v0.4.5: VMware UEFI fix, static musl binary, Forms auth + SSO config

VMware UEFI / Casper boot fix:
- Linux cmdline for Debian/Ubuntu/Mint/Pop!_OS/elementary now uses the
  canonical Casper `iso-url=` option and `ds=nocloud`, matching the
  fix Bootimus shipped in v0.1.67. The previous
  `boot=casper netboot=url url=… ip=dhcp ---` form booted fine on
  bare-metal UEFI but hung at "cloud-init running" on VMware guests
  because subiquity / cloud-init can't reach a metadata datasource
  through PXE.

Static binary (matches Bootimus v0.1.70):
- Dockerfile build stage now compiles against
  x86_64-unknown-linux-musl. The resulting /openpxe has no glibc
  dependency at all; the runtime stage still ships Debian slim for the
  samba/wimtools/nfs-common shellouts, but a future scratch/distroless
  variant is now a one-line swap. Cuts a class of "GLIBC_2.39 not
  found" surprises on older RHEL/Rocky hosts.

Forms auth (Sonarr/Radarr-style):
- New AdminStore in openpxe-core: single admin record persisted to
  <work_dir>/auth.json, bcrypt-hashed credentials, rotation requires
  current password.
- New SessionStore in openpxe-http-api: in-memory UUID-keyed sessions
  with 24h sliding TTL, openpxe_session HttpOnly cookie.
- Endpoints: POST /api/setup (first-run), POST /api/login, POST
  /api/logout, GET /api/me, PUT /api/me/credentials (rotates and
  revokes every other session).
- Auth middleware gates /api/* once the admin is configured;
  passes through entirely until then (tests + fresh installs ride this
  path). Allowlists PXE-essential paths (/boot.ipxe, /iso/*, /ipxe/*,
  /api/queue/join, /api/queue/poll/*) so iPXE clients still work
  without a cookie they can't send.
- WebUI: first-run setup card, login card, logout chip in the sidebar
  footer, Account card in Settings for rotating creds. Auth screen is
  fully styled (centered narrow card, matches Sonarr layout).

SSO config (FleetDM-shaped, storage-only):
- New SsoStore in openpxe-core: { enabled, idp_name, metadata,
  metadata_url } persisted to <work_dir>/sso.json with size caps and
  URL-scheme validation.
- Endpoints: GET /api/sso, PUT /api/sso. Validation: enabling SSO
  without either metadata or metadata_url returns 400.
- WebUI: SSO card in Settings with a URL-vs-XML mode switch and an
  inert "Sign in with X" button on the login screen while runtime
  flow is pending. Per the brief: no Entity ID field (defaults to the
  advertised public_base_url internally when SAML wiring lands).

Quality:
- 132 tests passing (was 106 in v0.4.4): +5 auth unit tests, +5 SSO
  unit tests, +7 auth integration tests, +1 SSO integration test, +1
  regression guard pinning the new Casper cmdline.
- cargo clippy --workspace --all-targets clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

.claude/settings.json

@@ -1,16 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "Bash(cargo check *)",
-      "Bash(cargo build *)",
-      "Bash(cargo clippy *)",
-      "Bash(cargo fmt *)",
-      "Bash(cargo tree *)",
-      "Bash(cargo doc *)",
-      "Bash(cargo test --workspace --lib)",
-      "Bash(cargo test --workspace)",
-      "Bash(cargo --version)",
-      "Bash(rustc --version)"
-    ]
-  }
-}

Cargo.toml

@@ -12,7 +12,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.5.1"
+version = "0.4.5"
 edition = "2021"
 rust-version = "1.95"
 license = "MIT OR Apache-2.0"
@@ -35,7 +35,7 @@ axum = { version = "0.7", features = ["macros", "multipart", "http2"] }
 tower = "0.5"
 tower-http = { version = "0.6", features = ["fs", "trace", "cors", "limit"] }
 hyper = "1.4"
-reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "stream", "json"] }
+reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "stream"] }
 mime = "0.3"
 mime_guess = "2.0"
 
@@ -58,33 +58,6 @@ once_cell = "1.19"
 parking_lot = "0.12"
 rust-embed = { version = "8.5", features = ["include-exclude"] }
 
-# v0.4.67: pure-Rust NFSv3 client. Replaces the (deleted-in-v0.4.65)
-# kernel-mount NFS path with an in-process implementation that works
-# in any container — no kernel modules, no CAP_SYS_ADMIN, no
-# subprocess. Ships alongside the userspace SMB consumer; operators
-# pick whichever protocol their NAS prefers.
-nfs3_client = { version = "0.9", features = ["tokio"] }
-nfs3_types = "0.5"
-
-# v0.5.0: SMTP for webhook notifications (Slack/Teams/Discord go over
-# plain HTTP via reqwest; email needs a real SMTP client). rustls TLS
-# to match reqwest and stay musl-static-friendly — no OpenSSL.
-lettre = { version = "0.11", default-features = false, features = ["smtp-transport", "tokio1-rustls-tls", "builder", "hostname"] }
-
-# v0.5.1: pure-Rust SAML 2.0 Service Provider. bergshamra does XML-DSig
-# verification + exclusive c14n with RustCrypto (no OpenSSL/xmlsec/libxml2
-# C deps), so the static musl binary stays OpenSSL-free — samael was
-# rejected precisely because it hard-requires OpenSSL. We build the thin
-# SP layer (AuthnRequest, metadata parse, SAMLResponse semantics) on top.
-bergshamra = "0.4"
-roxmltree = "0.21"
-quick-xml = "0.40"
-x509-parser = "0.18"
-# flate2 default backend is miniz_oxide (pure Rust) — do NOT enable the
-# zlib/zlib-ng C backends, which would break the musl-static build.
-flate2 = "1.1"
-base64 = "0.22"
-
 openpxe-core = { path = "crates/core" }
 openpxe-dhcp-proxy = { path = "crates/dhcp-proxy" }
 openpxe-tftp = { path = "crates/tftp" }

crates/core/Cargo.toml

@@ -25,19 +25,5 @@ tokio = { workspace = true, features = ["sync", "rt", "macros", "time"] }
 # for per-ISO boot passwords; just re-exported here.
 bcrypt.workspace = true
 
-# v0.5.1: pure-Rust SAML 2.0 SP. bergshamra = XML-DSig verify + exclusive
-# c14n (no OpenSSL/C). roxmltree/quick-xml parse + build SAML XML;
-# x509-parser pulls the IdP signing cert out of metadata; flate2+base64
-# encode the HTTP-Redirect binding's SAMLRequest.
-bergshamra.workspace = true
-roxmltree.workspace = true
-quick-xml.workspace = true
-x509-parser.workspace = true
-flate2.workspace = true
-base64.workspace = true
-
 [dev-dependencies]
 tempfile = "3.12"
-# v0.5.1: generate a throwaway self-signed signing cert/key so SAML
-# verification tests can produce genuinely signed SAMLResponses.
-rcgen = "0.13"

crates/core/src/branding.rs

@@ -44,14 +44,6 @@ struct Inner {
     /// MIME of the active logo, mirroring `logo_filename`. Cached here
     /// so the HTTP layer can set Content-Type without re-sniffing.
     logo_mime: Option<String>,
-    /// Monotonic counter bumped on every set/clear. Surfaces as a
-    /// cache-bust token (`/assets/logo.svg?r=<rev>`) so the browser
-    /// fetches the new bytes the moment the operator swaps the logo —
-    /// the app version alone can't do this since it doesn't change on
-    /// upload. Persisted so the token stays stable across restarts and
-    /// keeps climbing across multiple swaps.
-    #[serde(default)]
-    rev: u64,
 }
 
 /// In-memory + on-disk override registry. Cheap to clone; locks are
@@ -158,7 +150,6 @@ impl BrandingStore {
             let mut g = self.inner.write();
             g.logo_filename = Some(filename.clone());
             g.logo_mime = Some(mime.to_string());
-            g.rev = g.rev.wrapping_add(1);
         }
         self.persist();
         tracing::info!(
@@ -175,7 +166,6 @@ impl BrandingStore {
             let mut g = self.inner.write();
             let removed = g.logo_filename.take();
             g.logo_mime = None;
-            g.rev = g.rev.wrapping_add(1);
             removed
         };
         if let Some(name) = removed {
@@ -195,14 +185,6 @@ impl BrandingStore {
         self.inner.read().logo_filename.is_some()
     }
 
-    /// Cache-bust token for the logo asset URL. Changes on every
-    /// set/clear so `/assets/logo.svg?r=<rev>` resolves to a fresh URL
-    /// whenever the operator swaps the brand mark. Stable otherwise.
-    #[must_use]
-    pub fn logo_rev(&self) -> u64 {
-        self.inner.read().rev
-    }
-
     fn persist(&self) {
         let snap = self.inner.read().clone();
         let body = match serde_json::to_vec_pretty(&snap) {
@@ -310,23 +292,6 @@ mod tests {
         assert!(!entries.iter().any(|n| n == "logo.png"), "stale PNG left over: {entries:?}");
     }
 
-    #[test]
-    fn logo_rev_bumps_on_each_set_and_clear() {
-        let dir = tempdir().unwrap();
-        let b = BrandingStore::load_or_default(dir.path());
-        assert_eq!(b.logo_rev(), 0);
-        b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake").unwrap();
-        assert_eq!(b.logo_rev(), 1);
-        b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake2").unwrap();
-        assert_eq!(b.logo_rev(), 2);
-        b.clear_logo().unwrap();
-        assert_eq!(b.logo_rev(), 3);
-        // Survives a restart.
-        drop(b);
-        let b2 = BrandingStore::load_or_default(dir.path());
-        assert_eq!(b2.logo_rev(), 3);
-    }
-
     #[test]
     fn sanitize_ext_strips_separators_and_path_chars() {
         assert_eq!(sanitize_ext("svg"), "svg");
@@ -354,7 +319,6 @@ mod tests {
         let inner = Inner {
             logo_filename: Some("logo.png".into()),
             logo_mime: Some("image/png".into()),
-            rev: 0,
         };
         std::fs::write(
             brand_dir.join("branding.json"),

crates/core/src/lib.rs

@@ -12,25 +12,20 @@ pub mod error;
 pub mod host_bindings;
 pub mod log_bus;
 pub mod metrics;
-pub mod notify;
 pub mod queue;
-pub mod saml;
 pub mod settings;
 pub mod sso;
-pub mod wol;
 
 pub use arch::{ClientArch, FirmwareClass};
 pub use auth::{AdminAccount, AdminPublic, AdminStore};
 pub use boot_log::{BootEvent, BootLog};
 pub use branding::{ext_for_mime, BrandingStore, ALLOWED_LOGO_MIMES, MAX_LOGO_BYTES};
 pub use client::{ClientEvent, ClientRegistry, ClientSnapshot};
+pub use sso::{SsoConfig, SsoStore};
 pub use config::{Config, DhcpMode, NetworkConfig, Paths, ServerConfig};
 pub use error::{Error, Result};
 pub use host_bindings::{normalize_mac, HostBinding, HostBindings};
 pub use log_bus::{LogBus, LogBusLayer, LogLine};
 pub use metrics::{HttpRoute, Metrics};
-pub use notify::{NotifyConfig, NotifyKind, NotifyStore};
 pub use queue::{DeploymentQueue, QueueEntry};
-pub use saml::{IdpMetadata, SamlError, SpParams, VerifiedPrincipal, VerifiedResponse};
 pub use settings::{Settings, SettingsStore, TimeoutAction};
-pub use sso::{SsoConfig, SsoStore};

crates/core/src/notify.rs

@@ -1,362 +0,0 @@
-//! Webhook / email notification configuration.
-//!
-//! v0.5.0: OpenPXE can ping a chat webhook or send an email when
-//! something noteworthy happens (a machine PXE-booted an image, a
-//! deployment was assigned, a WoL was sent). One active provider at a
-//! time, chosen by `kind` — dead-simple for an L1 tech: pick Slack,
-//! paste the incoming-webhook URL, done.
-//!
-//! This module owns only the *configuration* (validation + persistence
-//! to `<work_dir>/notify.json`). The actual sending — HTTP POST for the
-//! chat providers, SMTP for email — lives in the http-api crate, which
-//! already carries an HTTP client and the SMTP dependency. Keeping the
-//! network I/O out of `core` matches how `BrandingStore`/`SsoStore`
-//! stay pure config stores.
-//!
-//! Secrets note: the SMTP password is persisted in `notify.json`
-//! alongside the rest of the config (0644 like the other state files).
-//! It is never echoed back through the API — the snapshot used for the
-//! GET response blanks it (see `Self::redacted`).
-
-use parking_lot::RwLock;
-use serde::{Deserialize, Serialize};
-use std::path::PathBuf;
-use std::sync::Arc;
-
-use crate::{Error, Result};
-
-const MAX_URL_LEN: usize = 2048;
-const MAX_FIELD_LEN: usize = 512;
-
-/// Which notification transport is active.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Serialize, Deserialize)]
-#[serde(rename_all = "lowercase")]
-pub enum NotifyKind {
-    /// Slack incoming webhook (`{ "text": ... }`).
-    #[default]
-    Slack,
-    /// Discord webhook (`{ "content": ... }`).
-    Discord,
-    /// Microsoft Teams incoming webhook (legacy MessageCard JSON).
-    Teams,
-    /// Email via SMTP.
-    Smtp,
-}
-
-impl NotifyKind {
-    /// True when this kind drives a chat webhook (POST a JSON body to a
-    /// single URL) rather than SMTP.
-    #[must_use]
-    pub fn is_webhook(self) -> bool {
-        matches!(self, Self::Slack | Self::Discord | Self::Teams)
-    }
-}
-
-/// Operator-configurable notification settings. Single provider active
-/// at a time; the inactive fields are kept so switching providers
-/// doesn't wipe the other one's values.
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-pub struct NotifyConfig {
-    #[serde(default)]
-    pub enabled: bool,
-    #[serde(default)]
-    pub kind: NotifyKind,
-    /// Incoming-webhook URL for Slack / Discord / Teams.
-    #[serde(default)]
-    pub webhook_url: String,
-
-    // ── SMTP fields (used when kind == Smtp) ──
-    #[serde(default)]
-    pub smtp_host: String,
-    #[serde(default = "default_smtp_port")]
-    pub smtp_port: u16,
-    #[serde(default)]
-    pub smtp_username: String,
-    #[serde(default)]
-    pub smtp_password: String,
-    /// `From:` address. Falls back to `smtp_username` when blank.
-    #[serde(default)]
-    pub smtp_from: String,
-    /// `To:` address (single recipient — keep it simple).
-    #[serde(default)]
-    pub smtp_to: String,
-    /// Use implicit TLS (port 465). When false we use STARTTLS on the
-    /// configured port (587 typical). Either way the connection is
-    /// encrypted — we never offer plaintext SMTP.
-    #[serde(default)]
-    pub smtp_implicit_tls: bool,
-}
-
-fn default_smtp_port() -> u16 {
-    587
-}
-
-impl NotifyConfig {
-    /// True when enabled and the active provider has the fields it
-    /// needs to actually send.
-    #[must_use]
-    pub fn is_usable(&self) -> bool {
-        if !self.enabled {
-            return false;
-        }
-        if self.kind.is_webhook() {
-            !self.webhook_url.trim().is_empty()
-        } else {
-            !self.smtp_host.trim().is_empty() && !self.smtp_to.trim().is_empty()
-        }
-    }
-
-    /// A copy safe to return over the API: the SMTP password is blanked
-    /// (replaced with a non-empty sentinel only when one is set, so the
-    /// UI can show "configured" without leaking it).
-    #[must_use]
-    pub fn redacted(&self) -> NotifyConfig {
-        let mut c = self.clone();
-        if !c.smtp_password.is_empty() {
-            c.smtp_password = SECRET_SENTINEL.to_string();
-        }
-        c
-    }
-}
-
-/// Returned by the API in place of a stored password. When the UI PUTs
-/// this value back unchanged we keep the existing password rather than
-/// overwriting it with the sentinel.
-pub const SECRET_SENTINEL: &str = "__keep__";
-
-/// In-memory + on-disk notification config registry.
-#[derive(Debug, Clone)]
-pub struct NotifyStore {
-    path: Arc<PathBuf>,
-    inner: Arc<RwLock<NotifyConfig>>,
-}
-
-impl NotifyStore {
-    #[must_use]
-    pub fn load_or_default(work_dir: &std::path::Path) -> Self {
-        let path = work_dir.join("notify.json");
-        let cfg = match std::fs::read_to_string(&path) {
-            Ok(text) => serde_json::from_str::<NotifyConfig>(&text).unwrap_or_else(|e| {
-                tracing::warn!(
-                    target: "openpxe::notify",
-                    "notify.json unreadable ({e}); starting with defaults"
-                );
-                NotifyConfig::default()
-            }),
-            Err(_) => NotifyConfig::default(),
-        };
-        Self {
-            path: Arc::new(path),
-            inner: Arc::new(RwLock::new(cfg)),
-        }
-    }
-
-    #[must_use]
-    pub fn snapshot(&self) -> NotifyConfig {
-        self.inner.read().clone()
-    }
-
-    /// Replace the whole config. `incoming.smtp_password == SECRET_SENTINEL`
-    /// is treated as "keep the existing password" so the UI never has to
-    /// round-trip the real secret.
-    pub fn replace(&self, mut incoming: NotifyConfig) -> Result<NotifyConfig> {
-        incoming.webhook_url = incoming.webhook_url.trim().to_string();
-        incoming.smtp_host = incoming.smtp_host.trim().to_string();
-        incoming.smtp_username = incoming.smtp_username.trim().to_string();
-        incoming.smtp_from = incoming.smtp_from.trim().to_string();
-        incoming.smtp_to = incoming.smtp_to.trim().to_string();
-
-        // Preserve the stored password when the UI sends the sentinel.
-        if incoming.smtp_password == SECRET_SENTINEL {
-            incoming
-                .smtp_password
-                .clone_from(&self.inner.read().smtp_password);
-        }
-
-        // Length caps.
-        if incoming.webhook_url.len() > MAX_URL_LEN {
-            return Err(Error::Invalid(format!(
-                "webhook URL exceeds {MAX_URL_LEN}-char cap"
-            )));
-        }
-        for (name, v) in [
-            ("smtp_host", &incoming.smtp_host),
-            ("smtp_username", &incoming.smtp_username),
-            ("smtp_from", &incoming.smtp_from),
-            ("smtp_to", &incoming.smtp_to),
-        ] {
-            if v.len() > MAX_FIELD_LEN {
-                return Err(Error::Invalid(format!(
-                    "{name} exceeds {MAX_FIELD_LEN}-char cap"
-                )));
-            }
-        }
-
-        // Validate the active provider only when enabling.
-        if incoming.enabled {
-            if incoming.kind.is_webhook() {
-                if incoming.webhook_url.is_empty() {
-                    return Err(Error::Invalid(
-                        "a webhook URL is required to enable chat notifications".into(),
-                    ));
-                }
-                if !incoming.webhook_url.starts_with("https://")
-                    && !incoming.webhook_url.starts_with("http://")
-                {
-                    return Err(Error::Invalid(
-                        "webhook URL must start with http:// or https://".into(),
-                    ));
-                }
-            } else {
-                if incoming.smtp_host.is_empty() {
-                    return Err(Error::Invalid(
-                        "SMTP host is required to enable email notifications".into(),
-                    ));
-                }
-                if incoming.smtp_to.is_empty() {
-                    return Err(Error::Invalid(
-                        "a recipient (To) is required to enable email notifications".into(),
-                    ));
-                }
-                if incoming.smtp_port == 0 {
-                    return Err(Error::Invalid("SMTP port must be non-zero".into()));
-                }
-            }
-        }
-
-        {
-            let mut g = self.inner.write();
-            *g = incoming.clone();
-        }
-        self.persist();
-        tracing::info!(
-            target: "openpxe::notify",
-            enabled = incoming.enabled, kind = ?incoming.kind,
-            "notification configuration updated"
-        );
-        Ok(incoming)
-    }
-
-    fn persist(&self) {
-        let snap = self.inner.read().clone();
-        let body = match serde_json::to_vec_pretty(&snap) {
-            Ok(b) => b,
-            Err(e) => {
-                tracing::warn!(target: "openpxe::notify", "serialize notify.json: {e}");
-                return;
-            }
-        };
-        if let Some(parent) = self.path.parent() {
-            let _ = std::fs::create_dir_all(parent);
-        }
-        let tmp = self.path.with_extension("json.tmp");
-        if let Err(e) = std::fs::write(&tmp, body) {
-            tracing::warn!(target: "openpxe::notify", "write notify.json tmp: {e}");
-            return;
-        }
-        if let Err(e) = std::fs::rename(&tmp, self.path.as_path()) {
-            tracing::warn!(target: "openpxe::notify", "rename notify.json: {e}");
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use tempfile::tempdir;
-
-    #[test]
-    fn default_disabled_not_usable() {
-        let dir = tempdir().unwrap();
-        let s = NotifyStore::load_or_default(dir.path());
-        assert!(!s.snapshot().enabled);
-        assert!(!s.snapshot().is_usable());
-    }
-
-    #[test]
-    fn slack_requires_url_when_enabled() {
-        let dir = tempdir().unwrap();
-        let s = NotifyStore::load_or_default(dir.path());
-        let r = s.replace(NotifyConfig {
-            enabled: true,
-            kind: NotifyKind::Slack,
-            ..Default::default()
-        });
-        assert!(matches!(r, Err(Error::Invalid(_))));
-        s.replace(NotifyConfig {
-            enabled: true,
-            kind: NotifyKind::Slack,
-            webhook_url: "https://hooks.slack.com/services/XXX".into(),
-            ..Default::default()
-        })
-        .unwrap();
-        assert!(s.snapshot().is_usable());
-    }
-
-    #[test]
-    fn smtp_requires_host_and_recipient() {
-        let dir = tempdir().unwrap();
-        let s = NotifyStore::load_or_default(dir.path());
-        let r = s.replace(NotifyConfig {
-            enabled: true,
-            kind: NotifyKind::Smtp,
-            smtp_host: "smtp.example.com".into(),
-            ..Default::default()
-        });
-        assert!(matches!(r, Err(Error::Invalid(_))), "missing recipient should reject");
-        s.replace(NotifyConfig {
-            enabled: true,
-            kind: NotifyKind::Smtp,
-            smtp_host: "smtp.example.com".into(),
-            smtp_port: 587,
-            smtp_to: "[email protected]".into(),
-            smtp_from: "[email protected]".into(),
-            ..Default::default()
-        })
-        .unwrap();
-        assert!(s.snapshot().is_usable());
-    }
-
-    #[test]
-    fn password_sentinel_preserves_stored_secret() {
-        let dir = tempdir().unwrap();
-        let s = NotifyStore::load_or_default(dir.path());
-        s.replace(NotifyConfig {
-            enabled: true,
-            kind: NotifyKind::Smtp,
-            smtp_host: "smtp.example.com".into(),
-            smtp_port: 587,
-            smtp_to: "[email protected]".into(),
-            smtp_password: "s3cret".into(),
-            ..Default::default()
-        })
-        .unwrap();
-        // Redacted snapshot hides the password behind the sentinel.
-        assert_eq!(s.snapshot().redacted().smtp_password, SECRET_SENTINEL);
-        // PUTting the sentinel back keeps the real password.
-        s.replace(NotifyConfig {
-            enabled: true,
-            kind: NotifyKind::Smtp,
-            smtp_host: "smtp.example.com".into(),
-            smtp_port: 587,
-            smtp_to: "[email protected]".into(),
-            smtp_password: SECRET_SENTINEL.into(),
-            ..Default::default()
-        })
-        .unwrap();
-        assert_eq!(s.snapshot().smtp_password, "s3cret");
-    }
-
-    #[test]
-    fn webhook_url_scheme_enforced() {
-        let dir = tempdir().unwrap();
-        let s = NotifyStore::load_or_default(dir.path());
-        let r = s.replace(NotifyConfig {
-            enabled: true,
-            kind: NotifyKind::Discord,
-            webhook_url: "ftp://example.com/hook".into(),
-            ..Default::default()
-        });
-        assert!(matches!(r, Err(Error::Invalid(_))));
-    }
-}

crates/core/src/saml/authn_request.rs

@@ -1,188 +0,0 @@
-//! AuthnRequest construction + HTTP-Redirect binding encoding.
-//!
-//! For SP-initiated login we build an `<AuthnRequest>`, then encode it for the
-//! HTTP-Redirect binding: raw DEFLATE (RFC 1951) → base64 → percent-encode,
-//! appended as the `SAMLRequest` query parameter. AuthnRequests are sent
-//! unsigned in this release (the IdP must not require client signatures).
-
-use std::fmt::Write as _;
-use std::io::Write as _;
-
-use base64::Engine;
-use flate2::write::DeflateEncoder;
-use flate2::Compression;
-use time::format_description::well_known::Rfc3339;
-use time::OffsetDateTime;
-
-use super::{SamlError, SpParams};
-
-const NS_PROTOCOL: &str = "urn:oasis:names:tc:SAML:2.0:protocol";
-const NS_ASSERTION: &str = "urn:oasis:names:tc:SAML:2.0:assertion";
-const NAMEID_EMAIL: &str = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress";
-const BINDING_POST: &str = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST";
-
-/// A built AuthnRequest, ready to redirect the browser to the IdP.
-#[derive(Debug, Clone)]
-pub struct AuthnRequest {
-    /// The request `ID` — the caller records this so the matching response's
-    /// `InResponseTo` can be correlated (replay/CSRF protection).
-    pub id: String,
-    /// The full IdP URL to 302 the browser to (includes `SAMLRequest` and,
-    /// when supplied, `RelayState`).
-    pub location: String,
-}
-
-/// Build an AuthnRequest targeting `idp_sso_url` and encode it for the
-/// HTTP-Redirect binding. `relay_state`, if given, round-trips back to us via
-/// the response (we use it to send the operator to their intended page).
-pub fn build(
-    sp: &SpParams,
-    idp_sso_url: &str,
-    relay_state: Option<&str>,
-) -> Result<AuthnRequest, SamlError> {
-    let id = format!("_{}", uuid::Uuid::new_v4().simple());
-    let issue_instant = OffsetDateTime::now_utc()
-        .replace_nanosecond(0)
-        .unwrap_or_else(|_| OffsetDateTime::now_utc())
-        .format(&Rfc3339)
-        .map_err(|e| SamlError::Timestamp(e.to_string()))?;
-
-    let xml = format!(
-        r#"<samlp:AuthnRequest xmlns:samlp="{NS_PROTOCOL}" xmlns:saml="{NS_ASSERTION}" ID="{id}" Version="2.0" IssueInstant="{instant}" Destination="{dest}" ProtocolBinding="{BINDING_POST}" AssertionConsumerServiceURL="{acs}"><saml:Issuer>{issuer}</saml:Issuer><samlp:NameIDPolicy Format="{NAMEID_EMAIL}" AllowCreate="true"/></samlp:AuthnRequest>"#,
-        instant = issue_instant,
-        dest = xml_escape(idp_sso_url),
-        acs = xml_escape(&sp.acs_url),
-        issuer = xml_escape(&sp.entity_id),
-    );
-
-    let encoded = deflate_base64(&xml)?;
-
-    let sep = if idp_sso_url.contains('?') { '&' } else { '?' };
-    let mut location = format!("{idp_sso_url}{sep}SAMLRequest={}", pct_encode(&encoded));
-    if let Some(rs) = relay_state {
-        location.push_str("&RelayState=");
-        location.push_str(&pct_encode(rs));
-    }
-
-    Ok(AuthnRequest { id, location })
-}
-
-/// Raw-DEFLATE then base64 — the HTTP-Redirect binding's `SAMLRequest` payload.
-fn deflate_base64(xml: &str) -> Result<String, SamlError> {
-    let mut enc = DeflateEncoder::new(Vec::new(), Compression::default());
-    enc.write_all(xml.as_bytes())
-        .and_then(|()| enc.try_finish())
-        .map_err(|e| SamlError::Xml(format!("deflate: {e}")))?;
-    let compressed = enc
-        .finish()
-        .map_err(|e| SamlError::Xml(format!("deflate: {e}")))?;
-    Ok(base64::engine::general_purpose::STANDARD.encode(compressed))
-}
-
-/// Percent-encode a query-string component (RFC 3986 unreserved set passes
-/// through; everything else is `%XX`).
-fn pct_encode(s: &str) -> String {
-    let mut out = String::with_capacity(s.len() * 3);
-    for b in s.bytes() {
-        match b {
-            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => {
-                out.push(b as char);
-            }
-            _ => {
-                let _ = write!(out, "%{b:02X}");
-            }
-        }
-    }
-    out
-}
-
-fn xml_escape(s: &str) -> String {
-    let mut out = String::with_capacity(s.len());
-    for c in s.chars() {
-        match c {
-            '&' => out.push_str("&amp;"),
-            '<' => out.push_str("&lt;"),
-            '>' => out.push_str("&gt;"),
-            '"' => out.push_str("&quot;"),
-            '\'' => out.push_str("&apos;"),
-            _ => out.push(c),
-        }
-    }
-    out
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use flate2::read::DeflateDecoder;
-    use std::io::Read;
-
-    fn sp() -> SpParams {
-        SpParams {
-            entity_id: "https://pxe.example.com".into(),
-            acs_url: "https://pxe.example.com/api/sso/acs".into(),
-        }
-    }
-
-    fn pct_decode(s: &str) -> Vec<u8> {
-        let bytes = s.as_bytes();
-        let mut out = Vec::with_capacity(bytes.len());
-        let mut i = 0;
-        while i < bytes.len() {
-            if bytes[i] == b'%' && i + 2 < bytes.len() {
-                let hi = (bytes[i + 1] as char).to_digit(16).unwrap();
-                let lo = (bytes[i + 2] as char).to_digit(16).unwrap();
-                out.push((hi * 16 + lo) as u8);
-                i += 3;
-            } else {
-                out.push(bytes[i]);
-                i += 1;
-            }
-        }
-        out
-    }
-
-    #[test]
-    fn id_is_ncname_and_location_has_request() {
-        let req = build(&sp(), "https://idp.example.com/sso", Some("/dashboard")).unwrap();
-        assert!(req.id.starts_with('_'));
-        assert!(req
-            .location
-            .starts_with("https://idp.example.com/sso?SAMLRequest="));
-        assert!(req.location.contains("&RelayState=%2Fdashboard"));
-    }
-
-    #[test]
-    fn redirect_payload_round_trips_to_our_authn_request() {
-        let req = build(&sp(), "https://idp.example.com/sso", None).unwrap();
-        // Pull SAMLRequest value out of the query string.
-        let q = req.location.split("SAMLRequest=").nth(1).unwrap();
-        let val = q.split('&').next().unwrap();
-        let compressed = base64::engine::general_purpose::STANDARD
-            .decode(pct_decode(val))
-            .unwrap();
-        let mut inflate = DeflateDecoder::new(&compressed[..]);
-        let mut xml = String::new();
-        inflate.read_to_string(&mut xml).unwrap();
-
-        let doc = roxmltree::Document::parse(&xml).unwrap();
-        let root = doc.root_element();
-        assert_eq!(root.tag_name().name(), "AuthnRequest");
-        assert_eq!(root.attribute("ID").unwrap(), req.id);
-        assert_eq!(
-            root.attribute("AssertionConsumerServiceURL").unwrap(),
-            "https://pxe.example.com/api/sso/acs"
-        );
-        let issuer = root
-            .descendants()
-            .find(|n| n.tag_name().name() == "Issuer")
-            .unwrap();
-        assert_eq!(issuer.text().unwrap(), "https://pxe.example.com");
-    }
-
-    #[test]
-    fn existing_query_uses_ampersand_separator() {
-        let req = build(&sp(), "https://idp.example.com/sso?foo=bar", None).unwrap();
-        assert!(req.location.contains("?foo=bar&SAMLRequest="));
-    }
-}

crates/core/src/saml/metadata.rs

@@ -1,241 +0,0 @@
-//! IdP metadata parsing + SP metadata generation.
-//!
-//! We parse only what the SP flow needs: the IdP Entity ID, its
-//! `SingleSignOnService` endpoints (HTTP-Redirect / HTTP-POST), and the
-//! X.509 signing certificate(s). Everything else in the document is ignored.
-
-use base64::Engine;
-
-use super::{SamlError, SpParams};
-
-/// SAML 2.0 binding URIs.
-pub const BINDING_REDIRECT: &str = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect";
-pub const BINDING_POST: &str = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST";
-
-/// The subset of an IdP's `EntityDescriptor` the SP flow consumes.
-#[derive(Debug, Clone)]
-pub struct IdpMetadata {
-    /// The IdP's Entity ID — we require incoming assertions to be issued by it.
-    pub entity_id: String,
-    /// SSO endpoint for the HTTP-Redirect binding (where we send AuthnRequests).
-    pub sso_redirect_url: Option<String>,
-    /// SSO endpoint for the HTTP-POST binding (fallback target).
-    pub sso_post_url: Option<String>,
-    /// DER-encoded X.509 signing certificate(s). More than one appears during
-    /// key rotation; verification tries each.
-    pub signing_certs_der: Vec<Vec<u8>>,
-}
-
-impl IdpMetadata {
-    /// Parse an IdP `EntityDescriptor` document.
-    ///
-    /// Robust to namespace-prefix variation (matches on local element names),
-    /// since IdPs disagree on prefixes (`md:`, `ns0:`, default, …).
-    pub fn parse(xml: &str) -> Result<Self, SamlError> {
-        let doc = roxmltree::Document::parse(xml).map_err(|e| SamlError::Xml(e.to_string()))?;
-        let root = doc.root_element();
-
-        // The signing IDP descriptor. Some metadata wraps multiple
-        // descriptors (AA, SP) in one document; we want IDPSSODescriptor.
-        let idp_desc = root
-            .descendants()
-            .find(|n| n.is_element() && n.tag_name().name() == "IDPSSODescriptor")
-            .ok_or_else(|| SamlError::Metadata("IDPSSODescriptor".into()))?;
-
-        // Entity ID lives on the EntityDescriptor (root, or an ancestor of the
-        // IDPSSODescriptor when several are nested).
-        let entity_id = idp_desc
-            .ancestors()
-            .find_map(|n| {
-                if n.tag_name().name() == "EntityDescriptor" {
-                    n.attribute("entityID")
-                } else {
-                    None
-                }
-            })
-            .or_else(|| root.attribute("entityID"))
-            .map(str::to_owned)
-            .ok_or_else(|| SamlError::Metadata("entityID".into()))?;
-
-        let mut sso_redirect_url = None;
-        let mut sso_post_url = None;
-        for sso in idp_desc
-            .children()
-            .filter(|n| n.is_element() && n.tag_name().name() == "SingleSignOnService")
-        {
-            let binding = sso.attribute("Binding").unwrap_or("");
-            let location = sso.attribute("Location").map(str::to_owned);
-            match binding {
-                BINDING_REDIRECT if sso_redirect_url.is_none() => sso_redirect_url = location,
-                BINDING_POST if sso_post_url.is_none() => sso_post_url = location,
-                _ => {}
-            }
-        }
-
-        // Signing certs: KeyDescriptor with use="signing" or no use attribute
-        // (a bare KeyDescriptor is valid for both signing and encryption).
-        let mut signing_certs_der = Vec::new();
-        for kd in idp_desc
-            .children()
-            .filter(|n| n.is_element() && n.tag_name().name() == "KeyDescriptor")
-        {
-            match kd.attribute("use") {
-                Some("signing") | None => {}
-                Some(_) => continue, // encryption-only key — skip
-            }
-            for cert_node in kd
-                .descendants()
-                .filter(|n| n.is_element() && n.tag_name().name() == "X509Certificate")
-            {
-                let b64: String = node_text(&cert_node)
-                    .chars()
-                    .filter(|c| !c.is_whitespace())
-                    .collect();
-                if b64.is_empty() {
-                    continue;
-                }
-                let der = base64::engine::general_purpose::STANDARD
-                    .decode(b64.as_bytes())
-                    .map_err(|e| SamlError::Base64(e.to_string()))?;
-                signing_certs_der.push(der);
-            }
-        }
-
-        if signing_certs_der.is_empty() {
-            return Err(SamlError::NoSigningCert);
-        }
-
-        Ok(Self {
-            entity_id,
-            sso_redirect_url,
-            sso_post_url,
-            signing_certs_der,
-        })
-    }
-
-    /// Preferred SSO destination for an outbound AuthnRequest: HTTP-Redirect
-    /// if advertised, otherwise HTTP-POST.
-    pub fn sso_destination(&self) -> Option<&str> {
-        self.sso_redirect_url
-            .as_deref()
-            .or(self.sso_post_url.as_deref())
-    }
-}
-
-/// Build our SP `EntityDescriptor` XML so an IdP admin can import OpenPXE as a
-/// relying party. Advertises the ACS URL (HTTP-POST binding) and an emailAddress
-/// NameID format — matching what the response path expects.
-pub fn build_sp_metadata(sp: &SpParams) -> String {
-    let entity = xml_escape(&sp.entity_id);
-    let acs = xml_escape(&sp.acs_url);
-    format!(
-        r#"<?xml version="1.0" encoding="UTF-8"?>
-<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="{entity}">
-  <SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
-    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
-    <AssertionConsumerService Binding="{BINDING_POST}" Location="{acs}" index="0" isDefault="true"/>
-  </SPSSODescriptor>
-</EntityDescriptor>
-"#
-    )
-}
-
-/// Collect the concatenated text of an element's direct text children.
-fn node_text(n: &roxmltree::Node<'_, '_>) -> String {
-    n.children()
-        .filter(roxmltree::Node::is_text)
-        .filter_map(|c| c.text())
-        .collect()
-}
-
-/// Minimal XML attribute/text escaping for the values we interpolate.
-fn xml_escape(s: &str) -> String {
-    let mut out = String::with_capacity(s.len());
-    for c in s.chars() {
-        match c {
-            '&' => out.push_str("&amp;"),
-            '<' => out.push_str("&lt;"),
-            '>' => out.push_str("&gt;"),
-            '"' => out.push_str("&quot;"),
-            '\'' => out.push_str("&apos;"),
-            _ => out.push(c),
-        }
-    }
-    out
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    // A trimmed-down Keycloak-style IdP descriptor (cert body is a stand-in;
-    // signing tests build real certs in the parent module's tests).
-    const SAMPLE: &str = r#"<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
-        xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
-        entityID="https://idp.example.com/realms/fleet">
-      <md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
-        <md:KeyDescriptor use="signing">
-          <ds:KeyInfo><ds:X509Data><ds:X509Certificate>
-            QUJDREVG
-          </ds:X509Certificate></ds:X509Data></ds:KeyInfo>
-        </md:KeyDescriptor>
-        <md:KeyDescriptor use="encryption">
-          <ds:KeyInfo><ds:X509Data><ds:X509Certificate>WlpaWg==</ds:X509Certificate></ds:X509Data></ds:KeyInfo>
-        </md:KeyDescriptor>
-        <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
-            Location="https://idp.example.com/realms/fleet/protocol/saml"/>
-        <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
-            Location="https://idp.example.com/realms/fleet/protocol/saml"/>
-      </md:IDPSSODescriptor>
-    </md:EntityDescriptor>"#;
-
-    #[test]
-    fn parses_entity_sso_and_signing_cert() {
-        let m = IdpMetadata::parse(SAMPLE).unwrap();
-        assert_eq!(m.entity_id, "https://idp.example.com/realms/fleet");
-        assert_eq!(
-            m.sso_redirect_url.as_deref(),
-            Some("https://idp.example.com/realms/fleet/protocol/saml")
-        );
-        assert!(m.sso_post_url.is_some());
-        // Only the signing KeyDescriptor's cert is collected (ABCDEF), not the
-        // encryption one (ZZZZ).
-        assert_eq!(m.signing_certs_der.len(), 1);
-        assert_eq!(m.signing_certs_der[0], b"ABCDEF");
-    }
-
-    #[test]
-    fn missing_signing_cert_is_rejected() {
-        let xml = r#"<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="x">
-            <IDPSSODescriptor>
-              <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://x/sso"/>
-            </IDPSSODescriptor></EntityDescriptor>"#;
-        assert!(matches!(
-            IdpMetadata::parse(xml),
-            Err(SamlError::NoSigningCert)
-        ));
-    }
-
-    #[test]
-    fn missing_idp_descriptor_is_rejected() {
-        let xml = r#"<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="x"></EntityDescriptor>"#;
-        assert!(matches!(
-            IdpMetadata::parse(xml),
-            Err(SamlError::Metadata(_))
-        ));
-    }
-
-    #[test]
-    fn sp_metadata_contains_entity_and_acs() {
-        let sp = SpParams {
-            entity_id: "https://pxe.example.com".into(),
-            acs_url: "https://pxe.example.com/api/sso/acs".into(),
-        };
-        let xml = build_sp_metadata(&sp);
-        assert!(xml.contains(r#"entityID="https://pxe.example.com""#));
-        assert!(xml.contains("https://pxe.example.com/api/sso/acs"));
-        assert!(xml.contains(BINDING_POST));
-        // Must be well-formed.
-        roxmltree::Document::parse(&xml).unwrap();
-    }
-}

