v0.4.4: Settings tab, API reference, ISO category, branding, disk space

Settings:
- New top-level Settings tab. Carries a placeholder for the planned
  LDAP / OIDC / user-management work, the new branding controls, and
  the API reference at the bottom.
- Custom logo upload (PNG/SVG/JPEG/WebP/GIF up to 2 MB) replaces the
  bundled brand mark via /assets/logo.svg; bytes live at
  <work_dir>/branding/ and survive restart. The original "OpenPXE
  v<x.y.z>" pins to the sidebar footer for support.
- API reference rendered from a new GET /api/docs into a per-method
  coloured pill list grouped by area.

ISO category (Storage):
- New IsoCategory { Os, Tools } on IsoMeta with PUT
  /api/isos/:id/category. Storage table's Type cell becomes a
  dropdown; selecting Tools moves the ISO into the Tools submenu next
  to memtest / shell / NIC info and removes it from the OS Installers
  family submenu. Family detection still drives BIOS/UEFI / kernel
  args; only the menu placement changes.

Storage telemetry:
- New IsoStore::disk_usage (libc::statvfs, lives in iso-store so the
  http-api crate stays #![forbid(unsafe_code)]) and GET
  /api/storage/disk. The Storage tab now shows free/used/total for
  the volume hosting the ISO directory with an 80%/95% colour ramp.

UI polish:
- Brand block in the sidebar now matches the topbar height exactly,
  so the divider runs straight across the top of the app rather than
  stepping; version label moved out of the brand and pinned to the
  sidebar footer ("OpenPXE v0.4.4").
- Light-mode terminal: --terminal-bg + per-level text colours track
  the active theme rather than being hard-coded dark.
- About: lead paragraph spans the full content width; new Docs row
  links to https://openpxe.com/.

106 tests passing (was 89 in v0.4.1, +17 across branding unit tests
and new integration coverage for category / disk / docs / branding).
cargo clippy --workspace --all-targets clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

.gitignore

@@ -1,5 +1,4 @@
 /target
-Cargo.lock
 data/isos/*.iso
 data/isos/*.partial
 data/isos/*.meta.json
@@ -11,3 +10,4 @@ data/work/
 # settings.local.json is your personal allowlist history and shouldn't be).
 .claude/settings.local.json
 .claude/worktrees/
+.claude/scheduled_tasks.lock

Cargo.toml

@@ -8,16 +8,16 @@ members = [
     "crates/iso-store",
     "crates/ipxe-assets",
     "crates/webui",
-    "crates/pxeforge",
+    "crates/openpxe",
 ]
 
 [workspace.package]
-version = "0.2.0"
+version = "0.4.4"
 edition = "2021"
-rust-version = "1.80"
+rust-version = "1.95"
 license = "MIT OR Apache-2.0"
-repository = "https://github.com/casperadmin/PXEForge"
-authors = ["PXEForge contributors"]
+repository = "https://gitea.milesward.dev/mward4/OpenPXE"
+authors = ["OpenPXE contributors"]
 
 [workspace.dependencies]
 tokio = { version = "1.40", features = ["full"] }
@@ -53,17 +53,18 @@ uuid = { version = "1.10", features = ["v4", "serde"] }
 time = { version = "0.3", features = ["serde", "serde-human-readable", "formatting", "macros"] }
 sha2 = "0.10"
 hex = "0.4"
+bcrypt = "0.15"
 once_cell = "1.19"
 parking_lot = "0.12"
 rust-embed = { version = "8.5", features = ["include-exclude"] }
 
-pxeforge-core = { path = "crates/core" }
-pxeforge-dhcp-proxy = { path = "crates/dhcp-proxy" }
-pxeforge-tftp = { path = "crates/tftp" }
-pxeforge-http-api = { path = "crates/http-api" }
-pxeforge-iso-store = { path = "crates/iso-store" }
-pxeforge-ipxe-assets = { path = "crates/ipxe-assets" }
-pxeforge-webui = { path = "crates/webui" }
+openpxe-core = { path = "crates/core" }
+openpxe-dhcp-proxy = { path = "crates/dhcp-proxy" }
+openpxe-tftp = { path = "crates/tftp" }
+openpxe-http-api = { path = "crates/http-api" }
+openpxe-iso-store = { path = "crates/iso-store" }
+openpxe-ipxe-assets = { path = "crates/ipxe-assets" }
+openpxe-webui = { path = "crates/webui" }
 
 [workspace.lints.rust]
 unsafe_code = "deny"

README.md

@@ -1,16 +1,16 @@
-# PXEForge
+# OpenPXE
 
 Container-native PXE boot server. A Rust reimplementation of
 [iVentoy (ventoy/PXE)](https://github.com/ventoy/PXE), designed from scratch
 for Docker/OCI and OpenShift. Upload `.iso` files via the web UI; network
 clients PXE-boot them.
 
-> **Status:** v0.2.0 / pre-beta. Phases 1–5 complete: full PXE stack,
-> Gated Deployment queue, NFS-share ISO sources, live tracing log + an
-> operator terminal, per-MAC host bindings (Tinkerbell-style),
-> Prometheus `/metrics`, light/dark theme toggle, animated anvil
-> imaging-progress widget. **66 tests passing**, clippy clean. Ready
-> for real-hardware validation.
+> **Status:** v0.4.1 / pre-beta. Phases 1–5 complete: full PXE stack,
+> Queued Deployment queue, NFS-share ISO sources, live tracing log + an
+> operator terminal, per-MAC host bindings, Prometheus `/metrics`,
+> light/dark theme toggle, animated OpenPXE imaging-progress widget,
+> chunked ISO uploads, and per-ISO boot passwords. The test suite and
+> clippy are part of the release checklist. Ready for real-hardware validation.
 
