":uefi");
-    let _ = writeln!(
-        s,
-        "# UEFI path: fall through to the firmware's next boot entry"
-    );
+    let _ = writeln!(s, "iseq ${{platform}} pcbios && sanboot --no-describe --drive 0x80 || ");
+    let _ = writeln!(s, "# UEFI path: fall through to the firmware's next boot entry");
     let _ = writeln!(s, "exit 0");
     let _ = writeln!(s, "# If the above exit returns, loop back to the main menu");
     let _ = writeln!(s, "chain {base}/boot.ipxe");
@@ -393,14 +207,8 @@ pub fn render_util(base_url: &str) -> String {
     let _ = writeln!(s, "item --gap");
     let _ = writeln!(s, "item back         < Back");
     let _ = writeln!(s, "choose target || goto menu");
-    let _ = writeln!(
-        s,
-        "iseq ${{target}} memtest && chain {base}/ipxe/memtest.bin || goto menu"
-    );
-    let _ = writeln!(
-        s,
-        "iseq ${{target}} back && chain {base}/boot/_tools_menu.ipxe || goto menu"
-    );
+    let _ = writeln!(s, "iseq ${{target}} memtest && chain {base}/ipxe/memtest.bin || ");
+    let _ = writeln!(s, "iseq ${{target}} back && chain {base}/boot/_tools_menu.ipxe || ");
     let _ = writeln!(s, "goto menu");
     s
 }
@@ -447,10 +255,7 @@ pub fn render_queue_entry(base_url: &str) -> String {
     let base = base_url.trim_end_matches('/');
     let mut s = String::new();
     let _ = writeln!(s, "#!ipxe");
-    let _ = writeln!(
-        s,
-        "# Queued Deployment - join the queue and wait for operator"
-    );
+    let _ = writeln!(s, "# Queued Deployment - join the queue and wait for operator");
     let _ = writeln!(s, "echo Joining deployment queue...");
     // imgfetch writes the body to a file in iPXE's transient FS; we read
     // the queue entry id out of the Location-style header by asking the server
@@ -467,11 +272,7 @@ pub fn render_entry(entry: &BootEntry, settings: &Settings, base_url: &str) -> S
     let _ = writeln!(s, "#!ipxe");
     let _ = writeln!(s, "set base-url {base}");
     match &entry.kind {
-        BootKind::LinuxKernel {
-            kernel_url,
-            initrd_urls,
-            args,
-        } => {
+        BootKind::LinuxKernel { kernel_url, initrd_urls, args } => {
             let mut cmdline = args.cmdline.replace("${base-url}", base);
             if !settings.extra_kernel_args.trim().is_empty() {
                 cmdline.push(' ');
@@ -522,178 +323,5 @@ fn has_family(isos: &[IsoMeta], pred: fn(DistroFamily) -> bool) -> bool {
 }
 
 fn escape_label(s: &str) -> String {
-    s.chars()
-        .map(|c| match c {
-            '\n' | '\r' => ' ',
-            c => c,
-        })
-        .collect()
-}
-
-/// Render the password-prompt script for a protected boot entry.
-///
-/// Flow on the client:
-///   1. iPXE clears any leftover ${password}, prints a banner naming the
-///      ISO so the operator knows what they're being asked for.
-///   2. `read --secret password` accepts input without echoing it to
-///      the screen.
-///   3. An empty input bails back to the main menu (lets the operator
-///      back out of a misclick).
-///   4. Otherwise the script chains the same /boot/<id>.ipxe URL but
-///      with `?token=${password:uristring}`. iPXE's `:uristring`
-///      modifier URL-encodes the value so `&`, `?`, `=`, spaces, etc.
-///      survive transport.
-///   5. The server replies with either the boot script (correct
-///      password) or [`render_password_failed`] (wrong password). On
-///      transport failure we fall back to the main menu.
-#[must_use]
-pub fn render_password_prompt(entry_id: &str, iso_filename: &str, base_url: &str) -> String {
-    let base = base_url.trim_end_matches('/');
-    let label = escape_label(iso_filename);
-    let mut s = String::new();
-    let _ = writeln!(s, "#!ipxe");
-    let _ = writeln!(s, "# OpenPXE password prompt for {label}");
-    let _ = writeln!(s, "echo");
-    let _ = writeln!(s, "echo ==========================================");
-    let _ = writeln!(s, "echo   This image requires a password");
-    let _ = writeln!(s, "echo   {label}");
-    let _ = writeln!(s, "echo   (enter alone returns to main menu)");
-    let _ = writeln!(s, "echo ==========================================");
-    let _ = writeln!(s, "set password ");
-    let _ = writeln!(s, "read --secret password");
-    let _ = writeln!(
-        s,
-        "iseq ${{password}} \"\" && chain {base}/boot.ipxe || goto submit"
-    );
-    let _ = writeln!(s, ":submit");
-    let _ = writeln!(s, "echo Verifying...");
-    // Carry `mac=${mac}` alongside the token so a successful unlock
-    // records the actual client MAC into the Host log. On
-    // older iPXE that can't resolve `${mac}` the server just stores it
-    // as "unknown" rather than refusing to boot.
-    let _ = writeln!(
-        s,
-        "chain {base}/boot/{entry_id}.ipxe?token=${{password:uristring}}&mac=${{mac}} \
-         || chain {base}/boot.ipxe"
-    );
-    s
-}
-
-/// Render the "wrong password" script. Tells the operator, sleeps for
-/// two seconds (gives the eye time to register the message and dampens
-/// brute-force rate without help from the server), and chains back to
-/// the same entry — which sends them through the prompt flow again.
-#[must_use]
-pub fn render_password_failed(entry_id: &str, base_url: &str) -> String {
-    let base = base_url.trim_end_matches('/');
-    let mut s = String::new();
-    let _ = writeln!(s, "#!ipxe");
-    let _ = writeln!(s, "echo");
-    let _ = writeln!(s, "echo Wrong password.");
-    let _ = writeln!(s, "sleep 2");
-    let _ = writeln!(
-        s,
-        "chain {base}/boot/{entry_id}.ipxe || chain {base}/boot.ipxe"
-    );
-    s
-}
-
-#[cfg(test)]
-mod password_tests {
-    use super::*;
-
-    #[test]
-    fn prompt_uses_secret_read_and_uri_escape() {
-        let s = render_password_prompt("alpha-linux", "Alpha Test.iso", "http://10.0.0.5");
-        assert!(s.starts_with("#!ipxe\n"));
-        assert!(s.contains("read --secret password"));
-        assert!(s.contains("Alpha Test.iso"));
-        // URI-string modifier on the var so passwords with `&`/spaces survive.
-        assert!(s.contains("token=${password:uristring}"));
-        // Empty enter sends back to the main menu, not back into the prompt
-        // (avoids a wedged client if the operator chose by mistake).
-        assert!(s.contains("&& chain http://10.0.0.5/boot.ipxe || goto submit"));
-        // Never log/echo the value.
-        assert!(!s.contains("echo ${password"));
-    }
-
-    #[test]
-    fn failed_chains_back_to_entry() {
-        let s = render_password_failed("alpha-linux", "http://10.0.0.5");
-        assert!(s.contains("Wrong password."));
-        // Re-target the entry so the prompt flow runs again.
-        assert!(s.contains("chain http://10.0.0.5/boot/alpha-linux.ipxe"));
-    }
-
-    #[test]
-    fn top_menu_has_polished_branding_and_arch_footer() {
-        // v0.4.69: the menu emits a `console --picture` line that paints
-        // a full-screen PNG background (the operator's logo, or the
-        // default OpenPXE mark) reserving a top margin for it, then
-        // falls back to a clean text console on iPXE builds without PNG
-        // support. The ASCII wordmark is gone — the graphical
-        // background carries the branding now. A single-line footer
-        // still carries the OpenPXE version + arch.
-        let settings = Settings::default();
-        let s = render_menu(&[], &settings, "http://10.0.0.5");
-        assert!(
-            s.contains("console --picture http://10.0.0.5/branding/pxe-logo"),
-            "missing console --picture line:\n{s}"
-        );
-        // The picture call reserves a top margin for the logo band.
-        assert!(s.contains("--top 290"), "missing --top margin:\n{s}");
-        // Picture-or-text-console must be a single statement so older
-        // iPXE parsers don't choke on the chain.
-        assert!(s.contains("|| console"), "missing graceful fallback:\n{s}");
-        // The ASCII wordmark must be GONE — its removal is the whole
-        // point of v0.4.69's graphical background.
-        assert!(
-            !s.contains("___                   ___  __  __ ___"),
-            "ASCII banner should have been removed:\n{s}"
-        );
-        // Footer with version + arch interpolation. The version comes
-        // from CARGO_PKG_VERSION at compile time.
-        let version = env!("CARGO_PKG_VERSION");
-        assert!(
-            s.contains(&format!("OpenPXE v{version}")),
-            "footer missing OpenPXE version:\n{s}"
-        );
-        assert!(
-            s.contains("${arch-label}"),
-            "footer missing arch-label interpolation:\n{s}"
-        );
-        // No website URL — the design brief calls that out as tacky.
-        assert!(
-            !s.to_ascii_lowercase().contains("openpxe.com"),
-            "footer should not advertise the website:\n{s}"
-        );
-        // Arch-label mapping covers the three labels from the brief:
-        // "x86 BIOS", "x86_64 UEFI", "arm64 UEFI".
-        assert!(s.contains("x86 BIOS"), "{s}");
-        assert!(s.contains("x86_64 UEFI"), "{s}");
-        assert!(s.contains("arm64 UEFI"), "{s}");
-    }
-
-    #[test]
-    fn generated_scripts_do_not_emit_bare_or_trailing_fallbacks() {
-        let settings = Settings::default();
-        let scripts = [
-            render_menu(&[], &settings, "http://10.0.0.5"),
-            render_tools_menu(&[], "http://10.0.0.5"),
-            render_local_hdd("http://10.0.0.5"),
-            render_util("http://10.0.0.5"),
-            render_shell("http://10.0.0.5"),
-            render_nic_info("http://10.0.0.5"),
-            render_queue_entry("http://10.0.0.5"),
-            render_password_failed("alpha-linux", "http://10.0.0.5"),
-        ];
-        for script in scripts {
-            for line in script.lines() {
-                assert!(
-                    !line.trim_end().ends_with("||"),
-                    "bare iPXE fallback operator in line: {line}\nscript:\n{script}"
-                );
-            }
-        }
-    }
+    s.chars().map(|c| match c { '\n' | '\r' => ' ', c => c }).collect()
 }

crates/http-api/src/iso_fs.rs

@@ -31,9 +31,7 @@ pub fn lookup(iso_path: &Path, in_iso_path: &str) -> Option<FileLocation> {
         .split('/')
         .filter(|c| !c.is_empty())
         .collect();
-    if components.is_empty() {
-        return None;
-    }
+    if components.is_empty() { return None; }
     walk(&mut f, root.offset, root.length, &components)
 }
 
@@ -42,16 +40,11 @@ fn read_root_directory(f: &mut std::fs::File) -> Option<FileLocation> {
     let mut pvd = [0u8; 2048];
     f.seek(SeekFrom::Start(16 * SECTOR)).ok()?;
     f.read_exact(&mut pvd).ok()?;
-    if pvd[0] != 0x01 || &pvd[1..6] != b"CD001" {
-        return None;
-    }
+    if pvd[0] != 0x01 || &pvd[1..6] != b"CD001" { return None; }
     // Root directory record is at offset 156, length 34.
     let rec = &pvd[156..156 + 34];
     let (offset, length) = parse_dir_record_ext(rec)?;
-    Some(FileLocation {
-        offset: offset * SECTOR,
-        length,
-    })
+    Some(FileLocation { offset: offset * SECTOR, length })
 }
 
 /// Walk components down the directory tree starting at `dir_offset`.
@@ -73,29 +66,21 @@ fn walk(
         if len == 0 {
             // Padding to sector boundary.
             let next = (i / SECTOR as usize + 1) * SECTOR as usize;
-            if next <= i {
-                break;
-            }
+            if next <= i { break; }
             i = next;
             continue;
         }
-        if i + len > dir.len() {
-            break;
-        }
+        if i + len > dir.len() { break; }
         let rec = &dir[i..i + len];
         let name = dir_record_name(rec);
         let is_dir = (rec.get(25).copied().unwrap_or(0) & 0x02) != 0;
         // Skip "." (0x00) and ".." (0x01) pseudo-entries.
-        let is_pseudo = matches!(rec.get(32).copied(), Some(1))
-            && rec.get(33).copied() == Some(0x00)
+        let is_pseudo = matches!(rec.get(32).copied(), Some(1)) && rec.get(33).copied() == Some(0x00)
             || matches!(rec.get(32).copied(), Some(1)) && rec.get(33).copied() == Some(0x01);
         if !is_pseudo && name.eq_ignore_ascii_case(target) {
             let (child_off, child_len) = parse_dir_record_ext(rec)?;
             if rest.is_empty() && !is_dir {
-                return Some(FileLocation {
-                    offset: child_off * SECTOR,
-                    length: child_len,
-                });
+                return Some(FileLocation { offset: child_off * SECTOR, length: child_len });
             } else if !rest.is_empty() && is_dir {
                 return walk(f, child_off * SECTOR, child_len, rest);
             }
@@ -109,9 +94,7 @@ fn walk(
 /// Layout per ISO9660: bytes 2..10 extent LBA (LE+BE duplicate), 10..18
 /// data length (LE+BE duplicate). We trust the little-endian copy.
 fn parse_dir_record_ext(rec: &[u8]) -> Option<(u64, u64)> {
-    if rec.len() < 34 {
-        return None;
-    }
+    if rec.len() < 34 { return None; }
     let lba = u32::from_le_bytes(rec[2..6].try_into().ok()?) as u64;
     let len = u32::from_le_bytes(rec[10..14].try_into().ok()?) as u64;
     Some((lba, len))
@@ -121,15 +104,9 @@ fn parse_dir_record_ext(rec: &[u8]) -> Option<(u64, u64)> {
 /// `;1` version suffix.
 fn dir_record_name(rec: &[u8]) -> String {
     let name_len = *rec.get(32).unwrap_or(&0) as usize;
-    if name_len == 0 || rec.len() < 33 + name_len {
-        return String::new();
-    }
+    if name_len == 0 || rec.len() < 33 + name_len { return String::new(); }
     let raw = &rec[33..33 + name_len];
     let s = String::from_utf8_lossy(raw).to_string();
     // Strip `;N` version suffix.
-    if let Some(i) = s.rfind(';') {
-        s[..i].to_string()
-    } else {
-        s
-    }
+    if let Some(i) = s.rfind(';') { s[..i].to_string() } else { s }
 }

crates/http-api/src/lib.rs

@@ -14,15 +14,11 @@
 #![forbid(unsafe_code)]
 
 pub mod app;
-pub mod auth;
 pub mod ipxe_script;
 pub mod iso_fs;
 pub mod log_stream;
-pub mod notify;
-pub mod saml_routes;
 pub mod state;
 pub mod terminal;
-pub mod uploads;
 
 pub use app::build_router;
 pub use state::AppState;

crates/http-api/src/log_stream.rs

@@ -36,11 +36,9 @@ pub async fn stream(
     let rx = state.log_bus.subscribe();
     let live = BroadcastStream::new(rx).map(|res| match res {
         Ok(line) => Ok(Event::default().data(line_json(&line))),
-        Err(tokio_stream::wrappers::errors::BroadcastStreamRecvError::Lagged(n)) => {
-            Ok(Event::default()
+        Err(tokio_stream::wrappers::errors::BroadcastStreamRecvError::Lagged(n)) => Ok(Event::default()
             .event("lagged")
-                .data(json!({ "skipped": n }).to_string()))
-        }
+            .data(json!({ "skipped": n }).to_string())),
     });
 
     Sse::new(recent_stream.chain(live))
@@ -57,11 +55,9 @@ pub async fn recent(State(state): State<AppState>) -> Json<serde_json::Value> {
 /// keep streaming new lines as they arrive).
 pub async fn clear(State(state): State<AppState>) -> Json<serde_json::Value> {
     state.log_bus.clear();
-    state.log_bus.push(
-        "info",
-        "openpxe::terminal",
-        "log buffer cleared by operator",
-    );
+    state
+        .log_bus
+        .push("info", "openpxe::terminal", "log buffer cleared by operator");
     Json(json!({ "ok": true }))
 }
 

crates/http-api/src/notify.rs

@@ -1,138 +0,0 @@
-//! Notification *delivery* — the network half of the notify feature.
-//!
-//! `openpxe_core::notify` owns the config + persistence; this module
-//! turns a `NotifyConfig` + a message into an actual delivery:
-//!
-//!   - Slack / Discord / Teams → HTTP POST of a provider-shaped JSON
-//!     body to the operator's incoming-webhook URL (via `reqwest`).
-//!   - SMTP → a TLS email via `lettre`.
-//!
-//! Every send is best-effort and time-bounded: a flaky webhook must
-//! never wedge a PXE boot. Callers fire these from a detached task.
-
-use openpxe_core::{NotifyConfig, NotifyKind};
-use std::time::Duration;
-
-/// Hard ceiling on any single delivery so a hung endpoint can't pin a
-/// task forever.
-const SEND_TIMEOUT: Duration = Duration::from_secs(10);
-
-/// Deliver `body` (with an optional `subject`, used as the email
-/// subject / chat bold-line) using the active provider in `cfg`.
-/// Returns `Ok(())` on success, or a human-readable error suitable for
-/// surfacing in the "Send test" response.
-pub async fn send(cfg: &NotifyConfig, subject: &str, body: &str) -> Result<(), String> {
-    if !cfg.is_usable() {
-        return Err("notifications are not enabled / fully configured".into());
-    }
-    match cfg.kind {
-        NotifyKind::Slack | NotifyKind::Discord | NotifyKind::Teams => {
-            send_webhook(cfg, subject, body).await
-        }
-        NotifyKind::Smtp => send_email(cfg, subject, body).await,
-    }
-}
-
-async fn send_webhook(cfg: &NotifyConfig, subject: &str, body: &str) -> Result<(), String> {
-    // Each chat platform wants a different JSON shape for an incoming
-    // webhook. Keep the bodies minimal and plain-text-ish so they
-    // render cleanly everywhere.
-    let combined = if subject.is_empty() {
-        body.to_string()
-    } else {
-        format!("*{subject}*\n{body}")
-    };
-    let payload = match cfg.kind {
-        NotifyKind::Slack => serde_json::json!({ "text": combined }),
-        NotifyKind::Discord => serde_json::json!({ "content": combined }),
-        NotifyKind::Teams => serde_json::json!({
-            // Legacy MessageCard — the format every Teams "Incoming
-            // Webhook" connector still accepts.
-            "@type": "MessageCard",
-            "@context": "https://schema.org/extensions",
-            "summary": if subject.is_empty() { "OpenPXE" } else { subject },
-            "title": subject,
-            "text": body,
-        }),
-        NotifyKind::Smtp => unreachable!("smtp handled separately"),
-    };
-
-    let client = reqwest::Client::builder()
-        .timeout(SEND_TIMEOUT)
-        .build()
-        .map_err(|e| format!("could not build HTTP client: {e}"))?;
-    let resp = client
-        .post(&cfg.webhook_url)
-        .json(&payload)
-        .send()
-        .await
-        .map_err(|e| format!("webhook POST failed: {e}"))?;
-    let status = resp.status();
-    if status.is_success() {
-        Ok(())
-    } else {
-        let snippet = resp
-            .text()
-            .await
-            .unwrap_or_default()
-            .chars()
-            .take(200)
-            .collect::<String>();
-        Err(format!("webhook returned HTTP {status}: {snippet}"))
-    }
-}
-
-async fn send_email(cfg: &NotifyConfig, subject: &str, body: &str) -> Result<(), String> {
-    use lettre::transport::smtp::authentication::Credentials;
-    use lettre::{AsyncSmtpTransport, AsyncTransport, Message, Tokio1Executor};
-
-    let from = if cfg.smtp_from.trim().is_empty() {
-        cfg.smtp_username.trim()
-    } else {
-        cfg.smtp_from.trim()
-    };
-    if from.is_empty() {
-        return Err("SMTP requires a From address (or a username to fall back to)".into());
-    }
-
-    let email = Message::builder()
-        .from(
-            from.parse()
-                .map_err(|e| format!("invalid From address '{from}': {e}"))?,
-        )
-        .to(cfg
-            .smtp_to
-            .trim()
-            .parse()
-            .map_err(|e| format!("invalid To address '{}': {e}", cfg.smtp_to))?)
-        .subject(if subject.is_empty() { "OpenPXE" } else { subject })
-        .body(body.to_string())
-        .map_err(|e| format!("could not build email: {e}"))?;
-
-    // Implicit TLS (465) vs STARTTLS (587). We never send plaintext.
-    let mut builder = if cfg.smtp_implicit_tls {
-        AsyncSmtpTransport::<Tokio1Executor>::relay(&cfg.smtp_host)
-            .map_err(|e| format!("SMTP relay setup failed: {e}"))?
-    } else {
-        AsyncSmtpTransport::<Tokio1Executor>::starttls_relay(&cfg.smtp_host)
-            .map_err(|e| format!("SMTP STARTTLS setup failed: {e}"))?
-    }
-    .port(cfg.smtp_port)
-    .timeout(Some(SEND_TIMEOUT));
-
-    // Auth is optional — some internal relays accept unauthenticated
-    // mail from trusted hosts. Only attach credentials when a username
-    // is set.
-    if !cfg.smtp_username.trim().is_empty() {
-        builder = builder.credentials(Credentials::new(
-            cfg.smtp_username.trim().to_string(),
-            cfg.smtp_password.clone(),
-        ));
-    }
-    let mailer = builder.build();
-    mailer
-        .send(email)
-        .await
-        .map(|_| ())
-        .map_err(|e| format!("SMTP send failed: {e}"))
-}

crates/http-api/src/saml_routes.rs

@@ -1,338 +0,0 @@
-//! SAML 2.0 Service Provider HTTP endpoints (v0.5.1).
-//!
-//! * `GET  /api/sso/login`    — SP-initiated: build an AuthnRequest, record its
-//!   ID, and 302 the browser to the IdP.
-//! * `POST /api/sso/acs`      — Assertion Consumer Service: verify + validate
-//!   the IdP's `SAMLResponse`, perform the stateful checks (InResponseTo
-//!   correlation, IdP-initiated gating, assertion replay), mint an operator
-//!   session, and 302 to the dashboard. (Mirrors FleetDM's `/sso/callback`.)
-//! * `GET  /api/sso/metadata` — serve our SP metadata XML for IdP import.
-//!
-//! Stateless crypto + semantic validation live in `openpxe_core::saml`; this
-//! module owns only the HTTP glue and the in-memory state the SP needs.
-
-use std::collections::HashMap;
-use std::sync::Arc;
-use std::time::{Duration as StdDuration, Instant};
-
-use axum::{
-    body::Body,
-    extract::{Form, Query, State},
-    http::{header, StatusCode},
-    response::{IntoResponse, Response},
-};
-use base64::Engine;
-use parking_lot::Mutex;
-use serde::Deserialize;
-use time::{Duration, OffsetDateTime};
-
-use openpxe_core::saml::{self, metadata::IdpMetadata, SamlError, SpParams};
-use openpxe_core::SsoConfig;
-
-use crate::auth;
-use crate::state::AppState;
-
-/// Outstanding AuthnRequest IDs live at most this long before a matching
-/// response is considered stale (covers a slow human at the IdP login form).
-const REQUEST_TTL: StdDuration = StdDuration::from_mins(10);
-/// How long we fetch-cache IdP metadata loaded from a URL.
-const METADATA_FETCH_TIMEOUT: StdDuration = StdDuration::from_secs(10);
-
-/// In-memory SAML runtime state. Cheap to clone (Arc-shared).
-#[derive(Clone, Default)]
-pub struct SamlRuntime {
-    /// request_id → issued_at. Correlates a response's `InResponseTo` to a
-    /// request *we* actually sent (replay / CSRF defense for SP-initiated).
-    outstanding: Arc<Mutex<HashMap<String, Instant>>>,
-    /// assertion_id → expiry. A consumed assertion may not be replayed.
-    consumed: Arc<Mutex<HashMap<String, Instant>>>,
-    /// Cache of IdP metadata fetched from a URL: (url, parsed).
-    metadata_cache: Arc<Mutex<Option<(String, IdpMetadata)>>>,
-}
-
-impl SamlRuntime {
-    /// Record an AuthnRequest we just sent.
-    pub fn register_request(&self, id: &str) {
-        let mut g = self.outstanding.lock();
-        prune(&mut g);
-        g.insert(id.to_owned(), Instant::now());
-    }
-
-    /// Consume an outstanding request ID, returning `true` if it was present
-    /// and still fresh. A miss means the response doesn't correlate to any
-    /// live request we issued.
-    pub fn take_request(&self, id: &str) -> bool {
-        let mut g = self.outstanding.lock();
-        prune(&mut g);
-        g.remove(id).is_some()
-    }
-
-    /// Record a consumed assertion. Returns `false` if it was already
-    /// consumed (a replay) — in which case the caller must reject.
-    pub fn record_assertion(&self, id: &str, expiry: OffsetDateTime) -> bool {
-        let mut g = self.consumed.lock();
-        prune(&mut g);
-        if g.contains_key(id) {
-            return false;
-        }
-        let ttl = (expiry - OffsetDateTime::now_utc())
-            .max(Duration::ZERO)
-            .unsigned_abs();
-        g.insert(id.to_owned(), Instant::now() + ttl);
-        true
-    }
-
-    fn cached_metadata(&self, url: &str) -> Option<IdpMetadata> {
-        let g = self.metadata_cache.lock();
-        match &*g {
-            Some((cached_url, md)) if cached_url == url => Some(md.clone()),
-            _ => None,
-        }
-    }
-
-    fn cache_metadata(&self, url: String, md: IdpMetadata) {
-        *self.metadata_cache.lock() = Some((url, md));
-    }
-}
-
-/// Drop expired entries so neither map grows unbounded.
-fn prune(map: &mut HashMap<String, Instant>) {
-    let now = Instant::now();
-    // For the request map this over-prunes (entries store issued_at, not
-    // expiry), so cap by REQUEST_TTL; the consumed map stores absolute
-    // expiry instants. Using saturating logic keeps both correct: request
-    // entries older than REQUEST_TTL go, consumed entries past expiry go.
-    map.retain(|_, &mut t| now.saturating_duration_since(t) < REQUEST_TTL || t > now);
-}
-
-// ─── GET /api/sso/login ───────────────────────────────────────────────────
-
-#[derive(Debug, Deserialize)]
-pub struct LoginQuery {
-    /// Optional local path to return to after login (becomes RelayState).
-    #[serde(default)]
-    pub next: Option<String>,
-}
-
-pub async fn sso_login(State(state): State<AppState>, Query(q): Query<LoginQuery>) -> Response {
-    let cfg = state.sso.snapshot();
-    if !cfg.is_usable() {
-        return redirect("/?sso_error=unavailable");
-    }
-    let idp = match resolve_idp_metadata(&state, &cfg).await {
-        Ok(m) => m,
-        Err(e) => {
-            tracing::warn!(target: "openpxe::saml", "sso_login: metadata unavailable: {e}");
-            return redirect("/?sso_error=metadata");
-        }
-    };
-    let Some(dest) = idp.sso_destination().map(str::to_owned) else {
-        tracing::warn!(target: "openpxe::saml", "sso_login: IdP metadata has no SSO endpoint");
-        return redirect("/?sso_error=metadata");
-    };
-    let sp = sp_params(&state, &cfg);
-    let relay = safe_local_path(q.next.as_deref());
-    match saml::authn_request::build(&sp, &dest, Some(&relay)) {
-        Ok(req) => {
-            state.saml.register_request(&req.id);
-            redirect(&req.location)
-        }
-        Err(e) => {
-            tracing::warn!(target: "openpxe::saml", "sso_login: build AuthnRequest failed: {e}");
-            redirect("/?sso_error=request")
-        }
-    }
-}
-
-// ─── POST /api/sso/acs ──────────────────────────────────────────────────────
-
-#[derive(Debug, Deserialize)]
-pub struct AcsForm {
-    #[serde(rename = "SAMLResponse")]
-    pub saml_response: String,
-    #[serde(rename = "RelayState", default)]
-    pub relay_state: Option<String>,
-}
-
-pub async fn sso_acs(State(state): State<AppState>, Form(form): Form<AcsForm>) -> Response {
-    let cfg = state.sso.snapshot();
-    if !cfg.is_usable() {
-        return redirect("/?sso_error=unavailable");
-    }
-    let xml = match base64::engine::general_purpose::STANDARD.decode(form.saml_response.as_bytes())
-    {
-        Ok(bytes) => String::from_utf8_lossy(&bytes).into_owned(),
-        Err(e) => {
-            tracing::warn!(target: "openpxe::saml", "acs: base64 decode failed: {e}");
-            return redirect("/?sso_error=1");
-        }
-    };
-    let idp = match resolve_idp_metadata(&state, &cfg).await {
-        Ok(m) => m,
-        Err(e) => {
-            tracing::warn!(target: "openpxe::saml", "acs: metadata unavailable: {e}");
-            return redirect("/?sso_error=metadata");
-        }
-    };
-    let sp = sp_params(&state, &cfg);
-
-    // Signature verification + semantic checks are CPU-bound — keep them off
-    // the async executor.
-    let now = OffsetDateTime::now_utc();
-    let skew = Duration::seconds(saml::DEFAULT_CLOCK_SKEW_SECS);
-    let verify = {
-        let xml = xml.clone();
-        let sp = sp.clone();
-        tokio::task::spawn_blocking(move || saml::response::consume(&xml, &sp, &idp, now, skew))
-            .await
-    };
-    let verified = match verify {
-        Ok(Ok(v)) => v,
-        Ok(Err(e)) => {
-            // Never leak which specific check failed to the browser.
-            tracing::warn!(target: "openpxe::saml", "acs: response rejected: {e}");
-            return redirect("/?sso_error=1");
-        }
-        Err(join) => {
-            tracing::error!(target: "openpxe::saml", "acs: verify task panicked: {join}");
-            return redirect("/?sso_error=1");
-        }
-    };
-
-    // Stateful checks the core deliberately left to us.
-    match &verified.in_response_to {
-        Some(id) => {
-            if !state.saml.take_request(id) {
-                tracing::warn!(target: "openpxe::saml", "acs: InResponseTo matches no live request");
-                return redirect("/?sso_error=1");
-            }
-        }
-        None => {
-            if !cfg.allow_idp_initiated {
-                tracing::warn!(target: "openpxe::saml", "acs: IdP-initiated login is disabled");
-                return redirect("/?sso_error=idp_initiated");
-            }
-        }
-    }
-    if !state
-        .saml
-        .record_assertion(&verified.assertion_id, verified.assertion_expiry)
-    {
-        tracing::warn!(target: "openpxe::saml", "acs: assertion replay rejected");
-        return redirect("/?sso_error=1");
-    }
-
-    // Success → mint an operator session keyed to the verified email.
-    let session = state.sessions.create(&verified.principal.email);
-    tracing::info!(
-        target: "openpxe::saml",
-        email = %verified.principal.email,
-        idp_initiated = verified.in_response_to.is_none(),
-        "SAML SSO sign-in"
-    );
-    // safe_local_path already maps None / unsafe values to "/".
-    let relay = safe_local_path(form.relay_state.as_deref());
-    redirect_with_session(&relay, &session)
-}
-
-// ─── GET /api/sso/metadata ──────────────────────────────────────────────────
-
-pub async fn sso_metadata(State(state): State<AppState>) -> Response {
-    let cfg = state.sso.snapshot();
-    let sp = sp_params(&state, &cfg);
-    let xml = saml::metadata::build_sp_metadata(&sp);
-    (
-        StatusCode::OK,
-        [(header::CONTENT_TYPE, "application/samlmetadata+xml")],
-        xml,
-    )
-        .into_response()
-}
-
-// ─── helpers ────────────────────────────────────────────────────────────────
-
-/// Derive runtime SP parameters from config + the advertised public base URL.
-fn sp_params(state: &AppState, cfg: &SsoConfig) -> SpParams {
-    let base = state.public_base_url.trim_end_matches('/');
-    let entity_id = if cfg.entity_id.trim().is_empty() {
-        base.to_owned()
-    } else {
-        cfg.entity_id.trim().to_owned()
-    };
-    SpParams {
-        entity_id,
-        acs_url: format!("{base}/api/sso/acs"),
-    }
-}
-
-/// Resolve the IdP metadata: prefer the metadata URL (fetched + cached) per
-/// the "URL wins" rule, else parse the pasted XML.
-async fn resolve_idp_metadata(state: &AppState, cfg: &SsoConfig) -> Result<IdpMetadata, SamlError> {
-    let url = cfg.metadata_url.trim();
-    if !url.is_empty() {
-        if let Some(md) = state.saml.cached_metadata(url) {
-            return Ok(md);
-        }
-        let body = fetch_metadata(url).await?;
-        let md = IdpMetadata::parse(&body)?;
-        state.saml.cache_metadata(url.to_owned(), md.clone());
-        return Ok(md);
-    }
-    if !cfg.metadata.trim().is_empty() {
-        return IdpMetadata::parse(&cfg.metadata);
-    }
-    Err(SamlError::Metadata("no metadata source configured".into()))
-}
-
-async fn fetch_metadata(url: &str) -> Result<String, SamlError> {
-    let client = reqwest::Client::builder()
-        .timeout(METADATA_FETCH_TIMEOUT)
-        .build()
-        .map_err(|e| SamlError::Metadata(format!("http client: {e}")))?;
-    let resp = client
-        .get(url)
-        .send()
-        .await
-        .map_err(|e| SamlError::Metadata(format!("fetch {url}: {e}")))?;
-    if !resp.status().is_success() {
-        return Err(SamlError::Metadata(format!(
-            "fetch {url}: HTTP {}",
-            resp.status()
-        )));
-    }
-    resp.text()
-        .await
-        .map_err(|e| SamlError::Metadata(format!("read {url}: {e}")))
-}
-
-/// Only permit a same-site path (single leading slash) as a redirect target —
-/// blocks open-redirect / protocol-relative (`//evil.com`) abuse of RelayState.
-fn safe_local_path(p: Option<&str>) -> String {
-    match p {
-        Some(p) if p.starts_with('/') && !p.starts_with("//") => p.to_owned(),
-        _ => "/".to_owned(),
-    }
-}
-
-fn redirect(location: &str) -> Response {
-    Response::builder()
-        .status(StatusCode::FOUND)
-        .header(header::LOCATION, location)
-        .body(Body::empty())
-        .map_or_else(
-            |_| StatusCode::INTERNAL_SERVER_ERROR.into_response(),
-            IntoResponse::into_response,
-        )
-}
-
-fn redirect_with_session(location: &str, session: &str) -> Response {
-    Response::builder()
-        .status(StatusCode::FOUND)
-        .header(header::LOCATION, location)
-        .header(header::SET_COOKIE, auth::session_cookie(session))
-        .body(Body::empty())
-        .map_or_else(
-            |_| StatusCode::INTERNAL_SERVER_ERROR.into_response(),
-            IntoResponse::into_response,
-        )
-}