crates/core/src/saml/mod.rs

@@ -1,92 +0,0 @@
-//! Pure-Rust SAML 2.0 Service Provider (v0.5.1).
-//!
-//! This module implements the SP half of a SAML Web-Browser-SSO profile:
-//!
-//! * [`metadata`] — parse the IdP's `EntityDescriptor` (SSO URLs + signing
-//!   certificates) and build *our* SP metadata for the IdP admin to import.
-//! * [`authn_request`] — build an `AuthnRequest` and encode it for the
-//!   HTTP-Redirect binding.
-//! * [`response`] — decode a `SAMLResponse`, **verify its XML signature**
-//!   against the IdP's pinned certificate (via the pure-Rust `bergshamra`
-//!   crate — no OpenSSL/libxml2/xmlsec, so the static musl binary stays
-//!   C-free), then enforce the SP-side semantic checks (Status, Destination,
-//!   Audience, time bounds) that are where SAML SPs actually get attacked.
-//!
-//! Stateful checks (replay of assertion IDs, correlating `InResponseTo`
-//! against requests *we* issued, gating IdP-initiated login) live in the
-//! HTTP layer — [`response::consume`] is deliberately stateless and returns
-//! the IDs the caller needs to perform them.
-//!
-//! Access model: any assertion the IdP authenticates and we cryptographically
-//! verify yields an operator [`VerifiedPrincipal`]. OpenPXE is single-tier —
-//! there is no per-user role table — and the local admin account remains a
-//! guaranteed fallback owner regardless of SSO state.
-
-pub mod authn_request;
-pub mod metadata;
-pub mod response;
-
-pub use authn_request::AuthnRequest;
-pub use metadata::IdpMetadata;
-pub use response::{VerifiedPrincipal, VerifiedResponse};
-
-use thiserror::Error;
-
-/// Default clock-skew tolerance applied to assertion time bounds. SAML IdPs
-/// and SPs rarely have perfectly synced clocks; 60s matches common practice
-/// (Shibboleth/FleetDM defaults are in this ballpark).
-pub const DEFAULT_CLOCK_SKEW_SECS: i64 = 60;
-
-/// Runtime SP parameters, derived from [`crate::SsoConfig`] + the advertised
-/// public base URL by the HTTP layer.
-#[derive(Debug, Clone)]
-pub struct SpParams {
-    /// Our SP Entity ID (the `<Issuer>` we send and the `Audience` we require
-    /// in responses). Defaults to the public base URL when the operator left
-    /// the Entity ID field blank.
-    pub entity_id: String,
-    /// The Assertion Consumer Service URL the IdP POSTs the response to —
-    /// `<public_base_url>/api/sso/acs`.
-    pub acs_url: String,
-}
-
-/// Everything that can go wrong consuming a SAML response. Kept coarse on
-/// purpose: the HTTP layer logs the detail and shows the operator a generic
-/// "SSO sign-in failed" — we never leak which specific check tripped to the
-/// browser, since that aids an attacker probing the SP.
-#[derive(Debug, Error)]
-pub enum SamlError {
-    #[error("SAML XML parse error: {0}")]
-    Xml(String),
-    #[error("IdP metadata is missing a required element: {0}")]
-    Metadata(String),
-    #[error("no usable IdP signing certificate in metadata")]
-    NoSigningCert,
-    #[error("signature verification failed: {0}")]
-    Signature(String),
-    #[error("the signature does not cover the assertion we read")]
-    SignatureScope,
-    #[error("SAML response status was not Success: {0}")]
-    Status(String),
-    #[error("response is missing a required element: {0}")]
-    MissingElement(String),
-    #[error("encrypted assertions are not supported in this release")]
-    EncryptedAssertionUnsupported,
-    #[error("expected exactly one assertion, found {0}")]
-    AssertionCount(usize),
-    #[error("issuer mismatch: response was not issued by the configured IdP")]
-    IssuerMismatch,
-    #[error("audience mismatch: assertion is not addressed to this service provider")]
-    AudienceMismatch,
-    #[error("response destination does not match our ACS URL")]
-    DestinationMismatch,
-    #[error("assertion is expired or not yet valid")]
-    TimeBounds,
-    #[error("invalid SAML timestamp: {0}")]
-    Timestamp(String),
-    #[error("base64 decode failed: {0}")]
-    Base64(String),
-}
-
-#[cfg(test)]
-mod tests;

crates/core/src/saml/response.rs

@@ -1,294 +0,0 @@
-//! SAMLResponse consumption: signature verification + SP-side validation.
-//!
-//! [`consume`] is intentionally **stateless** — it verifies the XML signature
-//! against the IdP's pinned certificate(s) and enforces every check that can
-//! be made from the response alone (Status, Destination, Issuer, Audience,
-//! time bounds, signature scope). It then returns the `assertion_id` and
-//! `in_response_to` so the HTTP layer can perform the *stateful* checks it
-//! owns: replay rejection, correlating the request we issued, and gating
-//! IdP-initiated login.
-
-use roxmltree::{Document, Node};
-use time::format_description::well_known::Rfc3339;
-use time::{Duration, OffsetDateTime};
-
-use super::metadata::IdpMetadata;
-use super::{SamlError, SpParams};
-
-const STATUS_SUCCESS: &str = "urn:oasis:names:tc:SAML:2.0:status:Success";
-
-/// The verified subject of a SAML assertion. OpenPXE is single-tier, so this
-/// is all an operator session needs.
-#[derive(Debug, Clone)]
-pub struct VerifiedPrincipal {
-    /// The `<NameID>` value (an email, per our requested NameID format).
-    pub name_id: String,
-    /// Email used as the session identity. Equals `name_id` for the
-    /// emailAddress NameID format.
-    pub email: String,
-    /// Human-readable display name, if the IdP sent one as an attribute.
-    pub display_name: Option<String>,
-}
-
-/// Result of a successful [`consume`]. The IDs/expiry feed the HTTP layer's
-/// stateful checks.
-#[derive(Debug, Clone)]
-pub struct VerifiedResponse {
-    pub principal: VerifiedPrincipal,
-    /// `InResponseTo` from the response, if present. `None` = unsolicited
-    /// (IdP-initiated) — the HTTP layer only accepts that when the operator
-    /// enabled it.
-    pub in_response_to: Option<String>,
-    /// The assertion's `ID` — used by the caller as the replay-guard key.
-    pub assertion_id: String,
-    /// The assertion's expiry (`Conditions/@NotOnOrAfter`) — the replay
-    /// guard can drop the consumed ID after this instant.
-    pub assertion_expiry: OffsetDateTime,
-    /// `AuthnStatement/@SessionIndex`, if present (useful for future SLO).
-    pub session_index: Option<String>,
-}
-
-/// Verify and validate a decoded `SAMLResponse` XML document.
-pub fn consume(
-    xml: &str,
-    sp: &SpParams,
-    idp: &IdpMetadata,
-    now: OffsetDateTime,
-    clock_skew: Duration,
-) -> Result<VerifiedResponse, SamlError> {
-    // 1. Cryptographically verify the signature against the pinned IdP cert(s).
-    //    `trusted_keys_only` ignores any cert embedded in the document's
-    //    KeyInfo, so an attacker can't substitute their own key.
-    let verified_uris = verify_signature(xml, &idp.signing_certs_der)?;
-
-    // 2. Parse for semantic validation.
-    let doc = Document::parse(xml).map_err(|e| SamlError::Xml(e.to_string()))?;
-    let root = doc.root_element();
-    if root.tag_name().name() != "Response" {
-        return Err(SamlError::MissingElement("Response".into()));
-    }
-    let response_id = root.attribute("ID").map(str::to_owned);
-    let in_response_to = root.attribute("InResponseTo").map(str::to_owned);
-
-    // 3. Status must be Success.
-    let status_value = root
-        .descendants()
-        .find(|n| n.is_element() && n.tag_name().name() == "StatusCode")
-        .and_then(|sc| sc.attribute("Value"))
-        .unwrap_or("");
-    if status_value != STATUS_SUCCESS && !status_value.ends_with(":Success") {
-        return Err(SamlError::Status(status_value.to_owned()));
-    }
-
-    // 4. Destination (if the IdP set one) must be our ACS.
-    if let Some(dest) = root.attribute("Destination") {
-        if !urls_equal(dest, &sp.acs_url) {
-            return Err(SamlError::DestinationMismatch);
-        }
-    }
-
-    // 5. Exactly one (unencrypted) Assertion.
-    if root
-        .descendants()
-        .any(|n| n.is_element() && n.tag_name().name() == "EncryptedAssertion")
-    {
-        return Err(SamlError::EncryptedAssertionUnsupported);
-    }
-    let assertions: Vec<Node<'_, '_>> = root
-        .children()
-        .filter(|c| c.is_element() && c.tag_name().name() == "Assertion")
-        .collect();
-    if assertions.len() != 1 {
-        return Err(SamlError::AssertionCount(assertions.len()));
-    }
-    let assertion = assertions[0];
-    let assertion_id = assertion
-        .attribute("ID")
-        .map(str::to_owned)
-        .ok_or_else(|| SamlError::MissingElement("Assertion/@ID".into()))?;
-
-    // 6. The signature must actually cover the assertion we're about to trust:
-    //    either the assertion itself, the enclosing response, or the whole
-    //    document. (bergshamra's strict_verification already constrains where
-    //    the signed element may sit; this ties it to *our* assertion.)
-    let covers_assertion = verified_uris.iter().any(|u| {
-        u.is_empty()
-            || u == &format!("#{assertion_id}")
-            || response_id
-                .as_ref()
-                .is_some_and(|rid| u == &format!("#{rid}"))
-    });
-    if !covers_assertion {
-        return Err(SamlError::SignatureScope);
-    }
-
-    // 7. Issuer must be the configured IdP.
-    let issuer = first_child(assertion, "Issuer")
-        .map(text_of)
-        .unwrap_or_default();
-    if !idp.entity_id.is_empty() && issuer != idp.entity_id {
-        return Err(SamlError::IssuerMismatch);
-    }
-
-    // 8. Subject → NameID + SubjectConfirmationData time/recipient checks.
-    let subject = first_child(assertion, "Subject")
-        .ok_or_else(|| SamlError::MissingElement("Subject".into()))?;
-    let name_id = first_child(subject, "NameID")
-        .map(text_of)
-        .filter(|s| !s.is_empty())
-        .ok_or_else(|| SamlError::MissingElement("NameID".into()))?;
-    if let Some(scd) = subject
-        .descendants()
-        .find(|n| n.is_element() && n.tag_name().name() == "SubjectConfirmationData")
-    {
-        if let Some(recipient) = scd.attribute("Recipient") {
-            if !urls_equal(recipient, &sp.acs_url) {
-                return Err(SamlError::DestinationMismatch);
-            }
-        }
-        if let Some(noa) = scd.attribute("NotOnOrAfter") {
-            let noa = parse_instant(noa)?;
-            if now >= noa + clock_skew {
-                return Err(SamlError::TimeBounds);
-            }
-        }
-    }
-
-    // 9. Conditions: time window + audience.
-    let conditions = first_child(assertion, "Conditions");
-    if let Some(cond) = conditions {
-        if let Some(nb) = cond.attribute("NotBefore") {
-            let nb = parse_instant(nb)?;
-            if now < nb - clock_skew {
-                return Err(SamlError::TimeBounds);
-            }
-        }
-    }
-    let assertion_expiry = conditions
-        .and_then(|c| c.attribute("NotOnOrAfter"))
-        .map(parse_instant)
-        .transpose()?
-        .ok_or_else(|| SamlError::MissingElement("Conditions/@NotOnOrAfter".into()))?;
-    if now >= assertion_expiry + clock_skew {
-        return Err(SamlError::TimeBounds);
-    }
-
-    let audience_ok = conditions.is_some_and(|c| {
-        c.descendants()
-            .filter(|n| n.is_element() && n.tag_name().name() == "Audience")
-            .any(|a| text_of(a) == sp.entity_id)
-    });
-    if !audience_ok {
-        return Err(SamlError::AudienceMismatch);
-    }
-
-    // 10. Optional: SessionIndex + display-name attribute.
-    let session_index = assertion
-        .descendants()
-        .find(|n| n.is_element() && n.tag_name().name() == "AuthnStatement")
-        .and_then(|a| a.attribute("SessionIndex"))
-        .map(str::to_owned);
-
-    let display_name = extract_display_name(assertion);
-
-    Ok(VerifiedResponse {
-        principal: VerifiedPrincipal {
-            email: name_id.clone(),
-            name_id,
-            display_name,
-        },
-        in_response_to,
-        assertion_id,
-        assertion_expiry,
-        session_index,
-    })
-}
-
-/// Verify the document's XML-DSig against each pinned IdP cert in turn
-/// (handles key rotation), returning the verified `<Reference>` URIs.
-fn verify_signature(xml: &str, certs_der: &[Vec<u8>]) -> Result<Vec<String>, SamlError> {
-    let mut last_err = String::from("no signing certificate matched");
-    for der in certs_der {
-        let key = match bergshamra::keys::loader::load_x509_cert_der(der) {
-            Ok(k) => k,
-            Err(e) => {
-                last_err = e.to_string();
-                continue;
-            }
-        };
-        let mut km = bergshamra::keys::KeysManager::new();
-        km.add_key(key);
-        // trusted_keys_only: only ever trust the pinned IdP key, never an
-        // inline KeyInfo cert. strict_verification: XSW positional defense.
-        let ctx = bergshamra::DsigContext::new(km)
-            .with_trusted_keys_only(true)
-            .with_strict_verification(true);
-        match bergshamra::verify(&ctx, xml) {
-            Ok(bergshamra::VerifyResult::Valid { references, .. }) => {
-                return Ok(references.into_iter().map(|r| r.uri).collect());
-            }
-            Ok(bergshamra::VerifyResult::Invalid { reason }) => last_err = reason,
-            Err(e) => last_err = e.to_string(),
-        }
-    }
-    Err(SamlError::Signature(last_err))
-}
-
-/// Pull a display name from the assertion's attribute statement, trying the
-/// common attribute names IdPs use (FleetDM checks the same set).
-fn extract_display_name(assertion: Node<'_, '_>) -> Option<String> {
-    const WANTED: &[&str] = &[
-        "name",
-        "displayname",
-        "cn",
-        "urn:oid:2.5.4.3",
-        "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
-    ];
-    for attr in assertion
-        .descendants()
-        .filter(|n| n.is_element() && n.tag_name().name() == "Attribute")
-    {
-        let key = attr
-            .attribute("Name")
-            .or_else(|| attr.attribute("FriendlyName"))
-            .unwrap_or("")
-            .to_ascii_lowercase();
-        if WANTED.contains(&key.as_str()) {
-            if let Some(val) = attr
-                .descendants()
-                .find(|n| n.is_element() && n.tag_name().name() == "AttributeValue")
-            {
-                let v = text_of(val);
-                if !v.is_empty() {
-                    return Some(v);
-                }
-            }
-        }
-    }
-    None
-}
-
-fn first_child<'a, 'i>(n: Node<'a, 'i>, local: &str) -> Option<Node<'a, 'i>> {
-    n.children()
-        .find(|c| c.is_element() && c.tag_name().name() == local)
-}
-
-fn text_of(n: Node<'_, '_>) -> String {
-    n.children()
-        .filter(Node::is_text)
-        .filter_map(|c| c.text())
-        .collect::<String>()
-        .trim()
-        .to_owned()
-}
-
-/// Parse an `xs:dateTime` (e.g. `2026-05-31T12:00:00.000Z`).
-fn parse_instant(s: &str) -> Result<OffsetDateTime, SamlError> {
-    OffsetDateTime::parse(s.trim(), &Rfc3339).map_err(|e| SamlError::Timestamp(format!("{s}: {e}")))
-}
-
-/// Compare two URLs for SAML endpoint-matching purposes: exact, or differing
-/// only by a single trailing slash.
-fn urls_equal(a: &str, b: &str) -> bool {
-    a == b || a.trim_end_matches('/') == b.trim_end_matches('/')
-}

crates/core/src/saml/tests.rs

@@ -1,287 +0,0 @@
-//! End-to-end SAML SP tests.
-//!
-//! We mint a throwaway self-signed cert/key with `rcgen`, sign a SAML Response
-//! template with `bergshamra::sign` (the same engine that verifies it), and
-//! drive [`response::consume`] through the accept path and every reject path.
-//! This proves both the signature wiring and the SP-semantic checks.
-
-use time::format_description::well_known::Rfc3339;
-use time::{Duration, OffsetDateTime};
-
-use super::metadata::IdpMetadata;
-use super::{response, SamlError, SpParams};
-
-const SP_ENTITY: &str = "https://pxe.example.com";
-const ACS: &str = "https://pxe.example.com/api/sso/acs";
-const IDP_ENTITY: &str = "https://idp.example.com/realms/fleet";
-const EMAIL: &str = "[email protected]";
-
-struct TestIdp {
-    cert_der: Vec<u8>,
-    key_pem: String,
-}
-
-fn test_idp() -> TestIdp {
-    let ck = rcgen::generate_simple_self_signed(vec!["idp.example.com".to_string()]).unwrap();
-    TestIdp {
-        cert_der: ck.cert.der().as_ref().to_vec(),
-        key_pem: ck.key_pair.serialize_pem(),
-    }
-}
-
-fn fmt(t: OffsetDateTime) -> String {
-    t.replace_nanosecond(0).unwrap().format(&Rfc3339).unwrap()
-}
-
-/// Knobs for building a response template — defaults are a valid response.
-struct Resp {
-    issuer: String,
-    audience: String,
-    status: String,
-    not_before: OffsetDateTime,
-    not_on_or_after: OffsetDateTime,
-    in_response_to: Option<String>,
-    recipient: String,
-}
-
-impl Default for Resp {
-    fn default() -> Self {
-        let now = OffsetDateTime::now_utc();
-        Self {
-            issuer: IDP_ENTITY.into(),
-            audience: SP_ENTITY.into(),
-            status: "urn:oasis:names:tc:SAML:2.0:status:Success".into(),
-            not_before: now - Duration::minutes(5),
-            not_on_or_after: now + Duration::hours(1),
-            in_response_to: Some("_req-abc".into()),
-            recipient: ACS.into(),
-        }
-    }
-}
-
-impl Resp {
-    /// The unsigned template (a `<ds:Signature>` with empty values).
-    fn template(&self) -> String {
-        let now = fmt(OffsetDateTime::now_utc());
-        let irt = self
-            .in_response_to
-            .as_ref()
-            .map(|v| format!(r#" InResponseTo="{v}""#))
-            .unwrap_or_default();
-        format!(
-            r##"<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_resp1" Version="2.0" IssueInstant="{now}" Destination="{ACS}"{irt}>
-  <saml:Issuer>{issuer}</saml:Issuer>
-  <samlp:Status><samlp:StatusCode Value="{status}"/></samlp:Status>
-  <saml:Assertion ID="_assertion1" Version="2.0" IssueInstant="{now}">
-    <saml:Issuer>{issuer}</saml:Issuer>
-    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
-      <ds:SignedInfo>
-        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
-        <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256"/>
-        <ds:Reference URI="#_assertion1">
-          <ds:Transforms>
-            <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
-            <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
-          </ds:Transforms>
-          <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
-          <ds:DigestValue></ds:DigestValue>
-        </ds:Reference>
-      </ds:SignedInfo>
-      <ds:SignatureValue></ds:SignatureValue>
-    </ds:Signature>
-    <saml:Subject>
-      <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">{EMAIL}</saml:NameID>
-      <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
-        <saml:SubjectConfirmationData Recipient="{recipient}" NotOnOrAfter="{noa}"{irt}/>
-      </saml:SubjectConfirmation>
-    </saml:Subject>
-    <saml:Conditions NotBefore="{nb}" NotOnOrAfter="{noa}">
-      <saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction>
-    </saml:Conditions>
-    <saml:AuthnStatement AuthnInstant="{now}" SessionIndex="sess-123">
-      <saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef></saml:AuthnContext>
-    </saml:AuthnStatement>
-    <saml:AttributeStatement>
-      <saml:Attribute Name="displayName"><saml:AttributeValue>Miles Ward</saml:AttributeValue></saml:Attribute>
-    </saml:AttributeStatement>
-  </saml:Assertion>
-</samlp:Response>"##,
-            issuer = self.issuer,
-            status = self.status,
-            audience = self.audience,
-            recipient = self.recipient,
-            nb = fmt(self.not_before),
-            noa = fmt(self.not_on_or_after),
-        )
-    }
-}
-
-fn sign(template: &str, key_pem: &str) -> String {
-    let key = bergshamra::keys::loader::load_pem_auto(key_pem.as_bytes(), None)
-        .expect("load test signing key");
-    let mut km = bergshamra::keys::KeysManager::new();
-    km.add_key(key);
-    let ctx = bergshamra::DsigContext::new(km);
-    bergshamra::sign(&ctx, template).expect("sign test response")
-}
-
-fn sp() -> SpParams {
-    SpParams {
-        entity_id: SP_ENTITY.into(),
-        acs_url: ACS.into(),
-    }
-}
-
-fn idp(cert_der: Vec<u8>) -> IdpMetadata {
-    IdpMetadata {
-        entity_id: IDP_ENTITY.into(),
-        sso_redirect_url: None,
-        sso_post_url: None,
-        signing_certs_der: vec![cert_der],
-    }
-}
-
-fn consume(xml: &str, cert_der: Vec<u8>) -> Result<response::VerifiedResponse, SamlError> {
-    response::consume(
-        xml,
-        &sp(),
-        &idp(cert_der),
-        OffsetDateTime::now_utc(),
-        Duration::seconds(60),
-    )
-}
-
-#[test]
-fn good_response_yields_principal() {
-    let t = test_idp();
-    let signed = sign(&Resp::default().template(), &t.key_pem);
-    let out = consume(&signed, t.cert_der).expect("valid response should verify");
-    assert_eq!(out.principal.email, EMAIL);
-    assert_eq!(out.principal.name_id, EMAIL);
-    assert_eq!(out.principal.display_name.as_deref(), Some("Miles Ward"));
-    assert_eq!(out.in_response_to.as_deref(), Some("_req-abc"));
-    assert_eq!(out.assertion_id, "_assertion1");
-    assert_eq!(out.session_index.as_deref(), Some("sess-123"));
-}
-
-#[test]
-fn tampered_assertion_is_rejected() {
-    let t = test_idp();
-    let signed = sign(&Resp::default().template(), &t.key_pem);
-    // Flip the subject email after signing — breaks the digest.
-    let tampered = signed.replace(EMAIL, "[email protected]");
-    assert_ne!(signed, tampered);
-    assert!(matches!(
-        consume(&tampered, t.cert_der),
-        Err(SamlError::Signature(_) | SamlError::SignatureScope)
-    ));
-}
-
-#[test]
-fn unsigned_response_is_rejected() {
-    let t = test_idp();
-    // Feed the *unsigned* template (empty SignatureValue) straight in.
-    let unsigned = Resp::default().template();
-    assert!(matches!(
-        consume(&unsigned, t.cert_der),
-        Err(SamlError::Signature(_))
-    ));
-}
-
-#[test]
-fn wrong_signing_key_is_rejected() {
-    let signer = test_idp();
-    let other = test_idp(); // different keypair pinned as the "IdP" cert
-    let signed = sign(&Resp::default().template(), &signer.key_pem);
-    assert!(matches!(
-        consume(&signed, other.cert_der),
-        Err(SamlError::Signature(_))
-    ));
-}
-
-#[test]
-fn wrong_audience_is_rejected() {
-    let t = test_idp();
-    let r = Resp {
-        audience: "https://someone-else.example".into(),
-        ..Resp::default()
-    };
-    let signed = sign(&r.template(), &t.key_pem);
-    assert!(matches!(
-        consume(&signed, t.cert_der),
-        Err(SamlError::AudienceMismatch)
-    ));
-}
-
-#[test]
-fn expired_assertion_is_rejected() {
-    let t = test_idp();
-    let now = OffsetDateTime::now_utc();
-    let r = Resp {
-        not_before: now - Duration::hours(2),
-        not_on_or_after: now - Duration::hours(1),
-        ..Resp::default()
-    };
-    let signed = sign(&r.template(), &t.key_pem);
-    assert!(matches!(
-        consume(&signed, t.cert_der),
-        Err(SamlError::TimeBounds)
-    ));
-}
-
-#[test]
-fn future_assertion_is_rejected() {
-    let t = test_idp();
-    let now = OffsetDateTime::now_utc();
-    let r = Resp {
-        not_before: now + Duration::hours(1),
-        not_on_or_after: now + Duration::hours(2),
-        ..Resp::default()
-    };
-    let signed = sign(&r.template(), &t.key_pem);
-    assert!(matches!(
-        consume(&signed, t.cert_der),
-        Err(SamlError::TimeBounds)
-    ));
-}
-
-#[test]
-fn wrong_issuer_is_rejected() {
-    let t = test_idp();
-    let r = Resp {
-        issuer: "https://evil-idp.example".into(),
-        ..Resp::default()
-    };
-    let signed = sign(&r.template(), &t.key_pem);
-    assert!(matches!(
-        consume(&signed, t.cert_der),
-        Err(SamlError::IssuerMismatch)
-    ));
-}
-
-#[test]
-fn non_success_status_is_rejected() {
-    let t = test_idp();
-    let r = Resp {
-        status: "urn:oasis:names:tc:SAML:2.0:status:Requester".into(),
-        ..Resp::default()
-    };
-    let signed = sign(&r.template(), &t.key_pem);
-    assert!(matches!(
-        consume(&signed, t.cert_der),
-        Err(SamlError::Status(_))
-    ));
-}
-
-#[test]
-fn idp_initiated_has_no_in_response_to() {
-    // No InResponseTo => the HTTP layer must gate it behind allow_idp_initiated.
-    let t = test_idp();
-    let r = Resp {
-        in_response_to: None,
-        ..Resp::default()
-    };
-    let signed = sign(&r.template(), &t.key_pem);
-    let out = consume(&signed, t.cert_der).expect("unsolicited but otherwise valid");
-    assert!(out.in_response_to.is_none());
-}

crates/core/src/sso.rs

@@ -1,17 +1,16 @@
-//! SAML SSO configuration — FleetDM-shaped.
+//! SAML SSO configuration — FleetDM-shaped, storage-only for v0.4.5.
 //!
 //! The operator pastes their IdP's metadata XML (or its URL) and a
-//! human-readable label. As of v0.5.1 the SAML login flow is wired
-//! end-to-end (see [`crate::saml`]): SP-initiated AuthnRequest, the ACS
-//! endpoint, pure-Rust signature verification, and operator-session
-//! minting. This module owns only the persisted *configuration*.
+//! human-readable label; v0.4.5 just persists it. The actual SAML
+//! response-validation / JIT-provisioning flow lands in a later release
+//! — for now we cover the "configurable" half so an operator can teach
+//! OpenPXE about their IdP today and flip the switch on next upgrade.
 //!
 //! Shape borrowed from <https://github.com/fleetdm/fleet>'s app-config
-//! SSO block, minus the user-RBAC fields (OpenPXE is single-tier: any
-//! IdP-authenticated user the SP cryptographically verifies gets an
-//! operator session; there is no per-user role table). Entity ID is
-//! exposed (FleetDM-style) but defaults to the advertised public base
-//! URL when blank, which is what most IdPs expect anyway.
+//! SSO block, minus the user-RBAC fields (OpenPXE is single-tier: you
+//! have access or you don't). Entity ID is omitted from the operator
+//! UI per the v0.4.5 brief — it defaults to the advertised public base
+//! URL when SAML wiring lands, which is what most IdPs expect anyway.
 
 use parking_lot::RwLock;
 use serde::{Deserialize, Serialize};
@@ -34,11 +33,6 @@ pub struct SsoConfig {
     /// with X" button label. Empty/whitespace falls back to "SSO".
     #[serde(default)]
     pub idp_name: String,
-    /// Optional HTTPS URL pointing at the IdP's brand logo. Rendered
-    /// next to `idp_name` on the WebUI's login screen (FleetDM-style).
-    /// Length-capped at [`MAX_URL_LEN`]; empty is fine.
-    #[serde(default)]
-    pub idp_logo_url: String,
     /// Raw SAML metadata XML pasted by the operator. Mutually exclusive
     /// with `metadata_url`; if both are set, the URL wins at apply time
     /// (operators typically forget about a stale XML paste).
@@ -48,18 +42,6 @@ pub struct SsoConfig {
     /// future SAML flow; not validated here beyond a basic length cap.
     #[serde(default)]
     pub metadata_url: String,
-    /// SP Entity ID advertised to the IdP — mirrors FleetDM's "Entity ID".
-    /// Must exactly match the SP/Relying-Party entry configured on the IdP.
-    /// Empty falls back to the advertised public base URL at runtime, which
-    /// is what most IdPs expect. Length-capped at [`MAX_URL_LEN`].
-    #[serde(default)]
-    pub entity_id: String,
-    /// Allow IdP-initiated login — an unsolicited `<Response>` POSTed to the
-    /// ACS with no `InResponseTo`. Mirrors FleetDM's "Allow SSO login
-    /// initiated by identity provider". Default off; SP-initiated (the
-    /// "Sign in with X" button) is always allowed regardless.
-    #[serde(default)]
-    pub allow_idp_initiated: bool,
 }
 
 impl SsoConfig {
@@ -69,7 +51,8 @@ impl SsoConfig {
     /// surface a yellow "configured but not live yet" hint.
     #[must_use]
     pub fn is_usable(&self) -> bool {
-        self.enabled && (!self.metadata.trim().is_empty() || !self.metadata_url.trim().is_empty())
+        self.enabled
+            && (!self.metadata.trim().is_empty() || !self.metadata_url.trim().is_empty())
     }
 }
 