 ## Design non-negotiables
 
@@ -38,27 +38,26 @@ clients PXE-boot them.
    ```
    Default        > Boot from Local HDD
    Installers     > Linux Installers  / Windows Installers
-   Tools          > Utilities / PXEForge Shell / Network Card Info
-   Gated Deployment
+   Tools          > Utilities / OpenPXE Shell / Network Card Info
+   Queued Deployment
    ```
-6. **Gated Deployment queue** — the "horse race gate" flow. A client that
-   selects *Gated Deployment* gets a numbered position and waits. The
+6. **Queued Deployment queue** — the coordinated launch flow. A client that
+   selects *Queued Deployment* gets a numbered position and waits. The
    operator picks an ISO in the web UI and fires it to every waiting
    client simultaneously.
-7. **Web UI** (Netbox-style): sidebar nav (Dashboard / Network / Forge
-   Gate / Storage / Hosts / Terminal / About), light + dark themes
-   (toggle top-right or press `T`), animated anvil "forge progress"
+7. **Web UI** (Netbox-style): sidebar nav (Dashboard / Network / Queue /
+   Storage / Hosts / Terminal / About), light + dark themes
+   (toggle top-right or press `T`), animated OpenPXE progress
    widget when devices are imaging. All assets served from the binary —
    no external requests.
 8. **Per-MAC host bindings.** Pin a MAC to a boot target and the client
-   skips the menu, chains straight through. Inspired by Tinkerbell's
-   `smee` MAC-prepended URL pattern.
+   skips the menu, chains straight through.
 9. **Prometheus metrics** at `/metrics` — DHCP replies by arch, TFTP
-   transfer counts and bytes, HTTP request counts by route, gate /
+   transfer counts and bytes, HTTP request counts by route, queue /
    imaging gauges, uptime, build info. Plain text exposition format,
    no external metrics framework dependency.
 8. **Settings API** lets you change the default boot-menu timeout (default
-   600s), the timeout action (stay / Local HDD / Gated Deployment), and
+   600s), the timeout action (stay / Local HDD / Queued Deployment), and
    feature toggles like Windows ISO support. The iPXE scripts regenerate
    on every request using current settings.
 
@@ -81,17 +80,17 @@ skip TFTP and respond with an HTTP URL.
 ./scripts/fetch-ipxe.sh
 
 # 2. Build the container image (~3 min first time).
-docker buildx build -f deploy/docker/Dockerfile -t pxeforge:0.1.0 --load .
+docker buildx build -f deploy/docker/Dockerfile -t openpxe:0.4.1 --load .
 
 # 3. Run it on the box plugged into your PXE network. Set PUBLIC_IP to
 #    this host's LAN address so advertised iPXE URLs are reachable.
-docker run -d --name pxeforge \
+docker run -d --name openpxe \
   --network host \
-  -e PXEFORGE_PUBLIC_IP=10.0.0.5 \
-  -e PXEFORGE_DHCP_MODE=proxy \
-  -v $PWD/data/isos:/var/lib/pxeforge/isos \
-  -v $PWD/data/work:/var/lib/pxeforge/work \
-  pxeforge:0.1.0
+  -e OPENPXE_PUBLIC_IP=10.0.0.5 \
+  -e OPENPXE_DHCP_MODE=proxy \
+  -v $PWD/data/isos:/var/lib/openpxe/isos \
+  -v $PWD/data/work:/var/lib/openpxe/work \
+  openpxe:0.4.1
 
 # 4. Open the UI and drop an ISO in.
 open http://10.0.0.5
@@ -99,16 +98,16 @@ open http://10.0.0.5
 
 Host networking is required in proxy mode so the container sees DHCPDISCOVER
 broadcasts from the PXE VLAN. On macOS/Windows hosts Docker runs in a Linux
-VM, so "host" means the VM — use `pxeforge-dev` in `docker-compose.yml` for
+VM, so "host" means the VM — use `openpxe-dev` in `docker-compose.yml` for
 API-only testing on a laptop.
 
 ### Quick start — docker compose
 
 ```bash
 # MVP / API testing on a laptop (no DHCP, high ports):
-PXEFORGE_PUBLIC_IP=127.0.0.1 docker compose up pxeforge-dev
+OPENPXE_PUBLIC_IP=127.0.0.1 docker compose up openpxe-dev
 # Real PXE deployment on a Linux host (host network, DHCP proxy on):
-PXEFORGE_PUBLIC_IP=10.0.0.5  docker compose up pxeforge
+OPENPXE_PUBLIC_IP=10.0.0.5  docker compose up openpxe
 ```
 
 ### Multi-arch build + push
@@ -117,12 +116,12 @@ For deploying to x86_64 servers, build both arches in one manifest:
 
 ```bash
 # One-time: bootstrap a multi-arch builder.
-docker buildx create --name pxeforge-multi --driver docker-container --use
+docker buildx create --name openpxe-multi --driver docker-container --use
 
 # Build + push both linux/amd64 and linux/arm64 under one tag.
-docker buildx build --builder pxeforge-multi \
+docker buildx build --builder openpxe-multi \
   --platform linux/amd64,linux/arm64 \
-  -t ghcr.io/YOUR-ORG/pxeforge:0.1.0 \
+  -t ghcr.io/YOUR-ORG/openpxe:0.4.1 \
   --push \
   -f deploy/docker/Dockerfile .
 ```
@@ -153,31 +152,31 @@ same pipeline the web UI uses (introspection + boot-entry generation):
 ```bash
 docker run --rm \
   -v /my/iso-library:/seed:ro \
-  -v pxeforge-data:/var/lib/pxeforge/isos \
-  -e PXEFORGE_PUBLIC_IP=10.0.0.5 \
-  pxeforge:0.1.0 seed --from /seed
+  -v openpxe-data:/var/lib/openpxe/isos \
+  -e OPENPXE_PUBLIC_IP=10.0.0.5 \
+  openpxe:0.4.1 seed --from /seed
 
 # Dry run first to see what would be imported:
-docker run --rm -v /my/iso-library:/seed:ro pxeforge:0.1.0 seed --from /seed --dry-run
+docker run --rm -v /my/iso-library:/seed:ro openpxe:0.4.1 seed --from /seed --dry-run
 ```
 