crates/http-api/src/state.rs

@@ -1,11 +1,5 @@
-use crate::auth::SessionStore;
-use crate::saml_routes::SamlRuntime;
-use crate::uploads::UploadSessions;
-use openpxe_core::{
-    AdminStore, BootLog, BrandingStore, ClientRegistry, DeploymentQueue, HostBindings, LogBus,
-    Metrics, NotifyStore, SettingsStore, SsoStore,
-};
-use openpxe_iso_store::{IsoStore, NfsShareManager, SmbManager, SmbShareManager};
+use openpxe_core::{ClientRegistry, DeploymentQueue, HostBindings, LogBus, Metrics, SettingsStore};
+use openpxe_iso_store::{IsoStore, NfsManager, SmbManager};
 use std::sync::Arc;
 use time::OffsetDateTime;
 
@@ -19,33 +13,6 @@ pub struct AppState {
     /// these MACs requests `/boot.ipxe`, we chain straight to the
     /// configured target instead of rendering the menu.
     pub hosts: HostBindings,
-    /// Persistent boot-event log surfaced under the Hosts tab. Records
-    /// every `/boot/<entry>.ipxe` chain that goes on to serve a script
-    /// (i.e. an image actually starting to install on a machine).
-    pub boot_log: BootLog,
-    /// Operator-controlled UI overrides (custom logo). When the
-    /// operator hasn't uploaded anything, the WebUI serves the bundled
-    /// rainbow-horizon mark.
-    pub branding: BrandingStore,
-    /// Forms-auth admin record + first-run bootstrap state. When
-    /// `admin.is_configured() == false`, the auth middleware passes
-    /// every request through and `/api/me` reports `setup_required`.
-    pub admin: AdminStore,
-    /// In-memory session table for active operator logins. Cleared on
-    /// process restart (sessions are tied to UI state, not persisted —
-    /// matches Sonarr/Radarr behaviour).
-    pub sessions: SessionStore,
-    /// SAML SSO configuration (persisted IdP metadata, Entity ID, toggles).
-    pub sso: SsoStore,
-    /// v0.5.1: in-memory SAML runtime state — outstanding AuthnRequest IDs
-    /// (for InResponseTo correlation), consumed-assertion replay guard, and
-    /// a cache of fetched IdP metadata. Tied to process lifetime, like
-    /// `sessions`; a restart simply invalidates any in-flight SSO login.
-    pub saml: SamlRuntime,
-    /// v0.5.0: webhook / email notification config (Slack/Teams/Discord/
-    /// SMTP). Drives the fire-and-forget pings on boot events and powers
-    /// the Advanced tab's config + "Send test" button.
-    pub notify: NotifyStore,
     /// Lock-free metrics counters surfaced at `/metrics` in Prometheus
     /// text format. Cheap to clone (handles to atomics).
     pub metrics: Metrics,
@@ -53,24 +20,11 @@ pub struct AppState {
     /// `smb_dir` at startup; `None` in pure-Linux-only deployments where
     /// Windows support is not wired in. Settings toggle drives start/stop.
     pub smb: Option<Arc<SmbManager>>,
-    /// v0.4.65: SMB share manager — userspace consumer of remote SMB
-    /// shares via Samba's `smbclient` CLI. Replaces the kernel-mount
-    /// NFS path that v0.4.64 shipped; that path didn't work on hosts
-    /// (Unraid, etc.) whose kernel ships without the nfs/cifs client
-    /// modules, and no container-side configuration could fix it.
-    /// `smbclient` does the SMB protocol over a plain TCP socket in
-    /// userspace — works in any container, no special caps required.
-    pub smb_shares: SmbShareManager,
-    /// v0.4.67: NFSv3 share manager — pure-Rust userspace consumer
-    /// via the `nfs3_client` crate. Ships alongside the SMB manager
-    /// so operators pick whichever protocol their NAS prefers.
-    /// In-process (no subprocess); supports HTTP Range requests on
-    /// NFS-sourced ISOs because NFSv3 READ3 takes an explicit offset.
-    pub nfs_shares: NfsShareManager,
-    /// Browser chunked upload state. Multipart uploads still go straight
-    /// through `IsoStore`, but the UI uses sessions so large ISO transfers
-    /// can show deterministic progress and leave visible partial files.
-    pub uploads: UploadSessions,
+    /// NFS share manager. Always present (mounting is opt-in by the
+    /// operator from the Storage tab); `add()` requires `mount.nfs` to be
+    /// available in the runtime image. Surfaces errors per-mount rather
+    /// than failing the global state.
+    pub nfs: NfsManager,
     /// Live log bus consumed by the Terminal tab via SSE. Operator-issued
     /// terminal commands also push synthetic lines onto it so the tail
     /// shows them inline.

crates/http-api/src/terminal.rs

@@ -31,17 +31,12 @@ pub async fn run_command(
 ) -> impl IntoResponse {
     let line = req.command.trim();
     if line.is_empty() {
-        return (
-            StatusCode::OK,
-            Json(json!({ "output": HELP_TEXT, "ok": true })),
-        );
+        return (StatusCode::OK, Json(json!({ "output": HELP_TEXT, "ok": true })));
     }
 
     // Echo the typed command into the live log so the Terminal tab shows
     // operator activity in-band with server-emitted log lines.
-    state
-        .log_bus
-        .push("info", "openpxe::terminal", format!("> {line}"));
+    state.log_bus.push("info", "openpxe::terminal", format!("> {line}"));
 
     let argv = shell_split(line);
     if argv.is_empty() {
@@ -60,11 +55,7 @@ pub async fn run_command(
     // so reading the live tail tells the same story as scrolling the
     // terminal pane.
     let mirror = if output.len() > 1024 {
-        format!(
-            "{}\n... ({} bytes truncated)",
-            &output[..1024],
-            output.len() - 1024
-        )
+        format!("{}\n... ({} bytes truncated)", &output[..1024], output.len() - 1024)
     } else {
         output.clone()
     };
@@ -87,15 +78,9 @@ async fn dispatch(state: &AppState, argv: &[String]) -> Result<String, String> {
         "status" => Ok(status_text(state)),
         "isos" | "images" => Ok(isos_text(state)),
         "clients" => Ok(clients_text(state)),
-        "queue" => queue_command(state, tail).await,
-        // `smb` controls the outbound Samba server for Windows
-        // install media. `share` lists/manages remote SMB shares
-        // OpenPXE pulls ISOs from (v0.4.65). `nfs` is the parallel
-        // command for remote NFSv3 shares (v0.4.67, in-process via
-        // nfs3_client — not the v0.4.64 kernel-mount path).
-        "share" | "smb-share" => smb_share_command(state, tail).await,
+        "queue" => gate_command(state, tail).await,
+        "nfs" => nfs_command(state, tail).await,
         "smb" => smb_command(state, tail).await,
-        "nfs" => nfs_share_command(state, tail).await,
         "log" => log_command(state, tail),
         "whoami" => Ok("operator".to_string()),
         "echo" => Ok(tail.join(" ")),
@@ -111,52 +96,32 @@ async fn dispatch(state: &AppState, argv: &[String]) -> Result<String, String> {
 fn status_text(s: &AppState) -> String {
     let isos = s.iso_store.list();
     let clients = s.clients.list();
-    let queue_entries = s.queue.list();
+    let gates = s.queue.list();
     let smb = s.smb.as_ref().map(|m| m.snapshot());
-    let smb_shares = s.smb_shares.list();
-    let smb_reachable = smb_shares.iter().filter(|m| m.reachable).count();
-    // v0.4.67: NFSv3 sources too.
-    let nfs_shares = s.nfs_shares.list();
-    let nfs_reachable = nfs_shares.iter().filter(|m| m.reachable).count();
+    let nfs = s.nfs.list();
+    let nfs_active = nfs.iter().filter(|m| m.mounted).count();
     format!(
         "OpenPXE {ver}\n\
          base url:     {base}\n\
          interface:    {nic}\n\
          uptime:       {up}\n\
-         isos:         {n_isos}  (local: {n_local}, smb: {n_smb}, nfs: {n_nfs})\n\
+         isos:         {n_isos}  (local: {n_local}, nfs: {n_nfs})\n\
          clients:      {n_clients}\n\
          queue:        {n_entries}\n\
-         smb server:   {smb}\n\
-         smb shares:   {n_smb_total} configured ({n_smb_active} reachable)\n\
-         nfs shares:   {n_nfs_total} configured ({n_nfs_active} reachable)\n",
+         smb:          {smb}\n\
+         nfs mounts:   {n_total} configured ({n_active} active)\n",
         ver = env!("CARGO_PKG_VERSION"),
         base = s.public_base_url,
-        nic = if s.nic_name.is_empty() {
-            "?"
-        } else {
-            s.nic_name.as_str()
-        },
+        nic = if s.nic_name.is_empty() { "?" } else { s.nic_name.as_str() },
         up = uptime_string(s),
         n_isos = isos.len(),
-        n_local = isos
-            .iter()
-            .filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Local))
-            .count(),
-        n_smb = isos
-            .iter()
-            .filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Smb { .. }))
-            .count(),
-        n_nfs = isos
-            .iter()
-            .filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Nfs { .. }))
-            .count(),
+        n_local = isos.iter().filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Local)).count(),
+        n_nfs = isos.iter().filter(|i| !matches!(i.source, openpxe_iso_store::IsoSource::Local)).count(),
         n_clients = clients.len(),
-        n_entries = queue_entries.len(),
+        n_entries = gates.len(),
         smb = smb.map_or_else(|| "(disabled)".into(), |s| format!("{s:?}")),
-        n_smb_total = smb_shares.len(),
-        n_smb_active = smb_reachable,
-        n_nfs_total = nfs_shares.len(),
-        n_nfs_active = nfs_reachable,
+        n_total = nfs.len(),
+        n_active = nfs_active,
     )
 }
 
@@ -174,9 +139,7 @@ fn isos_text(s: &AppState) -> String {
     for i in isos {
         let src = match i.source {
             openpxe_iso_store::IsoSource::Local => "local".to_string(),
-            openpxe_iso_store::IsoSource::Smb { share_id, .. } => format!("smb:{share_id}"),
-            // v0.4.67: NFSv3 via in-process nfs3_client.
-            openpxe_iso_store::IsoSource::Nfs { share_id, .. } => format!("nfs:{share_id}"),
+            openpxe_iso_store::IsoSource::Nfs { mount_id, .. } => format!("nfs:{mount_id}"),
         };
         let _ = writeln!(
             out,
@@ -196,7 +159,11 @@ fn clients_text(s: &AppState) -> String {
         return "(no clients yet)".into();
     }
     let mut out = String::new();
-    let _ = writeln!(out, "{:<19} {:<16} {:<8} LAST SEEN", "MAC", "IP", "EVENTS");
+    let _ = writeln!(
+        out,
+        "{:<19} {:<16} {:<8} LAST SEEN",
+        "MAC", "IP", "EVENTS"
+    );
     for c in clients {
         let ip = c.last_ip.map_or_else(|| "-".into(), |i| i.to_string());
         let _ = writeln!(
@@ -213,35 +180,35 @@ fn clients_text(s: &AppState) -> String {
     out
 }
 
-// ── queue ──────────────────────────────────────────────────────────────
+// ── gate ───────────────────────────────────────────────────────────────
 
-// `async` for symmetry with the other dispatch helpers — queue operations
+// `async` for symmetry with the other dispatch helpers — gate operations
 // are sync today but might grow to await on a database in a future phase.
 #[allow(clippy::unused_async)]
-async fn queue_command(s: &AppState, args: &[String]) -> Result<String, String> {
+async fn gate_command(s: &AppState, args: &[String]) -> Result<String, String> {
     match args.first().map(String::as_str) {
         None | Some("list") => {
-            let entries = s.queue.list();
-            if entries.is_empty() {
-                return Ok("(queue empty)".into());
+            let gs = s.queue.list();
+            if gs.is_empty() {
+                return Ok("(no gates)".into());
             }
             let mut out = String::new();
-            for entry in entries {
+            for g in gs {
                 let _ = writeln!(
                     out,
                     "#{:<3} {:<19} {:<16} target={}",
-                    entry.position,
-                    entry.mac,
-                    entry.id,
-                    entry.assigned_target.unwrap_or_else(|| "-".into())
+                    g.position,
+                    g.mac,
+                    g.id,
+                    g.assigned_target.unwrap_or_else(|| "-".into())
                 );
             }
             Ok(out)
         }
         Some("assign-all") => {
-            let target = args
-                .get(1)
-                .ok_or_else(|| "usage: queue assign-all <iso_boot_entry_id>".to_string())?;
+            let target = args.get(1).ok_or_else(|| {
+                "usage: gate assign-all <iso_boot_entry_id>".to_string()
+            })?;
             let found = s
                 .iso_store
                 .list()
@@ -252,166 +219,59 @@ async fn queue_command(s: &AppState, args: &[String]) -> Result<String, String>
             }
             let ids: Vec<_> = s.queue.list().into_iter().map(|g| g.id).collect();
             let n = s.queue.assign(&ids, target);
-            Ok(format!("assigned {n} queue entries -> {target}"))
+            Ok(format!("assigned {n} gates -> {target}"))
         }
         Some("assign") => {
             let entry_id = args
                 .get(1)
-                .ok_or_else(|| "usage: queue assign <entry_id> <iso_boot_entry_id>".to_string())?;
+                .ok_or_else(|| "usage: gate assign <entry_id> <iso_boot_entry_id>".to_string())?;
             let target = args
                 .get(2)
-                .ok_or_else(|| "usage: queue assign <entry_id> <iso_boot_entry_id>".to_string())?;
+                .ok_or_else(|| "usage: gate assign <entry_id> <iso_boot_entry_id>".to_string())?;
             let n = s.queue.assign(std::slice::from_ref(entry_id), target);
             if n == 0 {
-                return Err(format!("no such queue entry: {entry_id}"));
+                return Err(format!("no such gate: {entry_id}"));
             }
-            Ok(format!("assigned 1 queue entry -> {target}"))
+            Ok(format!("assigned 1 gate -> {target}"))
         }
         Some("release") => {
-            let entry_id = args
-                .get(1)
-                .ok_or_else(|| "usage: queue release <entry_id>".to_string())?;
+            let entry_id = args.get(1).ok_or_else(|| "usage: gate release <entry_id>".to_string())?;
             match s.queue.release(entry_id) {
                 Some(_) => Ok(format!("released {entry_id}")),
-                None => Err(format!("no such queue entry: {entry_id}")),
+                None => Err(format!("no such gate: {entry_id}")),
             }
         }
         Some(other) => Err(format!(
-            "unknown queue subcommand: {other}\ntry: queue [list|assign-all|assign|release]"
+            "unknown gate subcommand: {other}\ntry: gate [list|assign-all|assign|release]"
         )),
     }
 }
 
-// ── share (v0.4.65: SMB shares) ─────────────────────────────────────────
+// ── nfs ────────────────────────────────────────────────────────────────
 
-async fn smb_share_command(s: &AppState, args: &[String]) -> Result<String, String> {
+async fn nfs_command(s: &AppState, args: &[String]) -> Result<String, String> {
     match args.first().map(String::as_str) {
         None | Some("list") => {
-            let shares = s.smb_shares.list();
-            if shares.is_empty() {
-                return Ok("(no SMB shares configured)".into());
+            let mounts = s.nfs.list();
+            if mounts.is_empty() {
+                return Ok("(no NFS mounts configured)".into());
             }
             let mut out = String::new();
             let _ = writeln!(
                 out,
-                "{:<24} {:<7} {:<6} {:<6} TARGET",
-                "ID", "STATUS", "AUTH", "ISOS"
+                "{:<24} {:<6} {:<7} {:<6} TARGET",
+                "ID", "VER", "STATUS", "ISOS"
             );
-            for m in shares {
-                let status = if m.reachable { "ok" } else { "down" };
-                let auth = if m.guest { "guest" } else { "user" };
+            for m in mounts {
+                let status = if m.mounted { "ok" } else { "down" };
                 let _ = writeln!(
                     out,
-                    "{:<24} {:<7} {:<6} {:<6} //{}/{}",
-                    truncate(&m.id, 24),
-                    status,
-                    auth,
-                    m.iso_count,
-                    m.server,
-                    m.share,
-                );
-                if let Some(e) = m.last_error {
-                    let _ = writeln!(out, "    error: {e}");
-                }
-                if let Some(h) = m.last_hint {
-                    let _ = writeln!(out, "    hint:  {h}");
-                }
-            }
-            Ok(out)
-        }
-        Some("add") => {
-            // share add //server/share [guest|user:password]
-            let target = args
-                .get(1)
-                .ok_or_else(|| {
-                    "usage: share add //server/share [guest|user:password]".to_string()
-                })?;
-            // Accept either `//server/share` (UNC-style) or
-            // `server:share` (shorter to type).
-            let stripped = target.trim_start_matches('/').trim_start_matches('\\');
-            let (server, share) = if let Some((s, p)) = stripped.split_once('/') {
-                (s, p)
-            } else if let Some((s, p)) = stripped.split_once(':') {
-                (s, p)
-            } else {
-                return Err("target must be '//server/share' or 'server:share'".into());
-            };
-
-            // Auth spec: "guest" or "user:password". Default: guest.
-            let auth = args.get(2).cloned().unwrap_or_else(|| "guest".into());
-            let (guest, username, password) = if auth == "guest" {
-                (true, None, None)
-            } else if let Some((u, p)) = auth.split_once(':') {
-                (false, Some(u.to_string()), Some(p.to_string()))
-            } else {
-                return Err("auth must be 'guest' or 'user:password'".into());
-            };
-
-            let req = openpxe_iso_store::SmbAddRequest {
-                server: server.to_string(),
-                share: share.to_string(),
-                username,
-                password,
-                guest,
-                port: None,
-            };
-            match s.smb_shares.add(req).await {
-                Ok(m) => Ok(format!("added {} ({} isos)", m.id, m.iso_count)),
-                Err(e) => {
-                    let mut out = format!("add failed: {}", e.error);
-                    if let Some(h) = e.hint {
-                        out.push_str("\nhint: ");
-                        out.push_str(&h);
-                    }
-                    Err(out)
-                }
-            }
-        }
-        Some("remove") => {
-            let id = args
-                .get(1)
-                .ok_or_else(|| "usage: share remove <id>".to_string())?;
-            match s.smb_shares.remove(id).await {
-                Ok(()) => Ok(format!("removed {id}")),
-                Err(e) => Err(format!("remove failed: {e}")),
-            }
-        }
-        Some("scan") => {
-            let id = args
-                .get(1)
-                .ok_or_else(|| "usage: share scan <id>".to_string())?;
-            match s.smb_shares.rescan(id).await {
-                Ok(n) => Ok(format!("re-scanned {id}: {n} isos")),
-                Err(e) => Err(format!("scan failed: {e}")),
-            }
-        }
-        Some(other) => Err(format!(
-            "unknown share subcommand: {other}\ntry: share [list|add|remove|scan]"
-        )),
-    }
-}
-
-// ── nfs (v0.4.67: in-process NFSv3 via nfs3_client) ────────────────────
-
-async fn nfs_share_command(s: &AppState, args: &[String]) -> Result<String, String> {
-    match args.first().map(String::as_str) {
-        None | Some("list") => {
-            let shares = s.nfs_shares.list();
-            if shares.is_empty() {
-                return Ok("(no NFS shares configured)".into());
-            }
-            let mut out = String::new();
-            let _ = writeln!(
-                out,
-                "{:<24} {:<7} {:<6} TARGET",
-                "ID", "STATUS", "ISOS"
-            );
-            for m in shares {
-                let status = if m.reachable { "ok" } else { "down" };
-                let _ = writeln!(
-                    out,
-                    "{:<24} {:<7} {:<6} {}:{}",
+                    "{:<24} {:<6} {:<7} {:<6} {}:{}",
                     truncate(&m.id, 24),
+                    match m.version {
+                        openpxe_iso_store::NfsVersion::V3 => "v3",
+                        openpxe_iso_store::NfsVersion::V41 => "v4.1",
+                    },
                     status,
                     m.iso_count,
                     m.server,
@@ -420,58 +280,50 @@ async fn nfs_share_command(s: &AppState, args: &[String]) -> Result<String, Stri
                 if let Some(e) = m.last_error {
                     let _ = writeln!(out, "    error: {e}");
                 }
-                if let Some(h) = m.last_hint {
-                    let _ = writeln!(out, "    hint:  {h}");
-                }
             }
             Ok(out)
         }
-        Some("add") => {
-            // nfs add <server>:<export> [port]
+        Some("mount") => {
+            // nfs mount <server>:<export> [v3|v41] [ro|rw]
             let target = args
                 .get(1)
-                .ok_or_else(|| "usage: nfs add <server>:<export> [port]".to_string())?;
+                .ok_or_else(|| "usage: nfs mount <server>:<export> [v3|v41] [ro|rw]".to_string())?;
             let (server, export) = target
                 .split_once(':')
                 .ok_or_else(|| "target must be 'server:/export'".to_string())?;
-            let port = args.get(2).and_then(|s| s.parse::<u16>().ok());
+            let version = match args.get(2).map(String::as_str) {
+                Some("v3") => openpxe_iso_store::NfsVersion::V3,
+                Some("v41") | None => openpxe_iso_store::NfsVersion::V41,
+                Some(other) => return Err(format!("unknown nfs version: {other} (expect v3 or v41)")),
+            };
+            let read_only = !matches!(args.get(3).map(String::as_str), Some("rw"));
             let req = openpxe_iso_store::NfsAddRequest {
                 server: server.to_string(),
                 export: export.to_string(),
-                port,
+                version,
+                read_only,
             };
-            match s.nfs_shares.add(req).await {
-                Ok(m) => Ok(format!("added {} ({} isos)", m.id, m.iso_count)),
-                Err(e) => {
-                    let mut out = format!("add failed: {}", e.error);
-                    if let Some(h) = e.hint {
-                        out.push_str("\nhint: ");
-                        out.push_str(&h);
-                    }
-                    Err(out)
+            match s.nfs.add(req).await {
+                Ok(m) => Ok(format!("mounted {} ({} isos)", m.id, m.iso_count)),
+                Err(e) => Err(format!("mount failed: {e}")),
             }
         }
-        }
-        Some("remove") => {
-            let id = args
-                .get(1)
-                .ok_or_else(|| "usage: nfs remove <id>".to_string())?;
-            match s.nfs_shares.remove(id).await {
-                Ok(()) => Ok(format!("removed {id}")),
-                Err(e) => Err(format!("remove failed: {e}")),
+        Some("unmount") => {
+            let id = args.get(1).ok_or_else(|| "usage: nfs unmount <id>".to_string())?;
+            match s.nfs.remove(id).await {
+                Ok(()) => Ok(format!("unmounted {id}")),
+                Err(e) => Err(format!("unmount failed: {e}")),
             }
         }
         Some("scan") => {
-            let id = args
-                .get(1)
-                .ok_or_else(|| "usage: nfs scan <id>".to_string())?;
-            match s.nfs_shares.rescan(id).await {
+            let id = args.get(1).ok_or_else(|| "usage: nfs scan <id>".to_string())?;
+            match s.nfs.rescan(id).await {
                 Ok(n) => Ok(format!("re-scanned {id}: {n} isos")),
                 Err(e) => Err(format!("scan failed: {e}")),
             }
         }
         Some(other) => Err(format!(
-            "unknown nfs subcommand: {other}\ntry: nfs [list|add|remove|scan]"
+            "unknown nfs subcommand: {other}\ntry: nfs [list|mount|unmount|scan]"
         )),
     }
 }
@@ -516,7 +368,10 @@ fn log_command(s: &AppState, args: &[String]) -> Result<String, String> {
             Ok("log buffer cleared".into())
         }
         Some("tail") => {
-            let n: usize = args.get(1).and_then(|v| v.parse().ok()).unwrap_or(20);
+            let n: usize = args
+                .get(1)
+                .and_then(|v| v.parse().ok())
+                .unwrap_or(20);
             let lines = s.log_bus.recent();
             let start = lines.len().saturating_sub(n);
             let mut out = String::new();
@@ -607,23 +462,18 @@ OpenPXE terminal — available commands:
 
   isos                              list registered ISOs
   clients                           list PXE clients seen this session
-  queue list                        list queued clients
-  queue assign <entry_id> <target>   assign one queued client to a boot entry
-  queue assign-all <target>         assign every waiting client
-  queue release <entry_id>           release one queued client
+  gate list                         list gated-deployment queue
+  gate assign <entry_id> <target>    assign one gate to a boot entry
+  gate assign-all <target>          assign every waiting gate
+  gate release <entry_id>            release one gate
 