@@ -117,15 +100,8 @@ impl SsoStore {
     /// but the server enforces a hard ceiling regardless.
     pub fn replace(&self, mut cfg: SsoConfig) -> Result<SsoConfig> {
         cfg.idp_name = cfg.idp_name.trim().to_string();
-        cfg.idp_logo_url = cfg.idp_logo_url.trim().to_string();
         cfg.metadata = cfg.metadata.trim().to_string();
         cfg.metadata_url = cfg.metadata_url.trim().to_string();
-        cfg.entity_id = cfg.entity_id.trim().to_string();
-        if cfg.entity_id.len() > MAX_URL_LEN {
-            return Err(Error::Invalid(format!(
-                "entity_id exceeds {MAX_URL_LEN}-char cap"
-            )));
-        }
         if cfg.metadata.len() > MAX_METADATA_BYTES {
             return Err(Error::Invalid(format!(
                 "metadata XML exceeds {MAX_METADATA_BYTES}-byte cap"
@@ -136,11 +112,6 @@ impl SsoStore {
                 "metadata_url exceeds {MAX_URL_LEN}-char cap"
             )));
         }
-        if cfg.idp_logo_url.len() > MAX_URL_LEN {
-            return Err(Error::Invalid(format!(
-                "idp_logo_url exceeds {MAX_URL_LEN}-char cap"
-            )));
-        }
         if !cfg.metadata_url.is_empty()
             && !cfg.metadata_url.starts_with("http://")
             && !cfg.metadata_url.starts_with("https://")
@@ -149,14 +120,6 @@ impl SsoStore {
                 "metadata_url must start with http:// or https://".into(),
             ));
         }
-        if !cfg.idp_logo_url.is_empty()
-            && !cfg.idp_logo_url.starts_with("http://")
-            && !cfg.idp_logo_url.starts_with("https://")
-        {
-            return Err(Error::Invalid(
-                "idp_logo_url must start with http:// or https://".into(),
-            ));
-        }
         // If they're trying to *enable* the integration but haven't
         // supplied either source, reject — saves a "configured but
         // unusable" surprise later.
@@ -234,9 +197,6 @@ mod tests {
             idp_name: "Okta".into(),
             metadata: String::new(),
             metadata_url: "https://idp.example.com/metadata".into(),
-            idp_logo_url: String::new(),
-            entity_id: String::new(),
-            allow_idp_initiated: false,
         })
         .unwrap();
         drop(s);
@@ -258,9 +218,6 @@ mod tests {
             idp_name: "Test IdP".into(),
             metadata: xml.into(),
             metadata_url: String::new(),
-            idp_logo_url: String::new(),
-            entity_id: String::new(),
-            allow_idp_initiated: false,
         })
         .unwrap();
         assert!(s.snapshot().is_usable());
@@ -275,9 +232,6 @@ mod tests {
             idp_name: "Okta".into(),
             metadata: String::new(),
             metadata_url: String::new(),
-            idp_logo_url: String::new(),
-            entity_id: String::new(),
-            allow_idp_initiated: false,
         });
         assert!(matches!(r, Err(Error::Invalid(_))));
         // …and a disabled blank config is fine.
@@ -293,80 +247,6 @@ mod tests {
             idp_name: String::new(),
             metadata: String::new(),
             metadata_url: "ftp://idp.example.com/metadata".into(),
-            idp_logo_url: String::new(),
-            entity_id: String::new(),
-            allow_idp_initiated: false,
-        });
-        assert!(matches!(r, Err(Error::Invalid(_))));
-    }
-
-    #[test]
-    fn idp_logo_url_must_be_http_scheme() {
-        // v0.4.6: SSO settings learned an idp_logo_url so the login
-        // screen can render the FleetDM-style "Sign in with <IdP-logo>"
-        // affordance. Same scheme rule as metadata_url.
-        let dir = tempdir().unwrap();
-        let s = SsoStore::load_or_default(dir.path());
-        let r = s.replace(SsoConfig {
-            enabled: false,
-            idp_name: "Okta".into(),
-            metadata: String::new(),
-            metadata_url: String::new(),
-            idp_logo_url: "data:image/png;base64,...".into(),
-            entity_id: String::new(),
-            allow_idp_initiated: false,
-        });
-        assert!(matches!(r, Err(Error::Invalid(_))));
-        // Real HTTPS URL is fine.
-        s.replace(SsoConfig {
-            enabled: false,
-            idp_name: "Okta".into(),
-            metadata: String::new(),
-            metadata_url: String::new(),
-            idp_logo_url: "https://idp.example.com/logo.png".into(),
-            entity_id: String::new(),
-            allow_idp_initiated: false,
-        })
-        .unwrap();
-        assert_eq!(
-            s.snapshot().idp_logo_url,
-            "https://idp.example.com/logo.png"
-        );
-    }
-
-    #[test]
-    fn entity_id_and_idp_initiated_round_trip() {
-        // v0.5.1: SP Entity ID + IdP-initiated toggle persist across reload.
-        let dir = tempdir().unwrap();
-        let s = SsoStore::load_or_default(dir.path());
-        s.replace(SsoConfig {
-            enabled: true,
-            idp_name: "Keycloak".into(),
-            metadata: String::new(),
-            metadata_url: "https://idp.example.com/metadata".into(),
-            idp_logo_url: String::new(),
-            entity_id: "https://pxe.example.com".into(),
-            allow_idp_initiated: true,
-        })
-        .unwrap();
-        drop(s);
-        let cfg = SsoStore::load_or_default(dir.path()).snapshot();
-        assert_eq!(cfg.entity_id, "https://pxe.example.com");
-        assert!(cfg.allow_idp_initiated);
-    }
-
-    #[test]
-    fn entity_id_cap_enforced() {
-        let dir = tempdir().unwrap();
-        let s = SsoStore::load_or_default(dir.path());
-        let r = s.replace(SsoConfig {
-            enabled: false,
-            idp_name: String::new(),
-            metadata: String::new(),
-            metadata_url: String::new(),
-            idp_logo_url: String::new(),
-            entity_id: "x".repeat(MAX_URL_LEN + 1),
-            allow_idp_initiated: false,
         });
         assert!(matches!(r, Err(Error::Invalid(_))));
     }
@@ -381,9 +261,6 @@ mod tests {
             idp_name: String::new(),
             metadata: oversize,
             metadata_url: String::new(),
-            idp_logo_url: String::new(),
-            entity_id: String::new(),
-            allow_idp_initiated: false,
         });
         assert!(matches!(r, Err(Error::Invalid(_))));
     }

crates/core/src/wol.rs

@@ -1,210 +0,0 @@
-//! Wake-on-LAN.
-//!
-//! v0.5.0: from the Hosts tab, an operator can wake a bound machine.
-//! WoL is a "magic packet" — six `0xFF` bytes followed by the target
-//! MAC repeated sixteen times (102 bytes total) — broadcast on the
-//! local segment. The NIC's WoL logic matches the repeated MAC and
-//! powers the board on.
-//!
-//! ## Why this is trivial and safe in our container
-//!
-//! - It's a single UDP datagram to a broadcast address. No privileged
-//!   *local* port is needed (we bind an ephemeral source port); the
-//!   destination port is conventionally 9 (discard) or 7 (echo), and
-//!   nothing actually listens there — the magic is in the payload, not
-//!   the port. So WoL works without any extra capability.
-//! - We send to the limited broadcast `255.255.255.255` (stays on the
-//!   local link) and, when the caller knows the server's own subnet
-//!   broadcast, to that too — directed broadcast reaches the right VLAN
-//!   even when the host bridges multiple segments.
-//!
-//! ## Limits
-//!
-//! WoL only crosses L2. If the target is on a different subnet than the
-//! OpenPXE host, the intervening router must be configured to forward
-//! directed broadcasts (most aren't, by design). For the common case —
-//! OpenPXE and its PXE clients on the same VLAN — the limited broadcast
-//! is enough.
-
-use crate::{Error, Result};
-use std::net::{Ipv4Addr, SocketAddrV4, UdpSocket};
-
-/// Conventional WoL destination port. 9 (discard) is the de-facto
-/// default; the port is immaterial since the match is on the payload.
-const WOL_PORT: u16 = 9;
-
-/// Parse a MAC string in any common form (`aa:bb:cc:dd:ee:ff`,
-/// `aa-bb-...`, `aabb.ccdd.eeff`, or bare hex) into six octets.
-///
-/// Returns `Error::Invalid` if it doesn't resolve to exactly six bytes.
-pub fn parse_mac(mac: &str) -> Result<[u8; 6]> {
-    // Strip every non-hex-digit, then expect exactly 12 hex chars.
-    let hex: String = mac.chars().filter(char::is_ascii_hexdigit).collect();
-    if hex.len() != 12 {
-        return Err(Error::Invalid(format!(
-            "invalid MAC '{mac}': expected 6 octets (12 hex digits), got {}",
-            hex.len()
-        )));
-    }
-    let mut out = [0u8; 6];
-    for (i, byte) in out.iter_mut().enumerate() {
-        // Each octet is two hex chars; unwrap is safe — we validated
-        // the length and that every char is a hex digit above.
-        *byte = u8::from_str_radix(&hex[i * 2..i * 2 + 2], 16)
-            .map_err(|e| Error::Invalid(format!("invalid MAC '{mac}': {e}")))?;
-    }
-    Ok(out)
-}
-
-/// Build the 102-byte magic packet for `mac`.
-#[must_use]
-pub fn magic_packet(mac: [u8; 6]) -> [u8; 102] {
-    let mut pkt = [0u8; 102];
-    // 6 bytes of 0xFF.
-    for b in &mut pkt[..6] {
-        *b = 0xFF;
-    }
-    // MAC repeated 16 times.
-    for rep in 0..16 {
-        let start = 6 + rep * 6;
-        pkt[start..start + 6].copy_from_slice(&mac);
-    }
-    pkt
-}
-
-/// Send a Wake-on-LAN magic packet for `mac` to every address in
-/// `broadcasts` (e.g. `255.255.255.255` plus the server's subnet
-/// broadcast). Returns the number of broadcast addresses the packet was
-/// successfully sent to; errors only if the MAC is malformed or the
-/// socket can't be opened at all.
-pub fn wake(mac: &str, broadcasts: &[Ipv4Addr]) -> Result<usize> {
-    let parsed = parse_mac(mac)?;
-    let packet = magic_packet(parsed);
-
-    // Always include the limited broadcast even if the caller didn't —
-    // it's the one that works with zero network configuration.
-    let mut targets: Vec<Ipv4Addr> = vec![Ipv4Addr::BROADCAST];
-    for b in broadcasts {
-        if !targets.contains(b) {
-            targets.push(*b);
-        }
-    }
-
-    let sent = send_magic(&packet, &targets, WOL_PORT)?;
-    tracing::info!(
-        target: "openpxe::wol",
-        mac = %mac, broadcasts = sent,
-        "Wake-on-LAN magic packet sent"
-    );
-    Ok(sent)
-}
-
-/// Open a broadcast-enabled UDP socket and send `packet` to every
-/// `target:port`. Returns how many sends succeeded. Errors if the
-/// socket can't be opened or if *no* target accepted the packet.
-fn send_magic(packet: &[u8], targets: &[Ipv4Addr], port: u16) -> Result<usize> {
-    // Bind an ephemeral local UDP port on all interfaces. SO_BROADCAST
-    // must be enabled to send to a broadcast address.
-    let sock = UdpSocket::bind(SocketAddrV4::new(Ipv4Addr::UNSPECIFIED, 0))
-        .map_err(|e| Error::Invalid(format!("could not open WoL socket: {e}")))?;
-    sock.set_broadcast(true)
-        .map_err(|e| Error::Invalid(format!("could not enable broadcast: {e}")))?;
-
-    let mut sent = 0usize;
-    for &addr in targets {
-        match sock.send_to(packet, SocketAddrV4::new(addr, port)) {
-            Ok(_) => sent += 1,
-            Err(e) => {
-                tracing::warn!(
-                    target: "openpxe::wol",
-                    broadcast = %addr,
-                    "WoL send failed: {e}"
-                );
-            }
-        }
-    }
-    if sent == 0 {
-        return Err(Error::Invalid(
-            "Wake-on-LAN: no broadcast address accepted the packet".into(),
-        ));
-    }
-    Ok(sent)
-}
-
-/// Compute the IPv4 broadcast address for `ip`/`mask`, if both parse.
-/// Used so the caller can include the server's own subnet broadcast
-/// alongside the limited broadcast.
-#[must_use]
-pub fn subnet_broadcast(ip: Ipv4Addr, mask: Ipv4Addr) -> Ipv4Addr {
-    let ip = u32::from(ip);
-    let mask = u32::from(mask);
-    Ipv4Addr::from(ip | !mask)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn parse_mac_accepts_common_forms() {
-        let want = [0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff];
-        assert_eq!(parse_mac("aa:bb:cc:dd:ee:ff").unwrap(), want);
-        assert_eq!(parse_mac("AA-BB-CC-DD-EE-FF").unwrap(), want);
-        assert_eq!(parse_mac("aabb.ccdd.eeff").unwrap(), want);
-        assert_eq!(parse_mac("aabbccddeeff").unwrap(), want);
-    }
-
-    #[test]
-    fn parse_mac_rejects_bad_length() {
-        assert!(parse_mac("aa:bb:cc").is_err());
-        assert!(parse_mac("").is_err());
-        assert!(parse_mac("zz:bb:cc:dd:ee:ff").is_err()); // non-hex stripped → too short
-    }
-
-    #[test]
-    fn magic_packet_shape() {
-        let pkt = magic_packet([0x01, 0x02, 0x03, 0x04, 0x05, 0x06]);
-        assert_eq!(&pkt[..6], &[0xFF; 6]);
-        // First MAC repetition.
-        assert_eq!(&pkt[6..12], &[0x01, 0x02, 0x03, 0x04, 0x05, 0x06]);
-        // Last (16th) repetition ends the packet.
-        assert_eq!(&pkt[96..102], &[0x01, 0x02, 0x03, 0x04, 0x05, 0x06]);
-    }
-
-    #[test]
-    fn subnet_broadcast_computes() {
-        assert_eq!(
-            subnet_broadcast(
-                Ipv4Addr::new(192, 168, 1, 49),
-                Ipv4Addr::new(255, 255, 255, 0)
-            ),
-            Ipv4Addr::new(192, 168, 1, 255)
-        );
-        assert_eq!(
-            subnet_broadcast(
-                Ipv4Addr::new(10, 5, 3, 7),
-                Ipv4Addr::new(255, 255, 0, 0)
-            ),
-            Ipv4Addr::new(10, 5, 255, 255)
-        );
-    }
-
-    #[test]
-    fn send_magic_delivers_intact_packet_over_loopback() {
-        // Deterministic round-trip that doesn't depend on the sandbox
-        // permitting a real L2 broadcast: bind a receiver on loopback
-        // and confirm send_magic transmits the exact 102-byte packet.
-        let rx = UdpSocket::bind(SocketAddrV4::new(Ipv4Addr::LOCALHOST, 0)).unwrap();
-        let port = rx.local_addr().unwrap().port();
-        rx.set_read_timeout(Some(std::time::Duration::from_secs(2))).unwrap();
-
-        let packet = magic_packet([0x0a, 0x1b, 0x2c, 0x3d, 0x4e, 0x5f]);
-        let sent = send_magic(&packet, &[Ipv4Addr::LOCALHOST], port).unwrap();
-        assert_eq!(sent, 1);
-
-        let mut buf = [0u8; 128];
-        let n = rx.recv(&mut buf).unwrap();
-        assert_eq!(n, 102, "magic packet should be 102 bytes");
-        assert_eq!(&buf[..102], &packet[..]);
-    }
-}

crates/http-api/Cargo.toml

@@ -4,10 +4,6 @@ version.workspace = true
 edition.workspace = true
 license.workspace = true
 authors.workspace = true
-# v0.5.0: inherit the workspace repository so CARGO_PKG_REPOSITORY is
-# populated at build time — the About-tab update check derives the
-# Gitea releases API URL from it.
-repository.workspace = true
 description = "HTTP server: ISO uploads, iPXE script generation, ISO streaming"
 
 [lints]
@@ -38,14 +34,6 @@ mime_guess.workspace = true
 uuid.workspace = true
 # v0.4.5 Forms auth: lock-free session store and cookie helpers.
 parking_lot.workspace = true
-# v0.5.0: outbound HTTP for chat webhooks (Slack/Teams/Discord) and the
-# About-tab "check for updates" call to the Gitea releases API; SMTP for
-# email notifications. Both use rustls so the static musl binary stays
-# OpenSSL-free.
-reqwest.workspace = true
-lettre.workspace = true
-# v0.5.1: decode the base64 SAMLResponse at the ACS endpoint.
-base64.workspace = true
 
 [dev-dependencies]
 tokio = { workspace = true, features = ["macros", "rt", "rt-multi-thread", "time"] }
@@ -53,11 +41,3 @@ tower = { workspace = true }
 tempfile = "3.12"
 serde_json = { workspace = true }
 time = { workspace = true }
-# v0.4.61: integration tests need to generate real PNG bytes for the
-# `/branding/pxe-logo` compositor; hand-rolled CRCs are too fragile.
-image = { version = "0.25", default-features = false, features = ["png"] }
-# v0.5.1: the SAML ACS integration tests mint a throwaway IdP keypair
-# (rcgen) and sign a SAMLResponse with bergshamra so the happy-path,
-# replay, and IdP-initiated-gating flows exercise real signatures.
-rcgen = "0.13"
-bergshamra = { workspace = true }

crates/http-api/src/app.rs

@@ -31,11 +31,11 @@ use axum::{
     Json, Router,
 };
 use openpxe_core::{
-    ext_for_mime, wol, BootEvent, ClientEvent, Error, NotifyConfig, Settings, SsoConfig,
-    ALLOWED_LOGO_MIMES, MAX_LOGO_BYTES,
+    ext_for_mime, BootEvent, ClientEvent, Error, Settings, SsoConfig, ALLOWED_LOGO_MIMES,
+    MAX_LOGO_BYTES,
 };
 use openpxe_ipxe_assets::asset_bytes;
-use openpxe_iso_store::{IsoCategory, IsoMeta, IsoSource, NfsAddRequest, SmbAddRequest};
+use openpxe_iso_store::{IsoCategory, IsoMeta, NfsAddRequest};
 use serde::Deserialize;
 use serde_json::json;
 use std::net::SocketAddr;
@@ -51,13 +51,6 @@ pub fn build_router(state: AppState) -> Router {
         .route("/assets/app.css", get(ui_css))
         .route("/assets/logo.svg", get(ui_logo))
         .route("/assets/loader.svg", get(ui_loader))
-        // v0.4.6: PXE menu logo — the raster form of the operator's
-        // uploaded mark, served so iPXE's `console --picture` can
-        // overlay it on the boot menu. SVG uploads 404 here (iPXE
-        // can't rasterize SVG); we deliberately don't bundle a
-        // pre-rendered PNG fallback because iPXE's ASCII wordmark
-        // banner already provides the always-visible branding.
-        .route("/branding/pxe-logo", get(ui_pxe_logo))
         // iPXE script endpoints.
         .route("/boot.ipxe", get(boot_top_menu))
         .route("/boot/:filename", get(boot_sub))
@@ -116,16 +109,14 @@ pub fn build_router(state: AppState) -> Router {
         .route("/api/login", post(auth_api::api_login))
         .route("/api/logout", post(auth_api::api_logout))
         .route("/api/me", get(auth_api::api_me))
-        .route("/api/me/credentials", put(auth_api::api_update_credentials))
-        // SAML SSO configuration (FleetDM-shaped). Gated behind auth — the
-        // operator pastes their IdP metadata, Entity ID, and toggles here.
+        .route(
+            "/api/me/credentials",
+            put(auth_api::api_update_credentials),
+        )
+        // v0.4.5: SAML SSO configuration (FleetDM-shaped, storage-only).
+        // The actual sign-in flow lands in a later release; this just
+        // gives operators a place to paste their IdP metadata today.
         .route("/api/sso", get(api_sso_get).put(api_sso_put))
-        // v0.5.1: SAML SP login flow (pre-auth — see the require_auth
-        // allowlist). /login redirects to the IdP, /acs consumes the signed
-        // response + mints a session, /metadata serves our SP descriptor.
-        .route("/api/sso/login", get(crate::saml_routes::sso_login))
-        .route("/api/sso/acs", post(crate::saml_routes::sso_acs))
-        .route("/api/sso/metadata", get(crate::saml_routes::sso_metadata))
         .route("/api/clients", get(api_list_clients))
         .route("/api/status", get(api_status))
         .route("/api/settings", get(api_get_settings).put(api_put_settings))
@@ -134,27 +125,10 @@ pub fn build_router(state: AppState) -> Router {
         .route("/api/queue/poll/:entry_id", get(api_queue_poll))
         .route("/api/queue/assign", post(api_queue_assign))
         .route("/api/queue/:entry_id", delete(api_queue_release))
-        // v0.4.65: SMB share manager (userspace via smbclient). The
-        // kernel-mount NFS routes that v0.4.64 shipped are gone — they
-        // didn't work on hosts whose kernel lacked the nfs client
-        // modules (Unraid), and no container-side configuration could
-        // load a host kernel module. `smbclient` speaks SMB over a
-        // plain TCP socket in userspace, works in every container.
-        .route(
-            "/api/smb-shares",
-            get(api_smb_shares_list).post(api_smb_shares_add),
-        )
-        .route("/api/smb-shares/:id", delete(api_smb_shares_remove))
-        .route("/api/smb-shares/:id/scan", post(api_smb_shares_scan))
-        // v0.4.67: NFSv3 share manager (pure-Rust in-process client).
-        // Ships alongside SMB. Routes are parallel so the UI can
-        // reuse the same form/error/hint rendering for both.
-        .route(
-            "/api/nfs-shares",
-            get(api_nfs_shares_list).post(api_nfs_shares_add),
-        )
-        .route("/api/nfs-shares/:id", delete(api_nfs_shares_remove))
-        .route("/api/nfs-shares/:id/scan", post(api_nfs_shares_scan))
+        // Phase 4: NFS share manager.
+        .route("/api/nfs", get(api_nfs_list).post(api_nfs_add))
+        .route("/api/nfs/:id", delete(api_nfs_remove))
+        .route("/api/nfs/:id/scan", post(api_nfs_scan))
         // Phase 4: Network info (read-only) + DNS edit.
         .route("/api/network", get(api_network).put(api_network_put))
         // Phase 4: live-log stream + recent buffer for the Terminal tab.
@@ -167,19 +141,9 @@ pub fn build_router(state: AppState) -> Router {
         // pins a MAC to a boot entry; /boot.ipxe?mac=... chains directly.
         .route("/api/hosts", get(api_hosts_list).post(api_hosts_upsert))
         .route("/api/hosts/:mac", delete(api_hosts_remove))
-        // v0.5.0: Wake-on-LAN a bound host. Sends a magic packet to the
-        // limited broadcast + the server's own subnet broadcast.
-        .route("/api/hosts/:mac/wol", post(api_hosts_wol))
         // Rolling "host log" of boot events: what image actually
         // started installing on what MAC/IP, and when. Persisted to disk.
         .route("/api/boot-log", get(api_boot_log))
-        // v0.5.0: notification config (Advanced tab) + a "send test"
-        // probe. GET redacts the SMTP password.
-        .route("/api/notify", get(api_notify_get).put(api_notify_put))
-        .route("/api/notify/test", post(api_notify_test))
-        // v0.5.0: About-tab update check — queries the Gitea releases
-        // API and compares against the running version.
-        .route("/api/updates/check", get(api_updates_check))
         // Phase 5: Prometheus scrape endpoint. Plain text exposition
         // format. No auth — the metrics surface is intentionally
         // boring (counts, no payloads).
@@ -212,7 +176,9 @@ async fn api_sso_get(State(state): State<AppState>) -> Json<SsoConfig> {
 async fn api_sso_put(State(state): State<AppState>, Json(body): Json<SsoConfig>) -> Response {
     match state.sso.replace(body) {
         Ok(cfg) => (StatusCode::OK, Json(cfg)).into_response(),
-        Err(Error::Invalid(msg)) => (StatusCode::BAD_REQUEST, msg).into_response(),
+        Err(Error::Invalid(msg)) => {
+            (StatusCode::BAD_REQUEST, msg).into_response()
+        }
         Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
     }
 }
@@ -220,54 +186,23 @@ async fn api_sso_put(State(state): State<AppState>, Json(body): Json<SsoConfig>)
 // ─── UI ────────────────────────────────────────────────────────────────────
 
 async fn index(State(state): State<AppState>) -> Response {
-    // The asset version pin in index.html (`?v=…`) is what makes
-    // browsers re-fetch JS/CSS after an upgrade. We use the OpenPXE
-    // binary version — every release ships a new value, every release
-    // forces a fresh URL on each asset.
-    // logo_rev cache-busts the brand mark / favicon independently of
-    // the release version, so an operator who swaps the custom logo
-    // sees it update on the next reload without waiting for an upgrade.
-    let html = openpxe_webui::index_html(
-        &state.public_base_url,
-        env!("CARGO_PKG_VERSION"),
-        state.branding.logo_rev(),
-        state.branding.has_logo(),
-    );
+    let html = openpxe_webui::index_html(&state.public_base_url);
     (
-        [
-            (
-                header::CONTENT_TYPE,
-                HeaderValue::from_static("text/html; charset=utf-8"),
-            ),
-            // index.html itself must never be cached — that's how the
-            // browser learns about a new `?v=…` value for the assets.
-            (
-                header::CACHE_CONTROL,
-                HeaderValue::from_static("no-cache, must-revalidate"),
-            ),
-        ],
+        [(
+            header::CONTENT_TYPE,
+            HeaderValue::from_static("text/html; charset=utf-8"),
+        )],
         html,
     )
         .into_response()
 }
 
-/// Cache-Control header value used for the bundled JS/CSS/SVG assets.
-/// We pin a 1-day TTL so a long-lived deployment doesn't re-fetch the
-/// same bytes on every page-load, but require revalidation — combined
-/// with the `?v=<version>` query string in index.html, the practical
-/// upper bound on caching across an upgrade is "until the operator
-/// reloads".
-const ASSET_CACHE_CONTROL: HeaderValue = HeaderValue::from_static("no-cache, must-revalidate");
-
 async fn ui_js() -> Response {
     (
-        [
-            (
-                header::CONTENT_TYPE,
-                HeaderValue::from_static("application/javascript"),
-            ),
-            (header::CACHE_CONTROL, ASSET_CACHE_CONTROL),
-        ],
+        [(
+            header::CONTENT_TYPE,
+            HeaderValue::from_static("application/javascript"),
+        )],
         openpxe_webui::app_js(),
     )
         .into_response()
@@ -275,10 +210,7 @@ async fn ui_js() -> Response {
 
 async fn ui_css() -> Response {
     (
-        [
-            (header::CONTENT_TYPE, HeaderValue::from_static("text/css")),
-            (header::CACHE_CONTROL, ASSET_CACHE_CONTROL),
-        ],
+        [(header::CONTENT_TYPE, HeaderValue::from_static("text/css"))],
         openpxe_webui::app_css(),
     )
         .into_response()
@@ -322,100 +254,21 @@ async fn ui_logo(State(state): State<AppState>) -> Response {
         }
     }
     (
-        [
-            (
-                header::CONTENT_TYPE,
-                HeaderValue::from_static("image/svg+xml"),
-            ),
-            (header::CACHE_CONTROL, ASSET_CACHE_CONTROL),
-        ],
+        [(
+            header::CONTENT_TYPE,
+            HeaderValue::from_static("image/svg+xml"),
+        )],
         openpxe_webui::logo_svg(),
     )
         .into_response()
 }
 
-/// PXE boot-menu background, composed for the iPXE `console --picture`
-/// call. Returns a full-screen 1024×768 PNG: a dark field with the
-/// operator's uploaded logo across the top, or — when no logo is set —
-/// a default OpenPXE mark on the same dark field. Either way the
-/// endpoint *always* returns a valid PNG so the menu's `console
-/// --picture` paints a real background instead of falling through to
-/// bare text (v0.4.69 — replaces the old ASCII wordmark).
-///
-/// Any raster the operator uploads (PNG / JPEG / WebP / GIF) is decoded
-/// and transcoded to PNG here, since iPXE only consumes PNG. SVG
-/// uploads can't be rasterized without hauling in `resvg`, so an SVG
-/// brand mark falls back to the *default* background for the PXE screen
-/// (the WebUI still renders the SVG natively in the top-left).
-async fn ui_pxe_logo(State(state): State<AppState>) -> Response {
-    // Resolve the operator's raster upload, if any and if it's a format
-    // iPXE/our compositor can consume. SVG (or a missing/unreadable
-    // file) yields `None`, which composes the default background.
-    let raster: Option<Vec<u8>> = match (state.branding.logo_path(), state.branding.logo_mime()) {
-        (Some(path), Some(mime)) if mime != "image/svg+xml" => tokio::fs::read(&path).await.ok(),
-        _ => None,
-    };
-
-    let composed = match tokio::task::spawn_blocking(move || {
-        openpxe_iso_store::pxe_logo::compose_pxe_background(raster.as_deref())
-    })
-    .await
-    {
-        Ok(Ok(png)) => png,
-        Ok(Err(e)) => {
-            // A decode failure on the operator's upload shouldn't blank
-            // the boot screen — fall back to the default background.
-            tracing::warn!(
-                target: "openpxe::http::branding",
-                error = %e, "PXE background compose failed on upload; using default"
-            );
-            match tokio::task::spawn_blocking(|| {
-                openpxe_iso_store::pxe_logo::compose_pxe_background(None)
-            })
-            .await
-            {
-                Ok(Ok(png)) => png,
-                _ => {
-                    return (
-                        StatusCode::INTERNAL_SERVER_ERROR,
-                        "failed to compose PXE background",
-                    )
-                        .into_response();
-                }
-            }
-        }
-        Err(e) => {
-            return (
-                StatusCode::INTERNAL_SERVER_ERROR,
-                format!("pxe-background task failed: {e}"),
-            )
-                .into_response();
-        }
-    };
-    (
-        [
-            (header::CONTENT_TYPE, HeaderValue::from_static("image/png")),
-            // No-cache so a freshly uploaded logo paints on the next
-            // boot without a stale composite lingering.
-            (
-                header::CACHE_CONTROL,
-                HeaderValue::from_static("no-cache, max-age=0"),
-            ),
-        ],
-        composed,
-    )
-        .into_response()
-}
-
 async fn ui_loader() -> Response {
     (
-        [
-            (
-                header::CONTENT_TYPE,
-                HeaderValue::from_static("image/svg+xml"),
-            ),
-            (header::CACHE_CONTROL, ASSET_CACHE_CONTROL),
-        ],
+        [(
+            header::CONTENT_TYPE,
+            HeaderValue::from_static("image/svg+xml"),
+        )],
         openpxe_webui::loader_svg(),
     )
         .into_response()
@@ -626,22 +479,11 @@ async fn boot_sub(
                             .filter(|m| !m.is_empty());
                         state.boot_log.record(&BootEvent {
                             timestamp: time::OffsetDateTime::now_utc(),
-                            mac: mac_normalized.clone(),
+                            mac: mac_normalized,
                             ip: peer_ip,
                             target_id: entry.id.clone(),
                             target_title: format!("{} — {}", iso.filename, entry.title),
                         });
-                        // v0.5.0: fire-and-forget notification on the
-                        // canonical "a machine is imaging" moment.
-                        let who = mac_normalized
-                            .clone()
-                            .or_else(|| peer_ip.map(|ip| ip.to_string()))
-                            .unwrap_or_else(|| "an unknown client".into());
-                        spawn_notify(
-                            &state,
-                            "PXE boot started",
-                            &format!("{who} started booting {} ({}).", iso.filename, entry.title),
-                        );
                         return text_plain(render_entry(entry, &settings, base));
                     }
                 }
@@ -682,112 +524,12 @@ async fn iso_raw(
     headers: HeaderMap,
 ) -> Response {
     let id = filename.strip_suffix(".iso").unwrap_or(&filename);
-    // v0.4.65: SMB-sourced ISOs have no on-disk path — they're
-    // streamed live from the remote share via `smbclient`. We look
-    // up the meta first to decide whether to take the path-based
-    // local route or the subprocess-based SMB route.
-    let Some(meta) = state.iso_store.get(id) else {
+    let Some(path) = state.iso_store.iso_path_for(id) else {
         return (StatusCode::NOT_FOUND, "no such iso").into_response();
     };
-    match &meta.source {
-        IsoSource::Local => {
-            let Some(path) = state.iso_store.iso_path_for(id) else {
-                return (StatusCode::NOT_FOUND, "no such iso").into_response();
-            };
-            match stream_file_range(&path, headers.get(header::RANGE)).await {
-                Ok(r) => r,
-                Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
-            }
-        }
-        IsoSource::Smb {
-            share_id,
-            relative_path,
-        } => {
-            // Range requests aren't supported for SMB sources in
-            // v0.4.65 — smbclient's CLI can't seek mid-stream. iPXE
-            // chain loading and ISO sanboot do whole-file sequential
-            // reads, so this works in practice. A 416 here lets the
-            // client fall back to a full GET if it tried a range.
-            if headers.get(header::RANGE).is_some() {
-                return Response::builder()
-                    .status(StatusCode::RANGE_NOT_SATISFIABLE)
-                    .header(
-                        header::CONTENT_RANGE,
-                        format!("bytes */{}", meta.size_bytes),
-                    )
-                    .body(Body::empty())
-                    .unwrap();
-            }
-            match state.smb_shares.stream_iso(share_id, relative_path).await {
-                Ok(stream) => {
-                    let reader = stream.stdout;
-                    let body_stream = tokio_util::io::ReaderStream::new(reader);
-                    Response::builder()
-                        .status(StatusCode::OK)
-                        .header(header::CONTENT_TYPE, "application/octet-stream")
-                        .header(header::CONTENT_LENGTH, meta.size_bytes)
-                        // Tell intermediaries we don't support
-                        // ranges on this resource; saves them from
-                        // even trying.
-                        .header(header::ACCEPT_RANGES, "none")
-                        .body(Body::from_stream(body_stream))
-                        .unwrap()
-                }
-                Err(e) => (StatusCode::BAD_GATEWAY, format!("smb stream: {e}")).into_response(),
-            }
-        }
-        IsoSource::Nfs {
-            share_id,
-            relative_path,
-        } => {
-            // v0.4.67: NFS sources support Range requests because
-            // NFSv3 READ3 takes an explicit offset. We resolve the
-            // requested byte range here and pass start/len down to
-            // the streamer which seeks into the file via READ3.
-            let total = meta.size_bytes;
-            let range = match parse_range(headers.get(header::RANGE), total) {
-                Some(triple) => triple,
-                None if headers.get(header::RANGE).is_some() => {
-                    return Response::builder()
-                        .status(StatusCode::RANGE_NOT_SATISFIABLE)
-                        .header(header::CONTENT_RANGE, format!("bytes */{total}"))
-                        .body(Body::empty())
-                        .unwrap();
-                }
-                // No Range header — serve the whole file.
-                None => (0, total.saturating_sub(1), false),
-            };
-            let (start, end, partial) = range;
-            let len = if total == 0 { 0 } else { end - start + 1 };
-            let max_len = if total == 0 { None } else { Some(len) };
-            match state
-                .nfs_shares
-                .stream_iso(share_id, relative_path, start, max_len)
-                .await
-            {
-                Ok(stream) => {
-                    let body = Body::from_stream(stream);
-                    let status = if partial {
-                        StatusCode::PARTIAL_CONTENT
-                    } else {
-                        StatusCode::OK
-                    };
-                    let mut builder = Response::builder()
-                        .status(status)
-                        .header(header::CONTENT_TYPE, "application/octet-stream")
-                        .header(header::ACCEPT_RANGES, "bytes")
-                        .header(header::CONTENT_LENGTH, len);
-                    if partial {
-                        builder = builder.header(
-                            header::CONTENT_RANGE,
-                            format!("bytes {start}-{end}/{total}"),
-                        );
-                    }
-                    builder.body(body).unwrap()
-                }
-                Err(e) => (StatusCode::BAD_GATEWAY, format!("nfs stream: {e}")).into_response(),
-            }
-        }
+    match stream_file_range(&path, headers.get(header::RANGE)).await {
+        Ok(r) => r,
+        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
     }
 }
 
@@ -795,10 +537,6 @@ async fn iso_file(
     State(state): State<AppState>,
     AxumPath((id, path)): AxumPath<(String, String)>,
 ) -> Response {
-    // In-ISO file extraction is only supported for local ISOs — it
-    // needs random-access reads into the ISO9660 directory tree, which
-    // smbclient's whole-file streaming can't do efficiently. SMB-
-    // sourced ISOs use the raw streaming endpoint above instead.
     let Some(iso_path) = state.iso_store.iso_path_for(&id) else {
         return (StatusCode::NOT_FOUND, "no such iso").into_response();
     };
@@ -1052,7 +790,10 @@ async fn api_storage_disk(State(state): State<AppState>) -> Json<serde_json::Val
 
 // ─── Branding (custom logo) ───────────────────────────────────────────────
 
-async fn api_branding_upload(State(state): State<AppState>, mut multipart: Multipart) -> Response {
+async fn api_branding_upload(
+    State(state): State<AppState>,
+    mut multipart: Multipart,
+) -> Response {
     while let Ok(Some(field)) = multipart.next_field().await {
         let name = field.name().unwrap_or("").to_string();
         if name != "file" && name != "logo" {
@@ -1073,7 +814,9 @@ async fn api_branding_upload(State(state): State<AppState>, mut multipart: Multi
         // hitting disk. Logos are tiny by definition.
         let bytes = match field.bytes().await {
             Ok(b) => b,
-            Err(e) => return (StatusCode::BAD_REQUEST, format!("read body: {e}")).into_response(),
+            Err(e) => {
+                return (StatusCode::BAD_REQUEST, format!("read body: {e}")).into_response()
+            }
         };
         if bytes.len() > MAX_LOGO_BYTES {
             return (
@@ -1101,7 +844,9 @@ async fn api_branding_upload(State(state): State<AppState>, mut multipart: Multi
                 )
                     .into_response()
             }
-            Err(e) => return (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
+            Err(e) => {
+                return (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response()
+            }
         }
     }
     (StatusCode::BAD_REQUEST, "no 'file' part").into_response()
@@ -1167,30 +912,17 @@ async fn api_docs() -> Json<serde_json::Value> {
                      "summary": "Abort a chunked upload session and remove the .partial file."},
                 ],
             },
-            {
-                "name": "SMB shares",
-                "endpoints": [
-                    {"method": "GET", "path": "/api/smb-shares",
-                     "summary": "List configured SMB shares with connection state and iso counts."},
-                    {"method": "POST", "path": "/api/smb-shares",
-                     "summary": "Register an SMB share. Body: { server, share, guest, username?, password?, port? }."},
-                    {"method": "DELETE", "path": "/api/smb-shares/:id",
-                     "summary": "Forget a share and drop its entries from the ISO store."},
-                    {"method": "POST", "path": "/api/smb-shares/:id/scan",
-                     "summary": "Re-list a share for new ISOs."},
-                ],
-            },
             {
                 "name": "NFS shares",
                 "endpoints": [
-                    {"method": "GET", "path": "/api/nfs-shares",
-                     "summary": "List configured NFSv3 shares with connection state and iso counts."},
-                    {"method": "POST", "path": "/api/nfs-shares",
-                     "summary": "Register an NFSv3 share. Body: { server, export, port? }. Auth is AUTH_SYS only; access control is by client IP on the server side."},
-                    {"method": "DELETE", "path": "/api/nfs-shares/:id",
-                     "summary": "Forget a share and drop its entries from the ISO store."},
-                    {"method": "POST", "path": "/api/nfs-shares/:id/scan",
-                     "summary": "Re-list a share for new ISOs."},
+                    {"method": "GET", "path": "/api/nfs",
+                     "summary": "List configured NFS shares with mount state and iso counts."},
+                    {"method": "POST", "path": "/api/nfs",
+                     "summary": "Mount an NFS share. Body: { server, export, version, read_only }."},
+                    {"method": "DELETE", "path": "/api/nfs/:id",
+                     "summary": "Unmount a share and drop its entries from the ISO store."},
+                    {"method": "POST", "path": "/api/nfs/:id/scan",
+                     "summary": "Re-walk a mounted share for ISOs."},
                 ],
             },
             {
@@ -1213,8 +945,6 @@ async fn api_docs() -> Json<serde_json::Value> {
                      "summary": "Upload a custom WebUI logo (multipart 'file', PNG/SVG/JPEG/WebP/GIF up to 2 MB)."},
                     {"method": "DELETE", "path": "/api/branding/logo",
                      "summary": "Remove the custom logo and revert to the bundled mark."},
-                    {"method": "GET", "path": "/branding/pxe-logo",
-                     "summary": "Raster form of the operator's logo for the iPXE menu's `console --picture`. SVG uploads 404 here."},
                     {"method": "GET", "path": "/api/sso",
                      "summary": "Current SAML SSO configuration."},
                     {"method": "PUT", "path": "/api/sso",
@@ -1265,25 +995,10 @@ async fn api_docs() -> Json<serde_json::Value> {
                      "summary": "Pin a MAC to a boot target. Body: { mac, target, label }."},
                     {"method": "DELETE", "path": "/api/hosts/:mac",
                      "summary": "Remove a binding."},
-                    {"method": "POST", "path": "/api/hosts/:mac/wol",
-                     "summary": "Send a Wake-on-LAN magic packet to a bound MAC (limited + subnet broadcast)."},
                     {"method": "GET", "path": "/api/boot-log",
                      "summary": "Ring of recent boot events (timestamp, mac, ip, target)."},
                 ],
             },
-            {
-                "name": "Notifications & updates",
-                "endpoints": [
-                    {"method": "GET", "path": "/api/notify",
-                     "summary": "Current notification config (SMTP password redacted)."},
-                    {"method": "PUT", "path": "/api/notify",
-                     "summary": "Replace notification config. Body: { enabled, kind, webhook_url, smtp_* }."},
-                    {"method": "POST", "path": "/api/notify/test",
-                     "summary": "Send a test notification using the saved config."},
-                    {"method": "GET", "path": "/api/updates/check",
-                     "summary": "Compare the running version against the latest Gitea release."},
-                ],
-            },
             {
                 "name": "Operator console",
                 "endpoints": [
@@ -1622,13 +1337,8 @@ async fn api_list_clients(State(state): State<AppState>) -> Json<serde_json::Val
 
 async fn api_status(State(state): State<AppState>) -> Json<serde_json::Value> {
     let smb = state.smb.as_ref().map(|s| s.snapshot());
-    // v0.4.65+v0.4.67: external storage shares — SMB (userspace
-    // smbclient) and NFS (in-process nfs3_client). Dashboard tile
-    // sums both so operators see a single "reachable shares" number.
-    let smb_shares = state.smb_shares.list();
-    let smb_reachable = smb_shares.iter().filter(|m| m.reachable).count();
-    let nfs_shares = state.nfs_shares.list();
-    let nfs_reachable = nfs_shares.iter().filter(|m| m.reachable).count();
+    let nfs = state.nfs.list();
+    let nfs_active = nfs.iter().filter(|m| m.mounted).count();
     let isos = state.iso_store.list();
     let clients = state.clients.list();
     let queue_entries = state.queue.list();
@@ -1647,9 +1357,7 @@ async fn api_status(State(state): State<AppState>) -> Json<serde_json::Value> {
     state
         .metrics
         .set_queue_counts(queue_entries.len() as u64, imaging as u64);
-    state
-        .metrics
-        .set_nfs_active((smb_reachable + nfs_reachable) as u64);
+    state.metrics.set_nfs_active(nfs_active as u64);
     state.metrics.record_http(openpxe_core::HttpRoute::Api);
     let now = time::OffsetDateTime::now_utc();
     let uptime_secs = (now - state.started_at).whole_seconds().max(0);
@@ -1664,13 +1372,8 @@ async fn api_status(State(state): State<AppState>) -> Json<serde_json::Value> {
         "ipxe_assets": openpxe_ipxe_assets::list_assets(),
         "settings": state.settings.snapshot(),
         "smb": smb,
-        "smb_share_count": smb_shares.len(),
-        "smb_share_reachable": smb_reachable,
-        // v0.4.67: NFSv3 share counts. The dashboard tile sums these
-        // with the SMB counts above ("N shares reachable") so the
-        // top-line metric works regardless of protocol mix.
-        "nfs_share_count": nfs_shares.len(),
-        "nfs_share_reachable": nfs_reachable,
+        "nfs_count": nfs.len(),
+        "nfs_active": nfs_active,
         "host_bindings": state.hosts.len(),
         "custom_logo": state.branding.has_logo(),
         "uptime_secs": uptime_secs,
@@ -1885,83 +1588,32 @@ async fn api_queue_release(
     }
 }
 