 ### Environment overrides
 
 | Var                    | Default                     | Meaning                                |
 |------------------------|-----------------------------|----------------------------------------|
-| `PXEFORGE_HTTP_PORT`   | `80`                        | Web UI + boot script HTTP port         |
-| `PXEFORGE_TFTP_PORT`   | `69`                        | TFTP port                              |
-| `PXEFORGE_DHCP_PORT`   | `67`                        | DHCP server-side port                  |
-| `PXEFORGE_DHCP_MODE`   | `proxy`                     | `proxy` or `disabled`                  |
-| `PXEFORGE_PUBLIC_IP`   | auto-detect                 | Advertised IP for clients. Startup **fails** if unset and auto-detect returns loopback. |
-| `PXEFORGE_ISO_DIR`     | `/var/lib/pxeforge/isos`    | Where uploaded ISOs live               |
-| `PXEFORGE_WORK_DIR`    | `/var/lib/pxeforge/work`    | Scratch + runtime settings             |
-| `PXEFORGE_LOG`         | `info,pxeforge=debug`       | `tracing` filter                       |
+| `OPENPXE_HTTP_PORT`   | `80`                        | Web UI + boot script HTTP port         |
+| `OPENPXE_TFTP_PORT`   | `69`                        | TFTP port                              |
+| `OPENPXE_DHCP_PORT`   | `67`                        | DHCP server-side port                  |
+| `OPENPXE_DHCP_MODE`   | `proxy`                     | `proxy` or `disabled`                  |
+| `OPENPXE_PUBLIC_IP`   | auto-detect                 | Advertised IP for clients. Startup **fails** if unset and auto-detect returns loopback. |
+| `OPENPXE_ISO_DIR`     | `/var/lib/openpxe/isos`    | Where uploaded ISOs live               |
+| `OPENPXE_WORK_DIR`    | `/var/lib/openpxe/work`    | Scratch + runtime settings             |
+| `OPENPXE_LOG`         | `info,openpxe=debug`       | `tracing` filter                       |
 
 ## What the boot menu looks like on a real client
 
 ```
-                        PXEForge - network boot menu
+                        OpenPXE - network boot menu
 
  ------------------------- Default -------------------------
  Boot from Local HDD
@@ -188,14 +187,14 @@ docker run --rm -v /my/iso-library:/seed:ro pxeforge:0.1.0 seed --from /seed --d
  Tools              >                Utilities / Shell /
                                      NIC Info / Reboot /
                                      Exit and continue BIOS
- ---------------------- Gated Deployment ------------------
- Gated Deployment   (join queue)
+ ---------------------- Queued Deployment ------------------
+ Queued Deployment   (join queue)
 ```
 
 Linux/Windows submenus show file sizes iVentoy-style:
 
 ```
-                   PXEForge - Linux Installers
+                   OpenPXE - Linux Installers
 
  [  4376 MB]  CentOS-7-x86_64-DVD-1810
  [  2002 MB]  Fedora-Workstation-Live-x86_64-38-1.6
@@ -210,8 +209,8 @@ ISOs you upload via drag-and-drop in the web UI plus toggles in Settings.
 