-  share list                        list configured SMB shares
-  share add //srv/share [auth]      add an SMB share; auth = 'guest' or 'user:pass'
-  share remove <id>                 forget an SMB share
-  share scan <id>                   re-list a share for new ISOs
+  nfs list                          list NFS mounts
+  nfs mount <s>:<e> [v3|v41] [ro|rw]  add and mount an NFS share
+  nfs unmount <id>                  unmount and forget a share
+  nfs scan <id>                     re-scan a share for new ISOs
 
-  nfs list                          list configured NFSv3 shares
-  nfs add <srv>:<export> [port]     add an NFSv3 share
-  nfs remove <id>                   forget an NFS share
-  nfs scan <id>                     re-list an NFS share for new ISOs
-
-  smb status                        outbound Samba state (Windows install media)
-  smb start | stop | reload         control the outbound smbd
+  smb status                        SMB (Samba) state
+  smb start | stop | reload         control smbd
 
   log clear                         drop the in-memory log ring buffer
   log tail [n]                      show the last n buffered lines (default 20)
@@ -638,10 +488,10 @@ mod tests {
     #[test]
     fn shell_split_basic() {
         assert_eq!(shell_split(""), Vec::<String>::new());
-        assert_eq!(shell_split("share list"), vec!["share", "list"]);
+        assert_eq!(shell_split("nfs list"), vec!["nfs", "list"]);
         assert_eq!(
-            shell_split("share add //nas/isos guest"),
-            vec!["share", "add", "//nas/isos", "guest"]
+            shell_split("nfs mount 10.0.0.5:/srv v41 ro"),
+            vec!["nfs", "mount", "10.0.0.5:/srv", "v41", "ro"]
         );
     }
 
@@ -671,10 +521,4 @@ mod tests {
         assert_eq!(truncate("hi", 10), "hi");
         assert_eq!(truncate("longerthanfive", 5), "long…");
     }
-
-    #[test]
-    fn help_uses_queue_language() {
-        assert!(HELP_TEXT.contains("queue list"));
-        assert!(HELP_TEXT.contains("queued clients"));
-    }
 }

crates/http-api/src/uploads.rs

@@ -1,180 +0,0 @@
-//! Chunked upload sessions for browser-driven ISO uploads.
-//!
-//! The legacy multipart endpoint still exists for simple API clients, but
-//! browsers get a better failure mode with raw chunks: progress advances after
-//! each acknowledged write, partial files appear in the ISO directory
-//! immediately, and reverse proxies are less likely to buffer an entire DVD
-//! image before OpenPXE sees byte one.
-
-use bytes::Bytes;
-use openpxe_core::{Error, Result};
-use openpxe_iso_store::{IsoMeta, IsoStore, UploadHandle};
-use serde::Serialize;
-use std::collections::HashMap;
-use std::sync::Arc;
-use tokio::sync::Mutex;
-use uuid::Uuid;
-
-const DEFAULT_CHUNK_SIZE: u64 = 8 * 1024 * 1024;
-
-#[derive(Clone, Default)]
-pub struct UploadSessions {
-    inner: Arc<Mutex<HashMap<String, Arc<Mutex<UploadSession>>>>>,
-}
-
-struct UploadSession {
-    filename: String,
-    expected_size: Option<u64>,
-    offset: u64,
-    handle: Option<UploadHandle>,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct UploadStarted {
-    pub upload_id: String,
-    pub iso_id: String,
-    pub filename: String,
-    pub offset: u64,
-    pub chunk_size: u64,
-}
-
-#[derive(Debug, Clone, Serialize)]
-#[serde(rename_all = "snake_case")]
-pub enum UploadAppend {
-    Progress { offset: u64 },
-    Complete { offset: u64, iso: Box<IsoMeta> },
-}
-
-impl UploadSessions {
-    pub async fn begin(
-        &self,
-        store: &IsoStore,
-        filename: &str,
-        expected_size: Option<u64>,
-    ) -> Result<UploadStarted> {
-        if !filename.to_ascii_lowercase().ends_with(".iso") {
-            return Err(Error::Invalid("only .iso uploads accepted".to_string()));
-        }
-
-        let handle = store.begin_upload(filename).await?;
-        let iso_id = handle.id.clone();
-        let upload_id = Uuid::new_v4().to_string();
-        let session = UploadSession {
-            filename: filename.to_string(),
-            expected_size,
-            offset: 0,
-            handle: Some(handle),
-        };
-
-        self.inner
-            .lock()
-            .await
-            .insert(upload_id.clone(), Arc::new(Mutex::new(session)));
-
-        Ok(UploadStarted {
-            upload_id,
-            iso_id,
-            filename: filename.to_string(),
-            offset: 0,
-            chunk_size: DEFAULT_CHUNK_SIZE,
-        })
-    }
-
-    pub async fn append(
-        &self,
-        store: &IsoStore,
-        upload_id: &str,
-        offset: u64,
-        chunk: Bytes,
-        complete: bool,
-    ) -> Result<UploadAppend> {
-        let Some(session_lock) = self.inner.lock().await.get(upload_id).cloned() else {
-            return Err(Error::Invalid(format!("no such upload '{upload_id}'")));
-        };
-
-        let mut session = session_lock.lock().await;
-        if session.offset != offset {
-            return Err(Error::Invalid(format!(
-                "expected offset {}, got {offset}",
-                session.offset
-            )));
-        }
-
-        let new_offset = session
-            .offset
-            .checked_add(chunk.len() as u64)
-            .ok_or_else(|| Error::Invalid("upload offset overflow".to_string()))?;
-
-        if let Some(expected) = session.expected_size {
-            if new_offset > expected {
-                return Err(Error::Invalid(format!(
-                    "chunk exceeds declared upload size {expected}"
-                )));
-            }
-        }
-
-        let Some(handle) = session.handle.as_mut() else {
-            return Err(Error::Invalid("upload already completed".to_string()));
-        };
-        if let Err(e) = handle.write_chunk(&chunk).await {
-            let handle = session.handle.take();
-            drop(session);
-            self.inner.lock().await.remove(upload_id);
-            if let Some(handle) = handle {
-                let _ = handle.abort().await;
-            }
-            return Err(e);
-        }
-
-        session.offset = new_offset;
-        if !complete {
-            return Ok(UploadAppend::Progress { offset: new_offset });
-        }
-
-        if let Some(expected) = session.expected_size {
-            if new_offset != expected {
-                return Err(Error::Invalid(format!(
-                    "final chunk ended at {new_offset}, expected {expected}"
-                )));
-            }
-        }
-
-        let Some(handle) = session.handle.take() else {
-            return Err(Error::Invalid("upload already completed".to_string()));
-        };
-        let filename = session.filename.clone();
-        drop(session);
-
-        tracing::info!(
-            target: "openpxe::http::upload",
-            upload_id,
-            filename = %filename,
-            received_bytes = new_offset,
-            "chunked upload body complete; introspecting"
-        );
-
-        let meta = match handle.finish(store).await {
-            Ok(meta) => meta,
-            Err(e) => {
-                self.inner.lock().await.remove(upload_id);
-                return Err(e);
-            }
-        };
-        self.inner.lock().await.remove(upload_id);
-        Ok(UploadAppend::Complete {
-            offset: new_offset,
-            iso: Box::new(meta),
-        })
-    }
-
-    pub async fn abort(&self, upload_id: &str) -> Result<()> {
-        let Some(session_lock) = self.inner.lock().await.remove(upload_id) else {
-            return Err(Error::Invalid(format!("no such upload '{upload_id}'")));
-        };
-        let mut session = session_lock.lock().await;
-        if let Some(handle) = session.handle.take() {
-            handle.abort().await?;
-        }
-        Ok(())
-    }
-}

crates/ipxe-assets/src/lib.rs

@@ -51,9 +51,7 @@ pub fn asset_slice(name: &str) -> Option<std::borrow::Cow<'static, [u8]>> {
 /// Enumerate embedded asset filenames. Useful for startup logging so the
 /// operator can immediately tell which architectures will work.
 pub fn list_assets() -> Vec<String> {
-    IpxeAssets::iter()
-        .map(std::borrow::Cow::into_owned)
-        .collect()
+    IpxeAssets::iter().map(std::borrow::Cow::into_owned).collect()
 }
 
 /// Log at startup which iPXE binaries are present and which are missing.

crates/iso-store/Cargo.toml

@@ -20,28 +20,12 @@ thiserror.workspace = true
 anyhow.workspace = true
 sha2.workspace = true
 hex.workspace = true
-bcrypt.workspace = true
 uuid.workspace = true
 time.workspace = true
 parking_lot.workspace = true
 bytes.workspace = true
 tempfile = "3.12"
 libc = "0.2"
-# v0.4.61: server-side compose of the operator's uploaded raster into a
-# fixed 1024x768 canvas so the PXE menu always gets a consistently-sized
-# PNG regardless of what the operator uploaded. We use the bare-bones
-# `image` crate (no default features) and explicitly enable only the
-# decoders we accept on upload (PNG/JPEG/WebP/GIF) plus the PNG
-# encoder. Keeps the build slim — no JPEG2000, TIFF, BMP, etc.
-image = { version = "0.25", default-features = false, features = ["png", "jpeg", "webp", "gif"] }
-
-# v0.4.67: pure-Rust NFSv3 client for reading remote ISOs without a
-# kernel mount. See crates/iso-store/src/nfs_share.rs for usage.
-nfs3_client = { workspace = true }
-nfs3_types = { workspace = true }
-# Needed for the Stream trait that wraps the mpsc receiver feeding
-# NFS read-loop bytes into axum's Body::from_stream.
-futures = { workspace = true }
 
 [dev-dependencies]
 tempfile = "3.12"

crates/iso-store/src/introspect.rs

@@ -78,9 +78,7 @@ pub fn introspect(path: &Path) -> IntrospectionReport {
     let mut haystack = Vec::with_capacity(scan_bytes.min(32 * 1024 * 1024));
     while read_total < scan_bytes {
         let n = f.read(&mut buf).unwrap_or(0);
-        if n == 0 {
-            break;
-        }
+        if n == 0 { break; }
         haystack.extend_from_slice(&buf[..n]);
         read_total += n;
     }
@@ -109,11 +107,8 @@ fn family_from_label(label: &str) -> DistroFamily {
     let l = label.to_ascii_lowercase();
     if l.contains("ubuntu") || l.contains("debian") || l.contains("mint") {
         DistroFamily::DebianUbuntu
-    } else if l.contains("rhel")
-        || l.contains("centos")
-        || l.contains("fedora")
-        || l.contains("rocky")
-        || l.contains("alma")
+    } else if l.contains("rhel") || l.contains("centos") || l.contains("fedora")
+        || l.contains("rocky") || l.contains("alma")
     {
         DistroFamily::RhelFedora
     } else if l.contains("suse") || l.contains("opensuse") {
@@ -132,30 +127,17 @@ fn family_from_label(label: &str) -> DistroFamily {
 fn guess_kernel_initrd(family: DistroFamily) -> (Option<&'static str>, Vec<&'static str>) {
     match family {
         DistroFamily::DebianUbuntu => (Some("/casper/vmlinuz"), vec!["/casper/initrd"]),
-        DistroFamily::RhelFedora => (
-            Some("/images/pxeboot/vmlinuz"),
-            vec!["/images/pxeboot/initrd.img"],
-        ),
-        DistroFamily::OpenSuse => (
-            Some("/boot/x86_64/loader/linux"),
-            vec!["/boot/x86_64/loader/initrd"],
-        ),
-        DistroFamily::Arch => (
-            Some("/arch/boot/x86_64/vmlinuz-linux"),
-            vec!["/arch/boot/x86_64/initramfs-linux.img"],
-        ),
+        DistroFamily::RhelFedora => (Some("/images/pxeboot/vmlinuz"), vec!["/images/pxeboot/initrd.img"]),
+        DistroFamily::OpenSuse => (Some("/boot/x86_64/loader/linux"), vec!["/boot/x86_64/loader/initrd"]),
+        DistroFamily::Arch => (Some("/arch/boot/x86_64/vmlinuz-linux"), vec!["/arch/boot/x86_64/initramfs-linux.img"]),
         DistroFamily::Alpine => (Some("/boot/vmlinuz-lts"), vec!["/boot/initramfs-lts"]),
         DistroFamily::WindowsPe | DistroFamily::Unknown => (None, Vec::new()),
     }
 }
 
 fn contains_ascii(haystack: &[u8], needle: &[u8]) -> bool {
-    if needle.is_empty() || haystack.len() < needle.len() {
-        return false;
-    }
-    haystack
-        .windows(needle.len())
-        .any(|w| w.eq_ignore_ascii_case(needle))
+    if needle.is_empty() || haystack.len() < needle.len() { return false; }
+    haystack.windows(needle.len()).any(|w| w.eq_ignore_ascii_case(needle))
 }
 
 #[cfg(test)]
@@ -164,18 +146,9 @@ mod tests {
 
     #[test]
     fn label_matching() {
-        assert_eq!(
-            family_from_label("Ubuntu 24.04"),
-            DistroFamily::DebianUbuntu
-        );
-        assert_eq!(
-            family_from_label("Rocky-9-x86_64-dvd"),
-            DistroFamily::RhelFedora
-        );
-        assert_eq!(
-            family_from_label("openSUSE-Leap-15.6"),
-            DistroFamily::OpenSuse
-        );
+        assert_eq!(family_from_label("Ubuntu 24.04"), DistroFamily::DebianUbuntu);
+        assert_eq!(family_from_label("Rocky-9-x86_64-dvd"), DistroFamily::RhelFedora);
+        assert_eq!(family_from_label("openSUSE-Leap-15.6"), DistroFamily::OpenSuse);
         assert_eq!(family_from_label("ARCH_202604"), DistroFamily::Arch);
         assert_eq!(family_from_label("weird-custom"), DistroFamily::Unknown);
     }

crates/iso-store/src/lib.rs

@@ -18,29 +18,14 @@
 
 pub mod entry;
 pub mod introspect;
-pub mod nfs_share;
-pub mod pxe_logo;
+pub mod nfs;
 pub mod smb;
-pub mod smb_share;
 pub mod store;
 pub mod windows;
 
 pub use entry::{BootEntry, BootKind, KernelArgs};
 pub use introspect::{DistroFamily, IntrospectionReport};
-// v0.4.65: kernel-mount NFS is gone. SMB shares via Samba's userspace
-// `smbclient` CLI replaced it — works in any container (no
-// CAP_SYS_ADMIN, no host kernel modules), matching how Bootimus and
-// every other PXE/imaging tool that supports network storage handles
-// it.
+pub use nfs::{NfsAddRequest, NfsManager, NfsMount, NfsVersion};
 pub use smb::{extract_windows_iso, SmbManager, SmbState};
-pub use smb_share::{SmbAddRequest, SmbShare, SmbShareError, SmbShareManager, SmbStream};
-// v0.4.67: NFS is back — this time as an in-process userspace NFSv3
-// client (the `nfs3_client` crate) rather than a kernel mount. Same
-// "works in any container" property as SMB, plus support for HTTP
-// Range requests because NFSv3 READ3 takes an explicit offset.
-pub use nfs_share::{NfsAddRequest, NfsShare, NfsShareError, NfsShareManager, NfsStream};
-pub use store::{
-    generate_boot_entries_for, slugify_str, IsoCategory, IsoMeta, IsoSource, IsoStore,
-    UploadHandle,
-};
+pub use store::{generate_boot_entries_for, slugify_str, IsoMeta, IsoSource, IsoStore, UploadHandle};
 pub use windows::{WimPatcher, WinPatchState};

crates/iso-store/src/nfs.rs

@@ -0,0 +1,564 @@
+//! NFS share manager.
+//!
+//! Lets an operator mount a remote NFS export as an ISO source instead of
+//! uploading every ISO into the container's PVC. Supports NFSv3 and
+//! NFSv4.1 — the two versions the user explicitly asked for.
+//!
+//! ## How it works
+//!
+//! 1. Operator submits a mount spec via the Storage tab:
+//!    `{ server: "10.0.0.20", export: "/srv/isos", version: "v41" }`.
+//! 2. We slugify a stable id, mkdir `<work_dir>/nfs/<id>/`, then shell out
+//!    to `/bin/mount -t nfs -o vers=...,ro,nolock server:export local`.
+//! 3. On success we walk the mount point looking for `*.iso` files and
+//!    register each one with the `IsoStore` as an external source — same
+//!    introspection pipeline as a web upload, but no sha256 (the bytes
+//!    live on a remote machine; hashing them would suck them through the
+//!    network on every restart).
+//! 4. On failure we record `last_error` on the spec and persist anyway
+//!    so the UI can show a row in red rather than silently dropping it.
+//!
+//! ## Operational notes
+//!
+//! - Mounting NFS inside a container needs `CAP_SYS_ADMIN` and the
+//!   `nfs-common` package. The default image ships these (see Dockerfile).
+//! - On OpenShift, the SCC must allow `CAP_SYS_ADMIN`. The bundled SCC
+//!   doesn't — operators have to opt in by switching to a more privileged
+//!   SCC or running NFS mounts as a CSI driver outside the pod.
+//! - Mount commands are issued sequentially under a single mutex to avoid
+//!   `mount` racing on the same target dir.
+//!
+//! ## Persistence
+//!
+//! Mount specs (without runtime state) live at `<work_dir>/nfs.json`,
+//! re-mounted on startup. Mounts that fail to come back online keep their
+//! spec and their `last_error` so the operator sees what happened.
+
+use crate::introspect::{introspect, IntrospectionReport};
+use crate::store::{generate_boot_entries_for, slugify_str, IsoSource, IsoStore};
+use parking_lot::Mutex;
+use openpxe_core::{Error, Result};
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+use time::OffsetDateTime;
+use tokio::process::Command;
+
+/// Wire-protocol versions we support. Keep this enum closed — silently
+/// accepting "auto" or letting the kernel negotiate would mean operators
+/// could never confirm which version is in use.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum NfsVersion {
+    /// NFSv3 — UDP/TCP, separate `mountd` protocol. Required for many
+    /// older NAS appliances.
+    V3,
+    /// NFSv4.1 — single TCP port (2049), session-based. Modern default.
+    V41,
+}
+
+impl NfsVersion {
+    fn vers_arg(self) -> &'static str {
+        match self {
+            Self::V3 => "vers=3",
+            Self::V41 => "vers=4.1",
+        }
+    }
+}
+
+/// One configured mount. The id is generated from server+export so the
+/// operator can re-add the same export idempotently.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct NfsMount {
+    pub id: String,
+    pub server: String,
+    pub export: String,
+    pub version: NfsVersion,
+    /// Read-only by default — most ISO libraries are. Operators that need
+    /// write can flip this off but OpenPXE itself never writes.
+    pub read_only: bool,
+    /// Local mount point under `<work_dir>/nfs/`.
+    pub local_path: PathBuf,
+    /// Whether the mount is currently active.
+    pub mounted: bool,
+    /// Last error encountered on a `mount` or `umount` attempt; cleared on
+    /// success.
+    pub last_error: Option<String>,
+    #[serde(with = "time::serde::rfc3339::option")]
+    pub last_attempt: Option<OffsetDateTime>,
+    /// Number of `.iso` files found on the share (re-counted on each scan).
+    pub iso_count: u32,
+}
+
+/// Spec submitted by the UI. Server and export are normalized before use.
+#[derive(Debug, Clone, Deserialize)]
+pub struct NfsAddRequest {
+    pub server: String,
+    pub export: String,
+    #[serde(default = "default_version")]
+    pub version: NfsVersion,
+    #[serde(default = "default_ro")]
+    pub read_only: bool,
+}
+
+fn default_version() -> NfsVersion {
+    NfsVersion::V41
+}
+fn default_ro() -> bool {
+    true
+}
+
+#[derive(Debug, Default)]
+struct Inner {
+    mounts: HashMap<String, NfsMount>,
+}
+
+/// Manages NFS mounts and surfaces them as ISO sources.
+///
+/// Cheap to clone — internal state is `Arc<Mutex<...>>`.
+#[derive(Debug, Clone)]
+pub struct NfsManager {
+    work_root: Arc<PathBuf>,
+    state_path: Arc<PathBuf>,
+    inner: Arc<Mutex<Inner>>,
+    iso_store: IsoStore,
+    /// Single-writer lock around the actual `mount`/`umount` shell-outs;
+    /// avoids racing on the same target directory.
+    mount_lock: Arc<tokio::sync::Mutex<()>>,
+}
+
+impl NfsManager {
+    /// Construct a manager rooted at `work_dir`. Mount points live under
+    /// `<work_dir>/nfs/<id>/`. State persists to `<work_dir>/nfs.json`.
+    #[must_use]
+    pub fn new(work_dir: &Path, iso_store: IsoStore) -> Self {
+        let work_root = work_dir.join("nfs");
+        let state_path = work_dir.join("nfs.json");
+        Self {
+            work_root: Arc::new(work_root),
+            state_path: Arc::new(state_path),
+            inner: Arc::new(Mutex::new(Inner::default())),
+            iso_store,
+            mount_lock: Arc::new(tokio::sync::Mutex::new(())),
+        }
+    }
+
+    /// Where this manager mounts shares. Used by `IsoStore` to resolve
+    /// NFS-backed `IsoMeta`s to their on-disk path.
+    #[must_use]
+    pub fn mount_root(&self) -> PathBuf {
+        self.work_root.as_ref().clone()
+    }
+
+    /// Load persisted state and re-attempt every mount. Errors are logged
+    /// per-mount but never fail the call — startup must not block on a
+    /// remote NFS server being slow.
+    pub async fn load_and_remount(&self) -> Result<()> {
+        tokio::fs::create_dir_all(self.work_root.as_path()).await?;
+        let mounts = match tokio::fs::read_to_string(self.state_path.as_path()).await {
+            Ok(text) => serde_json::from_str::<Vec<NfsMount>>(&text).unwrap_or_default(),
+            Err(_) => Vec::new(),
+        };
+        for mut m in mounts {
+            // Always start from "not mounted" — the kernel state was lost
+            // when the process died. We'll try to remount each one.
+            m.mounted = false;
+            m.last_error = None;
+            self.inner.lock().mounts.insert(m.id.clone(), m.clone());
+            if let Err(e) = self.try_mount(&m.id).await {
+                tracing::warn!(
+                    target: "openpxe::nfs",
+                    id = %m.id, error = %e,
+                    "could not remount NFS share on startup"
+                );
+            }
+        }
+        Ok(())
+    }
+
+    /// Add a new mount. Returns the resulting `NfsMount` (with `mounted`
+    /// reflecting reality) or an error if the spec was invalid.
+    pub async fn add(&self, req: NfsAddRequest) -> Result<NfsMount> {
+        let server = req.server.trim().to_string();
+        let export = req.export.trim().to_string();
+        if server.is_empty() {
+            return Err(Error::Invalid("server is required".into()));
+        }
+        if !export.starts_with('/') {
+            return Err(Error::Invalid("export path must start with '/'".into()));
+        }
+
+        let id = mount_id(&server, &export);
+        let local_path = self.work_root.join(&id);
+        tokio::fs::create_dir_all(&local_path).await?;
+
+        let mount = NfsMount {
+            id: id.clone(),
+            server,
+            export,
+            version: req.version,
+            read_only: req.read_only,
+            local_path,
+            mounted: false,
+            last_error: None,
+            last_attempt: None,
+            iso_count: 0,
+        };
+        self.inner.lock().mounts.insert(id.clone(), mount);
+        self.persist_locked();
+        self.try_mount(&id).await?;
+        Ok(self.get(&id).expect("mount just inserted"))
+    }
+
+    /// Unmount and forget a share. Removes any ISOs it contributed from
+    /// the IsoStore and deletes the local mount point. Idempotent.
+    pub async fn remove(&self, id: &str) -> Result<()> {
+        // Best-effort umount; even if it fails (e.g. server unreachable)
+        // we still want to drop the in-memory record.
+        let _ = self.umount_one(id).await;
+        let local_path = {
+            let mut g = self.inner.lock();
+            g.mounts.remove(id).map(|m| m.local_path)
+        };
+        self.persist_locked();
+        self.iso_store.drop_external_source(id);
+        if let Some(p) = local_path {
+            // rmdir only — never recurse, the mount could still be live
+            // on some kernel error path and we don't want to nuke a
+            // remote filesystem.
+            let _ = tokio::fs::remove_dir(&p).await;
+        }
+        Ok(())
+    }
+
+    /// Re-scan a mounted share for ISOs, refreshing the IsoStore.
+    pub async fn rescan(&self, id: &str) -> Result<u32> {
+        let mount = self
+            .get(id)
+            .ok_or_else(|| Error::Invalid(format!("no such mount '{id}'")))?;
+        if !mount.mounted {
+            return Err(Error::Invalid(format!("mount '{id}' is not active")));
+        }
+        let count = self.scan_and_register(&mount).await?;
+        if let Some(m) = self.inner.lock().mounts.get_mut(id) {
+            m.iso_count = count;
+        }
+        self.persist_locked();
+        Ok(count)
+    }
+
+    /// Snapshot of every configured mount.
+    #[must_use]
+    pub fn list(&self) -> Vec<NfsMount> {
+        let g = self.inner.lock();
+        let mut v: Vec<_> = g.mounts.values().cloned().collect();
+        v.sort_by(|a, b| a.id.cmp(&b.id));
+        v
+    }
+
+    /// Look up a single mount by id.
+    #[must_use]
+    pub fn get(&self, id: &str) -> Option<NfsMount> {
+        self.inner.lock().mounts.get(id).cloned()
+    }
+
+    // ── internals ─────────────────────────────────────────────────────
+
+    async fn try_mount(&self, id: &str) -> Result<()> {
+        let _g = self.mount_lock.lock().await;
+
+        let m = self
+            .get(id)
+            .ok_or_else(|| Error::Invalid(format!("no such mount '{id}'")))?;
+        let now = OffsetDateTime::now_utc();
+
+        // Already mounted? Skip — `mount` would error on a busy target
+        // and confuse the operator's UI status.
+        if is_mountpoint(&m.local_path).await {
+            self.update_status(id, true, None, now);
+            // Even though already mounted, we still want a fresh ISO count.
+            let count = self.scan_and_register(&m).await.unwrap_or(0);
+            self.update_iso_count(id, count);
+            return Ok(());
+        }
+
+        let opts = mount_options(&m);
+        let target = format!("{}:{}", m.server, m.export);
+
+        let output = Command::new("mount")
+            .arg("-t")
+            .arg("nfs")
+            .arg("-o")
+            .arg(&opts)
+            .arg(&target)
+            .arg(&m.local_path)
+            .output()
+            .await;
+
+        match output {
+            Ok(out) if out.status.success() => {
+                tracing::info!(
+                    target: "openpxe::nfs",
+                    id = %id, server = %m.server, export = %m.export,
+                    version = ?m.version,
+                    "NFS mount succeeded"
+                );
+                self.update_status(id, true, None, now);
+                let count = self.scan_and_register(&m).await.unwrap_or(0);
+                self.update_iso_count(id, count);
+                Ok(())
+            }
+            Ok(out) => {
+                let err = format!(
+                    "mount exit {}: {}",
+                    out.status.code().unwrap_or(-1),
+                    String::from_utf8_lossy(&out.stderr).trim()
+                );
+                tracing::warn!(target: "openpxe::nfs", id = %id, "{err}");
+                self.update_status(id, false, Some(err.clone()), now);
+                Err(Error::Invalid(err))
+            }
+            Err(e) => {
+                let err = format!("could not exec /bin/mount: {e}");
+                tracing::error!(target: "openpxe::nfs", id = %id, "{err}");
+                self.update_status(id, false, Some(err.clone()), now);
+                Err(Error::Invalid(err))
+            }
+        }
+    }
+
+    async fn umount_one(&self, id: &str) -> Result<()> {
+        let _g = self.mount_lock.lock().await;
+        let Some(m) = self.get(id) else { return Ok(()) };
+        if !is_mountpoint(&m.local_path).await {
+            self.update_status(id, false, None, OffsetDateTime::now_utc());
+            return Ok(());
+        }
+        // -l = lazy: detach immediately, finish when no process has a
+        // handle. Important if a stale ISO read is still in flight.
+        let out = Command::new("umount")
+            .arg("-l")
+            .arg(&m.local_path)
+            .output()
+            .await;
+        match out {
+            Ok(o) if o.status.success() => {
+                self.update_status(id, false, None, OffsetDateTime::now_utc());
+                Ok(())
+            }
+            Ok(o) => {
+                let e = format!(
+                    "umount exit {}: {}",
+                    o.status.code().unwrap_or(-1),
+                    String::from_utf8_lossy(&o.stderr).trim()
+                );
+                self.update_status(id, false, Some(e.clone()), OffsetDateTime::now_utc());
+                Err(Error::Invalid(e))
+            }
+            Err(e) => {
+                let e = format!("could not exec /bin/umount: {e}");
+                self.update_status(id, false, Some(e.clone()), OffsetDateTime::now_utc());
+                Err(Error::Invalid(e))
+            }
+        }
+    }
+
+    /// Walk the mount point for `*.iso` files, introspect each one, and
+    /// register it with the IsoStore as an NFS-sourced entry. Returns the
+    /// count of ISOs registered.
+    async fn scan_and_register(&self, m: &NfsMount) -> Result<u32> {
+        // Drop any prior entries from this mount before re-registering, so
+        // a removed file disappears from the store.
+        self.iso_store.drop_external_source(&m.id);
+
+        let mut walker = tokio::fs::read_dir(&m.local_path).await?;
+        let mut count = 0u32;
+        while let Some(entry) = walker.next_entry().await? {
+            let p = entry.path();
+            if p.extension()
+                .and_then(|e| e.to_str())
+                .map(str::to_ascii_lowercase)
+                .as_deref()
+                != Some("iso")
+            {
+                continue;
+            }
+            let filename = match p.file_name().and_then(|s| s.to_str()) {
+                Some(f) => f.to_string(),
+                None => continue,
+            };
+            let size = tokio::fs::metadata(&p).await?.len();
+            // Introspection is sync + IO-bound (reads ISO9660 PVD). Push
+            // it to a blocking thread so the runtime stays responsive on
+            // a slow share.
+            let p_owned = p.clone();
+            let report: IntrospectionReport =
+                tokio::task::spawn_blocking(move || introspect(&p_owned))
+                    .await
+                    .map_err(|e| Error::Other(e.into()))?;
+            let id = format!("nfs-{}-{}", m.id, slugify_str(&filename));
+            let boot_entries = generate_boot_entries_for(&id, &filename, &report);
+            let source = IsoSource::Nfs {
+                mount_id: m.id.clone(),
+                relative_path: filename.clone(),
+            };
+            self.iso_store.register_external(
+                id,
+                filename,
+                size,
+                report,
+                boot_entries,
+                source,
+            );
+            count += 1;
+        }
+        Ok(count)
+    }
+
+    fn update_status(&self, id: &str, mounted: bool, err: Option<String>, ts: OffsetDateTime) {
+        if let Some(m) = self.inner.lock().mounts.get_mut(id) {
+            m.mounted = mounted;
+            m.last_error = err;
+            m.last_attempt = Some(ts);
+        }
+        self.persist_locked();
+    }
+
+    fn update_iso_count(&self, id: &str, count: u32) {
+        if let Some(m) = self.inner.lock().mounts.get_mut(id) {
+            m.iso_count = count;
+        }
+        self.persist_locked();
+    }
+
+    /// Atomically replace the on-disk JSON with the current state.
+    /// Persistence errors are logged, never propagated — settings live in
+    /// memory authoritatively, matching the SettingsStore policy.
+    fn persist_locked(&self) {
+        let mounts: Vec<NfsMount> = self.inner.lock().mounts.values().cloned().collect();
+        let path = self.state_path.as_path();
+        let tmp = path.with_extension("json.tmp");
+        let body = match serde_json::to_vec_pretty(&mounts) {
+            Ok(b) => b,
+            Err(e) => {
+                tracing::warn!(target: "openpxe::nfs", "serialize NFS state: {e}");
+                return;
+            }
+        };
+        if let Some(parent) = path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        if let Err(e) = std::fs::write(&tmp, body) {
+            tracing::warn!(target: "openpxe::nfs", "write NFS state tmp: {e}");
+            return;
+        }
+        if let Err(e) = std::fs::rename(&tmp, path) {
+            tracing::warn!(target: "openpxe::nfs", "rename NFS state: {e}");
+        }
+    }
+}
+
+fn mount_options(m: &NfsMount) -> String {
+    let mut opts = vec![m.version.vers_arg().to_string()];
+    if m.read_only {
+        opts.push("ro".into());
+    } else {
+        opts.push("rw".into());
+    }
+    // `nolock` for v3 — many storage appliances disable lockd; we don't
+    // need locking for read-only ISO access anyway.
+    if matches!(m.version, NfsVersion::V3) {
+        opts.push("nolock".into());
+    }
+    // Soft mount with a generous timeout — better to surface a hung share
+    // as a user-visible error than to wedge the iPXE client forever on a
+    // dead NFS server.
+    opts.push("soft".into());
+    opts.push("timeo=100".into());
+    opts.push("retrans=3".into());
+    opts.join(",")
+}
+
+fn mount_id(server: &str, export: &str) -> String {
+    let raw = format!("{server}{export}");
+    slugify_str(&raw)
+}
+
+/// Detect whether `path` is currently a mount point. We don't have
+/// `is_mountpoint(2)`, so compare the parent's device id to the dir's;
+/// if they differ the dir is a mount.
+async fn is_mountpoint(path: &Path) -> bool {
+    let Some(parent) = path.parent() else {
+        return false;
+    };
+    let Ok(m1) = tokio::fs::metadata(path).await else {
+        return false;
+    };
+    let Ok(m2) = tokio::fs::metadata(parent).await else {
+        return false;
+    };
+    use std::os::unix::fs::MetadataExt;
+    m1.dev() != m2.dev()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn version_arg() {
+        assert_eq!(NfsVersion::V3.vers_arg(), "vers=3");
+        assert_eq!(NfsVersion::V41.vers_arg(), "vers=4.1");
+    }
+
+    #[test]
+    fn mount_options_v3_includes_nolock() {
+        let m = NfsMount {
+            id: "x".into(),
+            server: "s".into(),
+            export: "/e".into(),
+            version: NfsVersion::V3,
+            read_only: true,
+            local_path: PathBuf::from("/tmp/x"),
+            mounted: false,
+            last_error: None,
+            last_attempt: None,
+            iso_count: 0,
+        };
+        let opts = mount_options(&m);
+        assert!(opts.contains("vers=3"));
+        assert!(opts.contains("ro"));
+        assert!(opts.contains("nolock"));
+        assert!(opts.contains("soft"));
+    }
+
+    #[test]
+    fn mount_options_v41_no_nolock() {
+        let m = NfsMount {
+            id: "x".into(),
+            server: "s".into(),
+            export: "/e".into(),
+            version: NfsVersion::V41,
+            read_only: false,
+            local_path: PathBuf::from("/tmp/x"),
+            mounted: false,
+            last_error: None,
+            last_attempt: None,
+            iso_count: 0,
+        };
+        let opts = mount_options(&m);
+        assert!(opts.contains("vers=4.1"));
+        assert!(opts.contains("rw"));
+        assert!(!opts.contains("nolock"));
+    }
+
+    #[test]
+    fn mount_id_is_stable_and_safe() {
+        let a = mount_id("10.0.0.5", "/srv/isos");
+        let b = mount_id("10.0.0.5", "/srv/isos");
+        assert_eq!(a, b);
+        assert!(!a.contains('/'));
+        assert!(!a.contains('.'));
+    }
+}