-// ─── SMB share API (v0.4.65) ───────────────────────────────────────────────
-//
-// Replaces the NFS share manager from v0.4.64. The wire shape is similar
-// — a {shares: [...]} list, a POST that returns either the share or a
-// structured {error, stderr, hint} body — so the UI can render both the
-// same way.
+// ─── NFS share API ─────────────────────────────────────────────────────────
 
-async fn api_smb_shares_list(State(state): State<AppState>) -> Json<serde_json::Value> {
-    Json(json!({ "shares": state.smb_shares.list() }))
+async fn api_nfs_list(State(state): State<AppState>) -> Json<serde_json::Value> {
+    Json(json!({ "mounts": state.nfs.list() }))
 }
 
-async fn api_smb_shares_add(
-    State(state): State<AppState>,
-    Json(req): Json<SmbAddRequest>,
-) -> Response {
-    match state.smb_shares.add(req).await {
-        Ok(s) => (StatusCode::CREATED, Json(s)).into_response(),
-        Err(err) => (StatusCode::BAD_REQUEST, Json(err)).into_response(),
-    }
-}
-
-async fn api_smb_shares_remove(
-    State(state): State<AppState>,
-    AxumPath(id): AxumPath<String>,
-) -> Response {
-    match state.smb_shares.remove(&id).await {
-        Ok(()) => StatusCode::NO_CONTENT.into_response(),
-        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
-    }
-}
-
-async fn api_smb_shares_scan(
-    State(state): State<AppState>,
-    AxumPath(id): AxumPath<String>,
-) -> Response {
-    match state.smb_shares.rescan(&id).await {
-        Ok(n) => Json(json!({ "ok": true, "iso_count": n })).into_response(),
+async fn api_nfs_add(State(state): State<AppState>, Json(req): Json<NfsAddRequest>) -> Response {
+    match state.nfs.add(req).await {
+        Ok(m) => (StatusCode::CREATED, Json(m)).into_response(),
+        // Anything from the manager surfaces as a user-fixable validation
+        // error — bad host, kernel without NFS support, missing
+        // `mount.nfs`, dead server. We pass the message through verbatim
+        // so the UI can show it to the operator.
         Err(e) => (StatusCode::BAD_REQUEST, format!("{e}")).into_response(),
     }
 }
 
-// ─── NFS share API (v0.4.67) ───────────────────────────────────────────────
-//
-// Parallel to the SMB shares API. The pure-Rust NFSv3 client
-// (`nfs3_client`) gives us in-process listing and streaming, no
-// subprocess. Unlike SMB, NFS-sourced ISOs support HTTP Range
-// requests — NFSv3 READ3 takes an explicit offset.
-
-async fn api_nfs_shares_list(State(state): State<AppState>) -> Json<serde_json::Value> {
-    Json(json!({ "shares": state.nfs_shares.list() }))
-}
-
-async fn api_nfs_shares_add(
-    State(state): State<AppState>,
-    Json(req): Json<NfsAddRequest>,
-) -> Response {
-    match state.nfs_shares.add(req).await {
-        Ok(s) => (StatusCode::CREATED, Json(s)).into_response(),
-        Err(err) => (StatusCode::BAD_REQUEST, Json(err)).into_response(),
-    }
-}
-
-async fn api_nfs_shares_remove(
-    State(state): State<AppState>,
-    AxumPath(id): AxumPath<String>,
-) -> Response {
-    match state.nfs_shares.remove(&id).await {
+async fn api_nfs_remove(State(state): State<AppState>, AxumPath(id): AxumPath<String>) -> Response {
+    match state.nfs.remove(&id).await {
         Ok(()) => StatusCode::NO_CONTENT.into_response(),
         Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
     }
 }
 
-async fn api_nfs_shares_scan(
-    State(state): State<AppState>,
-    AxumPath(id): AxumPath<String>,
-) -> Response {
-    match state.nfs_shares.rescan(&id).await {
+async fn api_nfs_scan(State(state): State<AppState>, AxumPath(id): AxumPath<String>) -> Response {
+    match state.nfs.rescan(&id).await {
         Ok(n) => Json(json!({ "ok": true, "iso_count": n })).into_response(),
         Err(e) => (StatusCode::BAD_REQUEST, format!("{e}")).into_response(),
     }
@@ -2055,218 +1707,6 @@ async fn api_hosts_remove(
     }
 }
 
-/// v0.5.0: Wake-on-LAN a bound host. Sends a magic packet to the limited
-/// broadcast (255.255.255.255) and the server's own subnet broadcast
-/// (computed from the advertised IP + detected mask), which covers the
-/// common "same VLAN as OpenPXE" case with zero network config. We only
-/// wake MACs that are actually bound — keeps this from being an open
-/// "spray packets at any MAC" endpoint.
-async fn api_hosts_wol(State(state): State<AppState>, AxumPath(mac): AxumPath<String>) -> Response {
-    if state.hosts.lookup(&mac).is_none() {
-        return (
-            StatusCode::NOT_FOUND,
-            "no host binding for that MAC — bind it first",
-        )
-            .into_response();
-    }
-
-    // Compute the server's subnet broadcast from the advertised IP +
-    // detected mask so the packet reaches the right VLAN even if the
-    // limited broadcast is filtered. Best-effort: skip if either won't
-    // parse.
-    let server_ip = state
-        .public_base_url
-        .strip_prefix("http://")
-        .unwrap_or(&state.public_base_url)
-        .split(':')
-        .next()
-        .unwrap_or("")
-        .parse::<std::net::Ipv4Addr>();
-    let mask = state.subnet_mask.parse::<std::net::Ipv4Addr>();
-    let mut broadcasts = Vec::new();
-    if let (Ok(ip), Ok(m)) = (server_ip, mask) {
-        broadcasts.push(wol::subnet_broadcast(ip, m));
-    }
-
-    // The send is a blocking std UDP call; push it off the async
-    // executor.
-    let mac_owned = mac.clone();
-    let result = tokio::task::spawn_blocking(move || wol::wake(&mac_owned, &broadcasts)).await;
-    match result {
-        Ok(Ok(n)) => {
-            // Fire-and-forget notification — nice "someone woke a box"
-            // signal, never blocks the response.
-            spawn_notify(
-                &state,
-                "Wake-on-LAN sent",
-                &format!("OpenPXE sent a Wake-on-LAN magic packet to {mac}."),
-            );
-            Json(json!({ "ok": true, "broadcasts": n })).into_response()
-        }
-        Ok(Err(e)) => (StatusCode::BAD_REQUEST, format!("{e}")).into_response(),
-        Err(e) => (
-            StatusCode::INTERNAL_SERVER_ERROR,
-            format!("wol task failed: {e}"),
-        )
-            .into_response(),
-    }
-}
-
-// ─── Notifications (v0.5.0) ───────────────────────────────────────────────
-
-async fn api_notify_get(State(state): State<AppState>) -> Json<NotifyConfig> {
-    // Redact the SMTP password before it leaves the process.
-    Json(state.notify.snapshot().redacted())
-}
-
-async fn api_notify_put(State(state): State<AppState>, Json(cfg): Json<NotifyConfig>) -> Response {
-    match state.notify.replace(cfg) {
-        Ok(saved) => (StatusCode::OK, Json(saved.redacted())).into_response(),
-        Err(e) => (StatusCode::BAD_REQUEST, format!("{e}")).into_response(),
-    }
-}
-
-/// Send a test notification using the *currently saved* config (not the
-/// request body) so the operator validates exactly what's persisted.
-async fn api_notify_test(State(state): State<AppState>) -> Response {
-    let cfg = state.notify.snapshot();
-    match crate::notify::send(
-        &cfg,
-        "OpenPXE test notification",
-        "If you're reading this, OpenPXE notifications are wired up correctly. \
-         This is a test from the Advanced settings tab.",
-    )
-    .await
-    {
-        Ok(()) => Json(json!({ "ok": true })).into_response(),
-        Err(e) => (StatusCode::BAD_GATEWAY, e).into_response(),
-    }
-}
-
-// ─── Update check (v0.5.0) ────────────────────────────────────────────────
-
-/// Query the project's Gitea releases API for the latest published tag
-/// and compare it to the running version. This is the only outbound
-/// call OpenPXE makes that isn't operator-initiated data movement, and
-/// it's strictly on-demand (the About tab's "Check for updates" button)
-/// — never a background poll, keeping the air-gapped promise intact.
-async fn api_updates_check() -> Response {
-    let current = env!("CARGO_PKG_VERSION");
-    let Some(api) = gitea_releases_api_url() else {
-        return Json(json!({
-            "current": current,
-            "error": "repository URL not configured at build time",
-        }))
-        .into_response();
-    };
-
-    let client = match reqwest::Client::builder()
-        .timeout(std::time::Duration::from_secs(8))
-        .user_agent(concat!("OpenPXE/", env!("CARGO_PKG_VERSION")))
-        .build()
-    {
-        Ok(c) => c,
-        Err(e) => {
-            return Json(json!({ "current": current, "error": format!("client: {e}") }))
-                .into_response();
-        }
-    };
-
-    match client.get(&api).send().await {
-        Ok(resp) if resp.status().is_success() => {
-            let body: serde_json::Value = resp.json().await.unwrap_or(json!({}));
-            let latest_tag = body
-                .get("tag_name")
-                .and_then(|v| v.as_str())
-                .unwrap_or("")
-                .to_string();
-            let html_url = body
-                .get("html_url")
-                .and_then(|v| v.as_str())
-                .unwrap_or("")
-                .to_string();
-            let update_available = version_is_newer(latest_tag.trim_start_matches('v'), current);
-            Json(json!({
-                "current": current,
-                "latest": latest_tag,
-                "update_available": update_available,
-                "html_url": html_url,
-            }))
-            .into_response()
-        }
-        Ok(resp) => Json(json!({
-            "current": current,
-            "error": format!("releases API returned HTTP {}", resp.status()),
-        }))
-        .into_response(),
-        Err(e) => Json(json!({
-            "current": current,
-            "error": format!("could not reach the releases API: {e}"),
-        }))
-        .into_response(),
-    }
-}
-
-/// Derive the Gitea `releases/latest` API URL from the compile-time
-/// repository URL (`https://host/owner/repo`).
-fn gitea_releases_api_url() -> Option<String> {
-    let repo = option_env!("CARGO_PKG_REPOSITORY").unwrap_or("");
-    let rest = repo
-        .strip_prefix("https://")
-        .or_else(|| repo.strip_prefix("http://"))?;
-    let mut parts = rest.trim_end_matches('/').splitn(3, '/');
-    let host = parts.next()?;
-    let owner = parts.next()?;
-    let name = parts.next()?;
-    if host.is_empty() || owner.is_empty() || name.is_empty() {
-        return None;
-    }
-    Some(format!(
-        "https://{host}/api/v1/repos/{owner}/{name}/releases/latest"
-    ))
-}
-
-/// Compare two dotted numeric versions; `true` when `latest` is strictly
-/// newer than `current`. Non-numeric / malformed parts compare as 0, so
-/// a garbage tag never falsely reports an update.
-fn version_is_newer(latest: &str, current: &str) -> bool {
-    fn parts(v: &str) -> Vec<u64> {
-        v.split('.')
-            .map(|p| {
-                p.chars()
-                    .take_while(char::is_ascii_digit)
-                    .collect::<String>()
-            })
-            .map(|s| s.parse::<u64>().unwrap_or(0))
-            .collect()
-    }
-    let (l, c) = (parts(latest), parts(current));
-    for i in 0..l.len().max(c.len()) {
-        let lv = l.get(i).copied().unwrap_or(0);
-        let cv = c.get(i).copied().unwrap_or(0);
-        if lv != cv {
-            return lv > cv;
-        }
-    }
-    false
-}
-
-/// Fire a notification on a detached task. Never blocks the caller and
-/// never surfaces an error — boot/WoL paths must not hinge on a webhook.
-fn spawn_notify(state: &AppState, subject: &str, body: &str) {
-    let cfg = state.notify.snapshot();
-    if !cfg.is_usable() {
-        return;
-    }
-    let subject = subject.to_string();
-    let body = body.to_string();
-    tokio::spawn(async move {
-        if let Err(e) = crate::notify::send(&cfg, &subject, &body).await {
-            tracing::warn!(target: "openpxe::notify", "notification send failed: {e}");
-        }
-    });
-}
-
 // ─── Boot event log ───────────────────────────────────────────────────────
 
 async fn api_boot_log(State(state): State<AppState>) -> Json<serde_json::Value> {
@@ -2293,21 +1733,9 @@ async fn api_metrics(State(state): State<AppState>) -> Response {
     state
         .metrics
         .set_queue_counts(queue_entries.len() as u64, imaging as u64);
-    // v0.4.67: gauge tracks reachable external-storage shares
-    // across both protocols (SMB userspace + NFSv3 in-process).
-    let smb_ok = state
-        .smb_shares
-        .list()
-        .iter()
-        .filter(|m| m.reachable)
-        .count();
-    let nfs_ok = state
-        .nfs_shares
-        .list()
-        .iter()
-        .filter(|m| m.reachable)
-        .count();
-    state.metrics.set_nfs_active((smb_ok + nfs_ok) as u64);
+    state
+        .metrics
+        .set_nfs_active(state.nfs.list().iter().filter(|m| m.mounted).count() as u64);
 
     let now = time::OffsetDateTime::now_utc();
     let uptime = (now - state.started_at).whole_seconds().max(0) as u64;
@@ -2326,28 +1754,6 @@ async fn api_metrics(State(state): State<AppState>) -> Response {
 mod tests {
     use super::*;
 
-    #[test]
-    fn version_newer_detects_updates() {
-        assert!(version_is_newer("0.5.1", "0.5.0"));
-        assert!(version_is_newer("0.6.0", "0.5.9"));
-        assert!(version_is_newer("1.0.0", "0.9.9"));
-        assert!(!version_is_newer("0.5.0", "0.5.0"));
-        assert!(!version_is_newer("0.4.69", "0.5.0"));
-        // A garbage / empty tag must never falsely report an update.
-        assert!(!version_is_newer("", "0.5.0"));
-        assert!(!version_is_newer("not-a-version", "0.5.0"));
-    }
-
-    #[test]
-    fn gitea_api_url_derives_from_repo() {
-        // The crate inherits the workspace `repository`, so
-        // CARGO_PKG_REPOSITORY is populated and the update check has a
-        // real URL to hit (regressed once when the inherit was missing).
-        let u = gitea_releases_api_url().expect("repository must be configured at build time");
-        assert!(u.contains("/api/v1/repos/"), "got: {u}");
-        assert!(u.ends_with("/releases/latest"), "got: {u}");
-    }
-
     #[test]
     fn range_full() {
         let (s, e, p) = parse_range(None, 1000).unwrap();

crates/http-api/src/auth.rs

@@ -140,16 +140,9 @@ fn cookie_attrs(value: &str, max_age: Option<i64>) -> String {
     // never overflow i64, but clippy's `cast_possible_wrap` lint wants
     // us to be explicit. `cast_signed` is the documented form.
     let lifetime = max_age.unwrap_or_else(|| SESSION_TTL.as_secs().cast_signed());
-    format!("{SESSION_COOKIE}={value}; Path=/; HttpOnly; SameSite=Lax; Max-Age={lifetime}")
-}
-
-/// Build the `Set-Cookie` header value that establishes a fresh operator
-/// session with the default 24h TTL. Exposed so the SAML ACS handler can
-/// attach an operator session to its post-login redirect, exactly as the
-/// Forms-login path does via [`login_response`].
-#[must_use]
-pub fn session_cookie(session: &str) -> String {
-    cookie_attrs(session, None)
+    format!(
+        "{SESSION_COOKIE}={value}; Path=/; HttpOnly; SameSite=Lax; Max-Age={lifetime}"
+    )
 }
 
 fn parse_cookie(headers: &axum::http::HeaderMap) -> Option<String> {
@@ -176,18 +169,9 @@ fn is_public_path(path: &str) -> bool {
         return true;
     }
     // Auth surface and iPXE long-poll endpoints (no cookie available).
-    // The SAML SP endpoints are pre-auth by nature — the operator hasn't a
-    // session yet when they start (or arrive from) the IdP. `/api/sso`
-    // (the config GET/PUT, no trailing slash) stays gated.
     matches!(
         path,
-        "/api/setup"
-            | "/api/login"
-            | "/api/logout"
-            | "/api/me"
-            | "/api/sso/login"
-            | "/api/sso/acs"
-            | "/api/sso/metadata"
+        "/api/setup" | "/api/login" | "/api/logout" | "/api/me"
     ) || path.starts_with("/api/queue/join")
         || path.starts_with("/api/queue/poll/")
 }
@@ -238,7 +222,10 @@ pub struct SetupBody {
 /// guards against a leaked WebUI being re-bootstrapped by an attacker
 /// who's seen the deployment URL. After bootstrap, the new session
 /// cookie is set so the operator goes straight to the dashboard.
-pub async fn api_setup(State(state): State<AppState>, Json(body): Json<SetupBody>) -> Response {
+pub async fn api_setup(
+    State(state): State<AppState>,
+    Json(body): Json<SetupBody>,
+) -> Response {
     if state.admin.is_configured() {
         return (
             StatusCode::CONFLICT,
@@ -293,7 +280,10 @@ pub async fn api_login(State(state): State<AppState>, Json(body): Json<LoginBody
     login_response(StatusCode::OK, &pub_, &session)
 }
 
-pub async fn api_logout(State(state): State<AppState>, headers: axum::http::HeaderMap) -> Response {
+pub async fn api_logout(
+    State(state): State<AppState>,
+    headers: axum::http::HeaderMap,
+) -> Response {
     if let Some(t) = parse_cookie(&headers) {
         state.sessions.revoke(&t);
     }
@@ -313,20 +303,12 @@ pub async fn api_logout(State(state): State<AppState>, headers: axum::http::Head
 /// * `authenticated: false` — admin exists, no session; show login.
 /// * `authenticated: true` + `user` — let the dashboard load.
 pub async fn api_me(State(state): State<AppState>, headers: axum::http::HeaderMap) -> Response {
-    // v0.5.0: include branding bootstrap so the pre-auth login/setup
-    // screens can render the FleetDM-style full-width custom logo (and
-    // cache-bust it) without an extra round trip. `/api/me` is public,
-    // and the logo asset is public, so this leaks nothing sensitive.
-    let has_custom_logo = state.branding.has_logo();
-    let logo_rev = state.branding.logo_rev();
     if !state.admin.is_configured() {
         return (
             StatusCode::OK,
             Json(json!({
                 "setup_required": true,
                 "authenticated": false,
-                "has_custom_logo": has_custom_logo,
-                "logo_rev": logo_rev,
             })),
         )
             .into_response();
@@ -341,8 +323,6 @@ pub async fn api_me(State(state): State<AppState>, headers: axum::http::HeaderMa
                 "authenticated": true,
                 "user": state.admin.snapshot(),
                 "session_user": u,
-                "has_custom_logo": has_custom_logo,
-                "logo_rev": logo_rev,
             })),
         )
             .into_response(),
@@ -351,8 +331,6 @@ pub async fn api_me(State(state): State<AppState>, headers: axum::http::HeaderMa
             Json(json!({
                 "setup_required": false,
                 "authenticated": false,
-                "has_custom_logo": has_custom_logo,
-                "logo_rev": logo_rev,
             })),
         )
             .into_response(),
@@ -459,18 +437,9 @@ mod tests {
     fn public_path_allowlist() {
         // PXE + chrome paths bypass auth.
         for p in [
-            "/",
-            "/assets/app.js",
-            "/boot.ipxe",
-            "/boot/fake.ipxe",
-            "/iso/fake.iso",
-            "/ipxe/snponly.efi",
-            "/healthz",
-            "/readyz",
+            "/", "/assets/app.js", "/boot.ipxe", "/boot/fake.ipxe",
+            "/iso/fake.iso", "/ipxe/snponly.efi", "/healthz", "/readyz",
             "/metrics",
-            // v0.4.6: iPXE fetches this for `console --picture` before
-            // it can possibly have a session cookie.
-            "/branding/pxe-logo",
         ] {
             assert!(is_public_path(p), "expected {p} to be public");
         }
@@ -478,10 +447,6 @@ mod tests {
         for p in ["/api/setup", "/api/login", "/api/logout", "/api/me"] {
             assert!(is_public_path(p), "expected {p} to be public");
         }
-        // v0.5.1: SAML SP endpoints are pre-auth (no session yet).
-        for p in ["/api/sso/login", "/api/sso/acs", "/api/sso/metadata"] {
-            assert!(is_public_path(p), "expected {p} to be public");
-        }
         // iPXE long-poll endpoints are public (no cookie available).
         assert!(is_public_path("/api/queue/join"));
         assert!(is_public_path("/api/queue/poll/abc"));
@@ -503,7 +468,8 @@ mod tests {
         let mut h = axum::http::HeaderMap::new();
         h.insert(
             header::COOKIE,
-            HeaderValue::from_str(&format!("foo=bar; {SESSION_COOKIE}=abc123; baz=qux")).unwrap(),
+            HeaderValue::from_str(&format!("foo=bar; {SESSION_COOKIE}=abc123; baz=qux"))
+                .unwrap(),
         );
         assert_eq!(parse_cookie(&h).as_deref(), Some("abc123"));
         // Different name → None.

crates/http-api/src/ipxe_script.rs

@@ -29,16 +29,6 @@ use std::fmt::Write as _;
 
 /// Top-level OpenPXE boot menu. Serialized identically for BIOS and UEFI
 /// clients because iPXE normalises the menu primitives across firmwares.
-///
-/// v0.4.69: rendered with an iVentoy-style graphical frame — a
-/// `console --picture` directive paints a full-screen PNG background
-/// (the operator's uploaded logo on a dark field, or the default
-/// OpenPXE mark) with the menu text overlaid below a reserved top
-/// margin, plus a footer carrying version + arch + firmware kind. On
-/// iPXE binaries built with `IMAGE_PNG` + `CONSOLE_FRAMEBUFFER` (our
-/// x86_64 UEFI binaries, compiled from source) the background paints;
-/// on binaries without PNG support the `|| console` fallback yields a
-/// clean text menu. The old ASCII wordmark has been removed.
 #[must_use]
 pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> String {
     let mut s = String::new();
@@ -57,36 +47,8 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
     let _ = writeln!(s, "set base-url {base}");
     let _ = writeln!(s, "set esc:hex 1b");
     let _ = writeln!(s, "set cls ${{esc:string}}[2J");
-    // v0.4.69: graphical background. `/branding/pxe-logo` always
-    // returns a full-screen 1024×768 PNG now — the operator's logo on a
-    // dark field, or a default OpenPXE mark when none is uploaded. The
-    // `--top 290` reserves the top band (where the logo paints) so the
-    // menu text lands below it. On an iPXE build *with* `IMAGE_PNG` +
-    // `CONSOLE_FRAMEBUFFER` (our x86_64 UEFI binaries, built from source
-    // — see deploy/docker/Dockerfile) this paints the background and
-    // overlays the menu. On a build *without* PNG support (the fetched
-    // BIOS/i386/arm64 binaries) the whole `console --picture …` command
-    // fails and the `|| console` resets to a clean full-screen text
-    // menu. Either way there's no ASCII placeholder anymore.
-    let _ = writeln!(
-        s,
-        "console --picture {base}/branding/pxe-logo --top 290 || console"
-    );
-    // Map iPXE's ${{buildarch}} + ${{platform}} into the human form the
-    // user asked for (e.g. "x86 BIOS", "x86_64 UEFI", "arm64 UEFI").
-    // iPXE evaluates `iseq` lazily, so we only set whichever line
-    // matches. Anything not on the allowlist falls through to a generic
-    // `<buildarch> <platform>` display.
-    let _ = writeln!(s, "set arch-label ${{buildarch}} ${{platform}}");
-    let _ = writeln!(
-        s,
-        "iseq ${{buildarch}} i386   && iseq ${{platform}} pcbios && set arch-label x86 BIOS         || iseq ${{buildarch}} x86_64 && iseq ${{platform}} efi    && set arch-label x86_64 UEFI      || iseq ${{buildarch}} arm64  && iseq ${{platform}} efi    && set arch-label arm64 UEFI       || true"
-    );
     let _ = writeln!(s, ":menu");
     let _ = writeln!(s, "menu OpenPXE - network boot menu");
-    // v0.4.69: the ASCII wordmark is gone — the graphical background
-    // (set via `console --picture` above) carries the branding now.
-    let _ = writeln!(s, "item --gap");
     let _ = writeln!(
         s,
         "item --gap -- ------------------------- Default -------------------------"
@@ -120,18 +82,6 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
     let _ = writeln!(s, "item queue            Queued Deployment  (join queue)");
     let _ = writeln!(s, "item --gap");
     let _ = writeln!(s, "item --key x exit     Exit iPXE");
-    // v0.4.6 footer line. Sits just above the `choose` line so it's
-    // always visible regardless of how the menu paginates. iPXE
-    // interpolates `${arch-label}` (set near the top of this script)
-    // and `${version}` is the binary-baked iPXE version — *not* the
-    // OpenPXE version — so we hard-code the OpenPXE version string
-    // here.
-    let openpxe_version = env!("CARGO_PKG_VERSION");
-    let _ = writeln!(s, "item --gap");
-    let _ = writeln!(
-        s,
-        "item --gap --                 OpenPXE v{openpxe_version}  -  ${{arch-label}}"
-    );
 
     if matches!(settings.timeout_action, TimeoutAction::Stay) {
         let _ = writeln!(s, "choose --default {default_item} target || goto menu");
@@ -625,55 +575,6 @@ mod password_tests {
         assert!(s.contains("chain http://10.0.0.5/boot/alpha-linux.ipxe"));
     }
 
-    #[test]
-    fn top_menu_has_polished_branding_and_arch_footer() {
-        // v0.4.69: the menu emits a `console --picture` line that paints
-        // a full-screen PNG background (the operator's logo, or the
-        // default OpenPXE mark) reserving a top margin for it, then
-        // falls back to a clean text console on iPXE builds without PNG
-        // support. The ASCII wordmark is gone — the graphical
-        // background carries the branding now. A single-line footer
-        // still carries the OpenPXE version + arch.
-        let settings = Settings::default();
-        let s = render_menu(&[], &settings, "http://10.0.0.5");
-        assert!(
-            s.contains("console --picture http://10.0.0.5/branding/pxe-logo"),
-            "missing console --picture line:\n{s}"
-        );
-        // The picture call reserves a top margin for the logo band.
-        assert!(s.contains("--top 290"), "missing --top margin:\n{s}");
-        // Picture-or-text-console must be a single statement so older
-        // iPXE parsers don't choke on the chain.
-        assert!(s.contains("|| console"), "missing graceful fallback:\n{s}");
-        // The ASCII wordmark must be GONE — its removal is the whole
-        // point of v0.4.69's graphical background.
-        assert!(
-            !s.contains("___                   ___  __  __ ___"),
-            "ASCII banner should have been removed:\n{s}"
-        );
-        // Footer with version + arch interpolation. The version comes
-        // from CARGO_PKG_VERSION at compile time.
-        let version = env!("CARGO_PKG_VERSION");
-        assert!(
-            s.contains(&format!("OpenPXE v{version}")),
-            "footer missing OpenPXE version:\n{s}"
-        );
-        assert!(
-            s.contains("${arch-label}"),
-            "footer missing arch-label interpolation:\n{s}"
-        );
-        // No website URL — the design brief calls that out as tacky.
-        assert!(
-            !s.to_ascii_lowercase().contains("openpxe.com"),
-            "footer should not advertise the website:\n{s}"
-        );
-        // Arch-label mapping covers the three labels from the brief:
-        // "x86 BIOS", "x86_64 UEFI", "arm64 UEFI".
-        assert!(s.contains("x86 BIOS"), "{s}");
-        assert!(s.contains("x86_64 UEFI"), "{s}");
-        assert!(s.contains("arm64 UEFI"), "{s}");
-    }
-
     #[test]
     fn generated_scripts_do_not_emit_bare_or_trailing_fallbacks() {
         let settings = Settings::default();

crates/http-api/src/lib.rs

@@ -18,8 +18,6 @@ pub mod auth;
 pub mod ipxe_script;
 pub mod iso_fs;
 pub mod log_stream;
-pub mod notify;
-pub mod saml_routes;
 pub mod state;
 pub mod terminal;
 pub mod uploads;

crates/http-api/src/notify.rs

@@ -1,138 +0,0 @@
-//! Notification *delivery* — the network half of the notify feature.
-//!
-//! `openpxe_core::notify` owns the config + persistence; this module
-//! turns a `NotifyConfig` + a message into an actual delivery:
-//!
-//!   - Slack / Discord / Teams → HTTP POST of a provider-shaped JSON
-//!     body to the operator's incoming-webhook URL (via `reqwest`).
-//!   - SMTP → a TLS email via `lettre`.
-//!
-//! Every send is best-effort and time-bounded: a flaky webhook must
-//! never wedge a PXE boot. Callers fire these from a detached task.
-
-use openpxe_core::{NotifyConfig, NotifyKind};
-use std::time::Duration;
-
-/// Hard ceiling on any single delivery so a hung endpoint can't pin a
-/// task forever.
-const SEND_TIMEOUT: Duration = Duration::from_secs(10);
-
-/// Deliver `body` (with an optional `subject`, used as the email
-/// subject / chat bold-line) using the active provider in `cfg`.
-/// Returns `Ok(())` on success, or a human-readable error suitable for
-/// surfacing in the "Send test" response.
-pub async fn send(cfg: &NotifyConfig, subject: &str, body: &str) -> Result<(), String> {
-    if !cfg.is_usable() {
-        return Err("notifications are not enabled / fully configured".into());
-    }
-    match cfg.kind {
-        NotifyKind::Slack | NotifyKind::Discord | NotifyKind::Teams => {
-            send_webhook(cfg, subject, body).await
-        }
-        NotifyKind::Smtp => send_email(cfg, subject, body).await,
-    }
-}
-
-async fn send_webhook(cfg: &NotifyConfig, subject: &str, body: &str) -> Result<(), String> {
-    // Each chat platform wants a different JSON shape for an incoming
-    // webhook. Keep the bodies minimal and plain-text-ish so they
-    // render cleanly everywhere.
-    let combined = if subject.is_empty() {
-        body.to_string()
-    } else {
-        format!("*{subject}*\n{body}")
-    };
-    let payload = match cfg.kind {
-        NotifyKind::Slack => serde_json::json!({ "text": combined }),
-        NotifyKind::Discord => serde_json::json!({ "content": combined }),
-        NotifyKind::Teams => serde_json::json!({
-            // Legacy MessageCard — the format every Teams "Incoming
-            // Webhook" connector still accepts.
-            "@type": "MessageCard",
-            "@context": "https://schema.org/extensions",
-            "summary": if subject.is_empty() { "OpenPXE" } else { subject },
-            "title": subject,
-            "text": body,
-        }),
-        NotifyKind::Smtp => unreachable!("smtp handled separately"),
-    };
-
-    let client = reqwest::Client::builder()
-        .timeout(SEND_TIMEOUT)
-        .build()
-        .map_err(|e| format!("could not build HTTP client: {e}"))?;
-    let resp = client
-        .post(&cfg.webhook_url)
-        .json(&payload)
-        .send()
-        .await
-        .map_err(|e| format!("webhook POST failed: {e}"))?;
-    let status = resp.status();
-    if status.is_success() {
-        Ok(())
-    } else {
-        let snippet = resp
-            .text()
-            .await
-            .unwrap_or_default()
-            .chars()
-            .take(200)
-            .collect::<String>();
-        Err(format!("webhook returned HTTP {status}: {snippet}"))
-    }
-}
-
-async fn send_email(cfg: &NotifyConfig, subject: &str, body: &str) -> Result<(), String> {
-    use lettre::transport::smtp::authentication::Credentials;
-    use lettre::{AsyncSmtpTransport, AsyncTransport, Message, Tokio1Executor};
-
-    let from = if cfg.smtp_from.trim().is_empty() {
-        cfg.smtp_username.trim()
-    } else {
-        cfg.smtp_from.trim()
-    };
-    if from.is_empty() {
-        return Err("SMTP requires a From address (or a username to fall back to)".into());
-    }
-
-    let email = Message::builder()
-        .from(
-            from.parse()
-                .map_err(|e| format!("invalid From address '{from}': {e}"))?,
-        )
-        .to(cfg
-            .smtp_to
-            .trim()
-            .parse()
-            .map_err(|e| format!("invalid To address '{}': {e}", cfg.smtp_to))?)
-        .subject(if subject.is_empty() { "OpenPXE" } else { subject })
-        .body(body.to_string())
-        .map_err(|e| format!("could not build email: {e}"))?;
-
-    // Implicit TLS (465) vs STARTTLS (587). We never send plaintext.
-    let mut builder = if cfg.smtp_implicit_tls {
-        AsyncSmtpTransport::<Tokio1Executor>::relay(&cfg.smtp_host)
-            .map_err(|e| format!("SMTP relay setup failed: {e}"))?
-    } else {
-        AsyncSmtpTransport::<Tokio1Executor>::starttls_relay(&cfg.smtp_host)
-            .map_err(|e| format!("SMTP STARTTLS setup failed: {e}"))?
-    }
-    .port(cfg.smtp_port)
-    .timeout(Some(SEND_TIMEOUT));
-
-    // Auth is optional — some internal relays accept unauthenticated
-    // mail from trusted hosts. Only attach credentials when a username
-    // is set.
-    if !cfg.smtp_username.trim().is_empty() {
-        builder = builder.credentials(Credentials::new(
-            cfg.smtp_username.trim().to_string(),
-            cfg.smtp_password.clone(),
-        ));
-    }
-    let mailer = builder.build();
-    mailer
-        .send(email)
-        .await
-        .map(|_| ())
-        .map_err(|e| format!("SMTP send failed: {e}"))
-}