 ```bash
 oc apply -f deploy/openshift/
-oc -n pxeforge get all
-oc -n pxeforge get route pxeforge -o jsonpath='{.spec.host}'
+oc -n openpxe get all
+oc -n openpxe get route openpxe -o jsonpath='{.spec.host}'
 ```
 
 ### Why a custom SCC?
@@ -219,7 +218,7 @@ oc -n pxeforge get route pxeforge -o jsonpath='{.spec.host}'
 The default `restricted-v2` blocks `hostNetwork` and all capabilities. PXE
 cannot work without host network (CNI overlays don't deliver L2 broadcast
 into pod netns), and we need `NET_BIND_SERVICE` to bind <1024. The custom
-`pxeforge-scc` grants exactly those two and nothing else. No raw sockets,
+`openpxe-scc` grants exactly those two and nothing else. No raw sockets,
 no privileged mode — proxy-mode DHCP sidesteps the usual requirements.
 
 ### What's on host ports
@@ -239,7 +238,7 @@ the node's host IP directly for UDP.
 Enabled by toggling **Windows ISO support** under Settings. The flow:
 
 1. Upload a stock Microsoft Windows install ISO (vanilla, no pre-processing).
-2. On upload, PXEForge extracts the ISO and uses `wimlib-imagex` to rewrite
+2. On upload, OpenPXE extracts the ISO and uses `wimlib-imagex` to rewrite
    image index 2 (WinPE) of `sources/boot.wim`. It injects exactly two
    plain-text files:
    - `Windows/System32/winpeshl.ini` — tells WinPE to run `startnet.cmd`.
@@ -271,22 +270,23 @@ operational constraints inherited from the design:
 - Hardware with NICs/storage controllers missing from WinPE's bundled
   drivers will need a driver-pack injection step (not yet implemented).
 
-## Gated Deployment
+## Queued Deployment
 
-The "horse race gate" flow, end to end:
+The coordinated launch flow, end to end:
 
-1. A client boots and picks **Gated Deployment** in the PXE menu (or falls
+1. A client boots and picks **Queued Deployment** in the PXE menu (or falls
    through on timeout with the default `timeout_action`).
-2. The client joins the queue, gets a numbered gate position, and enters a
+2. The client joins the queue, gets a numbered queue position, and enters a
    long-poll loop (25s per request, auto-renewed).
-3. In the web UI's **Gated Deployment** tab, the operator sees each waiting
+3. In the web UI's **Queued Deployment** tab, the operator sees each waiting
    client with its MAC, IP, arch, and position.
 4. The operator selects an image and clicks **Launch for all waiting**.
-   The server broadcasts the assignment to every gated client via a
+   The server broadcasts the assignment to every queued client via a
    `tokio::sync::Notify`; each client's next poll returns the boot script
    for the chosen image.
-5. Every client chains the same image at effectively the same moment — the
-   gate opens and the horses run together.
+5. Every client chains the same image at effectively the same moment. The
+   queue stays visible until the operator releases entries, which keeps a
+   useful audit trail during hardware testing.
 
 No user-facing iPXE anywhere in this flow. The client only ever runs
 scripts we generate; the operator only interacts with the web UI.

crates/core/Cargo.toml

@@ -1,10 +1,10 @@
 [package]
-name = "pxeforge-core"
+name = "openpxe-core"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
 authors.workspace = true
-description = "Shared types, config, and arch detection for PXEForge"
+description = "Shared types, config, and arch detection for OpenPXE"
 
 [lints]
 workspace = true

crates/core/src/arch.rs

@@ -126,7 +126,10 @@ mod tests {
     fn bootfile_names_stable() {
         assert_eq!(ClientArch::LegacyX86.ipxe_bootfile(), Some("undionly.kpxe"));
         assert_eq!(ClientArch::X64Uefi.ipxe_bootfile(), Some("snponly.efi"));
-        assert_eq!(ClientArch::Arm64Uefi.ipxe_bootfile(), Some("snponly-arm64.efi"));
+        assert_eq!(
+            ClientArch::Arm64Uefi.ipxe_bootfile(),
+            Some("snponly-arm64.efi")
+        );
         assert_eq!(ClientArch::Unknown(0xFFFF).ipxe_bootfile(), None);
     }
 

crates/core/src/boot_log.rs

@@ -0,0 +1,249 @@
+//! Boot-event log — "who installed what, when, from where".
+//!
+//! Each `/boot/<entry>.ipxe` fetch that actually goes on to serve a boot
+//! script lands an entry here. The log is bounded in memory (newest-first,
+//! ring-buffered at [`BootLog::CAP`]) and is mirrored append-only to
+//! `<work_dir>/boot_log.jsonl`. Mirrors `HostBindings`'s "in-memory is
+//! authoritative, disk is a cache" policy — a corrupt log file should
+//! never block PXE for the network.
+//!
+//! We deliberately don't push these onto the `LogBus` (the operator
+//! terminal stream). The terminal already shows the http traces; the
+//! Host log is a curated, persistent, easy-to-scan view of "what got
+//! imaged on what hardware" and conflating the two would be noisy.
+
+use parking_lot::RwLock;
+use serde::{Deserialize, Serialize};
+use std::collections::VecDeque;
+use std::io::Write;
+use std::net::IpAddr;
+use std::path::PathBuf;
+use std::sync::Arc;
+use time::OffsetDateTime;
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct BootEvent {
+    #[serde(with = "time::serde::rfc3339")]
+    pub timestamp: OffsetDateTime,
+    /// Lowercase, colon-separated. `None` when iPXE didn't supply
+    /// `?mac=${mac}` in the chain URL (older bookmarks, custom scripts).
+    pub mac: Option<String>,
+    /// Connecting peer's IP — taken from the TCP socket when available
+    /// (PXE clients connect direct, no reverse proxy), and falls back to
+    /// `X-Forwarded-For` for the rare case where one is present.
+    pub ip: Option<IpAddr>,
+    /// `BootEntry::id` — the same id used in `/boot/<id>.ipxe`.
+    pub target_id: String,
+    /// Human-friendly label: the ISO's filename / volume label / entry
+    /// title. Pre-resolved at log time so the UI can render without
+    /// joining against the ISO store (and so "what image was installed?"
+    /// survives the operator deleting the ISO later).
+    pub target_title: String,