crates/iso-store/src/pxe_logo.rs

@@ -1,264 +0,0 @@
-//! PXE boot-menu background compositor.
-//!
-//! The brief (v0.4.69): match iVentoy's polished graphical PXE screen.
-//! iPXE built with `CONSOLE_FRAMEBUFFER` + `IMAGE_PNG` paints a PNG to
-//! the framebuffer via `console --picture`, then draws the text menu on
-//! top (the console's default background colour is rendered transparent
-//! so the picture shows through the menu's blank cells). So what we
-//! produce here is a **full-screen 1024×768 background**, not just a
-//! floating logo:
-//!
-//!   - a solid dark field (matches the WebUI dark theme so the product
-//!     feels consistent from browser to bare metal), with
-//!   - the operator's uploaded logo composited across the top, leaving
-//!     the lower ~two-thirds clear for the iPXE menu text.
-//!
-//! When no custom logo is uploaded we still return a designed
-//! background — a dark field with a centered "rainbow-horizon" disc
-//! echoing the bundled OpenPXE mark — so the boot screen is graphical
-//! out of the box. This replaces the old ASCII wordmark entirely.
-//!
-//! iPXE does **not** scale pictures (confirmed against the decoder
-//! source): the image is painted at native pixel size and the firmware
-//! picks the smallest video mode that fits. 1024×768 is the universal
-//! safe mode, so we pin the canvas there. Operators uploading a 4K logo
-//! get it downscaled to fit the top band; tiny icons paint at native
-//! size, centered.
-//!
-//! Input formats: anything the `image` crate decodes with our enabled
-//! features — PNG, JPEG, WebP, GIF. iPXE itself only consumes PNG, so
-//! we always *emit* PNG regardless of what the operator uploaded; a
-//! WebP logo is transcoded here transparently.
-
-use image::imageops::FilterType;
-use image::{DynamicImage, ImageError, ImageFormat, Rgba, RgbaImage};
-use std::io::Cursor;
-
-/// Canvas dimensions. Pinned to 1024×768 — the universal framebuffer
-/// mode every BIOS/UEFI console supports, and iPXE doesn't scale.
-pub const CANVAS_W: u32 = 1024;
-pub const CANVAS_H: u32 = 768;
-
-/// Bounding box for the operator's logo across the top band. Wider than
-/// the old floating-logo box because the logo now anchors a full
-/// background rather than sitting alone on transparency.
-const LOGO_MAX_W: u32 = 760;
-const LOGO_MAX_H: u32 = 200;
-
-/// Top margin from the canvas top to the logo's top edge.
-const LOGO_TOP_MARGIN: u32 = 72;
-
-/// Background fill — a near-black with a faint blue cast, matching the
-/// WebUI's dark theme surface so the product reads as one piece from
-/// browser to PXE screen.
-const BG: Rgba<u8> = Rgba([11, 14, 22, 255]);
-
-/// Compose the operator's uploaded raster (`Some`) — or the default
-/// OpenPXE mark (`None`) — into a full-screen 1024×768 PNG background
-/// and return the encoded bytes.
-///
-/// Errors only when a provided `src_bytes` can't be decoded; the
-/// `None` path and the PNG encode are infallible for our fixed canvas.
-pub fn compose_pxe_background(src_bytes: Option<&[u8]>) -> Result<Vec<u8>, ImageError> {
-    let mut canvas: RgbaImage = RgbaImage::from_pixel(CANVAS_W, CANVAS_H, BG);
-
-    match src_bytes {
-        Some(bytes) => {
-            let logo = image::load_from_memory(bytes)?;
-            let logo = downscale_to_fit(logo, LOGO_MAX_W, LOGO_MAX_H);
-            let logo_rgba = logo.to_rgba8();
-            let off_x = CANVAS_W.saturating_sub(logo_rgba.width()) / 2;
-            let off_y = LOGO_TOP_MARGIN.min(CANVAS_H.saturating_sub(logo_rgba.height()));
-            // `overlay` alpha-composites, so a transparent-background
-            // logo blends onto the dark field exactly as designed.
-            image::imageops::overlay(&mut canvas, &logo_rgba, off_x.into(), off_y.into());
-        }
-        None => draw_default_mark(&mut canvas),
-    }
-
-    let mut out = Vec::with_capacity(128 * 1024);
-    DynamicImage::ImageRgba8(canvas).write_to(&mut Cursor::new(&mut out), ImageFormat::Png)?;
-    Ok(out)
-}
-
-/// Back-compat shim for the old name — callers that pass a raw logo and
-/// want it composited get the same result as `compose_pxe_background`
-/// with `Some`.
-pub fn compose_pxe_logo(src_bytes: &[u8]) -> Result<Vec<u8>, ImageError> {
-    compose_pxe_background(Some(src_bytes))
-}
-
-/// Paint a centered "rainbow-horizon" disc onto the dark canvas as the
-/// default brand mark when no operator logo is set. Pure pixel math —
-/// no font, no SVG rasterizer, no extra deps. A filled circle with a
-/// left-to-right hue sweep echoes the bundled `logo.svg` motif.
-// Casts here are all bounded small-range geometry (radius ≤ 90, canvas
-// ≤ 1024) — precision loss / wrap is structurally impossible.
-#[allow(clippy::cast_precision_loss, clippy::cast_possible_wrap)]
-fn draw_default_mark(canvas: &mut RgbaImage) {
-    let radius: i32 = 90;
-    let cx = (CANVAS_W / 2) as i32;
-    let cy = (LOGO_TOP_MARGIN + 100) as i32;
-    // Four-stop horizontal sweep across the disc (teal → blue → violet
-    // → magenta) — the OpenPXE palette.
-    let stops = [
-        [0x22u8, 0xd3, 0xaa],
-        [0x3b, 0x82, 0xf6],
-        [0x8b, 0x5c, 0xf6],
-        [0xec, 0x48, 0x99],
-    ];
-    let r2 = radius * radius;
-    for dy in -radius..=radius {
-        for dx in -radius..=radius {
-            if dx * dx + dy * dy > r2 {
-                continue;
-            }
-            // Position across the disc in [0,1] left→right.
-            let t = (f32::from(i16::try_from(dx + radius).unwrap_or(0)))
-                / (f32::from(i16::try_from(2 * radius).unwrap_or(1)));
-            let color = gradient_at(&stops, t);
-            // Soft edge: fade alpha in the outer 3px ring.
-            let dist = ((dx * dx + dy * dy) as f32).sqrt();
-            let alpha = if dist > (radius as f32 - 3.0) {
-                let edge = (radius as f32 - dist).clamp(0.0, 3.0) / 3.0;
-                (edge * 255.0) as u8
-            } else {
-                255
-            };
-            let px = cx + dx;
-            let py = cy + dy;
-            if px >= 0 && py >= 0 && (px as u32) < CANVAS_W && (py as u32) < CANVAS_H {
-                blend_pixel(canvas, px as u32, py as u32, color, alpha);
-            }
-        }
-    }
-}
-
-/// Linear interpolate across an N-stop palette at position `t` in [0,1].
-// `segments`/`idx` are ≤ palette length (4) — f32 cast is exact.
-#[allow(clippy::cast_precision_loss)]
-fn gradient_at(stops: &[[u8; 3]], t: f32) -> [u8; 3] {
-    let t = t.clamp(0.0, 1.0);
-    let segments = stops.len() - 1;
-    let scaled = t * segments as f32;
-    let idx = (scaled.floor() as usize).min(segments - 1);
-    let frac = scaled - idx as f32;
-    let a = stops[idx];
-    let b = stops[idx + 1];
-    [
-        lerp(a[0], b[0], frac),
-        lerp(a[1], b[1], frac),
-        lerp(a[2], b[2], frac),
-    ]
-}
-
-fn lerp(a: u8, b: u8, t: f32) -> u8 {
-    (f32::from(a) + (f32::from(b) - f32::from(a)) * t).round() as u8
-}
-
-/// Alpha-blend `color` at `alpha` over the existing canvas pixel.
-fn blend_pixel(canvas: &mut RgbaImage, x: u32, y: u32, color: [u8; 3], alpha: u8) {
-    let bg = canvas.get_pixel(x, y).0;
-    let a = f32::from(alpha) / 255.0;
-    let out = Rgba([
-        lerp(bg[0], color[0], a),
-        lerp(bg[1], color[1], a),
-        lerp(bg[2], color[2], a),
-        255,
-    ]);
-    canvas.put_pixel(x, y, out);
-}
-
-fn downscale_to_fit(img: DynamicImage, max_w: u32, max_h: u32) -> DynamicImage {
-    let (w, h) = (img.width(), img.height());
-    if w <= max_w && h <= max_h {
-        return img;
-    }
-    img.resize(max_w, max_h, FilterType::Lanczos3)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use image::{ImageBuffer, Rgb};
-
-    fn solid_png(w: u32, h: u32, rgb: [u8; 3]) -> Vec<u8> {
-        let img: ImageBuffer<Rgb<u8>, Vec<u8>> = ImageBuffer::from_pixel(w, h, Rgb(rgb));
-        let mut out = Vec::with_capacity(4096);
-        DynamicImage::ImageRgb8(img)
-            .write_to(&mut Cursor::new(&mut out), ImageFormat::Png)
-            .unwrap();
-        out
-    }
-
-    #[test]
-    fn custom_logo_emits_canvas_sized_png_with_dark_field() {
-        let src = solid_png(120, 60, [200, 50, 50]);
-        let out = compose_pxe_background(Some(&src)).unwrap();
-        let img = image::load_from_memory(&out).unwrap().to_rgba8();
-        assert_eq!(img.width(), CANVAS_W);
-        assert_eq!(img.height(), CANVAS_H);
-        // A far corner should be the opaque dark background fill, not
-        // transparent — this is a full background now, not a floating
-        // logo on transparency.
-        let corner = img.get_pixel(CANVAS_W - 1, CANVAS_H - 1);
-        assert_eq!(corner.0, BG.0, "corner should be the dark fill");
-    }
-
-    #[test]
-    fn custom_logo_painted_in_top_band() {
-        let src = solid_png(100, 40, [10, 200, 10]);
-        let out = compose_pxe_background(Some(&src)).unwrap();
-        let canvas = image::load_from_memory(&out).unwrap().to_rgba8();
-        let cx = (CANVAS_W - 100) / 2;
-        let cy = LOGO_TOP_MARGIN;
-        let inside = canvas.get_pixel(cx + 10, cy + 10);
-        assert!(
-            inside.0[1] > 100 && inside.0[0] < 100,
-            "logo pixel color mismatch: {inside:?}"
-        );
-    }
-
-    #[test]
-    fn default_background_is_dark_with_a_painted_mark() {
-        let out = compose_pxe_background(None).unwrap();
-        let canvas = image::load_from_memory(&out).unwrap().to_rgba8();
-        assert_eq!(canvas.width(), CANVAS_W);
-        assert_eq!(canvas.height(), CANVAS_H);
-        // Corner is dark fill.
-        assert_eq!(canvas.get_pixel(2, CANVAS_H - 2).0, BG.0);
-        // Center of the disc is not the background fill (something was
-        // painted there).
-        let center = canvas.get_pixel(CANVAS_W / 2, LOGO_TOP_MARGIN + 100);
-        assert_ne!(center.0, BG.0, "default mark should paint over the field");
-    }
-
-    #[test]
-    fn webp_or_jpeg_input_is_accepted_and_transcoded_to_png() {
-        // Encode a JPEG and confirm the compositor decodes it and emits
-        // a valid PNG (iPXE only eats PNG, so transcoding is the point).
-        let img: ImageBuffer<Rgb<u8>, Vec<u8>> = ImageBuffer::from_pixel(80, 80, Rgb([90, 90, 90]));
-        let mut jpeg = Vec::new();
-        DynamicImage::ImageRgb8(img)
-            .write_to(&mut Cursor::new(&mut jpeg), ImageFormat::Jpeg)
-            .unwrap();
-        let out = compose_pxe_background(Some(&jpeg)).unwrap();
-        // Output must be a PNG (magic bytes) of canvas size.
-        assert_eq!(&out[..8], b"\x89PNG\r\n\x1a\n");
-        let img = image::load_from_memory(&out).unwrap();
-        assert_eq!(img.width(), CANVAS_W);
-    }
-
-    #[test]
-    fn unsupported_bytes_returns_error_not_panic() {
-        let r = compose_pxe_background(Some(b"\xde\xad\xbe\xef not an image"));
-        assert!(r.is_err());
-    }
-
-    #[test]
-    fn gradient_endpoints_match_stops() {
-        let stops = [[0, 0, 0], [255, 255, 255]];
-        assert_eq!(gradient_at(&stops, 0.0), [0, 0, 0]);
-        assert_eq!(gradient_at(&stops, 1.0), [255, 255, 255]);
-    }
-}

crates/iso-store/src/smb.rs

@@ -25,11 +25,11 @@
 //!     Samba), we return `SmbState::SmbdMissing` and the UI surfaces the
 //!     gap. No panics, no retries, no silent failure.
 
-use parking_lot::Mutex;
 use serde::{Deserialize, Serialize};
 use std::path::{Path, PathBuf};
 use std::process::{Child, Command, Stdio};
 use std::sync::Arc;
+use parking_lot::Mutex;
 
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(rename_all = "snake_case", tag = "state")]
@@ -72,9 +72,7 @@ impl SmbManager {
     /// ISO under `smb_dir/<slug>/` becomes a share named `<slug>`. Returns
     /// the sorted list.
     pub fn discover_shares(&self) -> Vec<String> {
-        let Ok(rd) = std::fs::read_dir(&self.smb_dir) else {
-            return vec![];
-        };
+        let Ok(rd) = std::fs::read_dir(&self.smb_dir) else { return vec![]; };
         let mut out: Vec<String> = rd
             .flatten()
             .filter(|e| e.path().is_dir())
@@ -132,9 +130,7 @@ impl SmbManager {
         let shares = match self.write_conf() {
             Ok(v) => v,
             Err(e) => {
-                let s = SmbState::Failed {
-                    reason: format!("write smb.conf: {e}"),
-                };
+                let s = SmbState::Failed { reason: format!("write smb.conf: {e}") };
                 *self.state.lock() = s.clone();
                 return s;
             }
@@ -143,8 +139,7 @@ impl SmbManager {
             .args([
                 "--foreground",
                 "--no-process-group",
-                "--configfile",
-                self.conf_path.to_str().unwrap_or(""),
+                "--configfile", self.conf_path.to_str().unwrap_or(""),
                 "--log-stdout",
             ])
             .stdin(Stdio::null())
@@ -161,9 +156,7 @@ impl SmbManager {
                 s
             }
             Err(e) => {
-                let s = SmbState::Failed {
-                    reason: format!("spawn smbd: {e}"),
-                };
+                let s = SmbState::Failed { reason: format!("spawn smbd: {e}") };
                 *self.state.lock() = s.clone();
                 s
             }
@@ -175,15 +168,11 @@ impl SmbManager {
     #[allow(unsafe_code)]
     pub fn reconcile(&self) -> SmbState {
         let mut g = self.child.lock();
-        if g.is_none() {
-            return self.state.lock().clone();
-        }
+        if g.is_none() { return self.state.lock().clone(); }
         let shares = match self.write_conf() {
             Ok(v) => v,
             Err(e) => {
-                let s = SmbState::Failed {
-                    reason: format!("write smb.conf: {e}"),
-                };
+                let s = SmbState::Failed { reason: format!("write smb.conf: {e}") };
                 *self.state.lock() = s.clone();
                 return s;
             }
@@ -202,13 +191,8 @@ impl SmbManager {
             // covers this is `nix`, which pulls ~40 transitive deps for a
             // single signal send. One documented unsafe call is the better
             // tradeoff for a container-first project.
-            unsafe {
-                libc::kill(pid, libc::SIGHUP);
-            }
-            let s = SmbState::Running {
-                pid: pid as u32,
-                shares,
-            };
+            unsafe { libc::kill(pid, libc::SIGHUP); }
+            let s = SmbState::Running { pid: pid as u32, shares };
             *self.state.lock() = s.clone();
             s
         } else {
@@ -228,19 +212,15 @@ impl SmbManager {
 }
 
 fn smbd_present() -> bool {
-    let Ok(paths) = std::env::var("PATH") else {
-        return false;
-    };
+    let Ok(paths) = std::env::var("PATH") else { return false; };
     for dir in std::env::split_paths(&paths) {
-        if dir.join("smbd").is_file() {
-            return true;
-        }
+        if dir.join("smbd").is_file() { return true; }
     }
     false
 }
 
 const SMB_CONF_GLOBAL: &str = r"[global]
-workgroup = OPENPXE
+workgroup = PXEFORGE
 server min protocol = SMB2
 smb ports = 445
 log level = 1
@@ -255,15 +235,6 @@ lock directory = /tmp
 state directory = /tmp
 cache directory = /tmp
 pid directory = /tmp
-# WinPE reconnect hardening. Windows Setup can reboot mid-install and
-# reconnect from the same IP; stale sessions/oplocks otherwise cause
-# intermittent `net use` failures on the second stage.
-reset on zero vc = yes
-oplocks = no
-kernel oplocks = no
-level2 oplocks = no
-strict locking = no
-deadtime = 1
 ";
 
 /// Extract a Windows ISO at `iso_path` into `smb_dir/<slug>/`. Uses
@@ -274,11 +245,7 @@ deadtime = 1
 /// Idempotent: if the target dir already contains `sources/boot.wim`, we
 /// skip extraction. Callers who want a forced re-extract should remove the
 /// dir first.
-pub fn extract_windows_iso(
-    iso_path: &Path,
-    smb_dir: &Path,
-    slug: &str,
-) -> std::io::Result<PathBuf> {
+pub fn extract_windows_iso(iso_path: &Path, smb_dir: &Path, slug: &str) -> std::io::Result<PathBuf> {
     let target = smb_dir.join(slug);
     if target.join("sources").join("boot.wim").is_file() {
         tracing::debug!(target: "openpxe::smb", slug, "ISO already extracted, skipping");
@@ -296,9 +263,7 @@ pub fn extract_windows_iso(
             .stdout(Stdio::null())
             .stderr(Stdio::piped())
             .output()?;
-        if out.status.success() {
-            return Ok(target);
-        }
+        if out.status.success() { return Ok(target); }
         tracing::warn!(
             target: "openpxe::smb",
             stderr=%String::from_utf8_lossy(&out.stderr),
@@ -313,9 +278,7 @@ pub fn extract_windows_iso(
             .args(["-C"])
             .arg(&target)
             .output()?;
-        if out.status.success() {
-            return Ok(target);
-        }
+        if out.status.success() { return Ok(target); }
         return Err(std::io::Error::other(format!(
             "bsdtar failed: {}",
             String::from_utf8_lossy(&out.stderr)
@@ -331,9 +294,7 @@ fn which(cmd: &str) -> Option<PathBuf> {
     let paths = std::env::var_os("PATH")?;
     for dir in std::env::split_paths(&paths) {
         let p = dir.join(cmd);
-        if p.is_file() {
-            return Some(p);
-        }
+        if p.is_file() { return Some(p); }
     }
     None
 }
@@ -359,9 +320,7 @@ mod tests {
         let m = SmbManager::new(dir.path().into());
         let st = m.start();
         // Restore PATH before asserting so any subsequent failure is legible.
-        if let Some(p) = saved {
-            std::env::set_var("PATH", p);
-        }
+        if let Some(p) = saved { std::env::set_var("PATH", p); }
         assert_eq!(st, SmbState::SmbdMissing);
     }
 
@@ -388,27 +347,5 @@ mod tests {
         assert!(conf.contains("guest ok = yes"));
         assert!(conf.contains("read only = yes"));
         assert!(conf.contains("server min protocol = SMB2"));
-        assert!(conf.contains("workgroup = OPENPXE"));
-    }
-
-    #[test]
-    fn write_conf_includes_winpe_reconnect_tuning() {
-        let dir = tempdir().unwrap();
-        let m = SmbManager::new(dir.path().into());
-        m.write_conf().unwrap();
-        let conf = std::fs::read_to_string(dir.path().join("smb.conf")).unwrap();
-        for expected in [
-            "reset on zero vc = yes",
-            "oplocks = no",
-            "kernel oplocks = no",
-            "level2 oplocks = no",
-            "strict locking = no",
-            "deadtime = 1",
-        ] {
-            assert!(
-                conf.contains(expected),
-                "missing Windows reconnect Samba option {expected} in:\n{conf}"
-            );
-        }
     }
 }

crates/iso-store/src/store.rs

@@ -3,8 +3,8 @@
 use crate::entry::{BootEntry, BootKind, KernelArgs};
 use crate::introspect::{introspect, DistroFamily, IntrospectionReport};
 use bytes::Bytes;
-use openpxe_core::{Error, Result};
 use parking_lot::RwLock;
+use openpxe_core::{Error, Result};
 use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
 use std::collections::HashMap;
@@ -15,59 +15,22 @@ use tokio::io::AsyncWriteExt;
 
 /// Where the bytes for an ISO actually live.
 ///
-/// `Local` — uploaded ISO, sits at `<iso_dir>/<id>.iso`.
-/// `Smb` (v0.4.65) — remote SMB share, streamed via Samba's
-/// userspace `smbclient` CLI subprocess. No kernel mount, no local
-/// cache. Sequential whole-file streaming; HTTP Range requests
-/// return 416.
-/// `Nfs` (v0.4.67) — remote NFSv3 share, streamed via the pure-Rust
-/// `nfs3_client` crate (in-process, no subprocess). Same "works in
-/// any container" property as SMB, plus Range requests work because
-/// NFSv3 READ3 takes an explicit offset.
+/// The default is `Local` — uploaded ISOs sit in `<iso_dir>/<id>.iso`.
+/// `Nfs` entries point at a file inside a remote share that the
+/// `NfsManager` is keeping mounted. We resolve the on-disk path lazily
+/// in [`IsoStore::iso_path_for`] using the `nfs_root` set at startup.
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(tag = "kind", rename_all = "snake_case")]
 pub enum IsoSource {
     #[default]
     Local,
-    /// v0.4.65: SMB via userspace `smbclient` works in any container.
-    Smb {
-        share_id: String,
-        /// Filename at the share root. We don't support nested paths
-        /// in v0.4.65; ISOs live at the top of the share.
-        relative_path: String,
-    },
-    /// v0.4.67: NFSv3 via the in-process `nfs3_client` crate.
     Nfs {
-        share_id: String,
-        /// Filename at the export root.
+        mount_id: String,
+        /// Path relative to the mount point — typically just the filename.
         relative_path: String,
     },
 }
 
-/// Where the ISO lands in the PXE menu hierarchy.
-///
-/// Auto-detected family (Debian, Windows, …) still drives BIOS/UEFI
-/// behaviour and per-entry boot args, but the *menu placement* is
-/// operator-controlled — an operator who's uploaded a TinyCore live ISO
-/// to use as a recovery shim, or a SystemRescue image, can flip its
-/// category to `Tools` so it lands next to memtest/shell instead of
-/// under Linux Installers.
-///
-/// Old `meta.json` files without this field deserialize as `Os`, which
-/// matches v0.4.1 behaviour (everything goes under OS Installers).
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum IsoCategory {
-    /// "OS Installer" — routed via the auto-detected family into the
-    /// Linux / Windows installer submenus.
-    #[default]
-    Os,
-    /// "Tool" — surfaced under the Tools menu next to memtest, shell,
-    /// NIC info, etc. Family detection still decides BIOS/UEFI vs
-    /// wimboot vs sanboot at boot time.
-    Tools,
-}
-
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct IsoMeta {
     /// Stable slug used in URLs (derived from the uploaded filename).
@@ -85,29 +48,6 @@ pub struct IsoMeta {
     /// Old `meta.json` files without this field deserialize as `Local`.
     #[serde(default)]
     pub source: IsoSource,
-    /// Optional bcrypt hash of an operator-set password. When present,
-    /// `/boot/<entry>.ipxe` returns a `read --secret` prompt instead of
-    /// the boot script until the client chains back with the correct
-    /// `?token=...`. We never store, log, or transmit the plaintext.
-    /// Skipped on serialize when None to keep meta.json clean for
-    /// the common no-password case.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub password_hash: Option<String>,
-    /// Where the ISO sits in the PXE menu hierarchy — operator-controlled,
-    /// not driven by family detection. Defaults to [`IsoCategory::Os`].
-    #[serde(default)]
-    pub category: IsoCategory,
-}
-
-impl IsoMeta {
-    /// Convenience predicate the HTTP layer + UI can both use.
-    #[must_use]
-    pub fn is_password_protected(&self) -> bool {
-        self.password_hash
-            .as_deref()
-            .map(str::trim)
-            .is_some_and(|h| !h.is_empty())
-    }
 }
 
 pub struct UploadHandle {
@@ -154,8 +94,6 @@ impl UploadHandle {
             introspection,
             boot_entries,
             source: IsoSource::Local,
-            password_hash: None,
-            category: IsoCategory::default(),
         };
         store.persist_meta(&meta).await?;
         store.insert(meta.clone());
@@ -177,6 +115,10 @@ struct Inner {
 #[derive(Debug, Clone)]
 pub struct IsoStore {
     iso_dir: Arc<PathBuf>,
+    /// Where NFS mounts land on disk. Set at startup via
+    /// [`IsoStore::set_nfs_root`]; required for resolving any
+    /// `IsoSource::Nfs` entry.
+    nfs_root: Arc<RwLock<Option<PathBuf>>>,
     inner: Arc<RwLock<Inner>>,
 }
 