crates/http-api/src/saml_routes.rs

@@ -1,338 +0,0 @@
-//! SAML 2.0 Service Provider HTTP endpoints (v0.5.1).
-//!
-//! * `GET  /api/sso/login`    — SP-initiated: build an AuthnRequest, record its
-//!   ID, and 302 the browser to the IdP.
-//! * `POST /api/sso/acs`      — Assertion Consumer Service: verify + validate
-//!   the IdP's `SAMLResponse`, perform the stateful checks (InResponseTo
-//!   correlation, IdP-initiated gating, assertion replay), mint an operator
-//!   session, and 302 to the dashboard. (Mirrors FleetDM's `/sso/callback`.)
-//! * `GET  /api/sso/metadata` — serve our SP metadata XML for IdP import.
-//!
-//! Stateless crypto + semantic validation live in `openpxe_core::saml`; this
-//! module owns only the HTTP glue and the in-memory state the SP needs.
-
-use std::collections::HashMap;
-use std::sync::Arc;
-use std::time::{Duration as StdDuration, Instant};
-
-use axum::{
-    body::Body,
-    extract::{Form, Query, State},
-    http::{header, StatusCode},
-    response::{IntoResponse, Response},
-};
-use base64::Engine;
-use parking_lot::Mutex;
-use serde::Deserialize;
-use time::{Duration, OffsetDateTime};
-
-use openpxe_core::saml::{self, metadata::IdpMetadata, SamlError, SpParams};
-use openpxe_core::SsoConfig;
-
-use crate::auth;
-use crate::state::AppState;
-
-/// Outstanding AuthnRequest IDs live at most this long before a matching
-/// response is considered stale (covers a slow human at the IdP login form).
-const REQUEST_TTL: StdDuration = StdDuration::from_mins(10);
-/// How long we fetch-cache IdP metadata loaded from a URL.
-const METADATA_FETCH_TIMEOUT: StdDuration = StdDuration::from_secs(10);
-
-/// In-memory SAML runtime state. Cheap to clone (Arc-shared).
-#[derive(Clone, Default)]
-pub struct SamlRuntime {
-    /// request_id → issued_at. Correlates a response's `InResponseTo` to a
-    /// request *we* actually sent (replay / CSRF defense for SP-initiated).
-    outstanding: Arc<Mutex<HashMap<String, Instant>>>,
-    /// assertion_id → expiry. A consumed assertion may not be replayed.
-    consumed: Arc<Mutex<HashMap<String, Instant>>>,
-    /// Cache of IdP metadata fetched from a URL: (url, parsed).
-    metadata_cache: Arc<Mutex<Option<(String, IdpMetadata)>>>,
-}
-
-impl SamlRuntime {
-    /// Record an AuthnRequest we just sent.
-    pub fn register_request(&self, id: &str) {
-        let mut g = self.outstanding.lock();
-        prune(&mut g);
-        g.insert(id.to_owned(), Instant::now());
-    }
-
-    /// Consume an outstanding request ID, returning `true` if it was present
-    /// and still fresh. A miss means the response doesn't correlate to any
-    /// live request we issued.
-    pub fn take_request(&self, id: &str) -> bool {
-        let mut g = self.outstanding.lock();
-        prune(&mut g);
-        g.remove(id).is_some()
-    }
-
-    /// Record a consumed assertion. Returns `false` if it was already
-    /// consumed (a replay) — in which case the caller must reject.
-    pub fn record_assertion(&self, id: &str, expiry: OffsetDateTime) -> bool {
-        let mut g = self.consumed.lock();
-        prune(&mut g);
-        if g.contains_key(id) {
-            return false;
-        }
-        let ttl = (expiry - OffsetDateTime::now_utc())
-            .max(Duration::ZERO)
-            .unsigned_abs();
-        g.insert(id.to_owned(), Instant::now() + ttl);
-        true
-    }
-
-    fn cached_metadata(&self, url: &str) -> Option<IdpMetadata> {
-        let g = self.metadata_cache.lock();
-        match &*g {
-            Some((cached_url, md)) if cached_url == url => Some(md.clone()),
-            _ => None,
-        }
-    }
-
-    fn cache_metadata(&self, url: String, md: IdpMetadata) {
-        *self.metadata_cache.lock() = Some((url, md));
-    }
-}
-
-/// Drop expired entries so neither map grows unbounded.
-fn prune(map: &mut HashMap<String, Instant>) {
-    let now = Instant::now();
-    // For the request map this over-prunes (entries store issued_at, not
-    // expiry), so cap by REQUEST_TTL; the consumed map stores absolute
-    // expiry instants. Using saturating logic keeps both correct: request
-    // entries older than REQUEST_TTL go, consumed entries past expiry go.
-    map.retain(|_, &mut t| now.saturating_duration_since(t) < REQUEST_TTL || t > now);
-}
-
-// ─── GET /api/sso/login ───────────────────────────────────────────────────
-
-#[derive(Debug, Deserialize)]
-pub struct LoginQuery {
-    /// Optional local path to return to after login (becomes RelayState).
-    #[serde(default)]
-    pub next: Option<String>,
-}
-
-pub async fn sso_login(State(state): State<AppState>, Query(q): Query<LoginQuery>) -> Response {
-    let cfg = state.sso.snapshot();
-    if !cfg.is_usable() {
-        return redirect("/?sso_error=unavailable");
-    }
-    let idp = match resolve_idp_metadata(&state, &cfg).await {
-        Ok(m) => m,
-        Err(e) => {
-            tracing::warn!(target: "openpxe::saml", "sso_login: metadata unavailable: {e}");
-            return redirect("/?sso_error=metadata");
-        }
-    };
-    let Some(dest) = idp.sso_destination().map(str::to_owned) else {
-        tracing::warn!(target: "openpxe::saml", "sso_login: IdP metadata has no SSO endpoint");
-        return redirect("/?sso_error=metadata");
-    };
-    let sp = sp_params(&state, &cfg);
-    let relay = safe_local_path(q.next.as_deref());
-    match saml::authn_request::build(&sp, &dest, Some(&relay)) {
-        Ok(req) => {
-            state.saml.register_request(&req.id);
-            redirect(&req.location)
-        }
-        Err(e) => {
-            tracing::warn!(target: "openpxe::saml", "sso_login: build AuthnRequest failed: {e}");
-            redirect("/?sso_error=request")
-        }
-    }
-}
-
-// ─── POST /api/sso/acs ──────────────────────────────────────────────────────
-
-#[derive(Debug, Deserialize)]
-pub struct AcsForm {
-    #[serde(rename = "SAMLResponse")]
-    pub saml_response: String,
-    #[serde(rename = "RelayState", default)]
-    pub relay_state: Option<String>,
-}
-
-pub async fn sso_acs(State(state): State<AppState>, Form(form): Form<AcsForm>) -> Response {
-    let cfg = state.sso.snapshot();
-    if !cfg.is_usable() {
-        return redirect("/?sso_error=unavailable");
-    }
-    let xml = match base64::engine::general_purpose::STANDARD.decode(form.saml_response.as_bytes())
-    {
-        Ok(bytes) => String::from_utf8_lossy(&bytes).into_owned(),
-        Err(e) => {
-            tracing::warn!(target: "openpxe::saml", "acs: base64 decode failed: {e}");
-            return redirect("/?sso_error=1");
-        }
-    };
-    let idp = match resolve_idp_metadata(&state, &cfg).await {
-        Ok(m) => m,
-        Err(e) => {
-            tracing::warn!(target: "openpxe::saml", "acs: metadata unavailable: {e}");
-            return redirect("/?sso_error=metadata");
-        }
-    };
-    let sp = sp_params(&state, &cfg);
-
-    // Signature verification + semantic checks are CPU-bound — keep them off
-    // the async executor.
-    let now = OffsetDateTime::now_utc();
-    let skew = Duration::seconds(saml::DEFAULT_CLOCK_SKEW_SECS);
-    let verify = {
-        let xml = xml.clone();
-        let sp = sp.clone();
-        tokio::task::spawn_blocking(move || saml::response::consume(&xml, &sp, &idp, now, skew))
-            .await
-    };
-    let verified = match verify {
-        Ok(Ok(v)) => v,
-        Ok(Err(e)) => {
-            // Never leak which specific check failed to the browser.
-            tracing::warn!(target: "openpxe::saml", "acs: response rejected: {e}");
-            return redirect("/?sso_error=1");
-        }
-        Err(join) => {
-            tracing::error!(target: "openpxe::saml", "acs: verify task panicked: {join}");
-            return redirect("/?sso_error=1");
-        }
-    };
-
-    // Stateful checks the core deliberately left to us.
-    match &verified.in_response_to {
-        Some(id) => {
-            if !state.saml.take_request(id) {
-                tracing::warn!(target: "openpxe::saml", "acs: InResponseTo matches no live request");
-                return redirect("/?sso_error=1");
-            }
-        }
-        None => {
-            if !cfg.allow_idp_initiated {
-                tracing::warn!(target: "openpxe::saml", "acs: IdP-initiated login is disabled");
-                return redirect("/?sso_error=idp_initiated");
-            }
-        }
-    }
-    if !state
-        .saml
-        .record_assertion(&verified.assertion_id, verified.assertion_expiry)
-    {
-        tracing::warn!(target: "openpxe::saml", "acs: assertion replay rejected");
-        return redirect("/?sso_error=1");
-    }
-
-    // Success → mint an operator session keyed to the verified email.
-    let session = state.sessions.create(&verified.principal.email);
-    tracing::info!(
-        target: "openpxe::saml",
-        email = %verified.principal.email,
-        idp_initiated = verified.in_response_to.is_none(),
-        "SAML SSO sign-in"
-    );
-    // safe_local_path already maps None / unsafe values to "/".
-    let relay = safe_local_path(form.relay_state.as_deref());
-    redirect_with_session(&relay, &session)
-}
-
-// ─── GET /api/sso/metadata ──────────────────────────────────────────────────
-
-pub async fn sso_metadata(State(state): State<AppState>) -> Response {
-    let cfg = state.sso.snapshot();
-    let sp = sp_params(&state, &cfg);
-    let xml = saml::metadata::build_sp_metadata(&sp);
-    (
-        StatusCode::OK,
-        [(header::CONTENT_TYPE, "application/samlmetadata+xml")],
-        xml,
-    )
-        .into_response()
-}
-
-// ─── helpers ────────────────────────────────────────────────────────────────
-
-/// Derive runtime SP parameters from config + the advertised public base URL.
-fn sp_params(state: &AppState, cfg: &SsoConfig) -> SpParams {
-    let base = state.public_base_url.trim_end_matches('/');
-    let entity_id = if cfg.entity_id.trim().is_empty() {
-        base.to_owned()
-    } else {
-        cfg.entity_id.trim().to_owned()
-    };
-    SpParams {
-        entity_id,
-        acs_url: format!("{base}/api/sso/acs"),
-    }
-}
-
-/// Resolve the IdP metadata: prefer the metadata URL (fetched + cached) per
-/// the "URL wins" rule, else parse the pasted XML.
-async fn resolve_idp_metadata(state: &AppState, cfg: &SsoConfig) -> Result<IdpMetadata, SamlError> {
-    let url = cfg.metadata_url.trim();
-    if !url.is_empty() {
-        if let Some(md) = state.saml.cached_metadata(url) {
-            return Ok(md);
-        }
-        let body = fetch_metadata(url).await?;
-        let md = IdpMetadata::parse(&body)?;
-        state.saml.cache_metadata(url.to_owned(), md.clone());
-        return Ok(md);
-    }
-    if !cfg.metadata.trim().is_empty() {
-        return IdpMetadata::parse(&cfg.metadata);
-    }
-    Err(SamlError::Metadata("no metadata source configured".into()))
-}
-
-async fn fetch_metadata(url: &str) -> Result<String, SamlError> {
-    let client = reqwest::Client::builder()
-        .timeout(METADATA_FETCH_TIMEOUT)
-        .build()
-        .map_err(|e| SamlError::Metadata(format!("http client: {e}")))?;
-    let resp = client
-        .get(url)
-        .send()
-        .await
-        .map_err(|e| SamlError::Metadata(format!("fetch {url}: {e}")))?;
-    if !resp.status().is_success() {
-        return Err(SamlError::Metadata(format!(
-            "fetch {url}: HTTP {}",
-            resp.status()
-        )));
-    }
-    resp.text()
-        .await
-        .map_err(|e| SamlError::Metadata(format!("read {url}: {e}")))
-}
-
-/// Only permit a same-site path (single leading slash) as a redirect target —
-/// blocks open-redirect / protocol-relative (`//evil.com`) abuse of RelayState.
-fn safe_local_path(p: Option<&str>) -> String {
-    match p {
-        Some(p) if p.starts_with('/') && !p.starts_with("//") => p.to_owned(),
-        _ => "/".to_owned(),
-    }
-}
-
-fn redirect(location: &str) -> Response {
-    Response::builder()
-        .status(StatusCode::FOUND)
-        .header(header::LOCATION, location)
-        .body(Body::empty())
-        .map_or_else(
-            |_| StatusCode::INTERNAL_SERVER_ERROR.into_response(),
-            IntoResponse::into_response,
-        )
-}
-
-fn redirect_with_session(location: &str, session: &str) -> Response {
-    Response::builder()
-        .status(StatusCode::FOUND)
-        .header(header::LOCATION, location)
-        .header(header::SET_COOKIE, auth::session_cookie(session))
-        .body(Body::empty())
-        .map_or_else(
-            |_| StatusCode::INTERNAL_SERVER_ERROR.into_response(),
-            IntoResponse::into_response,
-        )
-}

crates/http-api/src/state.rs

@@ -1,11 +1,10 @@
-use crate::auth::SessionStore;
-use crate::saml_routes::SamlRuntime;
 use crate::uploads::UploadSessions;
+use crate::auth::SessionStore;
 use openpxe_core::{
     AdminStore, BootLog, BrandingStore, ClientRegistry, DeploymentQueue, HostBindings, LogBus,
-    Metrics, NotifyStore, SettingsStore, SsoStore,
+    Metrics, SettingsStore, SsoStore,
 };
-use openpxe_iso_store::{IsoStore, NfsShareManager, SmbManager, SmbShareManager};
+use openpxe_iso_store::{IsoStore, NfsManager, SmbManager};
 use std::sync::Arc;
 use time::OffsetDateTime;
 
@@ -35,17 +34,9 @@ pub struct AppState {
     /// process restart (sessions are tied to UI state, not persisted —
     /// matches Sonarr/Radarr behaviour).
     pub sessions: SessionStore,
-    /// SAML SSO configuration (persisted IdP metadata, Entity ID, toggles).
+    /// SAML SSO configuration. v0.4.5 stores it; the actual SSO login
+    /// flow ships in a later release.
     pub sso: SsoStore,
-    /// v0.5.1: in-memory SAML runtime state — outstanding AuthnRequest IDs
-    /// (for InResponseTo correlation), consumed-assertion replay guard, and
-    /// a cache of fetched IdP metadata. Tied to process lifetime, like
-    /// `sessions`; a restart simply invalidates any in-flight SSO login.
-    pub saml: SamlRuntime,
-    /// v0.5.0: webhook / email notification config (Slack/Teams/Discord/
-    /// SMTP). Drives the fire-and-forget pings on boot events and powers
-    /// the Advanced tab's config + "Send test" button.
-    pub notify: NotifyStore,
     /// Lock-free metrics counters surfaced at `/metrics` in Prometheus
     /// text format. Cheap to clone (handles to atomics).
     pub metrics: Metrics,
@@ -53,20 +44,11 @@ pub struct AppState {
     /// `smb_dir` at startup; `None` in pure-Linux-only deployments where
     /// Windows support is not wired in. Settings toggle drives start/stop.
     pub smb: Option<Arc<SmbManager>>,
-    /// v0.4.65: SMB share manager — userspace consumer of remote SMB
-    /// shares via Samba's `smbclient` CLI. Replaces the kernel-mount
-    /// NFS path that v0.4.64 shipped; that path didn't work on hosts
-    /// (Unraid, etc.) whose kernel ships without the nfs/cifs client
-    /// modules, and no container-side configuration could fix it.
-    /// `smbclient` does the SMB protocol over a plain TCP socket in
-    /// userspace — works in any container, no special caps required.
-    pub smb_shares: SmbShareManager,
-    /// v0.4.67: NFSv3 share manager — pure-Rust userspace consumer
-    /// via the `nfs3_client` crate. Ships alongside the SMB manager
-    /// so operators pick whichever protocol their NAS prefers.
-    /// In-process (no subprocess); supports HTTP Range requests on
-    /// NFS-sourced ISOs because NFSv3 READ3 takes an explicit offset.
-    pub nfs_shares: NfsShareManager,
+    /// NFS share manager. Always present (mounting is opt-in by the
+    /// operator from the Storage tab); `add()` requires `mount.nfs` to be
+    /// available in the runtime image. Surfaces errors per-mount rather
+    /// than failing the global state.
+    pub nfs: NfsManager,
     /// Browser chunked upload state. Multipart uploads still go straight
     /// through `IsoStore`, but the UI uses sessions so large ISO transfers
     /// can show deterministic progress and leave visible partial files.

crates/http-api/src/terminal.rs

@@ -88,14 +88,8 @@ async fn dispatch(state: &AppState, argv: &[String]) -> Result<String, String> {
         "isos" | "images" => Ok(isos_text(state)),
         "clients" => Ok(clients_text(state)),
         "queue" => queue_command(state, tail).await,
-        // `smb` controls the outbound Samba server for Windows
-        // install media. `share` lists/manages remote SMB shares
-        // OpenPXE pulls ISOs from (v0.4.65). `nfs` is the parallel
-        // command for remote NFSv3 shares (v0.4.67, in-process via
-        // nfs3_client — not the v0.4.64 kernel-mount path).
-        "share" | "smb-share" => smb_share_command(state, tail).await,
+        "nfs" => nfs_command(state, tail).await,
         "smb" => smb_command(state, tail).await,
-        "nfs" => nfs_share_command(state, tail).await,
         "log" => log_command(state, tail),
         "whoami" => Ok("operator".to_string()),
         "echo" => Ok(tail.join(" ")),
@@ -113,22 +107,18 @@ fn status_text(s: &AppState) -> String {
     let clients = s.clients.list();
     let queue_entries = s.queue.list();
     let smb = s.smb.as_ref().map(|m| m.snapshot());
-    let smb_shares = s.smb_shares.list();
-    let smb_reachable = smb_shares.iter().filter(|m| m.reachable).count();
-    // v0.4.67: NFSv3 sources too.
-    let nfs_shares = s.nfs_shares.list();
-    let nfs_reachable = nfs_shares.iter().filter(|m| m.reachable).count();
+    let nfs = s.nfs.list();
+    let nfs_active = nfs.iter().filter(|m| m.mounted).count();
     format!(
         "OpenPXE {ver}\n\
          base url:     {base}\n\
          interface:    {nic}\n\
          uptime:       {up}\n\
-         isos:         {n_isos}  (local: {n_local}, smb: {n_smb}, nfs: {n_nfs})\n\
+         isos:         {n_isos}  (local: {n_local}, nfs: {n_nfs})\n\
          clients:      {n_clients}\n\
          queue:        {n_entries}\n\
-         smb server:   {smb}\n\
-         smb shares:   {n_smb_total} configured ({n_smb_active} reachable)\n\
-         nfs shares:   {n_nfs_total} configured ({n_nfs_active} reachable)\n",
+         smb:          {smb}\n\
+         nfs mounts:   {n_total} configured ({n_active} active)\n",
         ver = env!("CARGO_PKG_VERSION"),
         base = s.public_base_url,
         nic = if s.nic_name.is_empty() {
@@ -142,21 +132,15 @@ fn status_text(s: &AppState) -> String {
             .iter()
             .filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Local))
             .count(),
-        n_smb = isos
-            .iter()
-            .filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Smb { .. }))
-            .count(),
         n_nfs = isos
             .iter()
-            .filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Nfs { .. }))
+            .filter(|i| !matches!(i.source, openpxe_iso_store::IsoSource::Local))
             .count(),
         n_clients = clients.len(),
         n_entries = queue_entries.len(),
         smb = smb.map_or_else(|| "(disabled)".into(), |s| format!("{s:?}")),
-        n_smb_total = smb_shares.len(),
-        n_smb_active = smb_reachable,
-        n_nfs_total = nfs_shares.len(),
-        n_nfs_active = nfs_reachable,
+        n_total = nfs.len(),
+        n_active = nfs_active,
     )
 }
 
@@ -174,9 +158,7 @@ fn isos_text(s: &AppState) -> String {
     for i in isos {
         let src = match i.source {
             openpxe_iso_store::IsoSource::Local => "local".to_string(),
-            openpxe_iso_store::IsoSource::Smb { share_id, .. } => format!("smb:{share_id}"),
-            // v0.4.67: NFSv3 via in-process nfs3_client.
-            openpxe_iso_store::IsoSource::Nfs { share_id, .. } => format!("nfs:{share_id}"),
+            openpxe_iso_store::IsoSource::Nfs { mount_id, .. } => format!("nfs:{mount_id}"),
         };
         let _ = writeln!(
             out,
@@ -282,136 +264,31 @@ async fn queue_command(s: &AppState, args: &[String]) -> Result<String, String>
     }
 }
 
-// ── share (v0.4.65: SMB shares) ─────────────────────────────────────────
+// ── nfs ────────────────────────────────────────────────────────────────
 
-async fn smb_share_command(s: &AppState, args: &[String]) -> Result<String, String> {
+async fn nfs_command(s: &AppState, args: &[String]) -> Result<String, String> {
     match args.first().map(String::as_str) {
         None | Some("list") => {
-            let shares = s.smb_shares.list();
-            if shares.is_empty() {
-                return Ok("(no SMB shares configured)".into());
+            let mounts = s.nfs.list();
+            if mounts.is_empty() {
+                return Ok("(no NFS mounts configured)".into());
             }
             let mut out = String::new();
             let _ = writeln!(
                 out,
-                "{:<24} {:<7} {:<6} {:<6} TARGET",
-                "ID", "STATUS", "AUTH", "ISOS"
+                "{:<24} {:<6} {:<7} {:<6} TARGET",
+                "ID", "VER", "STATUS", "ISOS"
             );
-            for m in shares {
-                let status = if m.reachable { "ok" } else { "down" };
-                let auth = if m.guest { "guest" } else { "user" };
+            for m in mounts {
+                let status = if m.mounted { "ok" } else { "down" };
                 let _ = writeln!(
                     out,
-                    "{:<24} {:<7} {:<6} {:<6} //{}/{}",
-                    truncate(&m.id, 24),
-                    status,
-                    auth,
-                    m.iso_count,
-                    m.server,
-                    m.share,
-                );
-                if let Some(e) = m.last_error {
-                    let _ = writeln!(out, "    error: {e}");
-                }
-                if let Some(h) = m.last_hint {
-                    let _ = writeln!(out, "    hint:  {h}");
-                }
-            }
-            Ok(out)
-        }
-        Some("add") => {
-            // share add //server/share [guest|user:password]
-            let target = args
-                .get(1)
-                .ok_or_else(|| {
-                    "usage: share add //server/share [guest|user:password]".to_string()
-                })?;
-            // Accept either `//server/share` (UNC-style) or
-            // `server:share` (shorter to type).
-            let stripped = target.trim_start_matches('/').trim_start_matches('\\');
-            let (server, share) = if let Some((s, p)) = stripped.split_once('/') {
-                (s, p)
-            } else if let Some((s, p)) = stripped.split_once(':') {
-                (s, p)
-            } else {
-                return Err("target must be '//server/share' or 'server:share'".into());
-            };
-
-            // Auth spec: "guest" or "user:password". Default: guest.
-            let auth = args.get(2).cloned().unwrap_or_else(|| "guest".into());
-            let (guest, username, password) = if auth == "guest" {
-                (true, None, None)
-            } else if let Some((u, p)) = auth.split_once(':') {
-                (false, Some(u.to_string()), Some(p.to_string()))
-            } else {
-                return Err("auth must be 'guest' or 'user:password'".into());
-            };
-
-            let req = openpxe_iso_store::SmbAddRequest {
-                server: server.to_string(),
-                share: share.to_string(),
-                username,
-                password,
-                guest,
-                port: None,
-            };
-            match s.smb_shares.add(req).await {
-                Ok(m) => Ok(format!("added {} ({} isos)", m.id, m.iso_count)),
-                Err(e) => {
-                    let mut out = format!("add failed: {}", e.error);
-                    if let Some(h) = e.hint {
-                        out.push_str("\nhint: ");
-                        out.push_str(&h);
-                    }
-                    Err(out)
-                }
-            }
-        }
-        Some("remove") => {
-            let id = args
-                .get(1)
-                .ok_or_else(|| "usage: share remove <id>".to_string())?;
-            match s.smb_shares.remove(id).await {
-                Ok(()) => Ok(format!("removed {id}")),
-                Err(e) => Err(format!("remove failed: {e}")),
-            }
-        }
-        Some("scan") => {
-            let id = args
-                .get(1)
-                .ok_or_else(|| "usage: share scan <id>".to_string())?;
-            match s.smb_shares.rescan(id).await {
-                Ok(n) => Ok(format!("re-scanned {id}: {n} isos")),
-                Err(e) => Err(format!("scan failed: {e}")),
-            }
-        }
-        Some(other) => Err(format!(
-            "unknown share subcommand: {other}\ntry: share [list|add|remove|scan]"
-        )),
-    }
-}
-
-// ── nfs (v0.4.67: in-process NFSv3 via nfs3_client) ────────────────────
-
-async fn nfs_share_command(s: &AppState, args: &[String]) -> Result<String, String> {
-    match args.first().map(String::as_str) {
-        None | Some("list") => {
-            let shares = s.nfs_shares.list();
-            if shares.is_empty() {
-                return Ok("(no NFS shares configured)".into());
-            }
-            let mut out = String::new();
-            let _ = writeln!(
-                out,
-                "{:<24} {:<7} {:<6} TARGET",
-                "ID", "STATUS", "ISOS"
-            );
-            for m in shares {
-                let status = if m.reachable { "ok" } else { "down" };
-                let _ = writeln!(
-                    out,
-                    "{:<24} {:<7} {:<6} {}:{}",
+                    "{:<24} {:<6} {:<7} {:<6} {}:{}",
                     truncate(&m.id, 24),
+                    match m.version {
+                        openpxe_iso_store::NfsVersion::V3 => "v3",
+                        openpxe_iso_store::NfsVersion::V41 => "v4.1",
+                    },
                     status,
                     m.iso_count,
                     m.server,
@@ -420,58 +297,56 @@ async fn nfs_share_command(s: &AppState, args: &[String]) -> Result<String, Stri
                 if let Some(e) = m.last_error {
                     let _ = writeln!(out, "    error: {e}");
                 }
-                if let Some(h) = m.last_hint {
-                    let _ = writeln!(out, "    hint:  {h}");
-                }
             }
             Ok(out)
         }
-        Some("add") => {
-            // nfs add <server>:<export> [port]
+        Some("mount") => {
+            // nfs mount <server>:<export> [v3|v41] [ro|rw]
             let target = args
                 .get(1)
-                .ok_or_else(|| "usage: nfs add <server>:<export> [port]".to_string())?;
+                .ok_or_else(|| "usage: nfs mount <server>:<export> [v3|v41] [ro|rw]".to_string())?;
             let (server, export) = target
                 .split_once(':')
                 .ok_or_else(|| "target must be 'server:/export'".to_string())?;
-            let port = args.get(2).and_then(|s| s.parse::<u16>().ok());
+            let version = match args.get(2).map(String::as_str) {
+                Some("v3") => openpxe_iso_store::NfsVersion::V3,
+                Some("v41") | None => openpxe_iso_store::NfsVersion::V41,
+                Some(other) => {
+                    return Err(format!("unknown nfs version: {other} (expect v3 or v41)"))
+                }
+            };
+            let read_only = !matches!(args.get(3).map(String::as_str), Some("rw"));
             let req = openpxe_iso_store::NfsAddRequest {
                 server: server.to_string(),
                 export: export.to_string(),
-                port,
+                version,
+                read_only,
             };
-            match s.nfs_shares.add(req).await {
-                Ok(m) => Ok(format!("added {} ({} isos)", m.id, m.iso_count)),
-                Err(e) => {
-                    let mut out = format!("add failed: {}", e.error);
-                    if let Some(h) = e.hint {
-                        out.push_str("\nhint: ");
-                        out.push_str(&h);
-                    }
-                    Err(out)
-                }
+            match s.nfs.add(req).await {
+                Ok(m) => Ok(format!("mounted {} ({} isos)", m.id, m.iso_count)),
+                Err(e) => Err(format!("mount failed: {e}")),
             }
         }
-        Some("remove") => {
+        Some("unmount") => {
             let id = args
                 .get(1)
-                .ok_or_else(|| "usage: nfs remove <id>".to_string())?;
-            match s.nfs_shares.remove(id).await {
-                Ok(()) => Ok(format!("removed {id}")),
-                Err(e) => Err(format!("remove failed: {e}")),
+                .ok_or_else(|| "usage: nfs unmount <id>".to_string())?;
+            match s.nfs.remove(id).await {
+                Ok(()) => Ok(format!("unmounted {id}")),
+                Err(e) => Err(format!("unmount failed: {e}")),
             }
         }
         Some("scan") => {
             let id = args
                 .get(1)
                 .ok_or_else(|| "usage: nfs scan <id>".to_string())?;
-            match s.nfs_shares.rescan(id).await {
+            match s.nfs.rescan(id).await {
                 Ok(n) => Ok(format!("re-scanned {id}: {n} isos")),
                 Err(e) => Err(format!("scan failed: {e}")),
             }
         }
         Some(other) => Err(format!(
-            "unknown nfs subcommand: {other}\ntry: nfs [list|add|remove|scan]"
+            "unknown nfs subcommand: {other}\ntry: nfs [list|mount|unmount|scan]"
         )),
     }
 }
@@ -612,18 +487,13 @@ OpenPXE terminal — available commands:
   queue assign-all <target>         assign every waiting client
   queue release <entry_id>           release one queued client
 
-  share list                        list configured SMB shares
-  share add //srv/share [auth]      add an SMB share; auth = 'guest' or 'user:pass'
-  share remove <id>                 forget an SMB share
-  share scan <id>                   re-list a share for new ISOs
+  nfs list                          list NFS mounts
+  nfs mount <s>:<e> [v3|v41] [ro|rw]  add and mount an NFS share
+  nfs unmount <id>                  unmount and forget a share
+  nfs scan <id>                     re-scan a share for new ISOs
 
-  nfs list                          list configured NFSv3 shares
-  nfs add <srv>:<export> [port]     add an NFSv3 share
-  nfs remove <id>                   forget an NFS share
-  nfs scan <id>                     re-list an NFS share for new ISOs
-
-  smb status                        outbound Samba state (Windows install media)
-  smb start | stop | reload         control the outbound smbd
+  smb status                        SMB (Samba) state
+  smb start | stop | reload         control smbd
 
   log clear                         drop the in-memory log ring buffer
   log tail [n]                      show the last n buffered lines (default 20)
@@ -638,10 +508,10 @@ mod tests {
     #[test]
     fn shell_split_basic() {
         assert_eq!(shell_split(""), Vec::<String>::new());
-        assert_eq!(shell_split("share list"), vec!["share", "list"]);
+        assert_eq!(shell_split("nfs list"), vec!["nfs", "list"]);
         assert_eq!(
-            shell_split("share add //nas/isos guest"),
-            vec!["share", "add", "//nas/isos", "guest"]
+            shell_split("nfs mount 10.0.0.5:/srv v41 ro"),
+            vec!["nfs", "mount", "10.0.0.5:/srv", "v41", "ro"]
         );
     }
 

crates/http-api/tests/full_flow.rs

@@ -14,7 +14,7 @@ use axum::body::Body;
 use axum::http::{header, Request, StatusCode};
 use openpxe_core::{ClientRegistry, DeploymentQueue, HostBindings, LogBus, Metrics, SettingsStore};
 use openpxe_http_api::{build_router, AppState};
-use openpxe_iso_store::{IsoStore, NfsShareManager, SmbShareManager};
+use openpxe_iso_store::{IsoStore, NfsManager};
 use tempfile::tempdir;
 use tower::ServiceExt;
 
@@ -94,15 +94,14 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
     let clients = ClientRegistry::new();
     let queue = DeploymentQueue::new();
     let settings = SettingsStore::load_or_default(dir.path());
-    let smb_shares = SmbShareManager::new(dir.path(), iso_store.clone());
-    let nfs_shares = NfsShareManager::new(dir.path(), iso_store.clone());
+    let nfs = NfsManager::new(dir.path(), iso_store.clone());
+    iso_store.set_nfs_root(nfs.mount_root());
     let log_bus = LogBus::new(64);
     let hosts = HostBindings::load_or_default(dir.path());
     let boot_log = openpxe_core::BootLog::load_or_default(dir.path());
     let branding = openpxe_core::BrandingStore::load_or_default(dir.path());
     let admin = openpxe_core::AdminStore::load_or_default(dir.path());
     let sso = openpxe_core::SsoStore::load_or_default(dir.path());
-    let notify = openpxe_core::NotifyStore::load_or_default(dir.path());
     let sessions = openpxe_http_api::auth::SessionStore::default();
     let metrics = Metrics::new();
     let state = AppState {
@@ -116,12 +115,9 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
         admin,
         sessions,
         sso,
-        saml: openpxe_http_api::saml_routes::SamlRuntime::default(),
-        notify,
         metrics,
         smb: None,
-        smb_shares,
-        nfs_shares,
+        nfs,
         uploads: openpxe_http_api::uploads::UploadSessions::default(),
         log_bus,
         started_at: time::OffsetDateTime::now_utc(),
@@ -468,171 +464,35 @@ async fn no_external_urls_in_generated_ipxe() {
 
 // ── Phase 4 integration tests ────────────────────────────────────────────
 
-// v0.4.65: kernel-mount NFS replaced with userspace SMB via smbclient.
-
 #[tokio::test]
-async fn smb_share_add_with_missing_server_is_rejected() {
-    // Validation must run before we shell out to smbclient — otherwise
-    // operators see opaque NT_STATUS codes for what's really a typo.
+async fn nfs_add_with_bad_export_is_rejected() {
+    // Validation must happen before we shell out to /bin/mount —
+    // otherwise the operator sees opaque kernel errors instead of a
+    // clear "your export must start with /" hint.
     let (state, _dir) = build_state().await;
     let app = build_router(state);
     let (s, b) = post_json(
         &app,
-        "/api/smb-shares",
-        r#"{"server":"","share":"isos","guest":true}"#,
+        "/api/nfs",
+        r#"{"server":"10.0.0.5","export":"isos","version":"v41","read_only":true}"#,
     )
     .await;
     assert_eq!(s, StatusCode::BAD_REQUEST);
     let msg = String::from_utf8_lossy(&b);
     assert!(
-        msg.to_lowercase().contains("server"),
+        msg.contains("export"),
         "expected validation hint, got: {msg}"
     );
 }
 
 #[tokio::test]
-async fn smb_share_add_requires_username_when_not_guest() {
+async fn nfs_list_starts_empty() {
     let (state, _dir) = build_state().await;
     let app = build_router(state);
-    let (s, b) = post_json(
-        &app,
-        "/api/smb-shares",
-        r#"{"server":"10.0.0.5","share":"isos","guest":false}"#,
-    )
-    .await;
-    assert_eq!(s, StatusCode::BAD_REQUEST);
-    let msg = String::from_utf8_lossy(&b);
-    assert!(
-        msg.to_lowercase().contains("username"),
-        "expected username hint, got: {msg}"
-    );
-}
-
-#[tokio::test]
-async fn smb_share_add_rejects_paths_in_share_name() {
-    let (state, _dir) = build_state().await;
-    let app = build_router(state);
-    let (s, b) = post_json(
-        &app,
-        "/api/smb-shares",
-        r#"{"server":"10.0.0.5","share":"isos/subdir","guest":true}"#,
-    )
-    .await;
-    assert_eq!(s, StatusCode::BAD_REQUEST);
-    let msg = String::from_utf8_lossy(&b);
-    assert!(
-        msg.to_lowercase().contains("share name"),
-        "expected share name hint, got: {msg}"
-    );
-}
-
-#[tokio::test]
-async fn smb_shares_list_starts_empty() {
-    let (state, _dir) = build_state().await;
-    let app = build_router(state);
-    let (s, b) = get(&app, "/api/smb-shares").await;
+    let (s, b) = get(&app, "/api/nfs").await;
     assert_eq!(s, StatusCode::OK);
     let v: serde_json::Value = serde_json::from_slice(&b).unwrap();
-    assert_eq!(v["shares"].as_array().unwrap().len(), 0);
-}
-
-// v0.4.67: NFSv3 share manager (parallel to SMB).
-
-// ── v0.5.0: notifications + Wake-on-LAN ────────────────────────────────────
-
-#[tokio::test]
-async fn notify_config_round_trips_and_redacts_smtp_password() {
-    let (state, _dir) = build_state().await;
-    let app = build_router(state);
-    // Save an SMTP config with a password.
-    let (s, _b) = put_json(
-        &app,
-        "/api/notify",
-        r#"{"enabled":true,"kind":"smtp","smtp_host":"smtp.example.com","smtp_port":587,"smtp_to":"[email protected]","smtp_from":"[email protected]","smtp_password":"s3cret"}"#,
-    )
-    .await;
-    assert_eq!(s, StatusCode::OK);
-    // GET must redact the password (never echo the real secret).
-    let (s, b) = get(&app, "/api/notify").await;
-    assert_eq!(s, StatusCode::OK);
-    let v: serde_json::Value = serde_json::from_slice(&b).unwrap();
-    assert_eq!(v["enabled"], true);
-    assert_eq!(v["kind"], "smtp");
-    let pw = v["smtp_password"].as_str().unwrap_or("");
-    assert_ne!(pw, "s3cret", "raw password must never be returned");
-    assert!(
-        !pw.is_empty(),
-        "a set password should surface as a sentinel"
-    );
-}
-
-#[tokio::test]
-async fn notify_enable_webhook_without_url_is_rejected() {
-    let (state, _dir) = build_state().await;
-    let app = build_router(state);
-    let (s, _b) = put_json(
-        &app,
-        "/api/notify",
-        r#"{"enabled":true,"kind":"slack","webhook_url":""}"#,
-    )
-    .await;
-    assert_eq!(s, StatusCode::BAD_REQUEST);
-}
-
-#[tokio::test]
-async fn wol_on_unbound_mac_is_404() {
-    // WoL only fires for bound MACs — an arbitrary MAC must 404 so the
-    // endpoint isn't an open packet sprayer.
-    let (state, _dir) = build_state().await;
-    let app = build_router(state);
-    let (s, _b) = post_json(&app, "/api/hosts/aa:bb:cc:dd:ee:ff/wol", "{}").await;
-    assert_eq!(s, StatusCode::NOT_FOUND);
-}
-
-#[tokio::test]
-async fn nfs_shares_list_starts_empty() {
-    let (state, _dir) = build_state().await;
-    let app = build_router(state);
-    let (s, b) = get(&app, "/api/nfs-shares").await;
-    assert_eq!(s, StatusCode::OK);
-    let v: serde_json::Value = serde_json::from_slice(&b).unwrap();
-    assert_eq!(v["shares"].as_array().unwrap().len(), 0);
-}
-
-#[tokio::test]
-async fn nfs_shares_add_rejects_missing_server() {
-    let (state, _dir) = build_state().await;
-    let app = build_router(state);
-    let (s, b) = post_json(
-        &app,
-        "/api/nfs-shares",
-        r#"{"server":"","export":"/srv/isos"}"#,
-    )
-    .await;
-    assert_eq!(s, StatusCode::BAD_REQUEST);
-    let msg = String::from_utf8_lossy(&b);
-    assert!(
-        msg.to_lowercase().contains("server"),
-        "expected server hint, got: {msg}"
-    );
-}
-
-#[tokio::test]
-async fn nfs_shares_add_rejects_export_without_leading_slash() {
-    let (state, _dir) = build_state().await;
-    let app = build_router(state);
-    let (s, b) = post_json(
-        &app,
-        "/api/nfs-shares",
-        r#"{"server":"10.0.0.5","export":"srv/isos"}"#,
-    )
-    .await;
-    assert_eq!(s, StatusCode::BAD_REQUEST);
-    let msg = String::from_utf8_lossy(&b);
-    assert!(
-        msg.to_lowercase().contains("export"),
-        "expected export-path hint, got: {msg}"
-    );
+    assert_eq!(v["mounts"].as_array().unwrap().len(), 0);
 }
 