+}
+
+/// In-memory ring + disk-backed append log of boot events. Cheap to
+/// clone; the inner state is `Arc<RwLock<_>>`.
+#[derive(Debug, Clone)]
+pub struct BootLog {
+    path: Arc<PathBuf>,
+    inner: Arc<RwLock<VecDeque<BootEvent>>>,
+}
+
+impl BootLog {
+    /// Newest entries we retain in memory. Past this, the oldest gets
+    /// evicted — the on-disk JSONL keeps the full history for offline
+    /// inspection. 500 covers a typical install-day's worth without
+    /// turning the Hosts tab into a wall of text.
+    pub const CAP: usize = 500;
+
+    /// Load up to `CAP` newest events from `<work_dir>/boot_log.jsonl`,
+    /// or start empty if the file is missing / unreadable.
+    #[must_use]
+    pub fn load_or_default(work_dir: &std::path::Path) -> Self {
+        let path = work_dir.join("boot_log.jsonl");
+        let mut events = VecDeque::with_capacity(Self::CAP);
+        if let Ok(text) = std::fs::read_to_string(&path) {
+            for line in text.lines() {
+                if line.trim().is_empty() {
+                    continue;
+                }
+                match serde_json::from_str::<BootEvent>(line) {
+                    Ok(ev) => {
+                        if events.len() == Self::CAP {
+                            events.pop_front();
+                        }
+                        events.push_back(ev);
+                    }
+                    Err(e) => {
+                        tracing::warn!(
+                            target: "openpxe::boot_log",
+                            "skipping unparseable boot_log line: {e}"
+                        );
+                    }
+                }
+            }
+        }
+        Self {
+            path: Arc::new(path),
+            inner: Arc::new(RwLock::new(events)),
+        }
+    }
+
+    /// Append an event. Persistence is best-effort and never blocks the
+    /// caller on a failed write (the in-memory copy is the source of
+    /// truth for the live UI; the JSONL is just for crash survival).
+    pub fn record(&self, ev: &BootEvent) {
+        // Push into the ring first so a slow / failing disk doesn't lose
+        // events for the live UI.
+        {
+            let mut g = self.inner.write();
+            if g.len() == Self::CAP {
+                g.pop_front();
+            }
+            g.push_back(ev.clone());
+        }
+        tracing::info!(
+            target: "openpxe::boot_log",
+            mac = ev.mac.as_deref().unwrap_or("?"),
+            ip = ev.ip.map(|i| i.to_string()).as_deref().unwrap_or("?"),
+            target = %ev.target_id,
+            "boot event"
+        );
+        // Append to disk. We tolerate write failures — they'd show up as
+        // missing entries on the next restart only.
+        let mut line = match serde_json::to_string(ev) {
+            Ok(s) => s,
+            Err(e) => {
+                tracing::warn!(target: "openpxe::boot_log", "serialize boot event: {e}");
+                return;
+            }
+        };
+        line.push('\n');
+        if let Some(parent) = self.path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        match std::fs::OpenOptions::new()
+            .create(true)
+            .append(true)
+            .open(self.path.as_path())
+        {
+            Ok(mut f) => {
+                if let Err(e) = f.write_all(line.as_bytes()) {
+                    tracing::warn!(target: "openpxe::boot_log", "append boot_log.jsonl: {e}");
+                }
+            }
+            Err(e) => {
+                tracing::warn!(target: "openpxe::boot_log", "open boot_log.jsonl: {e}");
+            }
+        }
+    }
+
+    /// Newest-first snapshot, up to `CAP` entries.
+    #[must_use]
+    pub fn list(&self) -> Vec<BootEvent> {
+        let g = self.inner.read();
+        // VecDeque preserves insertion order; reverse so newest is first.
+        g.iter().rev().cloned().collect()
+    }
+
+    #[must_use]
+    pub fn len(&self) -> usize {
+        self.inner.read().len()
+    }
+
+    #[must_use]
+    pub fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+
+    /// Wipe in-memory + the on-disk file. Used by the `terminal clear`
+    /// equivalent or future operator action; not currently wired to a UI
+    /// button but exposed for completeness.
+    pub fn clear(&self) {
+        self.inner.write().clear();
+        let _ = std::fs::remove_file(self.path.as_path());
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::tempdir;
+
+    fn ev(target: &str, mac: Option<&str>) -> BootEvent {
+        BootEvent {
+            timestamp: OffsetDateTime::now_utc(),
+            mac: mac.map(str::to_string),
+            ip: Some("10.0.0.42".parse().unwrap()),
+            target_id: target.into(),
+            target_title: format!("{target}.iso"),
+        }
+    }
+
+    #[test]
+    fn record_then_list_is_newest_first() {
+        let dir = tempdir().unwrap();
+        let log = BootLog::load_or_default(dir.path());
+        assert!(log.is_empty());
+        log.record(&ev("alpha", Some("aa:bb:cc:00:00:01")));
+        log.record(&ev("beta", Some("aa:bb:cc:00:00:02")));
+        let list = log.list();
+        assert_eq!(list.len(), 2);
+        assert_eq!(list[0].target_id, "beta");
+        assert_eq!(list[1].target_id, "alpha");
+    }
+
+    #[test]
+    fn round_trip_through_disk() {
+        let dir = tempdir().unwrap();
+        let log = BootLog::load_or_default(dir.path());
+        log.record(&ev("alpha", Some("aa:bb:cc:00:00:01")));
+        log.record(&ev("beta", None));
+        drop(log);
+        let log2 = BootLog::load_or_default(dir.path());
+        assert_eq!(log2.len(), 2);
+        let list = log2.list();
+        assert_eq!(list[0].target_id, "beta");
+        assert_eq!(list[1].target_id, "alpha");
+        assert!(list[0].mac.is_none());
+        assert_eq!(list[1].mac.as_deref(), Some("aa:bb:cc:00:00:01"));