@@ -184,10 +126,17 @@ impl IsoStore {
     pub fn new(iso_dir: PathBuf) -> Self {
         Self {
             iso_dir: Arc::new(iso_dir),
+            nfs_root: Arc::new(RwLock::new(None)),
             inner: Arc::new(RwLock::new(Inner::default())),
         }
     }
 
+    /// Tell the store where NFS mounts live. Without this set,
+    /// `IsoSource::Nfs` entries cannot be resolved to a file path.
+    pub fn set_nfs_root(&self, root: PathBuf) {
+        *self.nfs_root.write() = Some(root);
+    }
+
     pub async fn ensure_dirs(&self) -> Result<()> {
         tokio::fs::create_dir_all(self.iso_dir.as_path()).await?;
         Ok(())
@@ -201,9 +150,7 @@ impl IsoStore {
         let mut entries = tokio::fs::read_dir(self.iso_dir.as_path()).await?;
         while let Some(e) = entries.next_entry().await? {
             let p = e.path();
-            if p.extension().and_then(|s| s.to_str()) != Some("json") {
-                continue;
-            }
+            if p.extension().and_then(|s| s.to_str()) != Some("json") { continue; }
             if !p
                 .file_name()
                 .and_then(|s| s.to_str())
@@ -247,9 +194,6 @@ impl IsoStore {
             return Err(Error::Invalid(format!("iso '{id}' already exists")));
         }
         let partial_path = self.iso_dir.join(format!("{id}.partial"));
-        if partial_path.exists() {
-            return Err(Error::Invalid(format!("iso '{id}' is already uploading")));
-        }
         let file = tokio::fs::File::create(&partial_path).await?;
         Ok(UploadHandle {
             id,
@@ -283,39 +227,36 @@ impl IsoStore {
         self.inner.read().isos.get(id).cloned()
     }
 
-    /// Resolve an ISO id to its on-disk path, if any. For local
-    /// (uploaded) ISOs this is `<iso_dir>/<id>.iso`. For SMB-sourced
-    /// ISOs there is no on-disk path — the HTTP handler must stream
-    /// via `SmbShareManager::stream_iso` instead. Returns `None` for
-    /// SMB sources or when the file is missing.
+    /// Resolve an ISO id to its on-disk path, if any. For local entries
+    /// this is `<iso_dir>/<id>.iso`; for NFS entries it's
+    /// `<nfs_root>/<mount_id>/<relative_path>`. Returns None if the file
+    /// is missing or the source isn't resolvable (e.g. NFS share
+    /// unmounted).
     pub fn iso_path_for(&self, id: &str) -> Option<PathBuf> {
         let meta = self.get(id)?;
-        match &meta.source {
-            IsoSource::Local => {
-                let path = self.iso_path(id);
+        let path = match &meta.source {
+            IsoSource::Local => self.iso_path(id),
+            IsoSource::Nfs {
+                mount_id,
+                relative_path,
+            } => {
+                let root = self.nfs_root.read().clone()?;
+                root.join(mount_id).join(relative_path)
+            }
+        };
         if path.exists() {
             Some(path)
         } else {
             None
         }
     }
-            // SMB and NFS sources have no local path — they're
-            // streamed in-process. Callers must inspect the source
-            // kind first and dispatch to the appropriate share
-            // manager.
-            IsoSource::Smb { .. } | IsoSource::Nfs { .. } => None,
-        }
-    }
 
-    /// Delete an ISO and its sidecar metadata. Only acts on local
-    /// (uploaded) ISOs; for SMB-backed ISOs the operator must remove
-    /// the file from the share or unregister the share entirely.
+    /// Delete an ISO and its sidecar metadata. Only acts on local ISOs;
+    /// for NFS-backed ISOs the operator must remove the file from the
+    /// share or unmount the NFS share entirely.
     pub async fn delete(&self, id: &str) -> Result<()> {
         let meta = self.get(id);
-        let is_local = matches!(
-            meta.as_ref().map(|m| &m.source),
-            Some(IsoSource::Local) | None
-        );
+        let is_local = matches!(meta.as_ref().map(|m| &m.source), Some(IsoSource::Local) | None);
         if is_local {
             let iso = self.iso_path(id);
             let meta_path = self.meta_path(id);
@@ -326,10 +267,10 @@ impl IsoStore {
         Ok(())
     }
 
-    /// Register an externally-sourced ISO (SMB share, etc.). Used by
-    /// `SmbShareManager` after listing a share. We do **not** persist
-    /// a `meta.json` on disk for these — the source of truth is the
-    /// share itself, and the manager re-scans on startup.
+    /// Register an externally-sourced ISO (e.g. NFS-mounted). Used by
+    /// `NfsManager` after walking a freshly-mounted share. We do **not**
+    /// persist a `meta.json` on disk for these — the source of truth is
+    /// the share itself, and the NFS manager re-scans on startup.
     pub fn register_external(
         &self,
         id: String,
@@ -348,155 +289,19 @@ impl IsoStore {
             introspection,
             boot_entries,
             source,
-            password_hash: None,
-            category: IsoCategory::default(),
         };
         self.inner.write().isos.insert(id, meta);
     }
 
-    /// Drop every entry that belongs to `share_id`. Used by the SMB
-    /// and NFS share managers when an operator removes a share, or
-    /// before re-scanning to clean out stale entries. The same id
-    /// space serves both protocols — share ids are slugified from
-    /// `server+share` (SMB) or `server+export` (NFS) and the
-    /// protocol-specific prefix prevents collisions.
-    pub fn drop_external_source(&self, share_id: &str) {
+    /// Drop every entry that belongs to `mount_id`. Used by the NFS
+    /// manager when an operator removes a share, or before re-scanning
+    /// to clean out stale entries.
+    pub fn drop_external_source(&self, mount_id: &str) {
         let mut g = self.inner.write();
-        g.isos.retain(|_, m| match &m.source {
-            IsoSource::Smb { share_id: sid, .. } | IsoSource::Nfs { share_id: sid, .. } => {
-                sid != share_id
-            }
-            IsoSource::Local => true,
+        g.isos.retain(|_, m| {
+            !matches!(&m.source, IsoSource::Nfs { mount_id: mid, .. } if mid == mount_id)
         });
     }
-
-    /// Set or clear an ISO's boot password.
-    ///
-    /// `Some("plaintext")` hashes via bcrypt (cost 10 — fast enough for
-    /// an interactive iPXE prompt, slow enough to be hostile to brute
-    /// force on a leaked meta.json) and persists.
-    ///
-    /// `None` removes the password — the next /boot/<id>.ipxe request
-    /// returns the script directly without a prompt.
-    ///
-    /// We never store, log, or transmit the plaintext.
-    pub async fn set_password(&self, id: &str, password: Option<&str>) -> Result<()> {
-        let new_hash = match password {
-            None => None,
-            Some(pw) => {
-                let pw = pw.trim();
-                if pw.is_empty() {
-                    None
-                } else {
-                    let h = bcrypt::hash(pw, bcrypt::DEFAULT_COST)
-                        .map_err(|e| Error::Other(e.into()))?;
-                    Some(h)
-                }
-            }
-        };
-
-        // Update in-memory + grab a clone for persistence outside the lock.
-        let updated = {
-            let mut g = self.inner.write();
-            let m = g
-                .isos
-                .get_mut(id)
-                .ok_or_else(|| Error::Invalid(format!("no such iso '{id}'")))?;
-            m.password_hash = new_hash;
-            m.clone()
-        };
-        // NFS-sourced ISOs have no on-disk meta.json — skip persistence
-        // for them (the password lives in memory until the manager
-        // re-scans the share, then it's gone). Document this in the API
-        // handler so the operator knows.
-        if matches!(updated.source, IsoSource::Local) {
-            self.persist_meta(&updated).await?;
-        }
-        Ok(())
-    }
-
-    /// Flip an ISO's menu category. Persists to `meta.json` for local
-    /// ISOs; NFS-sourced ISOs keep the change in memory only (the next
-    /// re-scan would overwrite it anyway).
-    pub async fn set_category(&self, id: &str, category: IsoCategory) -> Result<IsoMeta> {
-        let updated = {
-            let mut g = self.inner.write();
-            let m = g
-                .isos
-                .get_mut(id)
-                .ok_or_else(|| Error::Invalid(format!("no such iso '{id}'")))?;
-            m.category = category;
-            m.clone()
-        };
-        if matches!(updated.source, IsoSource::Local) {
-            self.persist_meta(&updated).await?;
-        }
-        Ok(updated)
-    }
-
-    /// Absolute path to the directory holding local ISO uploads. Used
-    /// by the HTTP layer for the disk-space endpoint — the volume that
-    /// hosts this directory is what runs out of room first.
-    #[must_use]
-    pub fn iso_dir(&self) -> PathBuf {
-        self.iso_dir.as_path().to_path_buf()
-    }
-
-    /// `(total_bytes, available_bytes)` for the filesystem hosting the
-    /// ISO directory. Returns `None` if `statvfs` fails (read-only
-    /// filesystem with no quota, mount disappeared, …) — callers
-    /// should treat that as "unknown" rather than zero.
-    ///
-    /// Lives here rather than the HTTP crate because `http-api`'s
-    /// `#![forbid(unsafe_code)]` rules out the libc FFI directly, and
-    /// because this is naturally an `IsoStore` question — the volume
-    /// of interest is whatever's hosting the iso dir.
-    #[must_use]
-    pub fn disk_usage(&self) -> Option<(u64, u64)> {
-        disk_usage_for(self.iso_dir.as_path())
-    }
-
-    /// Verify a candidate password against the stored bcrypt hash.
-    /// Returns:
-    /// - `Ok(true)`   — match (or the ISO has no password set; boot is open)
-    /// - `Ok(false)`  — mismatch
-    /// - `Err(_)`     — id not found, or bcrypt error
-    pub fn verify_password(&self, id: &str, candidate: &str) -> Result<bool> {
-        let meta = self
-            .get(id)
-            .ok_or_else(|| Error::Invalid(format!("no such iso '{id}'")))?;
-        let Some(hash) = meta.password_hash else {
-            return Ok(true); // no password set — anyone can boot
-        };
-        bcrypt::verify(candidate, &hash).map_err(|e| Error::Other(e.into()))
-    }
-}
-
-/// Resolve `(total, available)` bytes for the filesystem hosting `path`.
-/// Returns `None` if `statvfs` fails.
-#[allow(unsafe_code)]
-fn disk_usage_for(path: &std::path::Path) -> Option<(u64, u64)> {
-    use std::ffi::CString;
-    use std::os::unix::ffi::OsStrExt;
-    let c = CString::new(path.as_os_str().as_bytes()).ok()?;
-    // SAFETY: `statvfs` is repr(C); a zeroed value is a valid initial
-    // state per POSIX. The FFI call writes every field we then read.
-    let mut stat: libc::statvfs = unsafe { std::mem::zeroed() };
-    // SAFETY: `c` is a NUL-terminated C string pointing into a stack
-    // CString that outlives this call; `&mut stat` is a unique aligned
-    // pointer to a stack-local `statvfs`. The kernel writes through
-    // it but does not retain the pointer past return.
-    let rc = unsafe { libc::statvfs(c.as_ptr(), &raw mut stat) };
-    if rc != 0 {
-        return None;
-    }
-    // Use f_frsize (fundamental block size). f_bsize is "preferred I/O
-    // block" and doesn't always match the unit f_blocks is denominated
-    // in — on some BSDs it would over-report by a factor of 8.
-    let frsize = stat.f_frsize as u64;
-    let total = stat.f_blocks as u64 * frsize;
-    let avail = stat.f_bavail as u64 * frsize;
-    Some((total, avail))
 }
 
 fn slugify(filename: &str) -> String {
@@ -541,10 +346,7 @@ pub fn generate_boot_entries_for(
 /// Build `BootEntry`s from the introspection report. URLs are relative —
 /// the HTTP layer rewrites them with the public base URL per request.
 fn generate_boot_entries(id: &str, filename: &str, r: &IntrospectionReport) -> Vec<BootEntry> {
-    let title = r
-        .volume_label
-        .clone()
-        .unwrap_or_else(|| filename.to_string());
+    let title = r.volume_label.clone().unwrap_or_else(|| filename.to_string());
     match r.family {
         DistroFamily::WindowsPe if r.has_boot_wim => {
             // Standard wimboot chain. Paths are in-ISO; the HTTP layer maps
@@ -568,22 +370,12 @@ fn generate_boot_entries(id: &str, filename: &str, r: &IntrospectionReport) -> V
         fam if r.kernel_path.is_some() => {
             let base = format!("iso/{id}");
             let kernel_url = format!("{base}{}", r.kernel_path.as_deref().unwrap_or(""));
-            let initrd_urls = r
-                .initrd_paths
-                .iter()
-                .map(|p| format!("{base}{p}"))
-                .collect();
-            let args = KernelArgs {
-                cmdline: linux_cmdline(fam, id),
-            };
+            let initrd_urls = r.initrd_paths.iter().map(|p| format!("{base}{p}")).collect();
+            let args = KernelArgs { cmdline: linux_cmdline(fam, id) };
             vec![BootEntry {
                 id: format!("{id}-linux"),
                 title,
-                kind: BootKind::LinuxKernel {
-                    kernel_url,
-                    initrd_urls,
-                    args,
-                },
+                kind: BootKind::LinuxKernel { kernel_url, initrd_urls, args },
             }]
         }
         _ => {
@@ -592,9 +384,7 @@ fn generate_boot_entries(id: &str, filename: &str, r: &IntrospectionReport) -> V
             vec![BootEntry {
                 id: format!("{id}-sanboot"),
                 title: format!("{title} (SAN boot — may fail for >1GiB ISOs)"),
-                kind: BootKind::SanBootIso {
-                    iso_url: format!("iso/{id}.iso"),
-                },
+                kind: BootKind::SanBootIso { iso_url: format!("iso/{id}.iso") },
             }]
         }
     }
@@ -604,17 +394,8 @@ fn linux_cmdline(family: DistroFamily, id: &str) -> String {
     // The HTTP layer resolves `${base-url}` at render time.
     let iso_url = format!("${{base-url}}/iso/{id}.iso");
     match family {
-        // VMware-UEFI fix (v0.4.5, matching Bootimus v0.1.67's Casper
-        // patch): drop `netboot=url url=… ---` in favour of the
-        // canonical Casper option `iso-url=` and add `ds=nocloud` so
-        // cloud-init / subiquity (live-server) doesn't stall waiting on
-        // a metadata datasource that doesn't exist in PXE. Without
-        // `ds=nocloud`, Ubuntu live-server / Mint / Pop!_OS / elementary
-        // ISOs would boot fine on bare-metal UEFI but hang at "cloud-init
-        // running" on VMware-UEFI guests because the vmxnet3 driver's
-        // late-init upsets cloud-init's network probe.
         DistroFamily::DebianUbuntu => format!(
-            "boot=casper initrd=initrd ds=nocloud ip=dhcp iso-url={iso_url}"
+            "boot=casper netboot=url url={iso_url} ip=dhcp ---"
         ),
         DistroFamily::RhelFedora => format!(
             "inst.repo={iso_url} inst.stage2={iso_url} ip=dhcp"
@@ -635,8 +416,6 @@ fn linux_cmdline(family: DistroFamily, id: &str) -> String {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::introspect::{DistroFamily, IntrospectionReport};
-    use tempfile::tempdir;
 
     #[test]
     fn slugify_basic() {
@@ -648,118 +427,4 @@ mod tests {
         // If a path sneaks in, file_stem strips the directory — OK, not a hazard.
         assert_eq!(slugify("/etc/passwd"), "passwd");
     }
-
-    #[test]
-    fn casper_cmdline_vmware_uefi_safe() {
-        // v0.4.5 regression guard: the Debian/Ubuntu cmdline must use
-        // the canonical Casper `iso-url=` option and include
-        // `ds=nocloud` so VMware-UEFI guests don't hang at "cloud-init
-        // running" waiting on a metadata datasource that PXE can't
-        // provide. The legacy `netboot=url url=… ---` form is gone for
-        // good.
-        let s = linux_cmdline(DistroFamily::DebianUbuntu, "ubuntu-24-04");
-        assert!(s.contains("boot=casper"), "{s}");
-        assert!(s.contains("iso-url=${base-url}/iso/ubuntu-24-04.iso"), "{s}");
-        assert!(s.contains("ds=nocloud"), "{s}");
-        assert!(s.contains("ip=dhcp"), "{s}");
-        assert!(!s.contains("netboot=url"), "legacy option leaked: {s}");
-        assert!(!s.contains(" --- "), "stray ---: {s}");
-    }
-
-    fn fake_meta(id: &str) -> IsoMeta {
-        IsoMeta {
-            id: id.into(),
-            filename: format!("{id}.iso"),
-            size_bytes: 0,
-            sha256_hex: None,
-            uploaded_at: OffsetDateTime::now_utc(),
-            introspection: IntrospectionReport {
-                family: DistroFamily::Unknown,
-                volume_label: None,
-                kernel_path: None,
-                initrd_paths: vec![],
-                has_boot_wim: false,
-            },
-            boot_entries: vec![],
-            source: IsoSource::Local,
-            password_hash: None,
-            category: IsoCategory::default(),
-        }
-    }
-
-    #[tokio::test]
-    async fn password_round_trip_set_verify_clear() {
-        let dir = tempdir().unwrap();
-        let store = IsoStore::new(dir.path().to_path_buf());
-        store.ensure_dirs().await.unwrap();
-        store
-            .inner
-            .write()
-            .isos
-            .insert("alpha".into(), fake_meta("alpha"));
-
-        // No password set — verify_password returns Ok(true) for any input.
-        assert!(store.verify_password("alpha", "anything").unwrap());
-        assert!(!store.get("alpha").unwrap().is_password_protected());
-
-        // Set a password.
-        store.set_password("alpha", Some("hunter2")).await.unwrap();
-        let m = store.get("alpha").unwrap();
-        assert!(m.is_password_protected());
-        assert!(m.password_hash.unwrap().starts_with("$2"));
-
-        // Verify correct + wrong.
-        assert!(store.verify_password("alpha", "hunter2").unwrap());
-        assert!(!store.verify_password("alpha", "wrong").unwrap());
-        assert!(!store.verify_password("alpha", "").unwrap());
-
-        // Clear by passing None or an empty string.
-        store.set_password("alpha", None).await.unwrap();
-        assert!(!store.get("alpha").unwrap().is_password_protected());
-        store.set_password("alpha", Some("again")).await.unwrap();
-        store.set_password("alpha", Some("   ")).await.unwrap();
-        assert!(!store.get("alpha").unwrap().is_password_protected());
-    }
-
-    #[tokio::test]
-    async fn set_password_for_unknown_id_errors() {
-        let dir = tempdir().unwrap();
-        let store = IsoStore::new(dir.path().to_path_buf());
-        store.ensure_dirs().await.unwrap();
-        let r = store.set_password("does-not-exist", Some("pw")).await;
-        assert!(matches!(r, Err(Error::Invalid(_))));
-    }
-
-    #[tokio::test]
-    async fn begin_upload_rejects_existing_partial_file() {
-        let dir = tempdir().unwrap();
-        let store = IsoStore::new(dir.path().to_path_buf());
-        store.ensure_dirs().await.unwrap();
-        tokio::fs::write(dir.path().join("ubuntu.partial"), b"in-flight")
-            .await
-            .unwrap();
-
-        let r = store.begin_upload("ubuntu.iso").await;
-        assert!(matches!(r, Err(Error::Invalid(_))));
-    }
-
-    #[tokio::test]
-    async fn password_persists_via_meta_json_for_local_isos() {
-        // Hash makes it onto disk so it survives a restart.
-        let dir = tempdir().unwrap();
-        let store = IsoStore::new(dir.path().to_path_buf());
-        store.ensure_dirs().await.unwrap();
-        let meta = fake_meta("alpha");
-        store.persist_meta(&meta).await.unwrap();
-        store.insert(meta);
-        store.set_password("alpha", Some("s3cret")).await.unwrap();
-
-        // Re-load from disk and confirm the hash came back.
-        let store2 = IsoStore::new(dir.path().to_path_buf());
-        store2.load_from_disk().await.unwrap();
-        let reloaded = store2.get("alpha").expect("reloaded");
-        assert!(reloaded.is_password_protected());
-        assert!(store2.verify_password("alpha", "s3cret").unwrap());
-        assert!(!store2.verify_password("alpha", "wrong").unwrap());
-    }
 }

crates/iso-store/src/windows.rs

@@ -54,10 +54,7 @@ pub struct WimPatcher {
 impl WimPatcher {
     #[must_use]
     pub fn new(smb_host: String, smb_share: String) -> Self {
-        Self {
-            smb_host,
-            smb_share,
-        }
+        Self { smb_host, smb_share }
     }
 
     /// Apply WinPE patches to `boot.wim` inside `extracted_iso_dir`. Returns
@@ -75,40 +72,31 @@ impl WimPatcher {
 
         let work = match tempfile::tempdir() {
             Ok(d) => d,
-            Err(e) => {
-                return WinPatchState::Failed {
-                    reason: format!("tempdir: {e}"),
-                }
-            }
+            Err(e) => return WinPatchState::Failed { reason: format!("tempdir: {e}") },
         };
 
         // Stage the two files we want present at /Windows/System32/.
         let staging = work.path().join("stage/Windows/System32");
         if let Err(e) = std::fs::create_dir_all(&staging) {
-            return WinPatchState::Failed {
-                reason: format!("staging mkdir: {e}"),
-            };
+            return WinPatchState::Failed { reason: format!("staging mkdir: {e}") };
         }
         if let Err(e) = std::fs::write(staging.join("winpeshl.ini"), WINPESHL_INI) {
-            return WinPatchState::Failed {
-                reason: format!("write winpeshl.ini: {e}"),
-            };
+            return WinPatchState::Failed { reason: format!("write winpeshl.ini: {e}") };
         }
         let startnet = render_startnet(&self.smb_host, &self.smb_share);
         if let Err(e) = std::fs::write(staging.join("startnet.cmd"), startnet) {
-            return WinPatchState::Failed {
-                reason: format!("write startnet.cmd: {e}"),
-            };
+            return WinPatchState::Failed { reason: format!("write startnet.cmd: {e}") };
         }
 
         // Build a wimlib update command file:
         //   add <stage>/Windows/System32 /Windows/System32
         let update_file = work.path().join("update.cmd");
-        let update_cmd = format!("add \"{}\" \"/Windows/System32\"\n", staging.display());
+        let update_cmd = format!(
+            "add \"{}\" \"/Windows/System32\"\n",
+            staging.display()
+        );
         if let Err(e) = std::fs::write(&update_file, update_cmd) {
-            return WinPatchState::Failed {
-                reason: format!("write update.cmd: {e}"),
-            };
+            return WinPatchState::Failed { reason: format!("write update.cmd: {e}") };
         }
 
         // Run wimlib-imagex update against image index 2 (WinPE).
@@ -132,9 +120,7 @@ impl WimPatcher {
                     String::from_utf8_lossy(&o.stderr)
                 ),
             },
-            Err(e) => WinPatchState::Failed {
-                reason: format!("spawn wimlib-imagex: {e}"),
-            },
+            Err(e) => WinPatchState::Failed { reason: format!("spawn wimlib-imagex: {e}") },
         }
     }
 }
@@ -147,9 +133,7 @@ fn which(cmd: &str) -> Option<PathBuf> {
     let paths = std::env::var_os("PATH")?;
     for dir in std::env::split_paths(&paths) {
         let p = dir.join(cmd);
-        if p.is_file() {
-            return Some(p);
-        }
+        if p.is_file() { return Some(p); }
     }
     None
 }
@@ -190,11 +174,7 @@ fn render_startnet(host: &str, share: &str) -> String {
     )
     .unwrap();
     s.push_str(":havenet\r\n");
-    writeln!(
-        s,
-        "echo Mapping install media from \\\\{host}\\{share}...\r"
-    )
-    .unwrap();
+    writeln!(s, "echo Mapping install media from \\\\{host}\\{share}...\r").unwrap();
     writeln!(
         s,
         ":mapshare\r\nnet use Z: \\\\{host}\\{share} /user:guest \"\" /persistent:no && goto mapped\r\n\
@@ -225,23 +205,6 @@ mod tests {
         assert!(s.contains("setup.exe"));
     }
 
-    #[test]
-    fn startnet_primes_workstation_and_surfaces_mapping_errors() {
-        let s = render_startnet("10.0.0.5", "win11");
-        assert!(
-            s.contains("net start Workstation"),
-            "WinPE should explicitly start the SMB client before net use:\n{s}"
-        );
-        let net_use_line = s
-            .lines()
-            .find(|line| line.contains("net use Z:"))
-            .expect("net use line");
-        assert!(
-            !net_use_line.contains(">nul"),
-            "net use errors must remain visible in WinPE console: {net_use_line}"
-        );
-    }
-
     #[test]
     fn patcher_reports_wimlib_missing_gracefully() {
         // We don't assume wimlib is present in CI; this checks the missing

crates/openpxe/src/main.rs

@@ -4,16 +4,16 @@
 
 use clap::{Parser, Subcommand};
 use openpxe_core::{
-    ClientRegistry, Config, DeploymentQueue, DhcpMode, HostBindings, LogBus, LogBusLayer, Metrics,
+    ClientRegistry, Config, DhcpMode, DeploymentQueue, HostBindings, LogBus, LogBusLayer, Metrics,
     SettingsStore,
 };
 use openpxe_dhcp_proxy::DhcpProxyServer;
 use openpxe_http_api::{build_router, AppState};
-use openpxe_iso_store::{IsoStore, NfsShareManager, SmbManager, SmbShareManager};
+use openpxe_iso_store::{IsoStore, NfsManager, SmbManager};
+use std::sync::Arc;
 use openpxe_tftp::TftpServer;
 use std::net::{Ipv4Addr, SocketAddr};
 use std::path::PathBuf;
-use std::sync::Arc;
 use tokio::io::AsyncReadExt;
 
 #[derive(Debug, Parser)]
@@ -39,7 +39,7 @@ enum Command {
     ///   docker run --rm \
     ///     -v /my/isos:/seed:ro \
     ///     -v openpxe-data:/var/lib/openpxe/isos \
-    ///     openpxe:0.4.1 seed --from /seed
+    ///     openpxe:0.1.0 seed --from /seed
     Seed {
         /// Source directory containing one or more `.iso` files.
         #[arg(long)]
@@ -100,15 +100,9 @@ async fn main() -> anyhow::Result<()> {
     let iso_store = IsoStore::new(config.paths.iso_dir.clone());
     iso_store.load_from_disk().await?;
     let clients = ClientRegistry::new();
-    let queue = DeploymentQueue::new();
+    let gates = DeploymentQueue::new();
     let settings = SettingsStore::load_or_default(&config.paths.work_dir);
     let hosts = HostBindings::load_or_default(&config.paths.work_dir);
-    let boot_log = openpxe_core::BootLog::load_or_default(&config.paths.work_dir);
-    let branding = openpxe_core::BrandingStore::load_or_default(&config.paths.work_dir);
-    let admin = openpxe_core::AdminStore::load_or_default(&config.paths.work_dir);
-    let sso = openpxe_core::SsoStore::load_or_default(&config.paths.work_dir);
-    let notify = openpxe_core::NotifyStore::load_or_default(&config.paths.work_dir);
-    let sessions = openpxe_http_api::auth::SessionStore::default();
     let metrics = Metrics::new();
 
     // Build the SMB manager unconditionally — it starts/stops on the
@@ -120,30 +114,13 @@ async fn main() -> anyhow::Result<()> {
         let _ = smb.start();
     }
 
-    // v0.4.65: SMB share manager — Samba `smbclient` userspace
-    // consumer. Replaces the kernel-mount NFS path that v0.4.64
-    // shipped; that didn't work on hosts whose kernel lacked the nfs
-    // client modules (Unraid is the dominant case). `smbclient` does
-    // the SMB protocol entirely in userspace over TCP and works in
-    // any container regardless of capabilities or kernel modules.
-    let smb_shares = SmbShareManager::new(&config.paths.work_dir, iso_store.clone());
-    if let Err(e) = smb_shares.load_and_rescan().await {
-        tracing::warn!(
-            target: "openpxe::smb",
-            "could not reload SMB shares on startup: {e}"
-        );
-    }
-
-    // v0.4.67: NFSv3 share manager — pure-Rust in-process consumer
-    // via the `nfs3_client` crate. Sits alongside the SMB manager;
-    // operators pick whichever protocol their NAS prefers, or use
-    // both. No subprocess, no kernel mount, works in any container.
-    let nfs_shares = NfsShareManager::new(&config.paths.work_dir, iso_store.clone());
-    if let Err(e) = nfs_shares.load_and_rescan().await {
-        tracing::warn!(
-            target: "openpxe::nfs",
-            "could not reload NFS shares on startup: {e}"
-        );
+    // NFS manager. The mount root has to be set on the IsoStore *before*
+    // we replay any persisted mounts, otherwise an in-memory IsoMeta
+    // pointing at an NFS source can't resolve to a path.
+    let nfs = NfsManager::new(&config.paths.work_dir, iso_store.clone());
+    iso_store.set_nfs_root(nfs.mount_root());
+    if let Err(e) = nfs.load_and_remount().await {
+        tracing::warn!(target: "openpxe::nfs", "could not reload NFS mounts: {e}");
     }
 