 #[tokio::test]
@@ -1463,7 +1323,7 @@ async fn storage_disk_endpoint_reports_volume_stats() {
     let avail = v["available_bytes"].as_u64().unwrap();
     let used = v["used_bytes"].as_u64().unwrap();
     assert!(total >= avail, "{v}");
-    assert!(total >= used, "{v}");
+    assert!(total >= used,  "{v}");
     assert!(v["path"].as_str().unwrap().contains("isos"), "got {v}");
 }
 
@@ -1555,11 +1415,7 @@ async fn put_json(router: &axum::Router, path: &str, body: &str) -> (StatusCode,
 
 // ─── v0.4.5: Forms auth + SSO ─────────────────────────────────────────────
 
-async fn post_collect(
-    router: &axum::Router,
-    path: &str,
-    body: &str,
-) -> (StatusCode, Vec<u8>, Vec<axum::http::HeaderValue>) {
+async fn post_collect(router: &axum::Router, path: &str, body: &str) -> (StatusCode, Vec<u8>, Vec<axum::http::HeaderValue>) {
     let res = router
         .clone()
         .oneshot(
@@ -1886,458 +1742,3 @@ async fn docs_lists_new_v0_4_5_endpoints() {
         assert!(paths.iter().any(|p| p == needle), "{needle} missing");
     }
 }
-
-// ─── v0.4.6: PXE logo endpoint ────────────────────────────────────────────
-
-#[tokio::test]
-async fn pxe_background_serves_default_when_no_custom_logo() {
-    // v0.4.69: the endpoint always returns a full-screen PNG background
-    // now — when no custom logo is configured it composes the default
-    // OpenPXE mark on a dark field rather than 404ing. This is what lets
-    // the PXE menu's `console --picture` paint a real background instead
-    // of falling back to the (now-removed) ASCII placeholder.
-    let (state, _dir) = build_state().await;
-    let app = build_router(state);
-    let res = app
-        .clone()
-        .oneshot(
-            Request::builder()
-                .uri("/branding/pxe-logo")
-                .body(Body::empty())
-                .unwrap(),
-        )
-        .await
-        .unwrap();
-    assert_eq!(res.status(), StatusCode::OK);
-    assert_eq!(
-        res.headers()
-            .get(axum::http::header::CONTENT_TYPE)
-            .unwrap()
-            .to_str()
-            .unwrap(),
-        "image/png"
-    );
-    let body = axum::body::to_bytes(res.into_body(), usize::MAX)
-        .await
-        .unwrap();
-    assert!(body.starts_with(b"\x89PNG"), "default background not a PNG");
-    let width = u32::from_be_bytes([body[16], body[17], body[18], body[19]]);
-    assert_eq!(width, 1024, "default background should be 1024 wide");
-}
-
-/// Build a tiny valid PNG via the `image` crate. The v0.4.61 PXE-logo
-/// compositor decodes whatever the operator uploaded — hand-rolled
-/// PNGs with handwritten CRCs are too easy to break; let the encoder
-/// produce something it can later decode.
-fn tiny_png() -> Vec<u8> {
-    use image::{DynamicImage, ImageBuffer, ImageFormat, Rgb};
-    use std::io::Cursor;
-    let buf: ImageBuffer<Rgb<u8>, Vec<u8>> = ImageBuffer::from_pixel(8, 8, Rgb([0, 180, 220]));
-    let mut out = Vec::with_capacity(256);
-    DynamicImage::ImageRgb8(buf)
-        .write_to(&mut Cursor::new(&mut out), ImageFormat::Png)
-        .unwrap();
-    out
-}
-
-#[tokio::test]
-async fn pxe_background_falls_back_to_default_for_svg_upload() {
-    // iPXE can't rasterize SVG, so an SVG upload doesn't paint as the
-    // PXE background — but v0.4.69 still returns the *default* OpenPXE
-    // background PNG (not a 404) so the boot screen stays graphical.
-    // The WebUI top-left continues to render the SVG natively.
-    let (state, _dir) = build_state().await;
-    state
-        .branding
-        .set_logo(
-            "image/svg+xml",
-            "svg",
-            br#"<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 8 8"/>"#,
-        )
-        .unwrap();
-    let app = build_router(state);
-    let res = app
-        .clone()
-        .oneshot(
-            Request::builder()
-                .uri("/branding/pxe-logo")
-                .body(Body::empty())
-                .unwrap(),
-        )
-        .await
-        .unwrap();
-    assert_eq!(res.status(), StatusCode::OK);
-    let body = axum::body::to_bytes(res.into_body(), usize::MAX)
-        .await
-        .unwrap();
-    assert!(
-        body.starts_with(b"\x89PNG"),
-        "should serve default PNG for SVG"
-    );
-    let width = u32::from_be_bytes([body[16], body[17], body[18], body[19]]);
-    assert_eq!(width, 1024);
-}
-
-#[tokio::test]
-async fn pxe_logo_composes_to_1024x768_png() {
-    // v0.4.61: the endpoint no longer serves the raw upload — it
-    // composes the operator's logo into a fixed 1024×768 canvas so
-    // the iPXE menu always paints at consistent dimensions.
-    let (state, _dir) = build_state().await;
-    let png = tiny_png();
-    state.branding.set_logo("image/png", "png", &png).unwrap();
-    let app = build_router(state);
-    let res = app
-        .clone()
-        .oneshot(
-            Request::builder()
-                .uri("/branding/pxe-logo")
-                .body(Body::empty())
-                .unwrap(),
-        )
-        .await
-        .unwrap();
-    assert_eq!(res.status(), StatusCode::OK);
-    let ct = res
-        .headers()
-        .get(axum::http::header::CONTENT_TYPE)
-        .unwrap()
-        .to_str()
-        .unwrap();
-    assert_eq!(ct, "image/png");
-    let body = axum::body::to_bytes(res.into_body(), usize::MAX)
-        .await
-        .unwrap();
-    // PNG signature.
-    assert!(body.starts_with(b"\x89PNG"), "PNG header missing");
-    // IHDR chunk lives at bytes 8..29; width is bytes 16..20, height
-    // 20..24 in big-endian u32. The composed canvas should be 1024×768.
-    let width = u32::from_be_bytes([body[16], body[17], body[18], body[19]]);
-    let height = u32::from_be_bytes([body[20], body[21], body[22], body[23]]);
-    assert_eq!(width, 1024, "compose should pin width to 1024");
-    assert_eq!(height, 768, "compose should pin height to 768");
-}
-
-#[tokio::test]
-async fn pxe_logo_endpoint_is_public_after_admin_setup() {
-    // iPXE clients can't send a session cookie, so /branding/pxe-logo
-    // must stay reachable once the admin has been bootstrapped. The
-    // auth allowlist gates `/api/*` only.
-    let (state, _dir) = build_state().await;
-    let png = tiny_png();
-    state.branding.set_logo("image/png", "png", &png).unwrap();
-    let app = build_router(state);
-    // Configure an admin so the middleware kicks in.
-    let (s, _, _) = post_collect(
-        &app,
-        "/api/setup",
-        r#"{"username":"admin","password":"hunter2hunter2"}"#,
-    )
-    .await;
-    assert_eq!(s, StatusCode::CREATED);
-    // Still public without a cookie.
-    let (s, _) = get(&app, "/branding/pxe-logo").await;
-    assert_eq!(s, StatusCode::OK);
-}
-
-// ─── v0.5.1: SAML SSO flow ──────────────────────────────────────────────────
-//
-// The core crate exhaustively tests signature verification + semantic
-// validation (crates/core/src/saml/tests.rs). These integration tests cover
-// the HTTP wiring the core can't: routing, base64 decode, session minting,
-// the InResponseTo / IdP-initiated gating, and assertion-replay rejection.
-
-use base64::Engine as _;
-use openpxe_core::SsoConfig;
-use time::format_description::well_known::Rfc3339;
-use time::{Duration as TimeDuration, OffsetDateTime};
-
-const SP_BASE: &str = "http://127.0.0.1"; // build_state's public_base_url
-const SP_ACS: &str = "http://127.0.0.1/api/sso/acs";
-const IDP_ENTITY: &str = "https://idp.test/realms/fleet";
-const IDP_SSO: &str = "https://idp.test/realms/fleet/protocol/saml";
-
-struct TestIdp {
-    cert_b64: String,
-    key_pem: String,
-}
-
-fn make_idp() -> TestIdp {
-    let ck = rcgen::generate_simple_self_signed(vec!["idp.test".to_string()]).unwrap();
-    let der = ck.cert.der().as_ref().to_vec();
-    TestIdp {
-        cert_b64: base64::engine::general_purpose::STANDARD.encode(der),
-        key_pem: ck.key_pair.serialize_pem(),
-    }
-}
-
-fn idp_metadata_xml(cert_b64: &str) -> String {
-    format!(
-        r#"<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" entityID="{IDP_ENTITY}">
-  <md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
-    <md:KeyDescriptor use="signing"><ds:KeyInfo><ds:X509Data><ds:X509Certificate>{cert_b64}</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor>
-    <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="{IDP_SSO}"/>
-  </md:IDPSSODescriptor>
-</md:EntityDescriptor>"#
-    )
-}
-
-/// Build + sign a SAMLResponse with the test IdP key. `in_response_to: None`
-/// makes it an unsolicited (IdP-initiated) response.
-fn signed_response(idp: &TestIdp, in_response_to: Option<&str>) -> String {
-    let now = OffsetDateTime::now_utc().replace_nanosecond(0).unwrap();
-    let fmt = |t: OffsetDateTime| t.format(&Rfc3339).unwrap();
-    let irt = in_response_to
-        .map(|v| format!(r#" InResponseTo="{v}""#))
-        .unwrap_or_default();
-    let template = format!(
-        r##"<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_resp1" Version="2.0" IssueInstant="{now}" Destination="{SP_ACS}"{irt}>
-  <saml:Issuer>{IDP_ENTITY}</saml:Issuer>
-  <samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>
-  <saml:Assertion ID="_assertion1" Version="2.0" IssueInstant="{now}">
-    <saml:Issuer>{IDP_ENTITY}</saml:Issuer>
-    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
-      <ds:SignedInfo>
-        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
-        <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256"/>
-        <ds:Reference URI="#_assertion1">
-          <ds:Transforms>
-            <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
-            <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
-          </ds:Transforms>
-          <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
-          <ds:DigestValue></ds:DigestValue>
-        </ds:Reference>
-      </ds:SignedInfo>
-      <ds:SignatureValue></ds:SignatureValue>
-    </ds:Signature>
-    <saml:Subject>
-      <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">[email protected]</saml:NameID>
-      <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
-        <saml:SubjectConfirmationData Recipient="{SP_ACS}" NotOnOrAfter="{noa}"{irt}/>
-      </saml:SubjectConfirmation>
-    </saml:Subject>
-    <saml:Conditions NotBefore="{nb}" NotOnOrAfter="{noa}">
-      <saml:AudienceRestriction><saml:Audience>{SP_BASE}</saml:Audience></saml:AudienceRestriction>
-    </saml:Conditions>
-    <saml:AuthnStatement AuthnInstant="{now}" SessionIndex="sess-1">
-      <saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef></saml:AuthnContext>
-    </saml:AuthnStatement>
-  </saml:Assertion>
-</samlp:Response>"##,
-        now = fmt(now),
-        nb = fmt(now - TimeDuration::minutes(5)),
-        noa = fmt(now + TimeDuration::hours(1)),
-    );
-    let key = bergshamra::keys::loader::load_pem_auto(idp.key_pem.as_bytes(), None).unwrap();
-    let mut km = bergshamra::keys::KeysManager::new();
-    km.add_key(key);
-    let ctx = bergshamra::DsigContext::new(km);
-    bergshamra::sign(&ctx, &template).unwrap()
-}
-
-fn urlencode(s: &str) -> String {
-    let mut out = String::with_capacity(s.len() * 3);
-    for b in s.bytes() {
-        match b {
-            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => {
-                out.push(b as char);
-            }
-            _ => {
-                out.push('%');
-                out.push(char::from_digit((b >> 4) as u32, 16).unwrap().to_ascii_uppercase());
-                out.push(char::from_digit((b & 0xf) as u32, 16).unwrap().to_ascii_uppercase());
-            }
-        }
-    }
-    out
-}
-
-fn configure_sso(state: &AppState, metadata: String, allow_idp_initiated: bool) {
-    state
-        .sso
-        .replace(SsoConfig {
-            enabled: true,
-            idp_name: "Test IdP".into(),
-            idp_logo_url: String::new(),
-            metadata,
-            metadata_url: String::new(),
-            entity_id: String::new(),
-            allow_idp_initiated,
-        })
-        .unwrap();
-}
-
-async fn post_acs(router: &axum::Router, signed_xml: &str) -> axum::response::Response {
-    let b64 = base64::engine::general_purpose::STANDARD.encode(signed_xml.as_bytes());
-    let body = format!("SAMLResponse={}", urlencode(&b64));
-    router
-        .clone()
-        .oneshot(
-            Request::builder()
-                .method("POST")
-                .uri("/api/sso/acs")
-                .header("content-type", "application/x-www-form-urlencoded")
-                .body(Body::from(body))
-                .unwrap(),
-        )
-        .await
-        .unwrap()
-}
-
-fn has_session_cookie(resp: &axum::response::Response) -> bool {
-    resp.headers().get_all(header::SET_COOKIE).iter().any(|v| {
-        let s = v.to_str().unwrap_or("");
-        s.starts_with("openpxe_session=")
-            && !s.contains("openpxe_session=;")
-            && !s.contains("Max-Age=0")
-    })
-}
-
-fn location(resp: &axum::response::Response) -> String {
-    resp.headers()
-        .get(header::LOCATION)
-        .and_then(|v| v.to_str().ok())
-        .unwrap_or("")
-        .to_owned()
-}
-
-#[tokio::test]
-async fn sso_login_redirects_to_idp() {
-    let (state, _dir) = build_state().await;
-    let idp = make_idp();
-    configure_sso(&state, idp_metadata_xml(&idp.cert_b64), false);
-    let app = build_router(state);
-    let resp = app
-        .clone()
-        .oneshot(
-            Request::builder()
-                .uri("/api/sso/login")
-                .body(Body::empty())
-                .unwrap(),
-        )
-        .await
-        .unwrap();
-    assert_eq!(resp.status(), StatusCode::FOUND);
-    let loc = location(&resp);
-    assert!(loc.starts_with(IDP_SSO), "redirect to IdP, got {loc}");
-    assert!(
-        loc.contains("SAMLRequest="),
-        "carries SAMLRequest, got {loc}"
-    );
-}
-
-#[tokio::test]
-async fn sso_login_unavailable_when_disabled() {
-    let (state, _dir) = build_state().await;
-    let app = build_router(state); // SSO never configured
-    let resp = app
-        .oneshot(
-            Request::builder()
-                .uri("/api/sso/login")
-                .body(Body::empty())
-                .unwrap(),
-        )
-        .await
-        .unwrap();
-    assert_eq!(resp.status(), StatusCode::FOUND);
-    assert!(location(&resp).contains("sso_error"));
-}
-
-#[tokio::test]
-async fn sso_metadata_is_served() {
-    let (state, _dir) = build_state().await;
-    let app = build_router(state);
-    let (status, body) = get(&app, "/api/sso/metadata").await;
-    assert_eq!(status, StatusCode::OK);
-    let xml = String::from_utf8(body).unwrap();
-    assert!(xml.contains("SPSSODescriptor"));
-    assert!(xml.contains(SP_ACS));
-    assert!(xml.contains(SP_BASE));
-}
-
-#[tokio::test]
-async fn acs_idp_initiated_mints_session() {
-    let (state, _dir) = build_state().await;
-    let idp = make_idp();
-    configure_sso(&state, idp_metadata_xml(&idp.cert_b64), true);
-    let app = build_router(state);
-    let signed = signed_response(&idp, None);
-    let resp = post_acs(&app, &signed).await;
-    assert_eq!(resp.status(), StatusCode::FOUND);
-    assert_eq!(location(&resp), "/");
-    assert!(
-        has_session_cookie(&resp),
-        "ACS must set an operator session cookie"
-    );
-}
-
-#[tokio::test]
-async fn acs_idp_initiated_blocked_when_disabled() {
-    let (state, _dir) = build_state().await;
-    let idp = make_idp();
-    configure_sso(&state, idp_metadata_xml(&idp.cert_b64), false); // gate OFF
-    let app = build_router(state);
-    let signed = signed_response(&idp, None);
-    let resp = post_acs(&app, &signed).await;
-    assert_eq!(resp.status(), StatusCode::FOUND);
-    assert!(location(&resp).contains("sso_error"));
-    assert!(
-        !has_session_cookie(&resp),
-        "no session when IdP-initiated is disabled"
-    );
-}
-
-#[tokio::test]
-async fn acs_sp_initiated_without_known_request_is_rejected() {
-    let (state, _dir) = build_state().await;
-    let idp = make_idp();
-    configure_sso(&state, idp_metadata_xml(&idp.cert_b64), true);
-    let app = build_router(state);
-    // A valid signature but an InResponseTo we never issued => reject.
-    let signed = signed_response(&idp, Some("_never-issued"));
-    let resp = post_acs(&app, &signed).await;
-    assert_eq!(resp.status(), StatusCode::FOUND);
-    assert!(location(&resp).contains("sso_error"));
-    assert!(!has_session_cookie(&resp));
-}
-
-#[tokio::test]
-async fn acs_replayed_assertion_is_rejected() {
-    let (state, _dir) = build_state().await;
-    let idp = make_idp();
-    configure_sso(&state, idp_metadata_xml(&idp.cert_b64), true);
-    let app = build_router(state);
-    let signed = signed_response(&idp, None);
-    // First use succeeds…
-    let first = post_acs(&app, &signed).await;
-    assert!(has_session_cookie(&first));
-    // …replaying the identical assertion is rejected.
-    let second = post_acs(&app, &signed).await;
-    assert_eq!(second.status(), StatusCode::FOUND);
-    assert!(location(&second).contains("sso_error"));
-    assert!(!has_session_cookie(&second));
-}
-
-#[tokio::test]
-async fn acs_garbage_is_rejected_without_500() {
-    let (state, _dir) = build_state().await;
-    let idp = make_idp();
-    configure_sso(&state, idp_metadata_xml(&idp.cert_b64), true);
-    let app = build_router(state);
-    let body = "SAMLResponse=not%20valid%20base64%21%21";
-    let resp = app
-        .oneshot(
-            Request::builder()
-                .method("POST")
-                .uri("/api/sso/acs")
-                .header("content-type", "application/x-www-form-urlencoded")
-                .body(Body::from(body))
-                .unwrap(),
-        )
-        .await
-        .unwrap();
-    assert_eq!(resp.status(), StatusCode::FOUND);
-    assert!(location(&resp).contains("sso_error"));
-    assert!(!has_session_cookie(&resp));
-}

crates/iso-store/Cargo.toml

@@ -27,21 +27,6 @@ parking_lot.workspace = true
 bytes.workspace = true
 tempfile = "3.12"
 libc = "0.2"
-# v0.4.61: server-side compose of the operator's uploaded raster into a
-# fixed 1024x768 canvas so the PXE menu always gets a consistently-sized
-# PNG regardless of what the operator uploaded. We use the bare-bones
-# `image` crate (no default features) and explicitly enable only the
-# decoders we accept on upload (PNG/JPEG/WebP/GIF) plus the PNG
-# encoder. Keeps the build slim — no JPEG2000, TIFF, BMP, etc.
-image = { version = "0.25", default-features = false, features = ["png", "jpeg", "webp", "gif"] }
-
-# v0.4.67: pure-Rust NFSv3 client for reading remote ISOs without a
-# kernel mount. See crates/iso-store/src/nfs_share.rs for usage.
-nfs3_client = { workspace = true }
-nfs3_types = { workspace = true }
-# Needed for the Stream trait that wraps the mpsc receiver feeding
-# NFS read-loop bytes into axum's Body::from_stream.
-futures = { workspace = true }
 
 [dev-dependencies]
 tempfile = "3.12"

crates/iso-store/src/lib.rs

@@ -18,27 +18,15 @@
 
 pub mod entry;
 pub mod introspect;
-pub mod nfs_share;
-pub mod pxe_logo;
+pub mod nfs;
 pub mod smb;
-pub mod smb_share;
 pub mod store;
 pub mod windows;
 
 pub use entry::{BootEntry, BootKind, KernelArgs};
 pub use introspect::{DistroFamily, IntrospectionReport};
-// v0.4.65: kernel-mount NFS is gone. SMB shares via Samba's userspace
-// `smbclient` CLI replaced it — works in any container (no
-// CAP_SYS_ADMIN, no host kernel modules), matching how Bootimus and
-// every other PXE/imaging tool that supports network storage handles
-// it.
+pub use nfs::{NfsAddRequest, NfsManager, NfsMount, NfsVersion};
 pub use smb::{extract_windows_iso, SmbManager, SmbState};
-pub use smb_share::{SmbAddRequest, SmbShare, SmbShareError, SmbShareManager, SmbStream};
-// v0.4.67: NFS is back — this time as an in-process userspace NFSv3
-// client (the `nfs3_client` crate) rather than a kernel mount. Same
-// "works in any container" property as SMB, plus support for HTTP
-// Range requests because NFSv3 READ3 takes an explicit offset.
-pub use nfs_share::{NfsAddRequest, NfsShare, NfsShareError, NfsShareManager, NfsStream};
 pub use store::{
     generate_boot_entries_for, slugify_str, IsoCategory, IsoMeta, IsoSource, IsoStore,
     UploadHandle,

crates/iso-store/src/nfs.rs

@@ -0,0 +1,558 @@
+//! NFS share manager.
+//!
+//! Lets an operator mount a remote NFS export as an ISO source instead of
+//! uploading every ISO into the container's PVC. Supports NFSv3 and
+//! NFSv4.1 — the two versions the user explicitly asked for.
+//!
+//! ## How it works
+//!
+//! 1. Operator submits a mount spec via the Storage tab:
+//!    `{ server: "10.0.0.20", export: "/srv/isos", version: "v41" }`.
+//! 2. We slugify a stable id, mkdir `<work_dir>/nfs/<id>/`, then shell out
+//!    to `/bin/mount -t nfs -o vers=...,ro,nolock server:export local`.
+//! 3. On success we walk the mount point looking for `*.iso` files and
+//!    register each one with the `IsoStore` as an external source — same
+//!    introspection pipeline as a web upload, but no sha256 (the bytes
+//!    live on a remote machine; hashing them would suck them through the
+//!    network on every restart).
+//! 4. On failure we record `last_error` on the spec and persist anyway
+//!    so the UI can show a row in red rather than silently dropping it.
+//!
+//! ## Operational notes
+//!
+//! - Mounting NFS inside a container needs `CAP_SYS_ADMIN` and the
+//!   `nfs-common` package. The default image ships these (see Dockerfile).
+//! - On OpenShift, the SCC must allow `CAP_SYS_ADMIN`. The bundled SCC
+//!   doesn't — operators have to opt in by switching to a more privileged
+//!   SCC or running NFS mounts as a CSI driver outside the pod.
+//! - Mount commands are issued sequentially under a single mutex to avoid
+//!   `mount` racing on the same target dir.
+//!
+//! ## Persistence
+//!
+//! Mount specs (without runtime state) live at `<work_dir>/nfs.json`,
+//! re-mounted on startup. Mounts that fail to come back online keep their
+//! spec and their `last_error` so the operator sees what happened.
+
+use crate::introspect::{introspect, IntrospectionReport};
+use crate::store::{generate_boot_entries_for, slugify_str, IsoSource, IsoStore};
+use openpxe_core::{Error, Result};
+use parking_lot::Mutex;
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+use time::OffsetDateTime;
+use tokio::process::Command;
+
+/// Wire-protocol versions we support. Keep this enum closed — silently
+/// accepting "auto" or letting the kernel negotiate would mean operators
+/// could never confirm which version is in use.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum NfsVersion {
+    /// NFSv3 — UDP/TCP, separate `mountd` protocol. Required for many
+    /// older NAS appliances.
+    V3,
+    /// NFSv4.1 — single TCP port (2049), session-based. Modern default.
+    V41,
+}
+
+impl NfsVersion {
+    fn vers_arg(self) -> &'static str {
+        match self {
+            Self::V3 => "vers=3",
+            Self::V41 => "vers=4.1",
+        }
+    }
+}
+
+/// One configured mount. The id is generated from server+export so the
+/// operator can re-add the same export idempotently.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct NfsMount {
+    pub id: String,
+    pub server: String,
+    pub export: String,
+    pub version: NfsVersion,
+    /// Read-only by default — most ISO libraries are. Operators that need
+    /// write can flip this off but OpenPXE itself never writes.
+    pub read_only: bool,
+    /// Local mount point under `<work_dir>/nfs/`.
+    pub local_path: PathBuf,
+    /// Whether the mount is currently active.
+    pub mounted: bool,
+    /// Last error encountered on a `mount` or `umount` attempt; cleared on
+    /// success.
+    pub last_error: Option<String>,
+    #[serde(with = "time::serde::rfc3339::option")]
+    pub last_attempt: Option<OffsetDateTime>,
+    /// Number of `.iso` files found on the share (re-counted on each scan).
+    pub iso_count: u32,
+}
+
+/// Spec submitted by the UI. Server and export are normalized before use.
+#[derive(Debug, Clone, Deserialize)]
+pub struct NfsAddRequest {
+    pub server: String,
+    pub export: String,
+    #[serde(default = "default_version")]
+    pub version: NfsVersion,
+    #[serde(default = "default_ro")]
+    pub read_only: bool,
+}
+
+fn default_version() -> NfsVersion {
+    NfsVersion::V41
+}
+fn default_ro() -> bool {
+    true
+}
+
+#[derive(Debug, Default)]
+struct Inner {
+    mounts: HashMap<String, NfsMount>,
+}
+
+/// Manages NFS mounts and surfaces them as ISO sources.
+///
+/// Cheap to clone — internal state is `Arc<Mutex<...>>`.
+#[derive(Debug, Clone)]
+pub struct NfsManager {
+    work_root: Arc<PathBuf>,
+    state_path: Arc<PathBuf>,
+    inner: Arc<Mutex<Inner>>,
+    iso_store: IsoStore,
+    /// Single-writer lock around the actual `mount`/`umount` shell-outs;
+    /// avoids racing on the same target directory.
+    mount_lock: Arc<tokio::sync::Mutex<()>>,
+}
+
+impl NfsManager {
+    /// Construct a manager rooted at `work_dir`. Mount points live under
+    /// `<work_dir>/nfs/<id>/`. State persists to `<work_dir>/nfs.json`.
+    #[must_use]
+    pub fn new(work_dir: &Path, iso_store: IsoStore) -> Self {
+        let work_root = work_dir.join("nfs");
+        let state_path = work_dir.join("nfs.json");
+        Self {
+            work_root: Arc::new(work_root),
+            state_path: Arc::new(state_path),
+            inner: Arc::new(Mutex::new(Inner::default())),
+            iso_store,
+            mount_lock: Arc::new(tokio::sync::Mutex::new(())),
+        }
+    }
+
+    /// Where this manager mounts shares. Used by `IsoStore` to resolve
+    /// NFS-backed `IsoMeta`s to their on-disk path.
+    #[must_use]
+    pub fn mount_root(&self) -> PathBuf {
+        self.work_root.as_ref().clone()
+    }
+
+    /// Load persisted state and re-attempt every mount. Errors are logged
+    /// per-mount but never fail the call — startup must not block on a
+    /// remote NFS server being slow.
+    pub async fn load_and_remount(&self) -> Result<()> {
+        tokio::fs::create_dir_all(self.work_root.as_path()).await?;
+        let mounts = match tokio::fs::read_to_string(self.state_path.as_path()).await {
+            Ok(text) => serde_json::from_str::<Vec<NfsMount>>(&text).unwrap_or_default(),
+            Err(_) => Vec::new(),
+        };
+        for mut m in mounts {
+            // Always start from "not mounted" — the kernel state was lost
+            // when the process died. We'll try to remount each one.
+            m.mounted = false;
+            m.last_error = None;
+            self.inner.lock().mounts.insert(m.id.clone(), m.clone());
+            if let Err(e) = self.try_mount(&m.id).await {
+                tracing::warn!(
+                    target: "openpxe::nfs",
+                    id = %m.id, error = %e,
+                    "could not remount NFS share on startup"
+                );
+            }
+        }
+        Ok(())
+    }
+
+    /// Add a new mount. Returns the resulting `NfsMount` (with `mounted`
+    /// reflecting reality) or an error if the spec was invalid.
+    pub async fn add(&self, req: NfsAddRequest) -> Result<NfsMount> {
+        let server = req.server.trim().to_string();
+        let export = req.export.trim().to_string();
+        if server.is_empty() {
+            return Err(Error::Invalid("server is required".into()));
+        }
+        if !export.starts_with('/') {
+            return Err(Error::Invalid("export path must start with '/'".into()));
+        }
+
+        let id = mount_id(&server, &export);
+        let local_path = self.work_root.join(&id);
+        tokio::fs::create_dir_all(&local_path).await?;
+
+        let mount = NfsMount {
+            id: id.clone(),
+            server,
+            export,
+            version: req.version,
+            read_only: req.read_only,
+            local_path,
+            mounted: false,
+            last_error: None,
+            last_attempt: None,
+            iso_count: 0,
+        };
+        self.inner.lock().mounts.insert(id.clone(), mount);
+        self.persist_locked();
+        self.try_mount(&id).await?;
+        Ok(self.get(&id).expect("mount just inserted"))
+    }
+
+    /// Unmount and forget a share. Removes any ISOs it contributed from
+    /// the IsoStore and deletes the local mount point. Idempotent.
+    pub async fn remove(&self, id: &str) -> Result<()> {
+        // Best-effort umount; even if it fails (e.g. server unreachable)
+        // we still want to drop the in-memory record.
+        let _ = self.umount_one(id).await;
+        let local_path = {
+            let mut g = self.inner.lock();
+            g.mounts.remove(id).map(|m| m.local_path)
+        };
+        self.persist_locked();
+        self.iso_store.drop_external_source(id);
+        if let Some(p) = local_path {
+            // rmdir only — never recurse, the mount could still be live
+            // on some kernel error path and we don't want to nuke a
+            // remote filesystem.
+            let _ = tokio::fs::remove_dir(&p).await;
+        }
+        Ok(())
+    }
+
+    /// Re-scan a mounted share for ISOs, refreshing the IsoStore.
+    pub async fn rescan(&self, id: &str) -> Result<u32> {
+        let mount = self
+            .get(id)
+            .ok_or_else(|| Error::Invalid(format!("no such mount '{id}'")))?;
+        if !mount.mounted {
+            return Err(Error::Invalid(format!("mount '{id}' is not active")));
+        }
+        let count = self.scan_and_register(&mount).await?;
+        if let Some(m) = self.inner.lock().mounts.get_mut(id) {
+            m.iso_count = count;
+        }
+        self.persist_locked();
+        Ok(count)
+    }
+
+    /// Snapshot of every configured mount.
+    #[must_use]
+    pub fn list(&self) -> Vec<NfsMount> {
+        let g = self.inner.lock();
+        let mut v: Vec<_> = g.mounts.values().cloned().collect();
+        v.sort_by(|a, b| a.id.cmp(&b.id));
+        v
+    }
+
+    /// Look up a single mount by id.
+    #[must_use]
+    pub fn get(&self, id: &str) -> Option<NfsMount> {
+        self.inner.lock().mounts.get(id).cloned()
+    }
+
+    // ── internals ─────────────────────────────────────────────────────
+
+    async fn try_mount(&self, id: &str) -> Result<()> {
+        let _g = self.mount_lock.lock().await;
+
+        let m = self
+            .get(id)
+            .ok_or_else(|| Error::Invalid(format!("no such mount '{id}'")))?;
+        let now = OffsetDateTime::now_utc();
+
+        // Already mounted? Skip — `mount` would error on a busy target
+        // and confuse the operator's UI status.
+        if is_mountpoint(&m.local_path).await {
+            self.update_status(id, true, None, now);
+            // Even though already mounted, we still want a fresh ISO count.
+            let count = self.scan_and_register(&m).await.unwrap_or(0);
+            self.update_iso_count(id, count);
+            return Ok(());
+        }
+
+        let opts = mount_options(&m);
+        let target = format!("{}:{}", m.server, m.export);
+
+        let output = Command::new("mount")
+            .arg("-t")
+            .arg("nfs")
+            .arg("-o")
+            .arg(&opts)
+            .arg(&target)
+            .arg(&m.local_path)
+            .output()
+            .await;
+
+        match output {
+            Ok(out) if out.status.success() => {
+                tracing::info!(
+                    target: "openpxe::nfs",
+                    id = %id, server = %m.server, export = %m.export,
+                    version = ?m.version,
+                    "NFS mount succeeded"
+                );
+                self.update_status(id, true, None, now);
+                let count = self.scan_and_register(&m).await.unwrap_or(0);
+                self.update_iso_count(id, count);
+                Ok(())
+            }
+            Ok(out) => {
+                let err = format!(
+                    "mount exit {}: {}",
+                    out.status.code().unwrap_or(-1),
+                    String::from_utf8_lossy(&out.stderr).trim()
+                );
+                tracing::warn!(target: "openpxe::nfs", id = %id, "{err}");
+                self.update_status(id, false, Some(err.clone()), now);
+                Err(Error::Invalid(err))
+            }
+            Err(e) => {
+                let err = format!("could not exec /bin/mount: {e}");
+                tracing::error!(target: "openpxe::nfs", id = %id, "{err}");
+                self.update_status(id, false, Some(err.clone()), now);
+                Err(Error::Invalid(err))
+            }
+        }
+    }
+
+    async fn umount_one(&self, id: &str) -> Result<()> {
+        let _g = self.mount_lock.lock().await;
+        let Some(m) = self.get(id) else { return Ok(()) };
+        if !is_mountpoint(&m.local_path).await {
+            self.update_status(id, false, None, OffsetDateTime::now_utc());
+            return Ok(());
+        }
+        // -l = lazy: detach immediately, finish when no process has a
+        // handle. Important if a stale ISO read is still in flight.
+        let out = Command::new("umount")
+            .arg("-l")
+            .arg(&m.local_path)
+            .output()
+            .await;
+        match out {
+            Ok(o) if o.status.success() => {
+                self.update_status(id, false, None, OffsetDateTime::now_utc());
+                Ok(())
+            }
+            Ok(o) => {
+                let e = format!(
+                    "umount exit {}: {}",
+                    o.status.code().unwrap_or(-1),
+                    String::from_utf8_lossy(&o.stderr).trim()
+                );
+                self.update_status(id, false, Some(e.clone()), OffsetDateTime::now_utc());
+                Err(Error::Invalid(e))
+            }
+            Err(e) => {
+                let e = format!("could not exec /bin/umount: {e}");
+                self.update_status(id, false, Some(e.clone()), OffsetDateTime::now_utc());
+                Err(Error::Invalid(e))
+            }
+        }
+    }
+
+    /// Walk the mount point for `*.iso` files, introspect each one, and
+    /// register it with the IsoStore as an NFS-sourced entry. Returns the
+    /// count of ISOs registered.
+    async fn scan_and_register(&self, m: &NfsMount) -> Result<u32> {
+        // Drop any prior entries from this mount before re-registering, so
+        // a removed file disappears from the store.
+        self.iso_store.drop_external_source(&m.id);
+
+        let mut walker = tokio::fs::read_dir(&m.local_path).await?;
+        let mut count = 0u32;
+        while let Some(entry) = walker.next_entry().await? {
+            let p = entry.path();
+            if p.extension()
+                .and_then(|e| e.to_str())
+                .map(str::to_ascii_lowercase)
+                .as_deref()
+                != Some("iso")
+            {
+                continue;
+            }
+            let filename = match p.file_name().and_then(|s| s.to_str()) {
+                Some(f) => f.to_string(),
+                None => continue,
+            };
+            let size = tokio::fs::metadata(&p).await?.len();
+            // Introspection is sync + IO-bound (reads ISO9660 PVD). Push
+            // it to a blocking thread so the runtime stays responsive on
+            // a slow share.
+            let p_owned = p.clone();
+            let report: IntrospectionReport =
+                tokio::task::spawn_blocking(move || introspect(&p_owned))
+                    .await
+                    .map_err(|e| Error::Other(e.into()))?;
+            let id = format!("nfs-{}-{}", m.id, slugify_str(&filename));
+            let boot_entries = generate_boot_entries_for(&id, &filename, &report);
+            let source = IsoSource::Nfs {
+                mount_id: m.id.clone(),
+                relative_path: filename.clone(),
+            };
+            self.iso_store
+                .register_external(id, filename, size, report, boot_entries, source);
+            count += 1;
+        }
+        Ok(count)
+    }
+
+    fn update_status(&self, id: &str, mounted: bool, err: Option<String>, ts: OffsetDateTime) {
+        if let Some(m) = self.inner.lock().mounts.get_mut(id) {
+            m.mounted = mounted;
+            m.last_error = err;
+            m.last_attempt = Some(ts);
+        }
+        self.persist_locked();
+    }
+
+    fn update_iso_count(&self, id: &str, count: u32) {
+        if let Some(m) = self.inner.lock().mounts.get_mut(id) {
+            m.iso_count = count;
+        }
+        self.persist_locked();
+    }
+
+    /// Atomically replace the on-disk JSON with the current state.
+    /// Persistence errors are logged, never propagated — settings live in
+    /// memory authoritatively, matching the SettingsStore policy.
+    fn persist_locked(&self) {
+        let mounts: Vec<NfsMount> = self.inner.lock().mounts.values().cloned().collect();
+        let path = self.state_path.as_path();
+        let tmp = path.with_extension("json.tmp");
+        let body = match serde_json::to_vec_pretty(&mounts) {
+            Ok(b) => b,
+            Err(e) => {
+                tracing::warn!(target: "openpxe::nfs", "serialize NFS state: {e}");
+                return;
+            }
+        };
+        if let Some(parent) = path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        if let Err(e) = std::fs::write(&tmp, body) {
+            tracing::warn!(target: "openpxe::nfs", "write NFS state tmp: {e}");
+            return;
+        }
+        if let Err(e) = std::fs::rename(&tmp, path) {
+            tracing::warn!(target: "openpxe::nfs", "rename NFS state: {e}");
+        }
+    }
+}
+
+fn mount_options(m: &NfsMount) -> String {
+    let mut opts = vec![m.version.vers_arg().to_string()];
+    if m.read_only {
+        opts.push("ro".into());
+    } else {
+        opts.push("rw".into());
+    }
+    // `nolock` for v3 — many storage appliances disable lockd; we don't
+    // need locking for read-only ISO access anyway.
+    if matches!(m.version, NfsVersion::V3) {
+        opts.push("nolock".into());
+    }
+    // Soft mount with a generous timeout — better to surface a hung share
+    // as a user-visible error than to wedge the iPXE client forever on a
+    // dead NFS server.
+    opts.push("soft".into());
+    opts.push("timeo=100".into());
+    opts.push("retrans=3".into());
+    opts.join(",")
+}
+
+fn mount_id(server: &str, export: &str) -> String {
+    let raw = format!("{server}{export}");
+    slugify_str(&raw)
+}
+
+/// Detect whether `path` is currently a mount point. We don't have
+/// `is_mountpoint(2)`, so compare the parent's device id to the dir's;
+/// if they differ the dir is a mount.
+async fn is_mountpoint(path: &Path) -> bool {
+    let Some(parent) = path.parent() else {
+        return false;
+    };
+    let Ok(m1) = tokio::fs::metadata(path).await else {
+        return false;
+    };
+    let Ok(m2) = tokio::fs::metadata(parent).await else {
+        return false;
+    };
+    use std::os::unix::fs::MetadataExt;
+    m1.dev() != m2.dev()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn version_arg() {
+        assert_eq!(NfsVersion::V3.vers_arg(), "vers=3");
+        assert_eq!(NfsVersion::V41.vers_arg(), "vers=4.1");
+    }
+
+    #[test]
+    fn mount_options_v3_includes_nolock() {
+        let m = NfsMount {
+            id: "x".into(),
+            server: "s".into(),
+            export: "/e".into(),
+            version: NfsVersion::V3,
+            read_only: true,
+            local_path: PathBuf::from("/tmp/x"),
+            mounted: false,
+            last_error: None,
+            last_attempt: None,
+            iso_count: 0,
+        };
+        let opts = mount_options(&m);
+        assert!(opts.contains("vers=3"));
+        assert!(opts.contains("ro"));
+        assert!(opts.contains("nolock"));
+        assert!(opts.contains("soft"));
+    }
+
+    #[test]
+    fn mount_options_v41_no_nolock() {
+        let m = NfsMount {
+            id: "x".into(),
+            server: "s".into(),
+            export: "/e".into(),
+            version: NfsVersion::V41,
+            read_only: false,
+            local_path: PathBuf::from("/tmp/x"),
+            mounted: false,
+            last_error: None,
+            last_attempt: None,
+            iso_count: 0,
+        };
+        let opts = mount_options(&m);
+        assert!(opts.contains("vers=4.1"));
+        assert!(opts.contains("rw"));
+        assert!(!opts.contains("nolock"));
+    }
+
+    #[test]
+    fn mount_id_is_stable_and_safe() {
+        let a = mount_id("10.0.0.5", "/srv/isos");
+        let b = mount_id("10.0.0.5", "/srv/isos");
+        assert_eq!(a, b);
+        assert!(!a.contains('/'));
+        assert!(!a.contains('.'));
+    }
+}