+    }
+
+    #[test]
+    fn ring_evicts_oldest_past_cap() {
+        let dir = tempdir().unwrap();
+        let log = BootLog::load_or_default(dir.path());
+        for i in 0..(BootLog::CAP + 5) {
+            log.record(&ev(&format!("e{i}"), None));
+        }
+        assert_eq!(log.len(), BootLog::CAP);
+        let list = log.list();
+        // Newest first; the most recent push is the last index inserted.
+        assert_eq!(list[0].target_id, format!("e{}", BootLog::CAP + 4));
+        // Oldest in-memory should be the 6th push (0..5 were evicted).
+        assert_eq!(list[BootLog::CAP - 1].target_id, "e5");
+    }
+
+    #[test]
+    fn clear_wipes_memory_and_disk() {
+        let dir = tempdir().unwrap();
+        let log = BootLog::load_or_default(dir.path());
+        log.record(&ev("alpha", None));
+        log.clear();
+        assert!(log.is_empty());
+        let log2 = BootLog::load_or_default(dir.path());
+        assert!(log2.is_empty());
+    }
+
+    #[test]
+    fn corrupt_disk_lines_are_skipped_not_fatal() {
+        // Write a file with one valid + one garbage line; loader should
+        // surface the valid one and skip the garbage.
+        let dir = tempdir().unwrap();
+        let path = dir.path().join("boot_log.jsonl");
+        let valid = serde_json::to_string(&ev("ok", Some("aa:bb:cc:00:00:09"))).unwrap();
+        std::fs::write(&path, format!("{valid}\nNOT_JSON\n{valid}\n")).unwrap();
+        let log = BootLog::load_or_default(dir.path());
+        assert_eq!(log.len(), 2);
+    }
+}

crates/core/src/branding.rs

@@ -0,0 +1,339 @@
+//! Operator-controlled branding overrides.
+//!
+//! The browser tab's logo (`/assets/logo.svg`) defaults to the bundled
+//! rainbow-horizon mark. Operators who deploy OpenPXE behind their own
+//! branding can upload a replacement that lives at
+//! `<work_dir>/branding/logo.<ext>` and is served in preference to the
+//! bundled SVG when present. Borrowed-from-FleetDM: tenant chrome, same
+//! product.
+//!
+//! Storage policy mirrors `HostBindings` / `BootLog`: in-memory cache is
+//! authoritative for the current process, disk is the source of truth on
+//! restart, and a corrupt cache file falls back to the bundled default
+//! rather than blocking startup.
+
+use parking_lot::RwLock;
+use serde::{Deserialize, Serialize};
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+
+/// Allowed MIME types for an uploaded logo. We deliberately keep this
+/// narrow — anything that can be `<img src="...">`'d into the brand
+/// block, no scripts. SVG carries the obvious XSS risk for raw inline
+/// HTML; we always serve the bytes as a separate asset with a strict
+/// content-type rather than inlining, so SVG is safe.
+pub const ALLOWED_LOGO_MIMES: &[&str] = &[
+    "image/svg+xml",
+    "image/png",
+    "image/jpeg",
+    "image/webp",
+    "image/gif",
+];
+
+/// Disk cap for an uploaded logo. PXE WebUIs are operator-facing — even
+/// a generous 2 MB cap is comfortable for any reasonable brand mark and
+/// puts a clear bound on memory + serialization cost.
+pub const MAX_LOGO_BYTES: usize = 2 * 1024 * 1024;
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+struct Inner {
+    /// File name (relative to the branding dir) for the active logo, if
+    /// any. Always under `<work_dir>/branding/`; never an absolute path
+    /// from the operator.
+    logo_filename: Option<String>,
+    /// MIME of the active logo, mirroring `logo_filename`. Cached here
+    /// so the HTTP layer can set Content-Type without re-sniffing.
+    logo_mime: Option<String>,
+}
+
+/// In-memory + on-disk override registry. Cheap to clone; locks are
+/// brief. The `branding.json` cache lives alongside the active asset
+/// inside `<work_dir>/branding/`.
+#[derive(Debug, Clone)]
+pub struct BrandingStore {
+    /// Root directory: `<work_dir>/branding/`. Created on first write.
+    dir: Arc<PathBuf>,
+    inner: Arc<RwLock<Inner>>,
+}
+
+impl BrandingStore {
+    /// Load (or initialise empty) from `<work_dir>/branding/`. Tolerates
+    /// missing directories, partial state, and corrupt JSON — a bad
+    /// cache should never block PXE for the network.
+    #[must_use]
+    pub fn load_or_default(work_dir: &Path) -> Self {
+        let dir = work_dir.join("branding");
+        let path = dir.join("branding.json");
+        let mut inner = Inner::default();
+        if let Ok(text) = std::fs::read_to_string(&path) {
+            match serde_json::from_str::<Inner>(&text) {
+                Ok(parsed) => {
+                    // Sanity: if the JSON says we have a logo but the
+                    // file is gone, clear the in-memory pointer so
+                    // /assets/logo.svg falls back to the bundled SVG
+                    // rather than 500ing on a missing file.
+                    if let Some(name) = parsed.logo_filename.as_deref() {
+                        if dir.join(name).is_file() {
+                            inner = parsed;
+                        } else {
+                            tracing::warn!(
+                                target: "openpxe::branding",
+                                file = %name,
+                                "branding.json points at missing file; clearing"
+                            );
+                        }
+                    } else {
+                        inner = parsed;
+                    }
+                }
+                Err(e) => {
+                    tracing::warn!(
+                        target: "openpxe::branding",
+                        "branding.json present but unreadable ({e}); starting empty"
+                    );
+                }
+            }
+        }
+        Self {
+            dir: Arc::new(dir),
+            inner: Arc::new(RwLock::new(inner)),
+        }
+    }
+
+    /// Absolute path to the active logo, if one is set and present on