     // Sniff network details for the Network tab. None of these are
@@ -161,20 +138,11 @@ async fn main() -> anyhow::Result<()> {
         iso_store: iso_store.clone(),
         clients: clients.clone(),
         settings: settings.clone(),
-        queue: queue.clone(),
+        queue: gates.clone(),
         hosts: hosts.clone(),
-        boot_log: boot_log.clone(),
-        branding: branding.clone(),
-        admin: admin.clone(),
-        sessions: sessions.clone(),
-        sso: sso.clone(),
-        saml: openpxe_http_api::saml_routes::SamlRuntime::default(),
-        notify: notify.clone(),
         metrics: metrics.clone(),
         smb: Some(smb.clone()),
-        smb_shares: smb_shares.clone(),
-        nfs_shares: nfs_shares.clone(),
-        uploads: openpxe_http_api::uploads::UploadSessions::default(),
+        nfs: nfs.clone(),
         log_bus: log_bus.clone(),
         started_at: time::OffsetDateTime::now_utc(),
         public_base_url: public_base_url.clone(),
@@ -188,15 +156,7 @@ async fn main() -> anyhow::Result<()> {
     let http_task = tokio::spawn(async move {
         let listener = tokio::net::TcpListener::bind(http_addr).await?;
         tracing::info!(target: "openpxe::http", "HTTP listening on {http_addr}");
-        // `into_make_service_with_connect_info` is required so per-request
-        // `ConnectInfo<SocketAddr>` extractors can resolve the peer IP —
-        // used by `/boot/<entry>.ipxe` to record the booting client's
-        // address into the Host log. Without this the extractor 500s.
-        axum::serve(
-            listener,
-            router.into_make_service_with_connect_info::<std::net::SocketAddr>(),
-        )
-        .await?;
+        axum::serve(listener, router).await?;
         Ok::<_, anyhow::Error>(())
     });
 
@@ -250,11 +210,7 @@ async fn run_command(cmd: Command, config: Config) -> anyhow::Result<()> {
 /// Reuses `IsoStore::begin_upload` / `finish` so the resulting meta on disk
 /// is identical to a web upload — same slug rules, same introspection, same
 /// sha256.
-async fn seed_from_dir(
-    src: &std::path::Path,
-    config: &Config,
-    dry_run: bool,
-) -> anyhow::Result<()> {
+async fn seed_from_dir(src: &std::path::Path, config: &Config, dry_run: bool) -> anyhow::Result<()> {
     let store = IsoStore::new(config.paths.iso_dir.clone());
     store.load_from_disk().await?;
     let mut entries = tokio::fs::read_dir(src).await?;
@@ -262,12 +218,7 @@ async fn seed_from_dir(
     let mut skipped = 0u32;
     while let Some(entry) = entries.next_entry().await? {
         let p = entry.path();
-        if p.extension()
-            .and_then(|e| e.to_str())
-            .map(str::to_ascii_lowercase)
-            .as_deref()
-            != Some("iso")
-        {
+        if p.extension().and_then(|e| e.to_str()).map(str::to_ascii_lowercase).as_deref() != Some("iso") {
             continue;
         }
         let filename = p
@@ -275,14 +226,8 @@ async fn seed_from_dir(
             .and_then(|s| s.to_str())
             .ok_or_else(|| anyhow::anyhow!("non-utf8 filename: {}", p.display()))?
             .to_string();
-        println!(
-            "  {} ({} bytes)",
-            filename,
-            tokio::fs::metadata(&p).await?.len()
-        );
-        if dry_run {
-            continue;
-        }
+        println!("  {} ({} bytes)", filename, tokio::fs::metadata(&p).await?.len());
+        if dry_run { continue; }
 
         let mut handle = match store.begin_upload(&filename).await {
             Ok(h) => h,
@@ -297,23 +242,15 @@ async fn seed_from_dir(
         let mut buf = vec![0u8; 1024 * 1024];
         loop {
             let n = file.read(&mut buf).await?;
-            if n == 0 {
-                break;
-            }
+            if n == 0 { break; }
             let chunk: bytes::Bytes = buf[..n].to_vec().into();
             handle.write_chunk(&chunk).await?;
         }
         let meta = handle.finish(&store).await?;
-        println!(
-            "    -> id={} family={:?}",
-            meta.id, meta.introspection.family
-        );
+        println!("    -> id={} family={:?}", meta.id, meta.introspection.family);
         imported += 1;
     }
-    println!(
-        "\nimported={imported}  skipped={skipped}  {}",
-        if dry_run { "(dry run)" } else { "" }
-    );
+    println!("\nimported={imported}  skipped={skipped}  {}", if dry_run { "(dry run)" } else { "" });
     Ok(())
 }
 
@@ -357,8 +294,9 @@ fn hostname() -> std::io::Result<String> {
     if let Ok(h) = std::fs::read_to_string("/proc/sys/kernel/hostname") {
         return Ok(h.trim().to_string());
     }
-    std::env::var("HOSTNAME")
-        .map_err(|_| std::io::Error::new(std::io::ErrorKind::NotFound, "no hostname"))
+    std::env::var("HOSTNAME").map_err(|_| std::io::Error::new(
+        std::io::ErrorKind::NotFound, "no hostname",
+    ))
 }
 
 fn init_tracing(bus: Arc<LogBus>) {
@@ -390,10 +328,7 @@ fn detect_network_info(our_ip: Ipv4Addr) -> NetworkInfo {
 
     // `ip -o -f inet addr show` lists every interface with its
     // `inet a.b.c.d/mask`. We match the line that mentions our IP.
-    if let Ok(out) = Command::new("ip")
-        .args(["-o", "-f", "inet", "addr", "show"])
-        .output()
-    {
+    if let Ok(out) = Command::new("ip").args(["-o", "-f", "inet", "addr", "show"]).output() {
         if let Ok(text) = String::from_utf8(out.stdout) {
             for line in text.lines() {
                 if !line.contains(&our_ip.to_string()) {
@@ -418,10 +353,7 @@ fn detect_network_info(our_ip: Ipv4Addr) -> NetworkInfo {
     }
 
     // `ip route show default` -> "default via 10.0.0.1 dev enp1s0 ..."
-    if let Ok(out) = Command::new("ip")
-        .args(["route", "show", "default"])
-        .output()
-    {
+    if let Ok(out) = Command::new("ip").args(["route", "show", "default"]).output() {
         if let Ok(text) = String::from_utf8(out.stdout) {
             if let Some(line) = text.lines().next() {
                 let mut parts = line.split_whitespace();
@@ -442,11 +374,7 @@ fn detect_network_info(our_ip: Ipv4Addr) -> NetworkInfo {
 
 fn prefix_to_dotted(prefix: u8) -> String {
     let prefix = prefix.min(32);
-    let mask: u32 = if prefix == 0 {
-        0
-    } else {
-        u32::MAX << (32 - prefix)
-    };
+    let mask: u32 = if prefix == 0 { 0 } else { u32::MAX << (32 - prefix) };
     format!(
         "{}.{}.{}.{}",
         (mask >> 24) & 0xff,

crates/tftp/src/server.rs

@@ -45,12 +45,7 @@ impl TftpServer {
         clients: Arc<ClientRegistry>,
         metrics: openpxe_core::Metrics,
     ) -> Self {
-        Self {
-            bind,
-            port,
-            clients,
-            metrics,
-        }
+        Self { bind, port, clients, metrics }
     }
 
     pub async fn run(self) -> anyhow::Result<()> {
@@ -91,9 +86,7 @@ async fn handle_rrq(
     let Some(req) = parse_rrq(&packet) else {
         return Ok(());
     };
-    let Request {
-        filename, options, ..
-    } = req;
+    let Request { filename, options, .. } = req;
 
     // Per-transfer ephemeral socket.
     let sock = bind_udp(bind_ip, 0)?;
@@ -105,9 +98,7 @@ async fn handle_rrq(
             &peer.ip().to_string(),
             Some(peer.ip()),
             None,
-            ClientEvent::TftpRead {
-                file: filename.clone(),
-            },
+            ClientEvent::TftpRead { file: filename.clone() },
         );
         return Ok(());
     };
@@ -121,9 +112,7 @@ async fn handle_rrq(
         &peer.ip().to_string(),
         Some(peer.ip()),
         None,
-        ClientEvent::TftpRead {
-            file: filename.clone(),
-        },
+        ClientEvent::TftpRead { file: filename.clone() },
     );
 
     // Negotiate options.
@@ -184,9 +173,7 @@ async fn handle_rrq(
 
         // Send one window worth of DATA.
         for _ in 0..window {
-            if offset >= total {
-                break;
-            }
+            if offset >= total { break; }
             let end = (offset + blksize).min(total);
             let chunk = &file_bytes[offset..end];
             let pkt = encode_data(block_no, chunk);
@@ -268,30 +255,20 @@ struct Request {
 }
 
 fn parse_rrq(pkt: &[u8]) -> Option<Request> {
-    if pkt.len() < 4 {
-        return None;
-    }
+    if pkt.len() < 4 { return None; }
     let op = u16::from_be_bytes([pkt[0], pkt[1]]);
-    if op != OP_RRQ {
-        return None;
-    }
+    if op != OP_RRQ { return None; }
     let mut rest = &pkt[2..];
     let filename = read_cstr(&mut rest)?;
     let mode = read_cstr(&mut rest)?;
     let mut options = Vec::new();
     while !rest.is_empty() {
         let Some(k) = read_cstr(&mut rest) else { break };
-        if k.is_empty() {
-            break;
-        }
+        if k.is_empty() { break; }
         let v = read_cstr(&mut rest).unwrap_or_default();
         options.push((k.to_ascii_lowercase(), v));
     }
-    Some(Request {
-        filename,
-        mode,
-        options,
-    })
+    Some(Request { filename, mode, options })
 }
 
 fn read_cstr(buf: &mut &[u8]) -> Option<String> {
@@ -339,12 +316,8 @@ async fn recv_ack(sock: &UdpSocket, peer: SocketAddr) -> anyhow::Result<u16> {
     let mut buf = [0u8; 32];
     loop {
         let (n, from) = sock.recv_from(&mut buf).await?;
-        if from.ip() != peer.ip() {
-            continue;
-        }
-        if n < 4 {
-            continue;
-        }
+        if from.ip() != peer.ip() { continue; }
+        if n < 4 { continue; }
         let op = u16::from_be_bytes([buf[0], buf[1]]);
         match op {
             OP_ACK => return Ok(u16::from_be_bytes([buf[2], buf[3]])),
@@ -371,19 +344,14 @@ async fn wait_for_ack(
             Ok(Ok(_)) => {}
             Ok(Err(_)) | Err(_) => {
                 tries += 1;
-                if tries > 5 {
-                    return Ok(false);
-                }
+                if tries > 5 { return Ok(false); }
             }
         }
     }
 }
 
 fn bind_udp(bind: IpAddr, port: u16) -> anyhow::Result<UdpSocket> {
-    let domain = match bind {
-        IpAddr::V4(_) => Domain::IPV4,
-        IpAddr::V6(_) => Domain::IPV6,
-    };
+    let domain = match bind { IpAddr::V4(_) => Domain::IPV4, IpAddr::V6(_) => Domain::IPV6 };
     let sock = Socket::new(domain, Type::DGRAM, Some(Protocol::UDP))?;
     sock.set_reuse_address(true)?;
     sock.set_nonblocking(true)?;
@@ -414,9 +382,7 @@ pub fn plan_window(
     let mut o = offset;
     let mut b = starting_block;
     for _ in 0..window {
-        if o >= total {
-            break;
-        }
+        if o >= total { break; }
         let end = (o + blksize).min(total);
         out.push((b, end - o));
         o = end;

crates/webui/src/app.css

@@ -8,49 +8,37 @@
  * CSS lands). */
 
 :root {
-  /* Jet-black dark palette (default). Modelled on Netbox Labs's
-     near-black product chrome, with surfaces stepping subtly upward
-     rather than the previous blue-tinted ramp, so the UI reads as a
-     genuine "dark" rather than "dim navy". */
-  --bg:           #030303;
-  --bg-panel:    #0a0a0a;
-  --bg-panel-2:  #141414;
-  --bg-elev:     #1c1c1c;
-  --fg:           #e8eaed;
-  --fg-dim:      #9aa0a6;
-  --fg-dimmer:   #6b7077;
-  --accent:       #00d4b4;   /* Netbox-ish teal — kept for brand */
+  /* Dark palette (default). */
+  --bg:           #0b1018;
+  --bg-panel:    #121826;
+  --bg-panel-2:  #1a2334;
+  --bg-elev:     #223047;
+  --fg:           #e4e8ef;
+  --fg-dim:      #8a94a7;
+  --fg-dimmer:   #5a6379;
+  --accent:       #00d4b4;   /* Netbox-ish teal */
   --accent-dim:  #07a38c;
   --warn:         #ffb347;
   --err:          #ef6e6e;
   --ok:           #4ade80;
-  --border:       #1f1f1f;
-  --border-soft: #141414;
-  --terminal-bg: #050505;
-  --shadow-card: 0 1px 0 rgba(255,255,255,0.02), 0 8px 24px rgba(0,0,0,0.55);
+  --border:       #223047;
+  --border-soft: #172033;
+  --terminal-bg: #06090e;
+  --shadow-card: 0 1px 0 rgba(255,255,255,0.02), 0 8px 24px rgba(0,0,0,0.25);
   --radius:      6px;
   --radius-lg:  10px;
   --sidebar-w:  240px;
   --topbar-h:   56px;
   --mono: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
   --sans: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, system-ui, sans-serif;
-  /* v0.4.63: tie native form-control rendering (checkboxes, scroll bars,
-     date pickers) to the active OpenPXE theme. Without this, the inline
-     `<meta name="color-scheme" content="dark light">` in index.html forces
-     dark form chrome in *both* themes — so the SSO "Enable single sign-on"
-     checkbox renders as an opaque black square against the light-mode
-     panel, ignoring our accent-color hint. CSS `color-scheme` overrides
-     the meta and tracks `data-theme` correctly. */
-  color-scheme: dark;
 }
 
 :root[data-theme="light"] {
-  color-scheme: light;
   /* Light palette — high-contrast neutral, accent unchanged for brand
      consistency. Designed against Netbox Labs's reference screenshot:
      near-white surfaces, soft grey dividers, dark text. */
   --bg:           #f6f8fb;
-  --bg-panel:    #fbfcfe;
+  --bg-panel:    #ffffff;
   --bg-panel-2:  #f0f3f8;
   --bg-elev:     #e6ebf2;
   --fg:           #1c2330;
@@ -63,11 +51,7 @@
   --ok:           #1f9b54;
   --border:       #d8dde6;
   --border-soft: #e7eaf0;
-  /* Light-mode terminal: the pane background and chrome track the rest
-     of the light theme. Per-level text colours below recolour-on-light
-     so log lines stay readable on a pale background — previously the
-     terminal was locked to dark and looked like a stuck panel. */
-  --terminal-bg: #ffffff;
+  --terminal-bg: #0d1219; /* terminal stays dark even in light mode */
   --shadow-card: 0 1px 0 rgba(0,0,0,0.02), 0 6px 18px rgba(20,28,52,0.06);
 }
 
@@ -100,37 +84,14 @@ code, kbd { font-family: var(--mono); font-size: 12.5px;
   border-right: 1px solid var(--border);
   display: flex; flex-direction: column;
 }
-/* The brand block sits flush with the topbar so the sidebar+topbar reads
-   as one continuous bar across the top of the app, rather than a chunky
-   2-line logo block plus a separate (smaller-typeface) page title. The
-   height/border-bottom match the topbar exactly so the divider runs
-   straight across without a step. */
 .sidebar .brand {
   display: flex; align-items: center; gap: 12px;
-  padding: 0 18px;
-  height: var(--topbar-h);
+  padding: 14px 18px;
   border-bottom: 1px solid var(--border);
 }
-.sidebar .brand img { width: 26px; height: 26px; flex: none; }
-.sidebar .brand strong {
-  font-size: 15px; font-weight: 600;
-  letter-spacing: 0.2px;
-  color: var(--fg);
-}
-
-/* v0.4.69: FleetDM-style full-width custom logo. When the operator has
-   uploaded a custom brand mark, the sidebar header drops the bundled
-   26px mark + "OpenPXE" wordmark and instead lets the uploaded image
-   span the header — left-aligned, capped at 200x50, scaled to fit
-   without distortion. The wordmark is hidden so the operator's logo is
-   the sole brand element (their logo presumably already contains their
-   name). The bundled-default case keeps the mark + wordmark. */
-.sidebar .brand.has-custom-logo { gap: 0; }
-.sidebar .brand.has-custom-logo img {
-  width: auto; height: 50px; max-width: 200px;
-  object-fit: contain; object-position: left center; flex: none;
-}
-.sidebar .brand.has-custom-logo strong { display: none; }
+.sidebar .brand img { width: 40px; height: auto; }
+.sidebar .brand strong { font-size: 16px; letter-spacing: 0.4px; }
+.sidebar .brand .sub { color: var(--fg-dim); font-size: 11px; }
 .sidebar nav { padding: 10px 0; flex: 1; overflow-y: auto; }
 .sidebar nav a {
   display: flex; align-items: center; gap: 10px;
@@ -152,40 +113,10 @@ code, kbd { font-family: var(--mono); font-size: 12.5px;
 }
 .sidebar nav a.active .count { background: var(--accent); color: #002923; }
 .sidebar .footer {
-  padding: 12px 18px; border-top: 1px solid var(--border);
+  padding: 10px 18px; border-top: 1px solid var(--border);
   color: var(--fg-dimmer); font-size: 11px;
-  display: flex; flex-direction: column; gap: 4px;
-}
-.sidebar .footer code { background: transparent; color: var(--fg-dim); padding: 0;
-  font-size: 11px; word-break: break-all; }
-.sidebar .footer .status-row {
-  display: flex; align-items: center; gap: 8px;
-  margin-bottom: 4px;
-}
-.sidebar .footer .status-row .dot {
-  width: 8px; height: 8px; border-radius: 50%; display: inline-block;
-  background: var(--fg-dimmer); flex: none;
-}
-.sidebar .footer .status-row .dot.ok   { background: var(--ok);
-  box-shadow: 0 0 6px color-mix(in srgb, var(--ok) 60%, transparent); }
-.sidebar .footer .status-row .dot.err  { background: var(--err); }
-.sidebar .footer .status-row .dot.warn { background: var(--warn); }
-.sidebar .footer .status-label { color: var(--fg-dim); }
-.sidebar .footer .status-value { color: var(--fg); font-weight: 600; }
-.sidebar .footer .status-value.ok   { color: var(--ok); }
-.sidebar .footer .status-value.err  { color: var(--err); }
-.sidebar .footer .status-value.warn { color: var(--warn); }
-.sidebar .footer .footer-sub { color: var(--fg-dimmer); margin-top: 2px; }
-/* Persistent backend identity. Sits below the advertised URL so even
-   when an operator has uploaded their own logo, "what is this" stays
-   answerable from the bottom-left of every page. */
-.sidebar .footer .footer-version {
-  margin-top: 8px; padding-top: 8px;
-  border-top: 1px dashed var(--border-soft);
-  color: var(--fg-dim);
-  font-variant-numeric: tabular-nums;
-  letter-spacing: 0.2px;
 }
+.sidebar .footer code { background: transparent; color: var(--fg-dim); padding: 0; }
 
 /* ── Top bar ───────────────────────────────────────────────────────── */
 
@@ -299,7 +230,7 @@ button, .btn {
   cursor: pointer;
   transition: background 0.12s ease;
 }
-button:hover, .btn:hover { background: var(--accent-dim); color: #f4fffd; }
+button:hover, .btn:hover { background: var(--accent-dim); color: #fff; }
 button.ghost { background: transparent; color: var(--fg); border: 1px solid var(--border); }
 button.ghost:hover { background: var(--bg-panel-2); color: var(--fg); }
 button.danger { background: transparent; color: var(--err); border: 1px solid color-mix(in srgb, var(--err) 35%, transparent); }
@@ -310,83 +241,23 @@ label.field {
 }
 label.field .name { color: var(--fg-dim); font-size: 12px; }
 label.field .hint { color: var(--fg-dimmer); font-size: 11px; }
-/* All single-line inputs share one chrome rule. Pre-v0.4.6 we only
-   styled type=text/number, which left type=password fields rendering
-   with the default browser look — visibly off vs adjacent text fields
-   in the Account card. The negation list keeps `type=checkbox`,
-   `type=file`, and `type=range` (none of which we use inside
-   `label.field`) from picking up the padded-box look. */
-label.field input:not([type="checkbox"]):not([type="file"]):not([type="range"]),
+label.field input[type="text"],
+label.field input[type="number"],
 label.field select,
 label.field textarea {
   width: 100%; background: var(--bg); color: var(--fg);
   border: 1px solid var(--border); border-radius: var(--radius);
   padding: 7px 10px; font: inherit;
-  /* iOS/Safari shrinks password-field text by default; clamp it so
-     the password input matches the username input's metrics. */
-  font-size: 14px; line-height: 1.4;
-  box-shadow: none; -webkit-appearance: none; appearance: none;
-}
-/* v0.4.63: with `appearance: none`, the native <select> dropdown arrow
-   disappears, which makes the "Metadata source" pick-list look like a
-   plain (and slightly squished) text input. Paint our own chevron via
-   background-image so the control still reads as a dropdown, and reserve
-   right-padding for it. The data-URI SVG inherits currentColor via the
-   `stroke` attribute so the arrow follows light/dark theme without a
-   second declaration. */
-label.field select {
-  background-image: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 12 8' fill='none' stroke='%239aa0a6' stroke-width='1.6' stroke-linecap='round' stroke-linejoin='round'><polyline points='1.5,1.5 6,6 10.5,1.5'/></svg>");
-  background-repeat: no-repeat;
-  background-position: right 10px center;
-  background-size: 11px 7px;
-  padding-right: 30px;
-}
-:root[data-theme="light"] label.field select {
-  background-image: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 12 8' fill='none' stroke='%235a6377' stroke-width='1.6' stroke-linecap='round' stroke-linejoin='round'><polyline points='1.5,1.5 6,6 10.5,1.5'/></svg>");
 }
 label.field input:focus, label.field select:focus, label.field textarea:focus {
   outline: none; border-color: var(--accent);
-  box-shadow: 0 0 0 1px color-mix(in srgb, var(--accent) 35%, transparent);
 }
 label.check {
   display: flex; gap: 10px; align-items: center;
   padding: 8px 10px; margin-bottom: 6px;
   border: 1px solid var(--border-soft); border-radius: var(--radius);
 }
-/* v0.4.63: native checkboxes used to render as opaque black squares in
-   light mode because the page meta declares `color-scheme: dark light`
-   and `accent-color` alone only repaints the *check mark* (not the
-   container). Take full control of the chrome so the box reads cleanly
-   on both palettes and the checked state lights up in our accent. */
-label.check input[type="checkbox"] {
-  appearance: none; -webkit-appearance: none;
-  width: 16px; height: 16px; flex: none;
-  background: var(--bg);
-  border: 1px solid var(--border);
-  border-radius: 3px;
-  display: inline-grid; place-content: center;
-  cursor: pointer; margin: 0;
-  transition: background 0.1s ease, border-color 0.1s ease;
-}
-label.check input[type="checkbox"]:hover { border-color: var(--accent); }
-label.check input[type="checkbox"]:checked {
-  background: var(--accent);
-  border-color: var(--accent);
-}
-label.check input[type="checkbox"]:checked::after {
-  /* Classic ✓ glyph built from a rotated rectangle border. Colour is
-     #002923 (the same near-black we use on solid-accent buttons) so the
-     tick stays legible against the teal fill in both themes. */
-  content: '';
-  width: 4px; height: 8px;
-  border: solid #002923;
-  border-width: 0 2px 2px 0;
-  transform: rotate(45deg) translate(-1px, -1px);
-}
-label.check input[type="checkbox"]:focus-visible {
-  outline: none;
-  box-shadow: 0 0 0 2px color-mix(in srgb, var(--accent) 35%, transparent);
-}
+label.check input { accent-color: var(--accent); }
 
 /* ── Drop zone ────────────────────────────────────────────────────── */
 
@@ -410,7 +281,8 @@ label.check input[type="checkbox"]:focus-visible {
 
 /* ── Imaging progress widget ───────────────────────────────────────
    Animated brand mark paired with a horizontal progress bar; surfaces
-   on Dashboard and the Queue tab. */
+   on Dashboard and the Queue tab. Renamed from `.forge-progress` in
+   v0.3.0 — the anvil-themed naming is gone with the rebrand. */
 .queue-progress {
   display: flex; align-items: center; gap: 16px;
   padding: 16px;
@@ -504,23 +376,11 @@ tr.unbootable td:first-child { border-left: 3px solid var(--warn); }
 .dot.err  { background: var(--err); }
 .dot.warn { background: var(--warn); }
 
-/* Inline form rows. The default is a 4-column grid sized for the
-   Account card's "Current / New username / New password / Confirm"
-   quartet; the `.cols-3` modifier swaps to a 3-column layout for the
-   SSO header strip (display name / logo URL / metadata source). All
-   `.form-row > label.field` children share the same baseline because
-   their inner inputs share metrics via the global rule above. */
-.form-row { display: grid; grid-template-columns: repeat(4, 1fr); gap: 10px 14px; align-items: end; }
-.form-row.cols-3 { grid-template-columns: repeat(3, 1fr); }
-.form-row.cols-2 { grid-template-columns: repeat(2, 1fr); }
-.form-row label.field { margin-bottom: 0; }
-@media (max-width: 900px) {
-  .form-row,
-  .form-row.cols-3,
-  .form-row.cols-2 { grid-template-columns: 1fr; }
-}
+/* Inline form rows. */
+.form-row { display: grid; grid-template-columns: repeat(4, 1fr); gap: 10px 14px; }
+@media (max-width: 900px) { .form-row { grid-template-columns: 1fr; } }
 