crates/iso-store/src/pxe_logo.rs

@@ -1,264 +0,0 @@
-//! PXE boot-menu background compositor.
-//!
-//! The brief (v0.4.69): match iVentoy's polished graphical PXE screen.
-//! iPXE built with `CONSOLE_FRAMEBUFFER` + `IMAGE_PNG` paints a PNG to
-//! the framebuffer via `console --picture`, then draws the text menu on
-//! top (the console's default background colour is rendered transparent
-//! so the picture shows through the menu's blank cells). So what we
-//! produce here is a **full-screen 1024×768 background**, not just a
-//! floating logo:
-//!
-//!   - a solid dark field (matches the WebUI dark theme so the product
-//!     feels consistent from browser to bare metal), with
-//!   - the operator's uploaded logo composited across the top, leaving
-//!     the lower ~two-thirds clear for the iPXE menu text.
-//!
-//! When no custom logo is uploaded we still return a designed
-//! background — a dark field with a centered "rainbow-horizon" disc
-//! echoing the bundled OpenPXE mark — so the boot screen is graphical
-//! out of the box. This replaces the old ASCII wordmark entirely.
-//!
-//! iPXE does **not** scale pictures (confirmed against the decoder
-//! source): the image is painted at native pixel size and the firmware
-//! picks the smallest video mode that fits. 1024×768 is the universal
-//! safe mode, so we pin the canvas there. Operators uploading a 4K logo
-//! get it downscaled to fit the top band; tiny icons paint at native
-//! size, centered.
-//!
-//! Input formats: anything the `image` crate decodes with our enabled
-//! features — PNG, JPEG, WebP, GIF. iPXE itself only consumes PNG, so
-//! we always *emit* PNG regardless of what the operator uploaded; a
-//! WebP logo is transcoded here transparently.
-
-use image::imageops::FilterType;
-use image::{DynamicImage, ImageError, ImageFormat, Rgba, RgbaImage};
-use std::io::Cursor;
-
-/// Canvas dimensions. Pinned to 1024×768 — the universal framebuffer
-/// mode every BIOS/UEFI console supports, and iPXE doesn't scale.
-pub const CANVAS_W: u32 = 1024;
-pub const CANVAS_H: u32 = 768;
-
-/// Bounding box for the operator's logo across the top band. Wider than
-/// the old floating-logo box because the logo now anchors a full
-/// background rather than sitting alone on transparency.
-const LOGO_MAX_W: u32 = 760;
-const LOGO_MAX_H: u32 = 200;
-
-/// Top margin from the canvas top to the logo's top edge.
-const LOGO_TOP_MARGIN: u32 = 72;
-
-/// Background fill — a near-black with a faint blue cast, matching the
-/// WebUI's dark theme surface so the product reads as one piece from
-/// browser to PXE screen.
-const BG: Rgba<u8> = Rgba([11, 14, 22, 255]);
-
-/// Compose the operator's uploaded raster (`Some`) — or the default
-/// OpenPXE mark (`None`) — into a full-screen 1024×768 PNG background
-/// and return the encoded bytes.
-///
-/// Errors only when a provided `src_bytes` can't be decoded; the
-/// `None` path and the PNG encode are infallible for our fixed canvas.
-pub fn compose_pxe_background(src_bytes: Option<&[u8]>) -> Result<Vec<u8>, ImageError> {
-    let mut canvas: RgbaImage = RgbaImage::from_pixel(CANVAS_W, CANVAS_H, BG);
-
-    match src_bytes {
-        Some(bytes) => {
-            let logo = image::load_from_memory(bytes)?;
-            let logo = downscale_to_fit(logo, LOGO_MAX_W, LOGO_MAX_H);
-            let logo_rgba = logo.to_rgba8();
-            let off_x = CANVAS_W.saturating_sub(logo_rgba.width()) / 2;
-            let off_y = LOGO_TOP_MARGIN.min(CANVAS_H.saturating_sub(logo_rgba.height()));
-            // `overlay` alpha-composites, so a transparent-background
-            // logo blends onto the dark field exactly as designed.
-            image::imageops::overlay(&mut canvas, &logo_rgba, off_x.into(), off_y.into());
-        }
-        None => draw_default_mark(&mut canvas),
-    }
-
-    let mut out = Vec::with_capacity(128 * 1024);
-    DynamicImage::ImageRgba8(canvas).write_to(&mut Cursor::new(&mut out), ImageFormat::Png)?;
-    Ok(out)
-}
-
-/// Back-compat shim for the old name — callers that pass a raw logo and
-/// want it composited get the same result as `compose_pxe_background`
-/// with `Some`.
-pub fn compose_pxe_logo(src_bytes: &[u8]) -> Result<Vec<u8>, ImageError> {
-    compose_pxe_background(Some(src_bytes))
-}
-
-/// Paint a centered "rainbow-horizon" disc onto the dark canvas as the
-/// default brand mark when no operator logo is set. Pure pixel math —
-/// no font, no SVG rasterizer, no extra deps. A filled circle with a
-/// left-to-right hue sweep echoes the bundled `logo.svg` motif.
-// Casts here are all bounded small-range geometry (radius ≤ 90, canvas
-// ≤ 1024) — precision loss / wrap is structurally impossible.
-#[allow(clippy::cast_precision_loss, clippy::cast_possible_wrap)]
-fn draw_default_mark(canvas: &mut RgbaImage) {
-    let radius: i32 = 90;
-    let cx = (CANVAS_W / 2) as i32;
-    let cy = (LOGO_TOP_MARGIN + 100) as i32;
-    // Four-stop horizontal sweep across the disc (teal → blue → violet
-    // → magenta) — the OpenPXE palette.
-    let stops = [
-        [0x22u8, 0xd3, 0xaa],
-        [0x3b, 0x82, 0xf6],
-        [0x8b, 0x5c, 0xf6],
-        [0xec, 0x48, 0x99],
-    ];
-    let r2 = radius * radius;
-    for dy in -radius..=radius {
-        for dx in -radius..=radius {
-            if dx * dx + dy * dy > r2 {
-                continue;
-            }
-            // Position across the disc in [0,1] left→right.
-            let t = (f32::from(i16::try_from(dx + radius).unwrap_or(0)))
-                / (f32::from(i16::try_from(2 * radius).unwrap_or(1)));
-            let color = gradient_at(&stops, t);
-            // Soft edge: fade alpha in the outer 3px ring.
-            let dist = ((dx * dx + dy * dy) as f32).sqrt();
-            let alpha = if dist > (radius as f32 - 3.0) {
-                let edge = (radius as f32 - dist).clamp(0.0, 3.0) / 3.0;
-                (edge * 255.0) as u8
-            } else {
-                255
-            };
-            let px = cx + dx;
-            let py = cy + dy;
-            if px >= 0 && py >= 0 && (px as u32) < CANVAS_W && (py as u32) < CANVAS_H {
-                blend_pixel(canvas, px as u32, py as u32, color, alpha);
-            }
-        }
-    }
-}
-
-/// Linear interpolate across an N-stop palette at position `t` in [0,1].
-// `segments`/`idx` are ≤ palette length (4) — f32 cast is exact.
-#[allow(clippy::cast_precision_loss)]
-fn gradient_at(stops: &[[u8; 3]], t: f32) -> [u8; 3] {
-    let t = t.clamp(0.0, 1.0);
-    let segments = stops.len() - 1;
-    let scaled = t * segments as f32;
-    let idx = (scaled.floor() as usize).min(segments - 1);
-    let frac = scaled - idx as f32;
-    let a = stops[idx];
-    let b = stops[idx + 1];
-    [
-        lerp(a[0], b[0], frac),
-        lerp(a[1], b[1], frac),
-        lerp(a[2], b[2], frac),
-    ]
-}
-
-fn lerp(a: u8, b: u8, t: f32) -> u8 {
-    (f32::from(a) + (f32::from(b) - f32::from(a)) * t).round() as u8
-}
-
-/// Alpha-blend `color` at `alpha` over the existing canvas pixel.
-fn blend_pixel(canvas: &mut RgbaImage, x: u32, y: u32, color: [u8; 3], alpha: u8) {
-    let bg = canvas.get_pixel(x, y).0;
-    let a = f32::from(alpha) / 255.0;
-    let out = Rgba([
-        lerp(bg[0], color[0], a),
-        lerp(bg[1], color[1], a),
-        lerp(bg[2], color[2], a),
-        255,
-    ]);
-    canvas.put_pixel(x, y, out);
-}
-
-fn downscale_to_fit(img: DynamicImage, max_w: u32, max_h: u32) -> DynamicImage {
-    let (w, h) = (img.width(), img.height());
-    if w <= max_w && h <= max_h {
-        return img;
-    }
-    img.resize(max_w, max_h, FilterType::Lanczos3)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use image::{ImageBuffer, Rgb};
-
-    fn solid_png(w: u32, h: u32, rgb: [u8; 3]) -> Vec<u8> {
-        let img: ImageBuffer<Rgb<u8>, Vec<u8>> = ImageBuffer::from_pixel(w, h, Rgb(rgb));
-        let mut out = Vec::with_capacity(4096);
-        DynamicImage::ImageRgb8(img)
-            .write_to(&mut Cursor::new(&mut out), ImageFormat::Png)
-            .unwrap();
-        out
-    }
-
-    #[test]
-    fn custom_logo_emits_canvas_sized_png_with_dark_field() {
-        let src = solid_png(120, 60, [200, 50, 50]);
-        let out = compose_pxe_background(Some(&src)).unwrap();
-        let img = image::load_from_memory(&out).unwrap().to_rgba8();
-        assert_eq!(img.width(), CANVAS_W);
-        assert_eq!(img.height(), CANVAS_H);
-        // A far corner should be the opaque dark background fill, not
-        // transparent — this is a full background now, not a floating
-        // logo on transparency.
-        let corner = img.get_pixel(CANVAS_W - 1, CANVAS_H - 1);
-        assert_eq!(corner.0, BG.0, "corner should be the dark fill");
-    }
-
-    #[test]
-    fn custom_logo_painted_in_top_band() {
-        let src = solid_png(100, 40, [10, 200, 10]);
-        let out = compose_pxe_background(Some(&src)).unwrap();
-        let canvas = image::load_from_memory(&out).unwrap().to_rgba8();
-        let cx = (CANVAS_W - 100) / 2;
-        let cy = LOGO_TOP_MARGIN;
-        let inside = canvas.get_pixel(cx + 10, cy + 10);
-        assert!(
-            inside.0[1] > 100 && inside.0[0] < 100,
-            "logo pixel color mismatch: {inside:?}"
-        );
-    }
-
-    #[test]
-    fn default_background_is_dark_with_a_painted_mark() {
-        let out = compose_pxe_background(None).unwrap();
-        let canvas = image::load_from_memory(&out).unwrap().to_rgba8();
-        assert_eq!(canvas.width(), CANVAS_W);
-        assert_eq!(canvas.height(), CANVAS_H);
-        // Corner is dark fill.
-        assert_eq!(canvas.get_pixel(2, CANVAS_H - 2).0, BG.0);
-        // Center of the disc is not the background fill (something was
-        // painted there).
-        let center = canvas.get_pixel(CANVAS_W / 2, LOGO_TOP_MARGIN + 100);
-        assert_ne!(center.0, BG.0, "default mark should paint over the field");
-    }
-
-    #[test]
-    fn webp_or_jpeg_input_is_accepted_and_transcoded_to_png() {
-        // Encode a JPEG and confirm the compositor decodes it and emits
-        // a valid PNG (iPXE only eats PNG, so transcoding is the point).
-        let img: ImageBuffer<Rgb<u8>, Vec<u8>> = ImageBuffer::from_pixel(80, 80, Rgb([90, 90, 90]));
-        let mut jpeg = Vec::new();
-        DynamicImage::ImageRgb8(img)
-            .write_to(&mut Cursor::new(&mut jpeg), ImageFormat::Jpeg)
-            .unwrap();
-        let out = compose_pxe_background(Some(&jpeg)).unwrap();
-        // Output must be a PNG (magic bytes) of canvas size.
-        assert_eq!(&out[..8], b"\x89PNG\r\n\x1a\n");
-        let img = image::load_from_memory(&out).unwrap();
-        assert_eq!(img.width(), CANVAS_W);
-    }
-
-    #[test]
-    fn unsupported_bytes_returns_error_not_panic() {
-        let r = compose_pxe_background(Some(b"\xde\xad\xbe\xef not an image"));
-        assert!(r.is_err());
-    }
-
-    #[test]
-    fn gradient_endpoints_match_stops() {
-        let stops = [[0, 0, 0], [255, 255, 255]];
-        assert_eq!(gradient_at(&stops, 0.0), [0, 0, 0]);
-        assert_eq!(gradient_at(&stops, 1.0), [255, 255, 255]);
-    }
-}

crates/iso-store/src/store.rs

@@ -15,31 +15,18 @@ use tokio::io::AsyncWriteExt;
 
 /// Where the bytes for an ISO actually live.
 ///
-/// `Local` — uploaded ISO, sits at `<iso_dir>/<id>.iso`.
-/// `Smb` (v0.4.65) — remote SMB share, streamed via Samba's
-/// userspace `smbclient` CLI subprocess. No kernel mount, no local
-/// cache. Sequential whole-file streaming; HTTP Range requests
-/// return 416.
-/// `Nfs` (v0.4.67) — remote NFSv3 share, streamed via the pure-Rust
-/// `nfs3_client` crate (in-process, no subprocess). Same "works in
-/// any container" property as SMB, plus Range requests work because
-/// NFSv3 READ3 takes an explicit offset.
+/// The default is `Local` — uploaded ISOs sit in `<iso_dir>/<id>.iso`.
+/// `Nfs` entries point at a file inside a remote share that the
+/// `NfsManager` is keeping mounted. We resolve the on-disk path lazily
+/// in [`IsoStore::iso_path_for`] using the `nfs_root` set at startup.
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(tag = "kind", rename_all = "snake_case")]
 pub enum IsoSource {
     #[default]
     Local,
-    /// v0.4.65: SMB via userspace `smbclient` works in any container.
-    Smb {
-        share_id: String,
-        /// Filename at the share root. We don't support nested paths
-        /// in v0.4.65; ISOs live at the top of the share.
-        relative_path: String,
-    },
-    /// v0.4.67: NFSv3 via the in-process `nfs3_client` crate.
     Nfs {
-        share_id: String,
-        /// Filename at the export root.
+        mount_id: String,
+        /// Path relative to the mount point — typically just the filename.
         relative_path: String,
     },
 }
@@ -177,6 +164,10 @@ struct Inner {
 #[derive(Debug, Clone)]
 pub struct IsoStore {
     iso_dir: Arc<PathBuf>,
+    /// Where NFS mounts land on disk. Set at startup via
+    /// [`IsoStore::set_nfs_root`]; required for resolving any
+    /// `IsoSource::Nfs` entry.
+    nfs_root: Arc<RwLock<Option<PathBuf>>>,
     inner: Arc<RwLock<Inner>>,
 }
 
@@ -184,10 +175,17 @@ impl IsoStore {
     pub fn new(iso_dir: PathBuf) -> Self {
         Self {
             iso_dir: Arc::new(iso_dir),
+            nfs_root: Arc::new(RwLock::new(None)),
             inner: Arc::new(RwLock::new(Inner::default())),
         }
     }
 
+    /// Tell the store where NFS mounts live. Without this set,
+    /// `IsoSource::Nfs` entries cannot be resolved to a file path.
+    pub fn set_nfs_root(&self, root: PathBuf) {
+        *self.nfs_root.write() = Some(root);
+    }
+
     pub async fn ensure_dirs(&self) -> Result<()> {
         tokio::fs::create_dir_all(self.iso_dir.as_path()).await?;
         Ok(())
@@ -283,33 +281,33 @@ impl IsoStore {
         self.inner.read().isos.get(id).cloned()
     }
 
-    /// Resolve an ISO id to its on-disk path, if any. For local
-    /// (uploaded) ISOs this is `<iso_dir>/<id>.iso`. For SMB-sourced
-    /// ISOs there is no on-disk path — the HTTP handler must stream
-    /// via `SmbShareManager::stream_iso` instead. Returns `None` for
-    /// SMB sources or when the file is missing.
+    /// Resolve an ISO id to its on-disk path, if any. For local entries
+    /// this is `<iso_dir>/<id>.iso`; for NFS entries it's
+    /// `<nfs_root>/<mount_id>/<relative_path>`. Returns None if the file
+    /// is missing or the source isn't resolvable (e.g. NFS share
+    /// unmounted).
     pub fn iso_path_for(&self, id: &str) -> Option<PathBuf> {
         let meta = self.get(id)?;
-        match &meta.source {
-            IsoSource::Local => {
-                let path = self.iso_path(id);
-                if path.exists() {
-                    Some(path)
-                } else {
-                    None
-                }
+        let path = match &meta.source {
+            IsoSource::Local => self.iso_path(id),
+            IsoSource::Nfs {
+                mount_id,
+                relative_path,
+            } => {
+                let root = self.nfs_root.read().clone()?;
+                root.join(mount_id).join(relative_path)
             }
-            // SMB and NFS sources have no local path — they're
-            // streamed in-process. Callers must inspect the source
-            // kind first and dispatch to the appropriate share
-            // manager.
-            IsoSource::Smb { .. } | IsoSource::Nfs { .. } => None,
+        };
+        if path.exists() {
+            Some(path)
+        } else {
+            None
         }
     }
 
-    /// Delete an ISO and its sidecar metadata. Only acts on local
-    /// (uploaded) ISOs; for SMB-backed ISOs the operator must remove
-    /// the file from the share or unregister the share entirely.
+    /// Delete an ISO and its sidecar metadata. Only acts on local ISOs;
+    /// for NFS-backed ISOs the operator must remove the file from the
+    /// share or unmount the NFS share entirely.
     pub async fn delete(&self, id: &str) -> Result<()> {
         let meta = self.get(id);
         let is_local = matches!(
@@ -326,10 +324,10 @@ impl IsoStore {
         Ok(())
     }
 
-    /// Register an externally-sourced ISO (SMB share, etc.). Used by
-    /// `SmbShareManager` after listing a share. We do **not** persist
-    /// a `meta.json` on disk for these — the source of truth is the
-    /// share itself, and the manager re-scans on startup.
+    /// Register an externally-sourced ISO (e.g. NFS-mounted). Used by
+    /// `NfsManager` after walking a freshly-mounted share. We do **not**
+    /// persist a `meta.json` on disk for these — the source of truth is
+    /// the share itself, and the NFS manager re-scans on startup.
     pub fn register_external(
         &self,
         id: String,
@@ -354,20 +352,14 @@ impl IsoStore {
         self.inner.write().isos.insert(id, meta);
     }
 
-    /// Drop every entry that belongs to `share_id`. Used by the SMB
-    /// and NFS share managers when an operator removes a share, or
-    /// before re-scanning to clean out stale entries. The same id
-    /// space serves both protocols — share ids are slugified from
-    /// `server+share` (SMB) or `server+export` (NFS) and the
-    /// protocol-specific prefix prevents collisions.
-    pub fn drop_external_source(&self, share_id: &str) {
+    /// Drop every entry that belongs to `mount_id`. Used by the NFS
+    /// manager when an operator removes a share, or before re-scanning
+    /// to clean out stale entries.
+    pub fn drop_external_source(&self, mount_id: &str) {
         let mut g = self.inner.write();
-        g.isos.retain(|_, m| match &m.source {
-            IsoSource::Smb { share_id: sid, .. } | IsoSource::Nfs { share_id: sid, .. } => {
-                sid != share_id
-            }
-            IsoSource::Local => true,
-        });
+        g.isos.retain(
+            |_, m| !matches!(&m.source, IsoSource::Nfs { mount_id: mid, .. } if mid == mount_id),
+        );
     }
 
     /// Set or clear an ISO's boot password.

crates/openpxe/src/main.rs

@@ -9,7 +9,7 @@ use openpxe_core::{
 };
 use openpxe_dhcp_proxy::DhcpProxyServer;
 use openpxe_http_api::{build_router, AppState};
-use openpxe_iso_store::{IsoStore, NfsShareManager, SmbManager, SmbShareManager};
+use openpxe_iso_store::{IsoStore, NfsManager, SmbManager};
 use openpxe_tftp::TftpServer;
 use std::net::{Ipv4Addr, SocketAddr};
 use std::path::PathBuf;
@@ -107,7 +107,6 @@ async fn main() -> anyhow::Result<()> {
     let branding = openpxe_core::BrandingStore::load_or_default(&config.paths.work_dir);
     let admin = openpxe_core::AdminStore::load_or_default(&config.paths.work_dir);
     let sso = openpxe_core::SsoStore::load_or_default(&config.paths.work_dir);
-    let notify = openpxe_core::NotifyStore::load_or_default(&config.paths.work_dir);
     let sessions = openpxe_http_api::auth::SessionStore::default();
     let metrics = Metrics::new();
 
@@ -120,30 +119,13 @@ async fn main() -> anyhow::Result<()> {
         let _ = smb.start();
     }
 
-    // v0.4.65: SMB share manager — Samba `smbclient` userspace
-    // consumer. Replaces the kernel-mount NFS path that v0.4.64
-    // shipped; that didn't work on hosts whose kernel lacked the nfs
-    // client modules (Unraid is the dominant case). `smbclient` does
-    // the SMB protocol entirely in userspace over TCP and works in
-    // any container regardless of capabilities or kernel modules.
-    let smb_shares = SmbShareManager::new(&config.paths.work_dir, iso_store.clone());
-    if let Err(e) = smb_shares.load_and_rescan().await {
-        tracing::warn!(
-            target: "openpxe::smb",
-            "could not reload SMB shares on startup: {e}"
-        );
-    }
-
-    // v0.4.67: NFSv3 share manager — pure-Rust in-process consumer
-    // via the `nfs3_client` crate. Sits alongside the SMB manager;
-    // operators pick whichever protocol their NAS prefers, or use
-    // both. No subprocess, no kernel mount, works in any container.
-    let nfs_shares = NfsShareManager::new(&config.paths.work_dir, iso_store.clone());
-    if let Err(e) = nfs_shares.load_and_rescan().await {
-        tracing::warn!(
-            target: "openpxe::nfs",
-            "could not reload NFS shares on startup: {e}"
-        );
+    // NFS manager. The mount root has to be set on the IsoStore *before*
+    // we replay any persisted mounts, otherwise an in-memory IsoMeta
+    // pointing at an NFS source can't resolve to a path.
+    let nfs = NfsManager::new(&config.paths.work_dir, iso_store.clone());
+    iso_store.set_nfs_root(nfs.mount_root());
+    if let Err(e) = nfs.load_and_remount().await {
+        tracing::warn!(target: "openpxe::nfs", "could not reload NFS mounts: {e}");
     }
 
     // Sniff network details for the Network tab. None of these are
@@ -168,12 +150,9 @@ async fn main() -> anyhow::Result<()> {
         admin: admin.clone(),
         sessions: sessions.clone(),
         sso: sso.clone(),
-        saml: openpxe_http_api::saml_routes::SamlRuntime::default(),
-        notify: notify.clone(),
         metrics: metrics.clone(),
         smb: Some(smb.clone()),
-        smb_shares: smb_shares.clone(),
-        nfs_shares: nfs_shares.clone(),
+        nfs: nfs.clone(),
         uploads: openpxe_http_api::uploads::UploadSessions::default(),
         log_bus: log_bus.clone(),
         started_at: time::OffsetDateTime::now_utc(),

crates/webui/src/app.css

@@ -34,18 +34,9 @@
   --topbar-h:   56px;
   --mono: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
   --sans: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, system-ui, sans-serif;
-  /* v0.4.63: tie native form-control rendering (checkboxes, scroll bars,
-     date pickers) to the active OpenPXE theme. Without this, the inline
-     `<meta name="color-scheme" content="dark light">` in index.html forces
-     dark form chrome in *both* themes — so the SSO "Enable single sign-on"
-     checkbox renders as an opaque black square against the light-mode
-     panel, ignoring our accent-color hint. CSS `color-scheme` overrides
-     the meta and tracks `data-theme` correctly. */
-  color-scheme: dark;
 }
 
 :root[data-theme="light"] {
-  color-scheme: light;
   /* Light palette — high-contrast neutral, accent unchanged for brand
      consistency. Designed against Netbox Labs's reference screenshot:
      near-white surfaces, soft grey dividers, dark text. */
@@ -117,20 +108,6 @@ code, kbd { font-family: var(--mono); font-size: 12.5px;
   letter-spacing: 0.2px;
   color: var(--fg);
 }
-
-/* v0.4.69: FleetDM-style full-width custom logo. When the operator has
-   uploaded a custom brand mark, the sidebar header drops the bundled
-   26px mark + "OpenPXE" wordmark and instead lets the uploaded image
-   span the header — left-aligned, capped at 200x50, scaled to fit
-   without distortion. The wordmark is hidden so the operator's logo is
-   the sole brand element (their logo presumably already contains their
-   name). The bundled-default case keeps the mark + wordmark. */
-.sidebar .brand.has-custom-logo { gap: 0; }
-.sidebar .brand.has-custom-logo img {
-  width: auto; height: 50px; max-width: 200px;
-  object-fit: contain; object-position: left center; flex: none;
-}
-.sidebar .brand.has-custom-logo strong { display: none; }
 .sidebar nav { padding: 10px 0; flex: 1; overflow-y: auto; }
 .sidebar nav a {
   display: flex; align-items: center; gap: 10px;
@@ -310,83 +287,23 @@ label.field {
 }
 label.field .name { color: var(--fg-dim); font-size: 12px; }
 label.field .hint { color: var(--fg-dimmer); font-size: 11px; }
-/* All single-line inputs share one chrome rule. Pre-v0.4.6 we only
-   styled type=text/number, which left type=password fields rendering
-   with the default browser look — visibly off vs adjacent text fields
-   in the Account card. The negation list keeps `type=checkbox`,
-   `type=file`, and `type=range` (none of which we use inside
-   `label.field`) from picking up the padded-box look. */
-label.field input:not([type="checkbox"]):not([type="file"]):not([type="range"]),
+label.field input[type="text"],
+label.field input[type="number"],
 label.field select,
 label.field textarea {
   width: 100%; background: var(--bg); color: var(--fg);
   border: 1px solid var(--border); border-radius: var(--radius);
   padding: 7px 10px; font: inherit;
-  /* iOS/Safari shrinks password-field text by default; clamp it so
-     the password input matches the username input's metrics. */
-  font-size: 14px; line-height: 1.4;
-  box-shadow: none; -webkit-appearance: none; appearance: none;
-}
-/* v0.4.63: with `appearance: none`, the native <select> dropdown arrow
-   disappears, which makes the "Metadata source" pick-list look like a
-   plain (and slightly squished) text input. Paint our own chevron via
-   background-image so the control still reads as a dropdown, and reserve
-   right-padding for it. The data-URI SVG inherits currentColor via the
-   `stroke` attribute so the arrow follows light/dark theme without a
-   second declaration. */
-label.field select {
-  background-image: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 12 8' fill='none' stroke='%239aa0a6' stroke-width='1.6' stroke-linecap='round' stroke-linejoin='round'><polyline points='1.5,1.5 6,6 10.5,1.5'/></svg>");
-  background-repeat: no-repeat;
-  background-position: right 10px center;
-  background-size: 11px 7px;
-  padding-right: 30px;
-}
-:root[data-theme="light"] label.field select {
-  background-image: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 12 8' fill='none' stroke='%235a6377' stroke-width='1.6' stroke-linecap='round' stroke-linejoin='round'><polyline points='1.5,1.5 6,6 10.5,1.5'/></svg>");
 }
 label.field input:focus, label.field select:focus, label.field textarea:focus {
   outline: none; border-color: var(--accent);
-  box-shadow: 0 0 0 1px color-mix(in srgb, var(--accent) 35%, transparent);
 }
 label.check {
   display: flex; gap: 10px; align-items: center;
   padding: 8px 10px; margin-bottom: 6px;
   border: 1px solid var(--border-soft); border-radius: var(--radius);
 }
-/* v0.4.63: native checkboxes used to render as opaque black squares in
-   light mode because the page meta declares `color-scheme: dark light`
-   and `accent-color` alone only repaints the *check mark* (not the
-   container). Take full control of the chrome so the box reads cleanly
-   on both palettes and the checked state lights up in our accent. */
-label.check input[type="checkbox"] {
-  appearance: none; -webkit-appearance: none;
-  width: 16px; height: 16px; flex: none;
-  background: var(--bg);
-  border: 1px solid var(--border);
-  border-radius: 3px;
-  display: inline-grid; place-content: center;
-  cursor: pointer; margin: 0;
-  transition: background 0.1s ease, border-color 0.1s ease;
-}
-label.check input[type="checkbox"]:hover { border-color: var(--accent); }
-label.check input[type="checkbox"]:checked {
-  background: var(--accent);
-  border-color: var(--accent);
-}
-label.check input[type="checkbox"]:checked::after {
-  /* Classic ✓ glyph built from a rotated rectangle border. Colour is
-     #002923 (the same near-black we use on solid-accent buttons) so the
-     tick stays legible against the teal fill in both themes. */
-  content: '';
-  width: 4px; height: 8px;
-  border: solid #002923;
-  border-width: 0 2px 2px 0;
-  transform: rotate(45deg) translate(-1px, -1px);
-}
-label.check input[type="checkbox"]:focus-visible {
-  outline: none;
-  box-shadow: 0 0 0 2px color-mix(in srgb, var(--accent) 35%, transparent);
-}
+label.check input { accent-color: var(--accent); }
 
 /* ── Drop zone ────────────────────────────────────────────────────── */
 
@@ -504,21 +421,9 @@ tr.unbootable td:first-child { border-left: 3px solid var(--warn); }
 .dot.err  { background: var(--err); }
 .dot.warn { background: var(--warn); }
 
-/* Inline form rows. The default is a 4-column grid sized for the
-   Account card's "Current / New username / New password / Confirm"
-   quartet; the `.cols-3` modifier swaps to a 3-column layout for the
-   SSO header strip (display name / logo URL / metadata source). All
-   `.form-row > label.field` children share the same baseline because
-   their inner inputs share metrics via the global rule above. */
-.form-row { display: grid; grid-template-columns: repeat(4, 1fr); gap: 10px 14px; align-items: end; }
-.form-row.cols-3 { grid-template-columns: repeat(3, 1fr); }
-.form-row.cols-2 { grid-template-columns: repeat(2, 1fr); }
-.form-row label.field { margin-bottom: 0; }
-@media (max-width: 900px) {
-  .form-row,
-  .form-row.cols-3,
-  .form-row.cols-2 { grid-template-columns: 1fr; }
-}
+/* Inline form rows. */
+.form-row { display: grid; grid-template-columns: repeat(4, 1fr); gap: 10px 14px; }
+@media (max-width: 900px) { .form-row { grid-template-columns: 1fr; } }
 
 /* ── Queued deployment visual ────────────────────────────────────── */
 .queue-track {
@@ -627,14 +532,6 @@ tr.unbootable td:first-child { border-left: 3px solid var(--warn); }
 }
 .auth-card .brand-row img { width: 32px; height: 32px; flex: none; }
 .auth-card .brand-row .name { font-size: 17px; font-weight: 600; letter-spacing: 0.2px; color: var(--fg); }
-/* v0.5.0: FleetDM-style custom logo on the login/setup card — the
-   uploaded logo spans the card header and the "OpenPXE" wordmark is
-   dropped (the logo is the brand). Matches the sidebar treatment. */
-.auth-card .brand-row.has-custom-logo { justify-content: center; gap: 0; margin-bottom: 22px; }
-.auth-card .brand-row.has-custom-logo img {
-  width: auto; height: 52px; max-width: 240px;
-  object-fit: contain; object-position: center;
-}
 .auth-card h2 {
   margin: 0 0 6px; font-size: 16px; font-weight: 600; color: var(--fg);
 }
@@ -670,56 +567,22 @@ tr.unbootable td:first-child { border-left: 3px solid var(--warn); }
 }
 .auth-card .sso-btn .meta { color: var(--fg-dim); font-size: 11px; margin-top: 2px; }
 
-/* ── Top-right user menu (v0.4.6) ────────────────────────────
-   The "signed in as X" identity + sign-out moved out of the sidebar
-   footer in v0.4.6 — the sidebar footer is now reserved for the
-   service-state trio (Service status / Advertised URL / Backend
-   version). The button matches the theme toggle's size + chrome so
-   the top-right reads as a tidy two-icon strip. */
-.user-menu { position: relative; }
-.user-btn {
-  display: inline-flex; align-items: center; justify-content: center;
-  width: 36px; height: 32px;
-  background: transparent; color: var(--fg);
-  border: 1px solid var(--border); border-radius: 8px;
-  cursor: pointer; padding: 0;
-  transition: background 0.15s ease, border-color 0.15s ease;
+/* ── Logout chip (sidebar footer) ────────────────────────────── */
+.sidebar .footer .logout-row {
+  margin-top: 8px; display: flex; align-items: center; justify-content: space-between;
+  gap: 8px;
 }
-.user-btn:hover { background: var(--bg-panel-2); border-color: var(--accent); }
-.user-pop {
-  position: absolute; right: 0; top: 38px;
-  min-width: 200px;
-  background: var(--bg-panel);
-  border: 1px solid var(--border);
-  border-radius: var(--radius-lg);
-  box-shadow: var(--shadow-card);
-  padding: 6px;
-  z-index: 60;
-  display: flex; flex-direction: column; gap: 2px;
-}
-.user-pop[hidden] { display: none; }
-.user-pop .user-pop-name {
-  padding: 8px 10px 6px;
-  border-bottom: 1px solid var(--border-soft);
-  margin-bottom: 4px;
-  color: var(--fg); font-weight: 600; font-size: 13px;
+.sidebar .footer .logout-row .who {
+  color: var(--fg); font-weight: 600; font-size: 11.5px;
   overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
 }
-.user-pop .user-pop-item {
-  text-align: left; width: 100%;
-  background: transparent; color: var(--fg);
-  border: 0; border-radius: var(--radius);
-  padding: 7px 10px; font: inherit; font-size: 13px; font-weight: 500;
+.sidebar .footer .logout-btn {
+  background: transparent; color: var(--fg-dim);
+  border: 1px solid var(--border); border-radius: var(--radius);
+  padding: 2px 8px; font: inherit; font-size: 11px; font-weight: 500;
   cursor: pointer;
 }
-.user-pop .user-pop-item:hover {
-  background: var(--bg-panel-2); color: var(--fg);
-}
-.user-pop .user-pop-danger { color: var(--err); }
-.user-pop .user-pop-danger:hover {
-  background: color-mix(in srgb, var(--err) 12%, transparent);
-  color: var(--err);
-}
+.sidebar .footer .logout-btn:hover { color: var(--fg); background: var(--bg-panel-2); border-color: var(--accent); }
 