+    /// disk. `None` means the HTTP layer should serve the bundled SVG.
+    #[must_use]
+    pub fn logo_path(&self) -> Option<PathBuf> {
+        let g = self.inner.read();
+        g.logo_filename.as_deref().map(|n| self.dir.join(n))
+    }
+
+    /// MIME of the active logo, if any. The HTTP layer pairs this with
+    /// the bytes returned by [`Self::logo_path`].
+    #[must_use]
+    pub fn logo_mime(&self) -> Option<String> {
+        self.inner.read().logo_mime.clone()
+    }
+
+    /// Replace the active logo. Returns the chosen on-disk filename so
+    /// the caller can echo it back in the API response. Old logos are
+    /// removed best-effort.
+    pub fn set_logo(&self, mime: &str, ext: &str, bytes: &[u8]) -> std::io::Result<String> {
+        std::fs::create_dir_all(self.dir.as_path())?;
+        // Single canonical filename per upload — overwriting the old one
+        // (after clearing it) keeps the directory tidy and avoids any
+        // path-traversal concern: the operator never supplies the name.
+        let safe_ext = sanitize_ext(ext);
+        let filename = format!("logo.{safe_ext}");
+        let final_path = self.dir.join(&filename);
+        // Atomic write: tmp -> rename. Guarantees the file is either
+        // entirely the old logo or entirely the new one.
+        let tmp = final_path.with_extension(format!("{safe_ext}.tmp"));
+        std::fs::write(&tmp, bytes)?;
+        std::fs::rename(&tmp, &final_path)?;
+        // Clean up any sibling logo.<otherext> so there's exactly one
+        // canonical file at any time.
+        if let Ok(entries) = std::fs::read_dir(self.dir.as_path()) {
+            for e in entries.flatten() {
+                let p = e.path();
+                let name = p
+                    .file_name()
+                    .and_then(|s| s.to_str())
+                    .unwrap_or("");
+                if name.starts_with("logo.") && name != filename {
+                    let _ = std::fs::remove_file(&p);
+                }
+            }
+        }
+
+        {
+            let mut g = self.inner.write();
+            g.logo_filename = Some(filename.clone());
+            g.logo_mime = Some(mime.to_string());
+        }
+        self.persist();
+        tracing::info!(
+            target: "openpxe::branding",
+            file = %filename, mime = %mime, size = bytes.len(),
+            "custom logo installed"
+        );
+        Ok(filename)
+    }
+
+    /// Drop the override and return to the bundled SVG.
+    pub fn clear_logo(&self) -> std::io::Result<()> {
+        let removed = {
+            let mut g = self.inner.write();
+            let removed = g.logo_filename.take();
+            g.logo_mime = None;
+            removed
+        };
+        if let Some(name) = removed {
+            let p = self.dir.join(&name);
+            let _ = std::fs::remove_file(&p);
+            tracing::info!(target: "openpxe::branding", file = %name, "custom logo cleared");
+        }
+        self.persist();
+        Ok(())
+    }
+
+    /// Convenience: true if a custom logo is configured. Surfaces on
+    /// `/api/status` so the WebUI can show "Custom logo: yes" without
+    /// fetching the asset itself.
+    #[must_use]
+    pub fn has_logo(&self) -> bool {
+        self.inner.read().logo_filename.is_some()
+    }
+
+    fn persist(&self) {
+        let snap = self.inner.read().clone();
+        let body = match serde_json::to_vec_pretty(&snap) {
+            Ok(b) => b,
+            Err(e) => {
+                tracing::warn!(target: "openpxe::branding", "serialize branding.json: {e}");
+                return;
+            }
+        };
+        if let Err(e) = std::fs::create_dir_all(self.dir.as_path()) {
+            tracing::warn!(target: "openpxe::branding", "mkdir branding/: {e}");
+            return;
+        }
+        let path = self.dir.join("branding.json");
+        let tmp = path.with_extension("json.tmp");
+        if let Err(e) = std::fs::write(&tmp, body) {
+            tracing::warn!(target: "openpxe::branding", "write branding.json tmp: {e}");
+            return;
+        }
+        if let Err(e) = std::fs::rename(&tmp, &path) {
+            tracing::warn!(target: "openpxe::branding", "rename branding.json: {e}");
+        }
+    }
+}
+
+/// Trim arbitrary operator-supplied extension strings to a small, safe
+/// alphanumeric form. Anything weird collapses to `bin`. We never let
+/// the extension affect the path beyond the final segment of `logo.<x>`.
+fn sanitize_ext(ext: &str) -> String {
+    let lc: String = ext
+        .chars()
+        .filter(char::is_ascii_alphanumeric)
+        .map(|c| c.to_ascii_lowercase())
+        .collect();
+    if lc.is_empty() || lc.len() > 5 {
+        "bin".into()
+    } else {
+        lc
+    }
+}
+
+/// Pick a safe filesystem extension from a MIME type. Returns `None`
+/// if the MIME isn't on the [`ALLOWED_LOGO_MIMES`] allowlist.
+#[must_use]
+pub fn ext_for_mime(mime: &str) -> Option<&'static str> {
+    match mime {
+        "image/svg+xml" => Some("svg"),
+        "image/png" => Some("png"),
+        "image/jpeg" => Some("jpg"),
+        "image/webp" => Some("webp"),
+        "image/gif" => Some("gif"),
+        _ => None,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::tempdir;
+
+    #[test]
+    fn empty_after_load_when_no_branding_dir() {
+        let dir = tempdir().unwrap();
+        let b = BrandingStore::load_or_default(dir.path());
+        assert!(!b.has_logo());
+        assert!(b.logo_path().is_none());
+        assert!(b.logo_mime().is_none());
+    }
+
+    #[test]
+    fn set_clear_round_trip_persists() {
+        let dir = tempdir().unwrap();
+        let b = BrandingStore::load_or_default(dir.path());
+        let name = b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake").unwrap();
+        assert_eq!(name, "logo.png");
+        assert!(b.has_logo());
+        assert_eq!(b.logo_mime().as_deref(), Some("image/png"));