-/* ── Queued deployment visual ────────────────────────────────────── */
+/* ── Gate queue "horse race" visual ──────────────────────────────── */
 .queue-track {
   display: grid; gap: 6px;
   padding: 10px 0;
@@ -554,289 +414,52 @@ tr.unbootable td:first-child { border-left: 3px solid var(--warn); }
   min-height: 480px;
   box-shadow: var(--shadow-card);
 }
-/* Terminal pane colours follow the active theme. Hard-coded hexes
-   (#050505, #181818, #cfd6e2 etc.) were leaving the light-mode pane
-   looking dark; we keep palette-aware vars instead so the toggle works. */
 .terminal .pane {
   flex: 1; overflow: auto;
   padding: 10px 14px;
   font-family: var(--mono); font-size: 12.5px; line-height: 1.5;
-  color: var(--fg);
+  color: #cfd6e2;
   white-space: pre-wrap; word-break: break-word;
 }
 .terminal .pane .lvl-error { color: var(--err); }
 .terminal .pane .lvl-warn  { color: var(--warn); }
-.terminal .pane .lvl-info  { color: var(--fg); }
-.terminal .pane .lvl-debug { color: var(--fg-dim); }
-.terminal .pane .lvl-trace { color: var(--fg-dimmer); }
-.terminal .pane .ts        { color: var(--fg-dimmer); }
-.terminal .pane .tg        { color: var(--accent); }
+.terminal .pane .lvl-info  { color: #cfd6e2; }
+.terminal .pane .lvl-debug { color: #8b94a8; }
+.terminal .pane .lvl-trace { color: #5a6379; }
+.terminal .pane .ts        { color: #5a6379; }
+.terminal .pane .tg        { color: #7cd3ff; }
 .terminal .pane .echo      { color: var(--accent); }
 .terminal .input-row {
   display: flex; align-items: center; gap: 8px;
   padding: 8px 14px;
-  background: var(--bg-panel-2);
-  border-top: 1px solid var(--border);
+  background: #0a0e15;
+  border-top: 1px solid #1d2330;
 }
 .terminal .input-row .prompt { color: var(--accent); font-family: var(--mono); }
 .terminal .input-row input {
-  flex: 1; background: transparent; border: 0; color: var(--fg);
+  flex: 1; background: transparent; border: 0; color: #e4e8ef;
   font: inherit; font-family: var(--mono); font-size: 13px;
   outline: none; padding: 4px 0;
 }
 .terminal .toolbar {
   display: flex; gap: 8px; align-items: center;
   padding: 8px 14px;
-  background: var(--bg-panel-2);
-  border-bottom: 1px solid var(--border);
-  font-size: 12px; color: var(--fg-dim);
+  background: #0a0e15;
+  border-bottom: 1px solid #1d2330;
+  font-size: 12px; color: #8a94a7;
 }
 .terminal .toolbar .right { margin-left: auto; display: flex; gap: 6px; }
 .terminal .toolbar button {
   padding: 3px 9px; font-size: 11px;
-  background: transparent; color: var(--fg-dim); border: 1px solid var(--border);
+  background: transparent; color: #8a94a7; border: 1px solid #1d2330;
   font-weight: 500;
 }
-.terminal .toolbar button:hover { color: var(--fg); background: var(--bg-elev); }
-
-/* ── Auth screen (first-run setup + login) ───────────────────────
-   Used when /api/me reports setup_required or !authenticated. The
-   regular .shell is hidden; this overlay takes the full viewport so
-   the operator never sees half-loaded dashboard chrome while the auth
-   state is unknown. Same palette as the rest of the UI — borrows the
-   Sonarr/Radarr layout (centered narrow card on the page background).
-*/
-.auth-screen {
-  position: fixed; inset: 0;
-  display: flex; align-items: center; justify-content: center;
-  background: var(--bg);
-  padding: 24px;
-  z-index: 100;
-}
-.auth-card {
-  width: 100%; max-width: 380px;
-  background: var(--bg-panel);
-  border: 1px solid var(--border);
-  border-radius: var(--radius-lg);
-  box-shadow: var(--shadow-card);
-  padding: 28px 28px 22px;
-}
-.auth-card .brand-row {
-  display: flex; align-items: center; gap: 12px;
-  margin-bottom: 18px;
-}
-.auth-card .brand-row img { width: 32px; height: 32px; flex: none; }
-.auth-card .brand-row .name { font-size: 17px; font-weight: 600; letter-spacing: 0.2px; color: var(--fg); }
-/* v0.5.0: FleetDM-style custom logo on the login/setup card — the
-   uploaded logo spans the card header and the "OpenPXE" wordmark is
-   dropped (the logo is the brand). Matches the sidebar treatment. */
-.auth-card .brand-row.has-custom-logo { justify-content: center; gap: 0; margin-bottom: 22px; }
-.auth-card .brand-row.has-custom-logo img {
-  width: auto; height: 52px; max-width: 240px;
-  object-fit: contain; object-position: center;
-}
-.auth-card h2 {
-  margin: 0 0 6px; font-size: 16px; font-weight: 600; color: var(--fg);
-}
-.auth-card .lede {
-  color: var(--fg-dim); font-size: 13px; margin: 0 0 18px;
-  line-height: 1.5;
-}
-.auth-card .field { margin-bottom: 12px; }
-.auth-card input[type="text"],
-.auth-card input[type="password"] {
-  width: 100%; background: var(--bg); color: var(--fg);
-  border: 1px solid var(--border); border-radius: var(--radius);
-  padding: 9px 11px; font: inherit; font-size: 13.5px;
-}
-.auth-card input:focus { outline: none; border-color: var(--accent); }
-.auth-card .submit { width: 100%; padding: 9px 12px; margin-top: 6px; }
-.auth-card .auth-err {
-  margin-top: 12px; color: var(--err); font-size: 12.5px;
-}
-.auth-card .auth-foot {
-  margin-top: 14px; padding-top: 12px;
-  border-top: 1px solid var(--border-soft);
-  color: var(--fg-dimmer); font-size: 11.5px; text-align: center;
-}
-.auth-card .sso-btn {
-  width: 100%; margin-top: 10px;
-  background: transparent; color: var(--fg);
-  border: 1px solid var(--border);
-  padding: 9px 12px;
-}
-.auth-card .sso-btn:hover {
-  background: var(--bg-panel-2); border-color: var(--accent); color: var(--fg);
-}
-.auth-card .sso-btn .meta { color: var(--fg-dim); font-size: 11px; margin-top: 2px; }
-
-/* ── Top-right user menu (v0.4.6) ────────────────────────────
-   The "signed in as X" identity + sign-out moved out of the sidebar
-   footer in v0.4.6 — the sidebar footer is now reserved for the
-   service-state trio (Service status / Advertised URL / Backend
-   version). The button matches the theme toggle's size + chrome so
-   the top-right reads as a tidy two-icon strip. */
-.user-menu { position: relative; }
-.user-btn {
-  display: inline-flex; align-items: center; justify-content: center;
-  width: 36px; height: 32px;
-  background: transparent; color: var(--fg);
-  border: 1px solid var(--border); border-radius: 8px;
-  cursor: pointer; padding: 0;
-  transition: background 0.15s ease, border-color 0.15s ease;
-}
-.user-btn:hover { background: var(--bg-panel-2); border-color: var(--accent); }
-.user-pop {
-  position: absolute; right: 0; top: 38px;
-  min-width: 200px;
-  background: var(--bg-panel);
-  border: 1px solid var(--border);
-  border-radius: var(--radius-lg);
-  box-shadow: var(--shadow-card);
-  padding: 6px;
-  z-index: 60;
-  display: flex; flex-direction: column; gap: 2px;
-}
-.user-pop[hidden] { display: none; }
-.user-pop .user-pop-name {
-  padding: 8px 10px 6px;
-  border-bottom: 1px solid var(--border-soft);
-  margin-bottom: 4px;
-  color: var(--fg); font-weight: 600; font-size: 13px;
-  overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
-}
-.user-pop .user-pop-item {
-  text-align: left; width: 100%;
-  background: transparent; color: var(--fg);
-  border: 0; border-radius: var(--radius);
-  padding: 7px 10px; font: inherit; font-size: 13px; font-weight: 500;
-  cursor: pointer;
-}
-.user-pop .user-pop-item:hover {
-  background: var(--bg-panel-2); color: var(--fg);
-}
-.user-pop .user-pop-danger { color: var(--err); }
-.user-pop .user-pop-danger:hover {
-  background: color-mix(in srgb, var(--err) 12%, transparent);
-  color: var(--err);
-}
+.terminal .toolbar button:hover { color: #e4e8ef; background: #1d2330; }
 
 /* ── About card ─────────────────────────────────────────────────── */
 .about-hero { padding: 20px 24px; }
 .about-hero h2 { font-size: 22px; margin: 0 0 8px; color: var(--fg); }
-/* Span the full main column rather than capping at 60ch — the page is
-   read at typical desktop widths and the cap was leaving the right two
-   thirds of the panel awkwardly empty. */
-.about-hero .lead { color: var(--fg-dim); font-size: 14px; max-width: none; }
+.about-hero .lead { color: var(--fg-dim); font-size: 14px; max-width: 60ch; }
 .about-hero .who { margin-top: 18px; font-size: 13px; }
 .about-hero .who span { color: var(--fg-dim); }
 .about-hero .who strong { color: var(--accent); }
-.about-hero a { color: var(--accent); }
-
-/* ── API reference (Settings → bottom) ─────────────────────────── */
-.api-ref { display: grid; gap: 18px; padding: 16px; }
-.api-ref .group h3 {
-  margin: 0 0 8px; font-size: 13px; color: var(--fg-dim);
-  text-transform: uppercase; letter-spacing: 0.8px;
-}
-.api-ref .ep {
-  display: grid; grid-template-columns: 64px minmax(200px, 1fr) 2fr;
-  gap: 12px; align-items: baseline;
-  padding: 6px 0; border-top: 1px solid var(--border-soft);
-  font-size: 13px;
-}
-.api-ref .ep:first-child { border-top: 0; }
-.api-ref .ep .method {
-  font-family: var(--mono); font-weight: 600; font-size: 11px;
-  padding: 2px 6px; border-radius: 4px;
-  text-align: center; letter-spacing: 0.6px;
-}
-.api-ref .ep .method.get    { background: color-mix(in srgb, var(--ok) 22%, transparent);     color: var(--ok); }
-.api-ref .ep .method.post   { background: color-mix(in srgb, var(--accent) 22%, transparent); color: var(--accent); }
-.api-ref .ep .method.put    { background: color-mix(in srgb, var(--warn) 22%, transparent);   color: var(--warn); }
-.api-ref .ep .method.delete { background: color-mix(in srgb, var(--err) 22%, transparent);    color: var(--err); }
-.api-ref .ep .path { font-family: var(--mono); color: var(--fg); word-break: break-all; }
-.api-ref .ep .desc { color: var(--fg-dim); }
-@media (max-width: 900px) {
-  .api-ref .ep { grid-template-columns: 1fr; gap: 4px; }
-  .api-ref .ep .method { justify-self: start; }
-}
-
-/* ── Disk space card ───────────────────────────────────────────── */
-.diskbar {
-  height: 10px; border-radius: 5px;
-  background: var(--bg-elev);
-  overflow: hidden; margin-top: 8px;
-}
-.diskbar .fill {
-  height: 100%;
-  background: linear-gradient(90deg, var(--accent-dim), var(--accent));
-  transition: width 0.4s ease;
-}
-.diskbar.warn .fill { background: var(--warn); }
-.diskbar.full .fill { background: var(--err); }
-.disk-meta { display: flex; gap: 14px; font-size: 12px; color: var(--fg-dim); margin-top: 8px; flex-wrap: wrap; }
-.disk-meta strong { color: var(--fg); font-weight: 600; font-variant-numeric: tabular-nums; }
-
-/* ── Logo upload (Settings) ────────────────────────────────────── */
-.logo-preview {
-  display: flex; align-items: center; gap: 14px;
-  padding: 12px;
-  background: var(--bg-panel-2);
-  border: 1px solid var(--border);
-  border-radius: var(--radius);
-}
-.logo-preview .swatch {
-  width: 56px; height: 56px;
-  display: flex; align-items: center; justify-content: center;
-  background: var(--bg); border: 1px solid var(--border);
-  border-radius: var(--radius);
-  flex: none;
-}
-.logo-preview .swatch img { max-width: 48px; max-height: 48px; }
-.logo-preview .info { flex: 1; min-width: 0; }
-.logo-preview .info .name { color: var(--fg); font-weight: 600; }
-.logo-preview .info .meta { color: var(--fg-dim); font-size: 12px; margin-top: 2px; }
-
-/* v0.5.1: collapsible "Advanced" disclosure at the bottom of Settings
-   (the former Advanced sidebar tab). A quiet, full-width toggle that
-   expands to reveal the notification + API-reference cards. */
-.advanced-disclosure { width: 100%; }
-.advanced-summary {
-  list-style: none;
-  cursor: pointer;
-  user-select: none;
-  display: flex;
-  align-items: center;
-  gap: 8px;
-  padding: 10px 14px;
-  color: var(--fg-dim);
-  font-size: 13px;
-  font-weight: 600;
-  background: var(--bg-panel-2);
-  border: 1px solid var(--border);
-  border-radius: var(--radius);
-}
-.advanced-summary:hover { color: var(--fg); }
-.advanced-summary::-webkit-details-marker { display: none; }
-.advanced-summary::before {
-  content: "▸";
-  font-size: 11px;
-  transition: transform 0.15s ease;
-}
-.advanced-disclosure[open] .advanced-summary::before { transform: rotate(90deg); }
-
-/* v0.5.1: protocol tag on a unified Remote-shares row (SMB / NFS). */
-.proto-badge {
-  display: inline-block;
-  font-size: 10px;
-  font-weight: 700;
-  letter-spacing: 0.04em;
-  padding: 1px 6px;
-  margin-right: 8px;
-  border-radius: 4px;
-  vertical-align: middle;
-  background: var(--bg-panel-2);
-  border: 1px solid var(--border);
-  color: var(--fg-dim);
-}

crates/webui/src/index.html

@@ -5,15 +5,8 @@
   <meta name="viewport" content="width=device-width, initial-scale=1" />
   <meta name="color-scheme" content="dark light" />
   <title>OpenPXE</title>
-  <!-- v0.4.61: the `?v=…` query string is replaced by the server at
-       request time with the running OpenPXE version. That guarantees a
-       fresh URL on every upgrade so browsers (and intermediary proxies)
-       can't keep serving stale JS / CSS / branding from before the
-       deploy. Combined with `Cache-Control: no-cache, must-revalidate`
-       on the asset handlers, the practical caching window is one
-       version. -->
-  <link rel="stylesheet" href="/assets/app.css?v={{ASSET_VERSION}}" />
-  <link rel="icon" type="image/svg+xml" href="/assets/logo.svg?v={{ASSET_VERSION}}&r={{LOGO_REV}}" />
+  <link rel="stylesheet" href="/assets/app.css" />
+  <link rel="icon" type="image/svg+xml" href="/assets/logo.svg" />
   <!-- Theme is read from localStorage *before* paint to avoid the
        dark→light flash on every navigation. Falls back to the OS
        preference and finally to dark. -->
@@ -32,9 +25,12 @@
 <body>
 <div class="shell">
   <aside class="sidebar">
-    <div class="{{BRAND_CLASS}}">
-      <img src="/assets/logo.svg?v={{ASSET_VERSION}}&r={{LOGO_REV}}" alt="OpenPXE" />
+    <div class="brand">
+      <img src="/assets/logo.svg" alt="" />
+      <div>
         <strong>OpenPXE</strong>
+        <div class="sub">v<span data-bind="version">0.3.0</span></div>
+      </div>
     </div>
     <nav>
       <a data-view="dashboard" class="active">Dashboard</a>
@@ -52,27 +48,18 @@
         <span class="count" data-bind="host_count">0</span>
       </a>
       <a data-view="terminal">Terminal</a>
-      <a data-view="settings">Settings</a>
       <a data-view="about">About</a>
     </nav>
     <div class="footer">
-      <div class="status-row">
-        <span class="dot" data-bind="ready_dot" title="Server readiness"></span>
-        <span class="status-label">Service status:</span>
-        <span class="status-value" data-bind="ready_label">checking…</span>
-      </div>
-      <div class="footer-sub">Advertised to clients</div>
+      Advertised to clients<br/>
       <code>{{BASE_URL}}</code>
-      <!-- The brand badge at the top can be overridden by operator-uploaded
-           logos; keep "OpenPXE v…" pinned in the footer so the backend
-           identity is always visible regardless of branding. -->
-      <div class="footer-version">OpenPXE&nbsp;v<span data-bind="version">0.4.63</span></div>
     </div>
   </aside>
 
   <header class="topbar">
     <h1 data-bind="view_title">Dashboard</h1>
     <div class="spacer"></div>
+    <span class="chip" data-bind="ready_chip" title="Server readiness">checking…</span>
     <span class="chip"><strong data-bind="iso_count2">0</strong>&nbsp;images</span>
     <span class="chip"><strong data-bind="client_count2">0</strong>&nbsp;clients</span>
     <span class="chip"><strong data-bind="queue_count2">0</strong>&nbsp;in queue</span>
@@ -96,32 +83,11 @@
         <path d="M20.5 14A8 8 0 0 1 10 3.5 a8 8 0 1 0 10.5 10.5z"/>
       </svg>
     </button>
-
-    <!-- v0.4.6: signed-in operator menu. Sits next to the theme toggle
-         in the top-right corner so the sidebar footer stays clean for
-         the "Service status / Advertised URL / Backend version" trio.
-         The whole block is hidden until /api/me confirms a session. -->
-    <div class="user-menu" data-bind="user_menu_wrap" style="display:none">
-      <button id="user-menu-btn" class="user-btn" type="button"
-              aria-label="Account menu" aria-haspopup="true" aria-expanded="false"
-              title="Account">
-        <svg viewBox="0 0 24 24" width="18" height="18" fill="none"
-             stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
-          <circle cx="12" cy="8" r="3.6"/>
-          <path d="M4.5 20a7.5 7.5 0 0 1 15 0"/>
-        </svg>
-      </button>
-      <div id="user-menu-pop" class="user-pop" data-bind="user_menu_pop" hidden>
-        <div class="user-pop-name" data-bind="user_pop_name">—</div>
-        <button type="button" class="user-pop-item" data-bind="user_pop_edit">Edit account</button>
-        <button type="button" class="user-pop-item user-pop-danger" data-bind="user_pop_logout">Sign out</button>
-      </div>
-    </div>
   </header>
 
   <main class="main" id="view-root"></main>
 </div>
 
-<script src="/assets/app.js?v={{ASSET_VERSION}}"></script>
+<script src="/assets/app.js"></script>
 </body>
 </html>

crates/webui/src/lib.rs

@@ -7,68 +7,27 @@
 //! nav, top bar with secondary tabs, card-dense content panels.
 #![forbid(unsafe_code)]
 
-/// Render the top-level page.
-///
-/// * `base_url` is interpolated into the footer so operators can see at
-///   a glance what URL clients are PXE-booting from.
-/// * `asset_version` is appended as `?v=…` to every asset URL so each
-///   release ships with brand-new asset URLs — browsers (and any
-///   intermediary proxy) can't keep serving last release's `app.js`
-///   when we know the new one is incompatible. Combined with
-///   `Cache-Control: no-cache, must-revalidate` on the asset handlers,
-///   the worst-case caching window is one version.
-/// * `logo_rev` is appended to the brand-mark and favicon URLs as an
-///   extra `&r=…` token. Unlike `asset_version` it changes every time
-///   the operator swaps the custom logo, so the top-left mark updates
-///   immediately on the next page load instead of being pinned to the
-///   release version (which only changes on upgrade). `index.html`
-///   itself is served `no-cache`, so the fresh token lands as soon as
-///   the operator reloads after an upload.
-/// * `has_custom_logo` switches the sidebar brand block between the
-///   bundled mark + "OpenPXE" wordmark (false) and a FleetDM-style
-///   full-width custom logo with the wordmark hidden (true). Rendered
-///   server-side so there's no flash of the default mark before JS runs.
+/// Render the top-level page. `base_url` is interpolated into the footer
+/// so operators can see at a glance what URL clients are PXE-booting from.
 #[must_use]
-pub fn index_html(
-    base_url: &str,
-    asset_version: &str,
-    logo_rev: u64,
-    has_custom_logo: bool,
-) -> String {
-    let brand_class = if has_custom_logo {
-        "brand has-custom-logo"
-    } else {
-        "brand"
-    };
-    INDEX_HTML
-        .replace("{{BASE_URL}}", base_url)
-        .replace("{{ASSET_VERSION}}", asset_version)
-        .replace("{{LOGO_REV}}", &logo_rev.to_string())
-        .replace("{{BRAND_CLASS}}", brand_class)
+pub fn index_html(base_url: &str) -> String {
+    INDEX_HTML.replace("{{BASE_URL}}", base_url)
 }
 
 #[must_use]
-pub fn app_js() -> &'static str {
-    APP_JS
-}
+pub fn app_js() -> &'static str { APP_JS }
 
 #[must_use]
-pub fn app_css() -> &'static str {
-    APP_CSS
-}
+pub fn app_css() -> &'static str { APP_CSS }
 
 #[must_use]
-pub fn logo_svg() -> &'static str {
-    LOGO_SVG
-}
+pub fn logo_svg() -> &'static str { LOGO_SVG }
 
 /// Larger, faster-cycling rainbow disc — used for the page-load
 /// transition and the imaging-progress widget on Dashboard / Queue.
 /// Pure SVG + SMIL, no JS, no GIF.
 #[must_use]
-pub fn loader_svg() -> &'static str {
-    LOADER_SVG
-}
+pub fn loader_svg() -> &'static str { LOADER_SVG }
 
 const INDEX_HTML: &str  = include_str!("index.html");
 const APP_CSS: &str     = include_str!("app.css");

deploy/docker/Dockerfile

@@ -14,14 +14,9 @@
 # Debian slim at ~75 MB + binary ~25 MB is fine for a PXE server that
 # spends most of its life idle.
 
-ARG RUST_VERSION=1.95
+ARG RUST_VERSION=1.82
 
-########## fetch iPXE binaries + wimboot ##########
-# Pulls the upstream boot.ipxe.org pre-builds (no PNG support) plus
-# wimboot. These cover the arches we don't build from source here:
-# BIOS undionly.kpxe and i386-efi (which need a 32-bit x86 toolchain),
-# and serve as the baseline that the PNG-enabled x86_64/arm64 UEFI
-# binaries from the `ipxe-build` stage overlay on top of.
+########## fetch iPXE binaries ##########
 FROM debian:12-slim AS fetch
 RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates \
  && rm -rf /var/lib/apt/lists/*
@@ -29,85 +24,27 @@ WORKDIR /src
 COPY scripts/fetch-ipxe.sh scripts/fetch-ipxe.sh
 RUN mkdir -p assets/ipxe && bash scripts/fetch-ipxe.sh
 
-########## build PNG-enabled iPXE from source ##########
-# v0.4.69: THE graphical-boot-menu unlock. iVentoy paints a PNG
-# background on the PXE screen using stock iPXE built with
-# CONSOLE_FRAMEBUFFER + IMAGE_PNG + CONSOLE_CMD; the public iPXE
-# binaries omit those, so `console --picture` is a no-op on them.
-# We build our own from upstream with that thin config delta.
-#
-# The historical blocker was cc1 segfaulting when an amd64 gcc ran
-# under QEMU emulation on an arm64 host. The fix: pin this stage to
-# $BUILDPLATFORM (the NATIVE builder arch — arm64 on an Apple-Silicon
-# Mac, amd64 in x86 CI) and cross-compile with a real cross toolchain
-# (CROSS_COMPILE=x86_64-linux-gnu-). The compiler runs native and
-# emits x86_64 — no emulation, no segfault. arm64-efi builds natively.
-FROM --platform=$BUILDPLATFORM debian:12-slim AS ipxe-build
-# libc6-dev is REQUIRED and easy to miss under --no-install-recommends:
-# iPXE's host utilities (elf2efi, zbin) compile with the native gcc and
-# pull <stdint.h>; without the native libc headers gcc's #include_next
-# falls through to iPXE's freestanding headers and dies on bits/stdint.h.
-# The target (iPXE firmware) code is -ffreestanding/-nostdinc, so the
-# x86_64 cross toolchain needs NO cross libc headers.
-RUN apt-get update && apt-get install -y --no-install-recommends \
-        git make perl gcc binutils libc6-dev \
-        gcc-x86-64-linux-gnu binutils-x86-64-linux-gnu \
-        ca-certificates \
- && rm -rf /var/lib/apt/lists/*
-WORKDIR /src
-COPY scripts/build-ipxe.sh scripts/build-ipxe.sh
-COPY deploy/ipxe/local/ deploy/ipxe/local/
-RUN mkdir -p assets/ipxe && bash scripts/build-ipxe.sh /src/assets/ipxe
-
 ########## build openpxe ##########
 FROM rust:${RUST_VERSION}-bookworm AS build
 WORKDIR /src
 
-# v0.4.5: build a fully static musl binary (matches Bootimus v0.1.70's
-# move). The resulting `/openpxe` has no glibc dependency at all, which:
-#   - Lets the runtime stage be any Linux distro (we still ship Debian
-#     slim for the `samba` / `wimtools` / `nfs-common` shellouts, but a
-#     scratch/distroless variant becomes a one-line swap).
-#   - Cuts a class of "GLIBC_2.39 not found" surprises when running on
-#     older RHEL/Rocky hosts that don't match Debian 12's libc version.
-#   - Sidesteps cross-compilation snags (the binary is its own world).
-#
-# x86_64-unknown-linux-musl is fully static by default (no extra
-# RUSTFLAGS needed). musl-tools provides the linker.
-RUN apt-get update \
- && apt-get install -y --no-install-recommends musl-tools \
- && rm -rf /var/lib/apt/lists/* \
- && rustup target add x86_64-unknown-linux-musl
-
 # Copy the whole workspace in one go. We used to do a two-pass "cache-prime
 # with stubs, then real build" dance for dep-compile reuse; that turned out
 # to silently serve stale stub binaries when cargo's fingerprint didn't
 # notice the source swap. A single build is ~1.5 min longer on cold cache
 # but guarantees the binary reflects the sources we copied.
-# Do not copy rust-toolchain.toml into the image. The local workspace pins
-# developer tooling, but inside Docker we intentionally use the Rust version
-# selected by the base image. Copying rust-toolchain.toml with
-# `channel = "stable"` makes rustup download a second full toolchain during
-# `cargo build`, which is slow and can exhaust small Colima/CI disks.
-COPY Cargo.toml Cargo.lock ./
+COPY Cargo.toml rust-toolchain.toml ./
 COPY crates/ crates/
-# Baseline binaries (BIOS / i386 / wimboot), then overlay the
-# PNG-enabled x86_64 + arm64 UEFI binaries built from source. The
-# overlay wins for snponly.efi / ipxe.efi / snponly-arm64.efi so the
-# common modern clients get the graphical background; the rest keep the
-# upstream no-PNG binaries and the menu's `|| console` text fallback.
 COPY --from=fetch /src/assets/ipxe /src/assets/ipxe
-COPY --from=ipxe-build /src/assets/ipxe/snponly.efi /src/assets/ipxe/snponly.efi
-COPY --from=ipxe-build /src/assets/ipxe/ipxe.efi /src/assets/ipxe/ipxe.efi
 
-# Cache cargo registry + target across builds. The mtime touch is
+# Cache cargo registry + target across builds. The `--no-edit` touch is
 # belt-and-suspenders: cargo occasionally misses mtime-only changes on
 # networked FS; this forces a fingerprint check.
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
     --mount=type=cache,target=/src/target,sharing=locked \
     find crates -name '*.rs' -exec touch {} + && \
-    cargo build --release --target x86_64-unknown-linux-musl --bin openpxe && \
-    cp target/x86_64-unknown-linux-musl/release/openpxe /openpxe && \
+    cargo build --release --bin openpxe && \
+    cp target/release/openpxe /openpxe && \
     ls -l /openpxe
 
 ########## runtime ##########
@@ -115,45 +52,27 @@ FROM debian:12-slim AS runtime
 RUN apt-get update \
  && apt-get install -y --no-install-recommends \
         ca-certificates libcap2-bin tini gosu iproute2 \
-        wimtools samba smbclient \
+        wimtools samba nfs-common \
  && rm -rf /var/lib/apt/lists/* \
  && useradd --system --uid 10001 --home-dir /var/lib/openpxe --shell /usr/sbin/nologin openpxe \
  && mkdir -p /var/lib/openpxe/isos /var/lib/openpxe/work /var/lib/openpxe/smb \
  && chown -R openpxe:openpxe /var/lib/openpxe
-# v0.4.5: the openpxe binary itself is now built against musl and is
-# fully static — no glibc dependency. The runtime stage still ships
-# Debian slim because OpenPXE shells out to the packages below for
-# functionality we deliberately don't reimplement in-process:
-#
-#   wimtools   - `wimlib-imagex`, used to inject startnet.cmd into boot.wim.
-#   samba      - `smbd` serves extracted Windows install media on :445 so
-#                WinPE can `net use`. Guest read-only, scoped to
-#                /var/lib/openpxe/smb. This package provides the SERVER
-#                side only; the client CLI is a separate package below.
-#   smbclient  - v0.4.66: Samba's `smbclient` userspace CLI, used by
-#                the Storage tab's SMB shares manager to list and stream
-#                ISOs from remote SMB servers without ever mounting them
-#                in the kernel. In Debian 12 `smbclient` is NOT pulled
-#                in by the `samba` package — they're siblings, not
-#                parent/child. v0.4.65 shipped without this line and
-#                every "Add share" attempt surfaced
-#                `could not exec smbclient: No such file or directory`
-#                until this landed.
-#   iproute2   - `ip addr` / `ip route` for the auto-detected Network
-#                tab fields (NIC name, subnet mask, default gateway).
-#                Tiny, always available; we don't pull in netlink crates
-#                for this one-shot startup probe.
-#   gosu       - drops privileges cleanly from root after the entrypoint
-#                fixes bind-mount ownership (common OpenShift/Docker UX
-#                issue).
-#
-# v0.4.65 dropped `nfs-common` — kernel-mount NFS is gone. The SMB
-# shares replacement uses userspace `smbclient` and needs no kernel
-# helpers.
-#
-# A future "openpxe-static" variant could drop everything except the
-# binary onto distroless once we move the Windows + SMB legs to
-# in-process Rust crates.
+# Runtime deps explained:
+#   wimtools  - provides `wimlib-imagex`, used to inject startnet.cmd into boot.wim.
+#   samba     - `smbd` serves extracted Windows install media on :445 for WinPE
+#               to `net use`. Guest read-only, scoped to /var/lib/openpxe/smb.
+#   nfs-common - provides `mount.nfs` / `mount.nfs4` for the Storage tab's
+#               NFS share manager. Mount also requires the container to run
+#               with CAP_SYS_ADMIN — without it, mount(2) returns EPERM and
+#               the manager surfaces a clear error in the UI instead of
+#               failing silently.
+#   iproute2  - `ip addr` / `ip route` for the auto-detected Network tab
+#               fields (NIC name, subnet mask, default gateway). Tiny,
+#               always available; we don't pull in netlink crates for
+#               this one-shot startup probe.
+#   gosu      - drops privileges cleanly from root after the entrypoint fixes
+#               bind-mount ownership (common OpenShift/Docker UX issue).
+# Windows-specific tools only activate when the WebUI toggle is on.
 
 COPY --from=build /openpxe /usr/local/bin/openpxe
 COPY deploy/docker/entrypoint.sh /usr/local/bin/entrypoint.sh

deploy/ipxe/local/console.h

@@ -1,14 +0,0 @@
-/*
- * OpenPXE iPXE build override — console options.
- *
- * Included at the end of config/console.h. CONSOLE_FRAMEBUFFER is the
- * unified graphical framebuffer console (EFI GOP on UEFI, VESA on
- * BIOS); it's what `console --picture` paints into. This is the same
- * single flag iVentoy enables for its graphical PXE screen.
- *
- * We *add* the framebuffer console rather than replacing the default
- * EFI/BIOS text consoles, so text output still works before/after the
- * picture is set.
- */
-
-#define CONSOLE_FRAMEBUFFER

deploy/ipxe/local/general.h

@@ -1,23 +0,0 @@
-/*
- * OpenPXE iPXE build override — general options.
- *
- * iPXE includes <config/local/general.h> at the end of config/general.h,
- * so anything defined here is layered on top of the stock defaults
- * without editing upstream files. We enable exactly the features the
- * graphical PXE boot menu needs:
- *
- *   IMAGE_PNG    - PNG decoder, so `console --picture <png>` can paint
- *                  the operator's logo / OpenPXE background.
- *   IMAGE_PNM    - Netpbm decoder (cheap; harmless belt-and-suspenders).
- *   CONSOLE_CMD  - the `console` command itself. Without it you get
- *                  "console: command not found" even with a framebuffer.
- *
- * (CONSOLE_FRAMEBUFFER lives in config/local/console.h.)
- *
- * Everything else stays at upstream defaults — we are intentionally a
- * thin, auditable delta over stock iPXE so the UBDL/GPL story is simple.
- */
-
-#define IMAGE_PNG
-#define IMAGE_PNM
-#define CONSOLE_CMD

deploy/openshift/30-deployment.yaml

@@ -34,7 +34,7 @@ spec:
         fsGroup: 10001
       containers:
         - name: openpxe
-          image: gitea.milesward.dev/mward4/openpxe:0.4.1
+          image: ghcr.io/casperadmin/openpxe:0.1.0
           imagePullPolicy: IfNotPresent
           ports:
             - name: dhcp

deploy/unraid/README.md

@@ -6,7 +6,7 @@ boot from OpenPXE". Pick the one that matches what you have.
 ## Path A — build on Unraid, push to Gitea registry, pull by tag
 
 Recommended once you've done it once. Image is published to
-`gitea.milesward.dev/mward4/openpxe:0.4.1` (or your equivalent) and
+`gitea.milesward.dev/mward4/openpxe:0.1.0` (or your equivalent) and
 every Unraid template / docker-compose just references the tag.
 