 /* ── About card ─────────────────────────────────────────────────── */
 .about-hero { padding: 20px 24px; }
@@ -797,46 +660,3 @@ tr.unbootable td:first-child { border-left: 3px solid var(--warn); }
 .logo-preview .info { flex: 1; min-width: 0; }
 .logo-preview .info .name { color: var(--fg); font-weight: 600; }
 .logo-preview .info .meta { color: var(--fg-dim); font-size: 12px; margin-top: 2px; }
-
-/* v0.5.1: collapsible "Advanced" disclosure at the bottom of Settings
-   (the former Advanced sidebar tab). A quiet, full-width toggle that
-   expands to reveal the notification + API-reference cards. */
-.advanced-disclosure { width: 100%; }
-.advanced-summary {
-  list-style: none;
-  cursor: pointer;
-  user-select: none;
-  display: flex;
-  align-items: center;
-  gap: 8px;
-  padding: 10px 14px;
-  color: var(--fg-dim);
-  font-size: 13px;
-  font-weight: 600;
-  background: var(--bg-panel-2);
-  border: 1px solid var(--border);
-  border-radius: var(--radius);
-}
-.advanced-summary:hover { color: var(--fg); }
-.advanced-summary::-webkit-details-marker { display: none; }
-.advanced-summary::before {
-  content: "▸";
-  font-size: 11px;
-  transition: transform 0.15s ease;
-}
-.advanced-disclosure[open] .advanced-summary::before { transform: rotate(90deg); }
-
-/* v0.5.1: protocol tag on a unified Remote-shares row (SMB / NFS). */
-.proto-badge {
-  display: inline-block;
-  font-size: 10px;
-  font-weight: 700;
-  letter-spacing: 0.04em;
-  padding: 1px 6px;
-  margin-right: 8px;
-  border-radius: 4px;
-  vertical-align: middle;
-  background: var(--bg-panel-2);
-  border: 1px solid var(--border);
-  color: var(--fg-dim);
-}

crates/webui/src/index.html

@@ -5,15 +5,8 @@
   <meta name="viewport" content="width=device-width, initial-scale=1" />
   <meta name="color-scheme" content="dark light" />
   <title>OpenPXE</title>
-  <!-- v0.4.61: the `?v=…` query string is replaced by the server at
-       request time with the running OpenPXE version. That guarantees a
-       fresh URL on every upgrade so browsers (and intermediary proxies)
-       can't keep serving stale JS / CSS / branding from before the
-       deploy. Combined with `Cache-Control: no-cache, must-revalidate`
-       on the asset handlers, the practical caching window is one
-       version. -->
-  <link rel="stylesheet" href="/assets/app.css?v={{ASSET_VERSION}}" />
-  <link rel="icon" type="image/svg+xml" href="/assets/logo.svg?v={{ASSET_VERSION}}&r={{LOGO_REV}}" />
+  <link rel="stylesheet" href="/assets/app.css" />
+  <link rel="icon" type="image/svg+xml" href="/assets/logo.svg" />
   <!-- Theme is read from localStorage *before* paint to avoid the
        dark→light flash on every navigation. Falls back to the OS
        preference and finally to dark. -->
@@ -32,8 +25,8 @@
 <body>
 <div class="shell">
   <aside class="sidebar">
-    <div class="{{BRAND_CLASS}}">
-      <img src="/assets/logo.svg?v={{ASSET_VERSION}}&r={{LOGO_REV}}" alt="OpenPXE" />
+    <div class="brand">
+      <img src="/assets/logo.svg" alt="OpenPXE" />
       <strong>OpenPXE</strong>
     </div>
     <nav>
@@ -66,7 +59,15 @@
       <!-- The brand badge at the top can be overridden by operator-uploaded
            logos; keep "OpenPXE v…" pinned in the footer so the backend
            identity is always visible regardless of branding. -->
-      <div class="footer-version">OpenPXE&nbsp;v<span data-bind="version">0.4.63</span></div>
+      <div class="footer-version">OpenPXE&nbsp;v<span data-bind="version">0.4.5</span></div>
+      <!-- v0.4.5: signed-in identity + one-click sign-out. The button
+           is populated by app.js after /api/me reports an authenticated
+           session — pre-auth states swap the whole shell for the
+           login/setup card so this row never gets shown there. -->
+      <div class="logout-row" data-bind="logout_row" style="display:none">
+        <span class="who" data-bind="signed_in_as" title=""></span>
+        <button type="button" class="logout-btn" data-bind="logout_btn">Sign out</button>
+      </div>
     </div>
   </aside>
 
@@ -96,32 +97,11 @@
         <path d="M20.5 14A8 8 0 0 1 10 3.5 a8 8 0 1 0 10.5 10.5z"/>
       </svg>
     </button>
-
-    <!-- v0.4.6: signed-in operator menu. Sits next to the theme toggle
-         in the top-right corner so the sidebar footer stays clean for
-         the "Service status / Advertised URL / Backend version" trio.
-         The whole block is hidden until /api/me confirms a session. -->
-    <div class="user-menu" data-bind="user_menu_wrap" style="display:none">
-      <button id="user-menu-btn" class="user-btn" type="button"
-              aria-label="Account menu" aria-haspopup="true" aria-expanded="false"
-              title="Account">
-        <svg viewBox="0 0 24 24" width="18" height="18" fill="none"
-             stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
-          <circle cx="12" cy="8" r="3.6"/>
-          <path d="M4.5 20a7.5 7.5 0 0 1 15 0"/>
-        </svg>
-      </button>
-      <div id="user-menu-pop" class="user-pop" data-bind="user_menu_pop" hidden>
-        <div class="user-pop-name" data-bind="user_pop_name">—</div>
-        <button type="button" class="user-pop-item" data-bind="user_pop_edit">Edit account</button>
-        <button type="button" class="user-pop-item user-pop-danger" data-bind="user_pop_logout">Sign out</button>
-      </div>
-    </div>
   </header>
 
   <main class="main" id="view-root"></main>
 </div>
 
-<script src="/assets/app.js?v={{ASSET_VERSION}}"></script>
+<script src="/assets/app.js"></script>
 </body>
 </html>

crates/webui/src/lib.rs

@@ -7,44 +7,11 @@
 //! nav, top bar with secondary tabs, card-dense content panels.
 #![forbid(unsafe_code)]
 
-/// Render the top-level page.
-///
-/// * `base_url` is interpolated into the footer so operators can see at
-///   a glance what URL clients are PXE-booting from.
-/// * `asset_version` is appended as `?v=…` to every asset URL so each
-///   release ships with brand-new asset URLs — browsers (and any
-///   intermediary proxy) can't keep serving last release's `app.js`
-///   when we know the new one is incompatible. Combined with
-///   `Cache-Control: no-cache, must-revalidate` on the asset handlers,
-///   the worst-case caching window is one version.
-/// * `logo_rev` is appended to the brand-mark and favicon URLs as an
-///   extra `&r=…` token. Unlike `asset_version` it changes every time
-///   the operator swaps the custom logo, so the top-left mark updates
-///   immediately on the next page load instead of being pinned to the
-///   release version (which only changes on upgrade). `index.html`
-///   itself is served `no-cache`, so the fresh token lands as soon as
-///   the operator reloads after an upload.
-/// * `has_custom_logo` switches the sidebar brand block between the
-///   bundled mark + "OpenPXE" wordmark (false) and a FleetDM-style
-///   full-width custom logo with the wordmark hidden (true). Rendered
-///   server-side so there's no flash of the default mark before JS runs.
+/// Render the top-level page. `base_url` is interpolated into the footer
+/// so operators can see at a glance what URL clients are PXE-booting from.
 #[must_use]
-pub fn index_html(
-    base_url: &str,
-    asset_version: &str,
-    logo_rev: u64,
-    has_custom_logo: bool,
-) -> String {
-    let brand_class = if has_custom_logo {
-        "brand has-custom-logo"
-    } else {
-        "brand"
-    };
-    INDEX_HTML
-        .replace("{{BASE_URL}}", base_url)
-        .replace("{{ASSET_VERSION}}", asset_version)
-        .replace("{{LOGO_REV}}", &logo_rev.to_string())
-        .replace("{{BRAND_CLASS}}", brand_class)
+pub fn index_html(base_url: &str) -> String {
+    INDEX_HTML.replace("{{BASE_URL}}", base_url)
 }
 
 #[must_use]

deploy/docker/Dockerfile

@@ -16,12 +16,7 @@
 
 ARG RUST_VERSION=1.95
 
-########## fetch iPXE binaries + wimboot ##########
-# Pulls the upstream boot.ipxe.org pre-builds (no PNG support) plus
-# wimboot. These cover the arches we don't build from source here:
-# BIOS undionly.kpxe and i386-efi (which need a 32-bit x86 toolchain),
-# and serve as the baseline that the PNG-enabled x86_64/arm64 UEFI
-# binaries from the `ipxe-build` stage overlay on top of.
+########## fetch iPXE binaries ##########
 FROM debian:12-slim AS fetch
 RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates \
  && rm -rf /var/lib/apt/lists/*
@@ -29,36 +24,6 @@ WORKDIR /src
 COPY scripts/fetch-ipxe.sh scripts/fetch-ipxe.sh
 RUN mkdir -p assets/ipxe && bash scripts/fetch-ipxe.sh
 
-########## build PNG-enabled iPXE from source ##########
-# v0.4.69: THE graphical-boot-menu unlock. iVentoy paints a PNG
-# background on the PXE screen using stock iPXE built with
-# CONSOLE_FRAMEBUFFER + IMAGE_PNG + CONSOLE_CMD; the public iPXE
-# binaries omit those, so `console --picture` is a no-op on them.
-# We build our own from upstream with that thin config delta.
-#
-# The historical blocker was cc1 segfaulting when an amd64 gcc ran
-# under QEMU emulation on an arm64 host. The fix: pin this stage to
-# $BUILDPLATFORM (the NATIVE builder arch — arm64 on an Apple-Silicon
-# Mac, amd64 in x86 CI) and cross-compile with a real cross toolchain
-# (CROSS_COMPILE=x86_64-linux-gnu-). The compiler runs native and
-# emits x86_64 — no emulation, no segfault. arm64-efi builds natively.
-FROM --platform=$BUILDPLATFORM debian:12-slim AS ipxe-build
-# libc6-dev is REQUIRED and easy to miss under --no-install-recommends:
-# iPXE's host utilities (elf2efi, zbin) compile with the native gcc and
-# pull <stdint.h>; without the native libc headers gcc's #include_next
-# falls through to iPXE's freestanding headers and dies on bits/stdint.h.
-# The target (iPXE firmware) code is -ffreestanding/-nostdinc, so the
-# x86_64 cross toolchain needs NO cross libc headers.
-RUN apt-get update && apt-get install -y --no-install-recommends \
-        git make perl gcc binutils libc6-dev \
-        gcc-x86-64-linux-gnu binutils-x86-64-linux-gnu \
-        ca-certificates \
- && rm -rf /var/lib/apt/lists/*
-WORKDIR /src
-COPY scripts/build-ipxe.sh scripts/build-ipxe.sh
-COPY deploy/ipxe/local/ deploy/ipxe/local/
-RUN mkdir -p assets/ipxe && bash scripts/build-ipxe.sh /src/assets/ipxe
-
 ########## build openpxe ##########
 FROM rust:${RUST_VERSION}-bookworm AS build
 WORKDIR /src
@@ -91,14 +56,7 @@ RUN apt-get update \
 # `cargo build`, which is slow and can exhaust small Colima/CI disks.
 COPY Cargo.toml Cargo.lock ./
 COPY crates/ crates/
-# Baseline binaries (BIOS / i386 / wimboot), then overlay the
-# PNG-enabled x86_64 + arm64 UEFI binaries built from source. The
-# overlay wins for snponly.efi / ipxe.efi / snponly-arm64.efi so the
-# common modern clients get the graphical background; the rest keep the
-# upstream no-PNG binaries and the menu's `|| console` text fallback.
 COPY --from=fetch /src/assets/ipxe /src/assets/ipxe
-COPY --from=ipxe-build /src/assets/ipxe/snponly.efi /src/assets/ipxe/snponly.efi
-COPY --from=ipxe-build /src/assets/ipxe/ipxe.efi /src/assets/ipxe/ipxe.efi
 
 # Cache cargo registry + target across builds. The mtime touch is
 # belt-and-suspenders: cargo occasionally misses mtime-only changes on
@@ -115,30 +73,23 @@ FROM debian:12-slim AS runtime
 RUN apt-get update \
  && apt-get install -y --no-install-recommends \
         ca-certificates libcap2-bin tini gosu iproute2 \
-        wimtools samba smbclient \
+        wimtools samba nfs-common \
  && rm -rf /var/lib/apt/lists/* \
  && useradd --system --uid 10001 --home-dir /var/lib/openpxe --shell /usr/sbin/nologin openpxe \
  && mkdir -p /var/lib/openpxe/isos /var/lib/openpxe/work /var/lib/openpxe/smb \
  && chown -R openpxe:openpxe /var/lib/openpxe
 # v0.4.5: the openpxe binary itself is now built against musl and is
 # fully static — no glibc dependency. The runtime stage still ships
-# Debian slim because OpenPXE shells out to the packages below for
+# Debian slim because OpenPXE shells out to the four packages below for
 # functionality we deliberately don't reimplement in-process:
-#
 #   wimtools   - `wimlib-imagex`, used to inject startnet.cmd into boot.wim.
 #   samba      - `smbd` serves extracted Windows install media on :445 so
 #                WinPE can `net use`. Guest read-only, scoped to
-#                /var/lib/openpxe/smb. This package provides the SERVER
-#                side only; the client CLI is a separate package below.
-#   smbclient  - v0.4.66: Samba's `smbclient` userspace CLI, used by
-#                the Storage tab's SMB shares manager to list and stream
-#                ISOs from remote SMB servers without ever mounting them
-#                in the kernel. In Debian 12 `smbclient` is NOT pulled
-#                in by the `samba` package — they're siblings, not
-#                parent/child. v0.4.65 shipped without this line and
-#                every "Add share" attempt surfaced
-#                `could not exec smbclient: No such file or directory`
-#                until this landed.
+#                /var/lib/openpxe/smb.
+#   nfs-common - `mount.nfs` / `mount.nfs4` for the Storage tab's NFS
+#                share manager. Mount requires CAP_SYS_ADMIN; without it
+#                mount(2) returns EPERM and the manager surfaces a clear
+#                error in the UI.
 #   iproute2   - `ip addr` / `ip route` for the auto-detected Network
 #                tab fields (NIC name, subnet mask, default gateway).
 #                Tiny, always available; we don't pull in netlink crates
@@ -146,13 +97,8 @@ RUN apt-get update \
 #   gosu       - drops privileges cleanly from root after the entrypoint
 #                fixes bind-mount ownership (common OpenShift/Docker UX
 #                issue).
-#
-# v0.4.65 dropped `nfs-common` — kernel-mount NFS is gone. The SMB
-# shares replacement uses userspace `smbclient` and needs no kernel
-# helpers.
-#
 # A future "openpxe-static" variant could drop everything except the
-# binary onto distroless once we move the Windows + SMB legs to
+# binary onto distroless once we move the Windows + NFS legs to
 # in-process Rust crates.
 
 COPY --from=build /openpxe /usr/local/bin/openpxe

deploy/ipxe/local/console.h

@@ -1,14 +0,0 @@
-/*
- * OpenPXE iPXE build override — console options.
- *
- * Included at the end of config/console.h. CONSOLE_FRAMEBUFFER is the
- * unified graphical framebuffer console (EFI GOP on UEFI, VESA on
- * BIOS); it's what `console --picture` paints into. This is the same
- * single flag iVentoy enables for its graphical PXE screen.
- *
- * We *add* the framebuffer console rather than replacing the default
- * EFI/BIOS text consoles, so text output still works before/after the
- * picture is set.
- */
-
-#define CONSOLE_FRAMEBUFFER

deploy/ipxe/local/general.h

@@ -1,23 +0,0 @@
-/*
- * OpenPXE iPXE build override — general options.
- *
- * iPXE includes <config/local/general.h> at the end of config/general.h,
- * so anything defined here is layered on top of the stock defaults
- * without editing upstream files. We enable exactly the features the
- * graphical PXE boot menu needs:
- *
- *   IMAGE_PNG    - PNG decoder, so `console --picture <png>` can paint
- *                  the operator's logo / OpenPXE background.
- *   IMAGE_PNM    - Netpbm decoder (cheap; harmless belt-and-suspenders).
- *   CONSOLE_CMD  - the `console` command itself. Without it you get
- *                  "console: command not found" even with a framebuffer.
- *
- * (CONSOLE_FRAMEBUFFER lives in config/local/console.h.)
- *
- * Everything else stays at upstream defaults — we are intentionally a
- * thin, auditable delta over stock iPXE so the UBDL/GPL story is simple.
- */
-
-#define IMAGE_PNG
-#define IMAGE_PNM
-#define CONSOLE_CMD

docs/queued/ipxe-pxe-menu-theme-research.md

@@ -1,106 +0,0 @@
-# PXE menu theme — research for next-release follow-up
-
-Status: queued. v0.4.63 keeps the ASCII-banner fallback + `console --picture`
-compositor wired; this note captures the design for the menu-theming work
-that lands once iPXE rebuilt with `IMAGE_PNG` is published.
-
-## How iVentoy actually does it
-
-iVentoy is closed-source for its menu, but the supporting bits are
-public at https://github.com/ventoy/PXE — a vanilla iPXE snapshot
-(`iPXE/ipxe-bd13697`) used to produce the loader binaries iVentoy
-serves over TFTP (`pxeboot.efi`, `iventoy_loader_16000`,
-`iventoy_loader_16000_uefi`).
-
-The graphical menu itself is rendered by iPXE's framebuffer console
-with a baked-in PNG background via `console --picture` — same
-primitive OpenPXE already uses in `crates/http-api/src/ipxe_script.rs`.
-Evidence:
-
-- The iPXE build in `ventoy/PXE` is configured with `CONSOLE_FRAMEBUFFER`
-  + `IMAGE_PNG` + `CONSOLE_CMD` (the three flags `console --picture`
-  needs).
-- iVentoy issue #11 confirms "iventoy using default 1024x768"; users
-  report 800x600 / 1024x768 / 1280x720 / 1280x1024 / 1920x1080 as
-  selectable resolutions from the iVentoy web UI **Configuration tab**,
-  not via EDID auto-detect. iPXE has no EDID parsing; the daemon writes
-  a resolution-tagged script per boot and serves the matching PNG.
-- iVentoy docs explicitly state both Free and Pro editions **do not
-  support** modifying the boot background/title — it's baked into the
-  shipped PNG assets.
-- Chrome is iPXE's native `menu` / `item` / `choose` widgets (single
-  highlight bar, no borders) painted on top of the PNG, with margins
-  set via `console --left/--right/--top/--bottom` to keep the text off
-  the logo. Not GRUB, not syslinux — UEFI iVentoy uses iPXE's
-  `snponly.efi` / `pxeboot.efi`, and `--picture` does work under UEFI
-  GOP despite older folklore.
-
-Do not conflate this with Ventoy-USB, which is a separate codebase and
-uses GRUB2 themes (`theme.txt`, `background_ventoy.png`, `select_c.png`).
-
-## Rust ingredients to replicate / surpass
-
-Most of these already exist in the workspace.
-
-1. **Compositor (extend, don't replace)** — extend
-   `crates/iso-store/src/pxe_logo.rs` to emit per-resolution PNGs
-   (1024x768, 1280x1024, 1920x1080 as the v1 set). `image` +
-   `imageproc` crates handle scaling; `ab_glyph` / `fontdue` for raster
-   text (subtitle, hostname, version). One source SVG/logo, three to
-   five rendered PNGs cached on disk.
-2. **Script generator** — `ipxe_script.rs` already emits
-   `console --picture … || console`. Add a `?res=` query param (or
-   per-MAC client hint persisted in `hosts.json`) and serve the matching
-   PNG plus matching `console --x --y` line. Keep the text-console
-   fallback already in place.
-3. **Resolution selection** — iPXE exposes `${vesa-x}` / `${vesa-y}` on
-   BIOS; UEFI side we can probe firmware vars at chain-time. The simpler
-   v1 is a "low-res / hi-res" toggle in Settings plus a per-host
-   override — mirrors iVentoy's UX, no kernel helper needed. True EDID
-   parsing is overkill for the first cut.
-4. **Chrome upgrades over iVentoy** — iPXE menus are limited (single
-   highlight, no borders). To look distinctly cooler without leaving
-   iPXE: paint border / title / footer **into the PNG**, leave a window
-   in the middle, then `console --left/--right/--top/--bottom` to inset
-   the iPXE menu exactly into that window. ASCII box-drawing inside the
-   menu remains fragile (iPXE mangles non-ASCII on some builds — already
-   noted in `ipxe_script.rs`).
-
-## Recommended architecture for the next OpenPXE release
-
-- Build a `pxe_theme` module beside `pxe_logo.rs`: takes operator logo
-  + theme tokens (accent colour, title, footer) and renders a layered
-  PNG (background gradient → framing chrome → logo → title bar → footer
-  with `${hostname}` / `${version}` / `${ip}`) at the three target
-  resolutions. Cache by hash of inputs.
-- Serve at `/branding/pxe-menu-{w}x{h}.png`. Default 1024x768; expose a
-  Settings dropdown.
-- In `ipxe_script.rs`, emit
-  `console --picture …/pxe-menu-1024x768.png --left 80 --right 80 --top 180 --bottom 60 || console`,
-  then the existing `menu` / `item` / `choose` block — text now lands
-  inside the framed window.
-- Compile iPXE with `CONSOLE_FRAMEBUFFER`, `IMAGE_PNG`, `CONSOLE_CMD`,
-  `CONSOLE_VESAFB` (BIOS) and `CONSOLE_EFIFB` (UEFI). The v0.4.61 image
-  attempted this in-Docker via QEMU emulation and hit `cc1` segfaults.
-  The follow-up will use a Gitea Actions runner pinned to native
-  `linux/amd64` (an Unraid host already exists for this).
-- Stretch goal: a second "theme pack" that ships a layered PNG with
-  subtle scanlines / grid — iPXE can't animate, but a well-designed
-  static composite beats iVentoy's plain centered logo handily.
-
-## Source URLs
-
-- https://github.com/ventoy/PXE
-- https://github.com/ventoy/PXE/tree/master/iPXE
-- https://github.com/ventoy/PXE/issues/11 — 1024x768 default
-- https://github.com/ventoy/PXE/issues/59 — iVentoy iPXE EFI loader
-- https://ipxe.org/cmd/console — `--picture` and compile flags
-- https://github.com/ipxe/ipxe/discussions/945 — background image how-to
-- https://github.com/ipxe/ipxe/discussions/802 — `CONSOLE_FRAMEBUFFER`
-  requirement
-- https://github.com/ipxe/ipxe/discussions/1006 — picture resolution
-  behaviour
-- https://www.iventoy.com/en/doc_edition.html — background / title not
-  user-customisable
-- https://kingtam.win/archives/iventoy.html — third-party iPXE-based
-  iVentoy alternative

docs/superpowers/specs/2026-05-31-saml-sso-and-ui-design.md

@@ -1,199 +0,0 @@
-# OpenPXE v0.5.1 — SAML SSO wiring + Settings/Storage UI consolidation
-
-**Date:** 2026-05-31
-**Author:** Miles Ward (with Claude)
-**Status:** Approved design → implementation
-
-## Summary
-
-Three workstreams for v0.5.1:
-
-1. **Wire SAML 2.0 SSO** end-to-end (currently config is persisted but no runtime
-   sign-in exists). Pure-Rust implementation that preserves the static-musl /
-   no-OpenSSL architecture, mirroring how FleetDM exposes and handles SAML.
-2. **Fold the Advanced sidebar tab into Settings** as a collapsible section.
-3. **Merge the Storage tab's SMB and NFS cards** into one "Remote shares" card
-   with a protocol dropdown.
-
-Then bump `0.5.0 → 0.5.1`, build the static musl image, push `:0.5.1` + `:latest`
-to Gitea, create the release, and scrub registry credentials.
-
-## Decisions (locked with the user)
-
-- **Crypto:** pure-Rust via `bergshamra` (XML-DSig + exclusive c14n, RustCrypto-based,
-  `#![forbid(unsafe_code)]`, ~99% xmlsec interop). `samael` is rejected — it
-  hard-requires OpenSSL/`xmlsec`/`libxml2` C deps, which would break the static
-  musl binary and the project's pure-Rust / no-OpenSSL architecture.
-- **Access model:** any SAML assertion the IdP successfully authenticates and that
-  we cryptographically verify mints a full operator session. No user table, no
-  roles, no domain allowlist. The local admin account remains a guaranteed
-  fallback owner regardless of SSO state.
-- **Flows:** SP-initiated (the "Sign in with <IdP>" button) is always on.
-  IdP-initiated is supported but gated behind an `allow_idp_initiated` toggle
-  (default off), mirroring FleetDM's "Allow SSO login initiated by identity
-  provider."
-
-## Scope boundaries (v0.5.1)
-
-In scope: SP-initiated + (gated) IdP-initiated login, signature verification on the
-SAML Response/Assertion, full SP-side semantic validation, SP metadata endpoint,
-login-page button wiring.
-
-Out of scope (note for later releases): EncryptedAssertion (assertions must be
-unencrypted), signed AuthnRequests (sent unsigned; Keycloak "client signature
-required" must be off), Single Logout (SLO), multi-user accounts / RBAC / JIT role
-mapping.
-
----
-
-## Workstream 1 — SAML SP wiring (pure-Rust)
-
-### New dependencies (workspace)
-
-- `bergshamra` — XML-DSig verification + exclusive c14n (pure Rust).
-- `roxmltree` (read/navigate) and/or `quick-xml` (build/serialize) — parse IdP
-  metadata + SAMLResponse, build AuthnRequest and SP metadata.
-- `x509-parser` — extract the IdP signing certificate / public key from metadata.
-- `flate2` — raw DEFLATE for the HTTP-Redirect binding.
-- `base64` — encode/decode SAMLRequest/SAMLResponse.
-
-All pure-Rust → the `x86_64-unknown-linux-musl` static build stays OpenSSL-free.
-Exact `bergshamra` function signatures (`verify`, `DsigContext`, `KeysManager`,
-`Key`, `VerifiedReference`, `VerifyResult`) will be pinned against the installed
-crate source during implementation.
-
-### Module boundaries
-
-Pure protocol logic lives in `openpxe-core` (no axum dependency, unit-testable);
-HTTP wiring lives in `openpxe-http-api`.
-
-- `crates/core/src/saml/mod.rs` — public surface + shared types
-  (`VerifiedPrincipal { email, display_name, name_id, session_index }`, `SamlError`).
-- `crates/core/src/saml/metadata.rs` — parse IdP `EntityDescriptor`: IdP EntityID,
-  `SingleSignOnService` locations + bindings, and one or more X.509 signing
-  certificates. Also build **our** SP metadata XML.
-- `crates/core/src/saml/authn_request.rs` — build an AuthnRequest, return both the
-  request ID (to track) and the encoded HTTP-Redirect query value
-  (deflate → base64 → URL-encode).
-- `crates/core/src/saml/response.rs` — decode `SAMLResponse` (base64 → XML),
-  **verify the signature via bergshamra** against the IdP cert, then enforce SP
-  semantics, returning `VerifiedPrincipal` or a typed `SamlError`.
-
-### SP-side validation (response.rs)
-
-After a cryptographically valid signature over the Response and/or the Assertion:
-
-1. `Status` is `Success`.
-2. `Destination` (if present) equals our ACS URL.
-3. `Conditions/AudienceRestriction/Audience` equals our SP EntityID.
-4. `NotBefore` / `NotOnOrAfter` within bounds (allow small clock skew, e.g. ±60s).
-5. `InResponseTo` matches an outstanding request we issued (SP-initiated). Absent
-   for IdP-initiated, which is only accepted when `allow_idp_initiated` is true.
-6. Assertion-ID replay guard: reject a previously consumed assertion ID.
-7. NameID is the email (`nameid-format:emailAddress`). Display name read from
-   common attributes (`name`, `displayname`, `cn`, `urn:oid:2.5.4.3`).
-
-XML Signature Wrapping (XSW) defenses come from bergshamra (duplicate-ID rejection,
-strict positional verification); enable its strict verification options. We
-additionally confirm the verified `Reference` covers the element we read claims from.
-
-### State (in `openpxe-http-api`)
-
-Two small TTL-pruned in-memory stores (parking_lot `Mutex<HashMap<...>>`):
-
-- **Outstanding requests:** `request_id → issued_at`, TTL ≈ 5 min, for `InResponseTo`.
-- **Consumed assertions:** `assertion_id → expires_at`, TTL = assertion validity,
-  for replay protection.
-
-(In-memory is acceptable: a single-container app; a restart simply invalidates
-in-flight logins.)
-
-### Routes (all pre-auth; added to the public allowlist in the auth middleware)
-
-- `GET /api/sso/login` → build AuthnRequest, record its ID, 302 to the IdP SSO URL
-  (HTTP-Redirect binding) with `SAMLRequest` + `RelayState`.
-- `POST /api/sso/acs` → consume `SAMLResponse` (form-encoded). Verify + validate.
-  On success: `SessionStore::create(email)`, set the `openpxe_session` cookie
-  (same attributes as forms login), 302 to the dashboard. On failure: 302 back to
-  the login page with an error indicator. (Mirrors FleetDM's `/sso/callback`.)
-- `GET /api/sso/metadata` → serve our SP `EntityDescriptor` XML for IdP import.
-
-### Config changes (`crates/core/src/sso.rs`)
-
-Add to `SsoConfig` (preserve existing fields + validation):
-
-- `entity_id: String` — SP Entity ID (mirrors FleetDM's "Entity ID"); defaults to
-  the configured public base URL. The ACS URL is derived as
-  `<public_base_url>/api/sso/acs`.
-- `allow_idp_initiated: bool` — default `false`.
-
-`GET /api/sso` returns the new fields; `PUT /api/sso` validates and persists them.
-
-### Login page (`crates/webui/src/app.js`)
-
-Replace the "configured · runtime pending" message: the existing
-"Sign in with <IdP>" button navigates to `GET /api/sso/login`. Render the IdP logo
-(if `idp_logo_url` set) and use `idp_name` as the label. Keep the existing
-FleetDM-style login layout.
-
-### Testing
-
-- `core/saml` unit tests using a self-signed test keypair we control:
-  - Parse representative Keycloak IdP metadata → correct SSO URL + cert.
-  - Build an AuthnRequest → well-formed, deflate/base64 round-trips, ID recorded.
-  - A correctly signed Response → `VerifiedPrincipal { email, .. }`.
-  - Reject: tampered signature, expired (`NotOnOrAfter`), wrong audience,
-    replayed assertion ID, unsigned response, `Status != Success`.
-- `http-api` integration test: `GET /api/sso/login` returns a 302 with a
-  `SAMLRequest` query param; a crafted signed `SAMLResponse` POSTed to
-  `/api/sso/acs` (signed with the test key) sets an `openpxe_session` cookie.
-
----
-
-## Workstream 2 — Advanced tab → Settings
-
-- Remove the `Advanced` sidebar entry (`crates/webui/src/index.html`) and its
-  `advanced` view route in `app.js`.
-- In the Settings view, append a **collapsible "Advanced" disclosure**
-  (default-collapsed) at the bottom containing the existing **Webhook
-  Notifications** card and the **API reference** block (moved out of the removed
-  Advanced view).
-- No backend changes; `/api/notify*` and `/api/docs` endpoints are unchanged.
-
----
-
-## Workstream 3 — Storage: merge SMB + NFS → "Remote shares"
-
-- Replace the separate "SMB shares" and "NFS shares" cards with a single
-  **"Remote shares"** card:
-  - One add-form with a **protocol dropdown (SMB / NFS)**. Selecting the protocol
-    swaps the fields: SMB → server, share, guest checkbox, username, password;
-    NFS → server, export path.
-  - One unified table with a leading **Protocol** column (SMB/NFS badge), then
-    server/share-or-export, auth, ISO count, reachability, and Re-scan / Remove
-    actions.
-- **No backend changes.** The form dispatches to the existing
-  `POST /api/smb-shares` or `POST /api/nfs-shares`; the table merges
-  `GET /api/smb-shares` + `GET /api/nfs-shares`, tagging each row with its
-  protocol. Re-scan/Remove call the existing per-protocol endpoints.
-- Leaves the card pattern open for a future "Config files" card.
-
----
-
-## Release
-
-1. Bump workspace version `0.5.0 → 0.5.1` (`Cargo.toml`).
-2. `cargo fmt`, `cargo clippy`, `cargo test` (all crates) green.
-3. Build the static musl binary + Docker image; verify SAML deps compile clean
-   under musl (no OpenSSL/C linkage).
-4. Push `openpxe:0.5.1` + `openpxe:latest` to Gitea via the established
-   temp-DOCKER_CONFIG pipeline; scrub credentials (logout + verify no token traces).
-5. Create the Gitea release `v0.5.1` with notes.
-
-## Risks
-
-- `bergshamra` is pre-1.0 and unaudited. Mitigation: pin the version, enable strict
-  verification, keep the local-admin fallback, and own the SP-semantic checks
-  carefully (audience/Conditions/replay/InResponseTo — where SP vulns usually live).
-- SAML is security-sensitive; negative tests (tamper/expiry/audience/replay/unsigned)
-  are part of the definition of done, not optional.

scripts/build-ipxe.sh

@@ -1,74 +0,0 @@
-#!/usr/bin/env bash
-# Build PNG-enabled iPXE binaries from source.
-#
-# Why from source: the official boot.ipxe.org binaries (and the
-# Debian-packaged ones) are NOT built with CONSOLE_FRAMEBUFFER +
-# IMAGE_PNG + CONSOLE_CMD, so `console --picture` is a no-op on them —
-# you can't paint a graphical boot-menu background. iVentoy solves this
-# by shipping its own iPXE build with exactly those three flags; we do
-# the same, from upstream iPXE, with a thin auditable config delta
-# (deploy/ipxe/local/{general,console}.h).
-#
-# Why a real cross-compiler instead of QEMU: building amd64 iPXE by
-# emulating an amd64 gcc under QEMU on an arm64 host intermittently
-# segfaults cc1 (the reason this was stuck for ~8 releases). Running a
-# NATIVE arm64 gcc that cross-targets x86_64 (CROSS_COMPILE=
-# x86_64-linux-gnu-) sidesteps emulation entirely — the compiler is a
-# native binary, it just emits x86_64 objects. This stage is meant to
-# run on $BUILDPLATFORM (the native builder arch), NOT the emulated
-# target platform.
-#
-# Outputs (into $DEST), using the filenames OpenPXE's arch mapping
-# expects:
-#   snponly.efi   x86_64 UEFI, PNG-enabled
-#   ipxe.efi      x86_64 UEFI, PNG-enabled (bundled drivers)
-#
-# We build ONLY x86_64 UEFI, always via the x86_64 cross toolchain
-# (`x86_64-linux-gnu-gcc`). That's deliberately host-arch-agnostic: it
-# works whether this stage runs on an arm64 Mac builder or an amd64 CI
-# runner, because the cross compiler runs native and emits x86_64
-# either way. Building arm64-efi or BIOS here would re-introduce a
-# dependency on the host arch (native arm64 build) or a 32-bit multilib
-# toolchain — so those arches keep their upstream-fetched (no-PNG)
-# binaries and fall back to the menu's clean `|| console` text screen.
-# Modern PXE clients are overwhelmingly x86_64 UEFI, which get the full
-# graphical background.
-
-set -euo pipefail
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd)"
-DEST="${1:-$ROOT/assets/ipxe}"
-WORK="$(mktemp -d)"
-trap 'rm -rf "$WORK"' EXIT
-
-# Pinned upstream iPXE. Rolling master is fine functionally, but a pin
-# keeps builds reproducible and protects against a transient master
-# breakage. Bump deliberately.
-IPXE_REPO="https://github.com/ipxe/ipxe.git"
-IPXE_REF="${IPXE_REF:-master}"
-
-echo ">> cloning iPXE ($IPXE_REF)"
-git clone --depth 1 --branch "$IPXE_REF" "$IPXE_REPO" "$WORK/ipxe" 2>/dev/null \
-  || git clone "$IPXE_REPO" "$WORK/ipxe"
-SRC="$WORK/ipxe/src"
-
-echo ">> applying OpenPXE config overrides (PNG + framebuffer + console cmd)"
-mkdir -p "$SRC/config/local"
-cp "$ROOT/deploy/ipxe/local/general.h" "$SRC/config/local/general.h"
-cp "$ROOT/deploy/ipxe/local/console.h" "$SRC/config/local/console.h"
-
-mkdir -p "$DEST"
-
-# x86_64 UEFI — cross-compiled with the native arm64 gcc targeting
-# x86_64. HOST_CC stays the native cc for iPXE's build-time utilities
-# (elf2efi, zbin, …); only the target objects use the cross compiler.
-echo ">> building x86_64 UEFI (snponly.efi, ipxe.efi)"
-make -C "$SRC" -j"$(nproc)" \
-  CROSS_COMPILE=x86_64-linux-gnu- \
-  bin-x86_64-efi/snponly.efi \
-  bin-x86_64-efi/ipxe.efi
-cp "$SRC/bin-x86_64-efi/snponly.efi" "$DEST/snponly.efi"
-cp "$SRC/bin-x86_64-efi/ipxe.efi"    "$DEST/ipxe.efi"
-
-echo ">> iPXE build complete:"
-ls -l "$DEST"/snponly.efi "$DEST"/ipxe.efi