 Pre-flight:
@@ -40,14 +40,14 @@ What it does:
 3. `docker build` against `deploy/docker/Dockerfile`.
 4. `docker login gitea.milesward.dev:3000` using a temp `DOCKER_CONFIG`
    so the credential never lands in your real `~/.docker/config.json`.
-5. `docker push` both `:0.4.1` and `:latest`.
+5. `docker push` both `:0.1.0` and `:latest`.
 6. Logout, scrub the temp config, delete the workspace.
 
 After it finishes, in Unraid → Docker → Add Container, set:
 
 | Field      | Value                                           |
 |------------|-------------------------------------------------|
-| Repository | `gitea.milesward.dev/mward4/openpxe:0.4.1`     |
+| Repository | `gitea.milesward.dev/mward4/openpxe:0.1.0`     |
 | Network    | `host`                                          |
 | Extra args | `--cap-add=NET_BIND_SERVICE`                    |
 
@@ -88,14 +88,14 @@ then:
 
 ```bash
 # On the build host
-docker save openpxe:0.4.1 | gzip > openpxe-0.4.1.tar.gz
+docker save openpxe:0.1.0 | gzip > openpxe-0.1.0.tar.gz
 
 # Transfer (rsync / scp / SMB / ZFS-replicate / sneakernet)
-scp openpxe-0.4.1.tar.gz root@unraid:/tmp/
+scp openpxe-0.1.0.tar.gz root@unraid:/tmp/
 
 # On Unraid
-gunzip -c /tmp/openpxe-0.4.1.tar.gz | docker load
-docker tag openpxe:0.4.1 gitea.milesward.dev/mward4/openpxe:0.4.1
+gunzip -c /tmp/openpxe-0.1.0.tar.gz | docker load
+docker tag openpxe:0.1.0 gitea.milesward.dev/mward4/openpxe:0.1.0
 ```
 
 If you want it pullable by tag from other Unraid templates, push to

deploy/unraid/openpxe.xml

@@ -34,8 +34,8 @@
     Air-gapped network PXE boot server. Container-native Rust
     implementation — DHCP proxy + TFTP + iPXE chainload + HTTP ISO
     streaming, all in one process. Web UI for ISO upload, NFS share
-    mounting, and Queued Deployment for coordinated launch of one ISO
-    across many waiting clients.
+    mounting, and Queued Deployment ("horse-race" simultaneous launch
+    of one ISO across many waiting clients).
 
     NEVER touches the client OS trust store: no test-signed drivers,
     no testsigning toggle, no httpdisk.sys. Windows boot uses vanilla

docs/NEXT_PHASE.md

@@ -1,7 +1,7 @@
 # Phase 6 — recommendations
 
-The v0.4.1 cut leaves OpenPXE in a state where the entire protocol stack
-and operator UI are exercised by the automated test suite, the container is
+The v0.2.0 cut leaves OpenPXE in a state where the entire protocol stack
+and operator UI are exercised by 66 automated tests, the container is
 multi-arch buildable, and the image ships at ~97 MB. What's left before
 this looks and feels like a 1.0 product is mostly **real-hardware
 validation** plus a small batch of features that can only sensibly be

docs/architecture.md

@@ -265,9 +265,10 @@ tab is one click from the brand bar.
 - Persisted to `<work_dir>/hosts.json`. Like `SettingsStore`, in-memory
   is authoritative — disk corruption falls back to empty rather than
   failing startup.
-- The DHCP reply embeds `?mac=${mac}` in the boot.ipxe URL; iPXE
-  substitutes the literal MAC client-side, so the HTTP layer can
-  short-circuit past the menu when a binding exists.
+- Inspired by Tinkerbell `smee`'s MAC-prepended URL pattern. The DHCP
+  reply now embeds `?mac=${mac}` in the boot.ipxe URL; iPXE substitutes
+  the literal MAC client-side, so the HTTP layer can short-circuit
+  past the menu when a binding exists.
 - `/api/hosts` GET / POST / DELETE drives the **Hosts** tab.
 
 **Prometheus metrics** (`crates/core/src/metrics.rs`):
@@ -287,17 +288,18 @@ warning-free. Replaced `format!()`-into-`String` with
 `Reverse`, fixed `map_or(false, …)` → `is_some_and`, and a handful of
 other idiom fixes.
 
-**UI overhaul** for the pre-beta milestone:
+**UI overhaul** for the v0.2.0 pre-beta milestone:
 - Light + dark themes via `:root[data-theme=light]` token swap.
   Toggled by a top-right button or the `T` key. Persisted in
   localStorage; pre-paint inline script avoids dark→light flash.
-- New SVG logos: a refined OpenPXE mark (`logo.svg`) and a compact
-  SMIL-animated loader (`loader.svg`). Pure SVG, embedded in the binary.
-- Deployment progress widget on the Dashboard and Queue: animated
-  OpenPXE mark paired with a `linear-gradient(warn → accent)` progress bar
+- New SVG logos: a refined anvil (`logo.svg`) and a SMIL-animated
+  `anvil-forge.svg` (rising sparks + pulsing underglow). Pure SVG —
+  no GIFs, no CSS keyframes for the sparks.
+- "Forge progress" widget on the Dashboard and Queue: animated
+  anvil paired with a `linear-gradient(warn → accent)` progress bar
   with a moving sheen. Goes idle (greyscale, no sheen) at zero
   imaging load.
-- Loader replaced "Loading..." text with the same OpenPXE mark.
+- Loader replaced "Loading…" text with the same anvil.
 - Sidebar gains a **Hosts** tab.
 
 **Windows boot validation**:
@@ -315,8 +317,7 @@ other idiom fixes.
   fixes: explicit `net start Workstation` before `net use`, surfaces
   errors instead of blind retries.
 
-**Test posture**: protocol, HTTP, ISO-store, Windows script, queue, metrics,
-and UI-offline checks all run in the workspace test suite.
+**Test count**: 66 → up from 56 in v0.1.0.
 
 ## What's deferred to Phase 6
 

docs/queued/ipxe-pxe-menu-theme-research.md

@@ -1,106 +0,0 @@
-# PXE menu theme — research for next-release follow-up
-
-Status: queued. v0.4.63 keeps the ASCII-banner fallback + `console --picture`
-compositor wired; this note captures the design for the menu-theming work
-that lands once iPXE rebuilt with `IMAGE_PNG` is published.
-
-## How iVentoy actually does it
-
-iVentoy is closed-source for its menu, but the supporting bits are
-public at https://github.com/ventoy/PXE — a vanilla iPXE snapshot
-(`iPXE/ipxe-bd13697`) used to produce the loader binaries iVentoy
-serves over TFTP (`pxeboot.efi`, `iventoy_loader_16000`,
-`iventoy_loader_16000_uefi`).
-
-The graphical menu itself is rendered by iPXE's framebuffer console
-with a baked-in PNG background via `console --picture` — same
-primitive OpenPXE already uses in `crates/http-api/src/ipxe_script.rs`.
-Evidence:
-
-- The iPXE build in `ventoy/PXE` is configured with `CONSOLE_FRAMEBUFFER`
-  + `IMAGE_PNG` + `CONSOLE_CMD` (the three flags `console --picture`
-  needs).
-- iVentoy issue #11 confirms "iventoy using default 1024x768"; users
-  report 800x600 / 1024x768 / 1280x720 / 1280x1024 / 1920x1080 as
-  selectable resolutions from the iVentoy web UI **Configuration tab**,
-  not via EDID auto-detect. iPXE has no EDID parsing; the daemon writes
-  a resolution-tagged script per boot and serves the matching PNG.
-- iVentoy docs explicitly state both Free and Pro editions **do not
-  support** modifying the boot background/title — it's baked into the
-  shipped PNG assets.
-- Chrome is iPXE's native `menu` / `item` / `choose` widgets (single
-  highlight bar, no borders) painted on top of the PNG, with margins
-  set via `console --left/--right/--top/--bottom` to keep the text off
-  the logo. Not GRUB, not syslinux — UEFI iVentoy uses iPXE's
-  `snponly.efi` / `pxeboot.efi`, and `--picture` does work under UEFI
-  GOP despite older folklore.
-
-Do not conflate this with Ventoy-USB, which is a separate codebase and
-uses GRUB2 themes (`theme.txt`, `background_ventoy.png`, `select_c.png`).
-
-## Rust ingredients to replicate / surpass
-
-Most of these already exist in the workspace.
-
-1. **Compositor (extend, don't replace)** — extend
-   `crates/iso-store/src/pxe_logo.rs` to emit per-resolution PNGs
-   (1024x768, 1280x1024, 1920x1080 as the v1 set). `image` +
-   `imageproc` crates handle scaling; `ab_glyph` / `fontdue` for raster
-   text (subtitle, hostname, version). One source SVG/logo, three to
-   five rendered PNGs cached on disk.
-2. **Script generator** — `ipxe_script.rs` already emits
-   `console --picture … || console`. Add a `?res=` query param (or
-   per-MAC client hint persisted in `hosts.json`) and serve the matching
-   PNG plus matching `console --x --y` line. Keep the text-console
-   fallback already in place.
-3. **Resolution selection** — iPXE exposes `${vesa-x}` / `${vesa-y}` on
-   BIOS; UEFI side we can probe firmware vars at chain-time. The simpler
-   v1 is a "low-res / hi-res" toggle in Settings plus a per-host
-   override — mirrors iVentoy's UX, no kernel helper needed. True EDID
-   parsing is overkill for the first cut.
-4. **Chrome upgrades over iVentoy** — iPXE menus are limited (single
-   highlight, no borders). To look distinctly cooler without leaving
-   iPXE: paint border / title / footer **into the PNG**, leave a window
-   in the middle, then `console --left/--right/--top/--bottom` to inset
-   the iPXE menu exactly into that window. ASCII box-drawing inside the
-   menu remains fragile (iPXE mangles non-ASCII on some builds — already
-   noted in `ipxe_script.rs`).
-
-## Recommended architecture for the next OpenPXE release
-
-- Build a `pxe_theme` module beside `pxe_logo.rs`: takes operator logo
-  + theme tokens (accent colour, title, footer) and renders a layered
-  PNG (background gradient → framing chrome → logo → title bar → footer
-  with `${hostname}` / `${version}` / `${ip}`) at the three target
-  resolutions. Cache by hash of inputs.
-- Serve at `/branding/pxe-menu-{w}x{h}.png`. Default 1024x768; expose a
-  Settings dropdown.
-- In `ipxe_script.rs`, emit
-  `console --picture …/pxe-menu-1024x768.png --left 80 --right 80 --top 180 --bottom 60 || console`,
-  then the existing `menu` / `item` / `choose` block — text now lands
-  inside the framed window.
-- Compile iPXE with `CONSOLE_FRAMEBUFFER`, `IMAGE_PNG`, `CONSOLE_CMD`,
-  `CONSOLE_VESAFB` (BIOS) and `CONSOLE_EFIFB` (UEFI). The v0.4.61 image
-  attempted this in-Docker via QEMU emulation and hit `cc1` segfaults.
-  The follow-up will use a Gitea Actions runner pinned to native
-  `linux/amd64` (an Unraid host already exists for this).
-- Stretch goal: a second "theme pack" that ships a layered PNG with
-  subtle scanlines / grid — iPXE can't animate, but a well-designed
-  static composite beats iVentoy's plain centered logo handily.
-
-## Source URLs
-
-- https://github.com/ventoy/PXE
-- https://github.com/ventoy/PXE/tree/master/iPXE
-- https://github.com/ventoy/PXE/issues/11 — 1024x768 default
-- https://github.com/ventoy/PXE/issues/59 — iVentoy iPXE EFI loader
-- https://ipxe.org/cmd/console — `--picture` and compile flags
-- https://github.com/ipxe/ipxe/discussions/945 — background image how-to
-- https://github.com/ipxe/ipxe/discussions/802 — `CONSOLE_FRAMEBUFFER`
-  requirement
-- https://github.com/ipxe/ipxe/discussions/1006 — picture resolution
-  behaviour
-- https://www.iventoy.com/en/doc_edition.html — background / title not
-  user-customisable
-- https://kingtam.win/archives/iventoy.html — third-party iPXE-based
-  iVentoy alternative

docs/superpowers/specs/2026-05-31-saml-sso-and-ui-design.md

@@ -1,199 +0,0 @@
-# OpenPXE v0.5.1 — SAML SSO wiring + Settings/Storage UI consolidation
-
-**Date:** 2026-05-31
-**Author:** Miles Ward (with Claude)
-**Status:** Approved design → implementation
-
-## Summary
-
-Three workstreams for v0.5.1:
-
-1. **Wire SAML 2.0 SSO** end-to-end (currently config is persisted but no runtime
-   sign-in exists). Pure-Rust implementation that preserves the static-musl /
-   no-OpenSSL architecture, mirroring how FleetDM exposes and handles SAML.
-2. **Fold the Advanced sidebar tab into Settings** as a collapsible section.
-3. **Merge the Storage tab's SMB and NFS cards** into one "Remote shares" card
-   with a protocol dropdown.
-
-Then bump `0.5.0 → 0.5.1`, build the static musl image, push `:0.5.1` + `:latest`
-to Gitea, create the release, and scrub registry credentials.
-
-## Decisions (locked with the user)
-
-- **Crypto:** pure-Rust via `bergshamra` (XML-DSig + exclusive c14n, RustCrypto-based,
-  `#![forbid(unsafe_code)]`, ~99% xmlsec interop). `samael` is rejected — it
-  hard-requires OpenSSL/`xmlsec`/`libxml2` C deps, which would break the static
-  musl binary and the project's pure-Rust / no-OpenSSL architecture.
-- **Access model:** any SAML assertion the IdP successfully authenticates and that
-  we cryptographically verify mints a full operator session. No user table, no
-  roles, no domain allowlist. The local admin account remains a guaranteed
-  fallback owner regardless of SSO state.
-- **Flows:** SP-initiated (the "Sign in with <IdP>" button) is always on.
-  IdP-initiated is supported but gated behind an `allow_idp_initiated` toggle
-  (default off), mirroring FleetDM's "Allow SSO login initiated by identity
-  provider."
-
-## Scope boundaries (v0.5.1)
-
-In scope: SP-initiated + (gated) IdP-initiated login, signature verification on the
-SAML Response/Assertion, full SP-side semantic validation, SP metadata endpoint,
-login-page button wiring.
-
-Out of scope (note for later releases): EncryptedAssertion (assertions must be
-unencrypted), signed AuthnRequests (sent unsigned; Keycloak "client signature
-required" must be off), Single Logout (SLO), multi-user accounts / RBAC / JIT role
-mapping.
-
----
-
-## Workstream 1 — SAML SP wiring (pure-Rust)
-
-### New dependencies (workspace)
-
-- `bergshamra` — XML-DSig verification + exclusive c14n (pure Rust).
-- `roxmltree` (read/navigate) and/or `quick-xml` (build/serialize) — parse IdP
-  metadata + SAMLResponse, build AuthnRequest and SP metadata.
-- `x509-parser` — extract the IdP signing certificate / public key from metadata.
-- `flate2` — raw DEFLATE for the HTTP-Redirect binding.
-- `base64` — encode/decode SAMLRequest/SAMLResponse.
-
-All pure-Rust → the `x86_64-unknown-linux-musl` static build stays OpenSSL-free.
-Exact `bergshamra` function signatures (`verify`, `DsigContext`, `KeysManager`,
-`Key`, `VerifiedReference`, `VerifyResult`) will be pinned against the installed
-crate source during implementation.
-
-### Module boundaries
-
-Pure protocol logic lives in `openpxe-core` (no axum dependency, unit-testable);
-HTTP wiring lives in `openpxe-http-api`.
-
-- `crates/core/src/saml/mod.rs` — public surface + shared types
-  (`VerifiedPrincipal { email, display_name, name_id, session_index }`, `SamlError`).
-- `crates/core/src/saml/metadata.rs` — parse IdP `EntityDescriptor`: IdP EntityID,
-  `SingleSignOnService` locations + bindings, and one or more X.509 signing
-  certificates. Also build **our** SP metadata XML.
-- `crates/core/src/saml/authn_request.rs` — build an AuthnRequest, return both the
-  request ID (to track) and the encoded HTTP-Redirect query value
-  (deflate → base64 → URL-encode).
-- `crates/core/src/saml/response.rs` — decode `SAMLResponse` (base64 → XML),
-  **verify the signature via bergshamra** against the IdP cert, then enforce SP
-  semantics, returning `VerifiedPrincipal` or a typed `SamlError`.
-
-### SP-side validation (response.rs)
-
-After a cryptographically valid signature over the Response and/or the Assertion:
-
-1. `Status` is `Success`.
-2. `Destination` (if present) equals our ACS URL.
-3. `Conditions/AudienceRestriction/Audience` equals our SP EntityID.
-4. `NotBefore` / `NotOnOrAfter` within bounds (allow small clock skew, e.g. ±60s).
-5. `InResponseTo` matches an outstanding request we issued (SP-initiated). Absent
-   for IdP-initiated, which is only accepted when `allow_idp_initiated` is true.
-6. Assertion-ID replay guard: reject a previously consumed assertion ID.
-7. NameID is the email (`nameid-format:emailAddress`). Display name read from
-   common attributes (`name`, `displayname`, `cn`, `urn:oid:2.5.4.3`).
-
-XML Signature Wrapping (XSW) defenses come from bergshamra (duplicate-ID rejection,
-strict positional verification); enable its strict verification options. We
-additionally confirm the verified `Reference` covers the element we read claims from.
-
-### State (in `openpxe-http-api`)
-
-Two small TTL-pruned in-memory stores (parking_lot `Mutex<HashMap<...>>`):
-
-- **Outstanding requests:** `request_id → issued_at`, TTL ≈ 5 min, for `InResponseTo`.
-- **Consumed assertions:** `assertion_id → expires_at`, TTL = assertion validity,
-  for replay protection.
-
-(In-memory is acceptable: a single-container app; a restart simply invalidates
-in-flight logins.)
-
-### Routes (all pre-auth; added to the public allowlist in the auth middleware)
-
-- `GET /api/sso/login` → build AuthnRequest, record its ID, 302 to the IdP SSO URL
-  (HTTP-Redirect binding) with `SAMLRequest` + `RelayState`.
-- `POST /api/sso/acs` → consume `SAMLResponse` (form-encoded). Verify + validate.
-  On success: `SessionStore::create(email)`, set the `openpxe_session` cookie
-  (same attributes as forms login), 302 to the dashboard. On failure: 302 back to
-  the login page with an error indicator. (Mirrors FleetDM's `/sso/callback`.)
-- `GET /api/sso/metadata` → serve our SP `EntityDescriptor` XML for IdP import.
-
-### Config changes (`crates/core/src/sso.rs`)
-
-Add to `SsoConfig` (preserve existing fields + validation):
-
-- `entity_id: String` — SP Entity ID (mirrors FleetDM's "Entity ID"); defaults to
-  the configured public base URL. The ACS URL is derived as
-  `<public_base_url>/api/sso/acs`.
-- `allow_idp_initiated: bool` — default `false`.
-
-`GET /api/sso` returns the new fields; `PUT /api/sso` validates and persists them.
-
-### Login page (`crates/webui/src/app.js`)
-
-Replace the "configured · runtime pending" message: the existing
-"Sign in with <IdP>" button navigates to `GET /api/sso/login`. Render the IdP logo
-(if `idp_logo_url` set) and use `idp_name` as the label. Keep the existing
-FleetDM-style login layout.
-
-### Testing
-
-- `core/saml` unit tests using a self-signed test keypair we control:
-  - Parse representative Keycloak IdP metadata → correct SSO URL + cert.
-  - Build an AuthnRequest → well-formed, deflate/base64 round-trips, ID recorded.
-  - A correctly signed Response → `VerifiedPrincipal { email, .. }`.
-  - Reject: tampered signature, expired (`NotOnOrAfter`), wrong audience,
-    replayed assertion ID, unsigned response, `Status != Success`.
-- `http-api` integration test: `GET /api/sso/login` returns a 302 with a
-  `SAMLRequest` query param; a crafted signed `SAMLResponse` POSTed to
-  `/api/sso/acs` (signed with the test key) sets an `openpxe_session` cookie.
-
----
-
-## Workstream 2 — Advanced tab → Settings
-
-- Remove the `Advanced` sidebar entry (`crates/webui/src/index.html`) and its
-  `advanced` view route in `app.js`.
-- In the Settings view, append a **collapsible "Advanced" disclosure**
-  (default-collapsed) at the bottom containing the existing **Webhook
-  Notifications** card and the **API reference** block (moved out of the removed
-  Advanced view).
-- No backend changes; `/api/notify*` and `/api/docs` endpoints are unchanged.
-
----
-
-## Workstream 3 — Storage: merge SMB + NFS → "Remote shares"
-
-- Replace the separate "SMB shares" and "NFS shares" cards with a single
-  **"Remote shares"** card:
-  - One add-form with a **protocol dropdown (SMB / NFS)**. Selecting the protocol
-    swaps the fields: SMB → server, share, guest checkbox, username, password;
-    NFS → server, export path.
-  - One unified table with a leading **Protocol** column (SMB/NFS badge), then
-    server/share-or-export, auth, ISO count, reachability, and Re-scan / Remove
-    actions.
-- **No backend changes.** The form dispatches to the existing
-  `POST /api/smb-shares` or `POST /api/nfs-shares`; the table merges
-  `GET /api/smb-shares` + `GET /api/nfs-shares`, tagging each row with its
-  protocol. Re-scan/Remove call the existing per-protocol endpoints.
-- Leaves the card pattern open for a future "Config files" card.
-
----
-
-## Release
-
-1. Bump workspace version `0.5.0 → 0.5.1` (`Cargo.toml`).
-2. `cargo fmt`, `cargo clippy`, `cargo test` (all crates) green.
-3. Build the static musl binary + Docker image; verify SAML deps compile clean
-   under musl (no OpenSSL/C linkage).
-4. Push `openpxe:0.5.1` + `openpxe:latest` to Gitea via the established
-   temp-DOCKER_CONFIG pipeline; scrub credentials (logout + verify no token traces).
-5. Create the Gitea release `v0.5.1` with notes.
-
-## Risks
-
-- `bergshamra` is pre-1.0 and unaudited. Mitigation: pin the version, enable strict
-  verification, keep the local-admin fallback, and own the SP-semantic checks
-  carefully (audience/Conditions/replay/InResponseTo — where SP vulns usually live).
-- SAML is security-sensitive; negative tests (tamper/expiry/audience/replay/unsigned)
-  are part of the definition of done, not optional.

runbooks/linux-network-boot.md

@@ -115,7 +115,7 @@ Two options. Pick one.
 
 Big ISOs stream — there is no 2 GB limit, but expect upload to be
 throttled by your browser ↔ host link. The UI shows a progress bar; the
-animated OpenPXE mark on the Dashboard tab fires up while imaging is in
+animated anvil on the Dashboard tab fires up while imaging is in
 flight.
 
 ### 2b. Bulk seed from a directory (recommended for fresh deploys / CI)
@@ -290,7 +290,7 @@ INFO openpxe::http: GET /iso/ubuntu-…/casper/initrd  Range=bytes=0- 200 OK 75
 ```
 
 The **Terminal** tab in the web UI shows the same thing live, plus a
-short whitelisted command palette (`status`, `clients`, `queue`,
+short whitelisted command palette (`status`, `clients`, `gate`,
 `hosts`, `log`).
 
 ### 5d. Internet-side ISO sources
@@ -347,19 +347,19 @@ default for production hardware.
 ## 7. Re-imaging — the “Queued Deployment” flow
 
 Different scenario: you have **a rack of 30 servers** to image
-identically, all at once. Don’t bind 30 MACs by hand. Use the queue.
+identically, all at once. Don’t bind 30 MACs by hand. Use the gate.
 
 1. **Don’t** create host bindings.
 2. PXE-boot every machine. They land on the menu.
 3. On each: select **Queued Deployment**. They get position #1, #2,
    …, #30 and start long-polling.
-4. In the UI: **Queue** tab shows all 30 lined up. Pick the
+4. In the UI: **Forge Gate** tab shows all 30 lined up. Pick the
    ISO, click **Assign to all waiting**.
 5. Every client’s open long-poll wakes up at the same instant and
    chains the same boot script. They all start imaging
-   simultaneously.
+   simultaneously — the “horse race gate” opens.
 
-The animated OpenPXE progress widget on the Dashboard runs while any client is
+The animated anvil widget on the Dashboard runs while any client is
 still in the kernel-fetch phase.
 
 ---

scripts/build-ipxe.sh

@@ -1,74 +0,0 @@
-#!/usr/bin/env bash
-# Build PNG-enabled iPXE binaries from source.
-#
-# Why from source: the official boot.ipxe.org binaries (and the
-# Debian-packaged ones) are NOT built with CONSOLE_FRAMEBUFFER +
-# IMAGE_PNG + CONSOLE_CMD, so `console --picture` is a no-op on them —
-# you can't paint a graphical boot-menu background. iVentoy solves this
-# by shipping its own iPXE build with exactly those three flags; we do
-# the same, from upstream iPXE, with a thin auditable config delta
-# (deploy/ipxe/local/{general,console}.h).
-#
-# Why a real cross-compiler instead of QEMU: building amd64 iPXE by
-# emulating an amd64 gcc under QEMU on an arm64 host intermittently
-# segfaults cc1 (the reason this was stuck for ~8 releases). Running a
-# NATIVE arm64 gcc that cross-targets x86_64 (CROSS_COMPILE=
-# x86_64-linux-gnu-) sidesteps emulation entirely — the compiler is a
-# native binary, it just emits x86_64 objects. This stage is meant to
-# run on $BUILDPLATFORM (the native builder arch), NOT the emulated
-# target platform.
-#
-# Outputs (into $DEST), using the filenames OpenPXE's arch mapping
-# expects:
-#   snponly.efi   x86_64 UEFI, PNG-enabled
-#   ipxe.efi      x86_64 UEFI, PNG-enabled (bundled drivers)
-#
-# We build ONLY x86_64 UEFI, always via the x86_64 cross toolchain
-# (`x86_64-linux-gnu-gcc`). That's deliberately host-arch-agnostic: it
-# works whether this stage runs on an arm64 Mac builder or an amd64 CI
-# runner, because the cross compiler runs native and emits x86_64
-# either way. Building arm64-efi or BIOS here would re-introduce a
-# dependency on the host arch (native arm64 build) or a 32-bit multilib
-# toolchain — so those arches keep their upstream-fetched (no-PNG)
-# binaries and fall back to the menu's clean `|| console` text screen.
-# Modern PXE clients are overwhelmingly x86_64 UEFI, which get the full
-# graphical background.
-
-set -euo pipefail
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd)"
-DEST="${1:-$ROOT/assets/ipxe}"
-WORK="$(mktemp -d)"
-trap 'rm -rf "$WORK"' EXIT
-
-# Pinned upstream iPXE. Rolling master is fine functionally, but a pin
-# keeps builds reproducible and protects against a transient master
-# breakage. Bump deliberately.
-IPXE_REPO="https://github.com/ipxe/ipxe.git"
-IPXE_REF="${IPXE_REF:-master}"
-
-echo ">> cloning iPXE ($IPXE_REF)"
-git clone --depth 1 --branch "$IPXE_REF" "$IPXE_REPO" "$WORK/ipxe" 2>/dev/null \
-  || git clone "$IPXE_REPO" "$WORK/ipxe"
-SRC="$WORK/ipxe/src"
-
-echo ">> applying OpenPXE config overrides (PNG + framebuffer + console cmd)"
-mkdir -p "$SRC/config/local"
-cp "$ROOT/deploy/ipxe/local/general.h" "$SRC/config/local/general.h"
-cp "$ROOT/deploy/ipxe/local/console.h" "$SRC/config/local/console.h"
-
-mkdir -p "$DEST"
-
-# x86_64 UEFI — cross-compiled with the native arm64 gcc targeting
-# x86_64. HOST_CC stays the native cc for iPXE's build-time utilities
-# (elf2efi, zbin, …); only the target objects use the cross compiler.
-echo ">> building x86_64 UEFI (snponly.efi, ipxe.efi)"
-make -C "$SRC" -j"$(nproc)" \
-  CROSS_COMPILE=x86_64-linux-gnu- \
-  bin-x86_64-efi/snponly.efi \
-  bin-x86_64-efi/ipxe.efi
-cp "$SRC/bin-x86_64-efi/snponly.efi" "$DEST/snponly.efi"
-cp "$SRC/bin-x86_64-efi/ipxe.efi"    "$DEST/ipxe.efi"
-
-echo ">> iPXE build complete:"
-ls -l "$DEST"/snponly.efi "$DEST"/ipxe.efi