+        let p = b.logo_path().unwrap();
+        assert!(p.is_file());
+
+        // Re-open and confirm the override survives a restart.
+        drop(b);
+        let b2 = BrandingStore::load_or_default(dir.path());
+        assert!(b2.has_logo());
+        assert_eq!(b2.logo_mime().as_deref(), Some("image/png"));
+
+        // Clear; the file goes away and has_logo flips off.
+        b2.clear_logo().unwrap();
+        assert!(!b2.has_logo());
+        assert!(!p.exists());
+    }
+
+    #[test]
+    fn replacing_logo_removes_old_extension_sibling() {
+        // PNG then SVG; only the SVG should remain on disk.
+        let dir = tempdir().unwrap();
+        let b = BrandingStore::load_or_default(dir.path());
+        b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake").unwrap();
+        b.set_logo("image/svg+xml", "svg", br#"<svg xmlns="http://www.w3.org/2000/svg"/>"#).unwrap();
+        let entries: Vec<_> = std::fs::read_dir(dir.path().join("branding"))
+            .unwrap()
+            .filter_map(|e| e.ok().map(|e| e.file_name().to_string_lossy().into_owned()))
+            .collect();
+        assert!(entries.iter().any(|n| n == "logo.svg"), "got {entries:?}");
+        assert!(!entries.iter().any(|n| n == "logo.png"), "stale PNG left over: {entries:?}");
+    }
+
+    #[test]
+    fn sanitize_ext_strips_separators_and_path_chars() {
+        assert_eq!(sanitize_ext("svg"), "svg");
+        // Path separators and non-alphanumerics filter out, leaving just
+        // letters. The remaining "etcpasswd" exceeds the 5-char cap so
+        // it collapses to `bin` rather than producing `etcpa`.
+        assert_eq!(sanitize_ext("../etc/passwd"), "bin");
+        // Short alphanumeric strip-through stays itself.
+        assert_eq!(sanitize_ext("../svg"), "svg");
+        assert_eq!(sanitize_ext(""), "bin");
+        assert_eq!(sanitize_ext("PNG"), "png");
+        // Anything past five chars is suspicious — collapse to `bin`.
+        assert_eq!(sanitize_ext("svgvvvv"), "bin");
+    }
+
+    #[test]
+    fn missing_file_referenced_by_json_resolves_to_empty() {
+        // If the operator nukes the file out from under the JSON cache,
+        // we should silently fall back to no-override rather than
+        // hanging on to a bogus path.
+        let dir = tempdir().unwrap();
+        let brand_dir = dir.path().join("branding");
+        std::fs::create_dir_all(&brand_dir).unwrap();
+        // Hand-write a branding.json claiming logo.png exists.
+        let inner = Inner {
+            logo_filename: Some("logo.png".into()),
+            logo_mime: Some("image/png".into()),
+        };
+        std::fs::write(
+            brand_dir.join("branding.json"),
+            serde_json::to_vec_pretty(&inner).unwrap(),
+        )
+        .unwrap();
+        let b = BrandingStore::load_or_default(dir.path());
+        assert!(!b.has_logo(), "should fall back when referenced file is missing");
+    }
+
+    #[test]
+    fn ext_for_mime_only_accepts_known_types() {
+        assert_eq!(ext_for_mime("image/png"), Some("png"));
+        assert_eq!(ext_for_mime("image/svg+xml"), Some("svg"));
+        assert_eq!(ext_for_mime("application/octet-stream"), None);
+        assert_eq!(ext_for_mime("text/html"), None);
+    }
+}

crates/core/src/client.rs

@@ -56,19 +56,25 @@ impl ClientRegistry {
     ) {
         let mut guard = self.inner.write();
         let now = OffsetDateTime::now_utc();
-        let entry = guard.entry(mac.to_string()).or_insert_with(|| ClientSnapshot {
-            mac: mac.to_string(),
-            last_ip: ip,
-            arch,
-            hostname: None,
-            first_seen: now,
-            last_seen: now,
-            events: Vec::new(),
-            selected_target: None,
-        });
+        let entry = guard
+            .entry(mac.to_string())
+            .or_insert_with(|| ClientSnapshot {
+                mac: mac.to_string(),
+                last_ip: ip,
+                arch,
+                hostname: None,
+                first_seen: now,
+                last_seen: now,
+                events: Vec::new(),
+                selected_target: None,
+            });
         entry.last_seen = now;
-        if ip.is_some() { entry.last_ip = ip; }
-        if arch.is_some() { entry.arch = arch; }
+        if ip.is_some() {
+            entry.last_ip = ip;
+        }
+        if arch.is_some() {
+            entry.arch = arch;
+        }
         entry.events.push((now, event));
         // Cap event history per client to keep memory bounded.
         const MAX_EVENTS: usize = 64;

crates/core/src/config.rs

@@ -54,7 +54,7 @@ pub enum DhcpMode {
     #[default]
     Proxy,
     /// Disabled — rely on an external DHCP server that has been manually
-    /// configured with `next-server` / `filename`. PXEForge only serves TFTP
+    /// configured with `next-server` / `filename`. OpenPXE only serves TFTP
     /// + HTTP in this mode. Useful for home routers that can be pre-set.
     Disabled,
 }
@@ -68,11 +68,11 @@ pub struct Paths {
     pub work_dir: PathBuf,
     /// Directory containing bundled iPXE binaries (undionly.kpxe, snponly.efi, ...).
     pub ipxe_dir: PathBuf,
-    /// Path to the wimboot binary for Windows ISOs (optional — feature-gated).
+    /// Path to the wimboot binary for Windows ISOs (optional — feature-controlled).
     pub wimboot_path: Option<PathBuf>,
     /// Directory under which Windows ISOs are extracted and served via SMB.
     /// Only used when `settings.windows_enabled = true`. Defaults to
-    /// `/var/lib/pxeforge/smb` in the container image.
+    /// `/var/lib/openpxe/smb` in the container image.
     pub smb_dir: PathBuf,
 }
 
@@ -104,11 +104,11 @@ impl Default for NetworkConfig {
 impl Default for Paths {
     fn default() -> Self {
         Self {
-            iso_dir: PathBuf::from("/var/lib/pxeforge/isos"),
-            work_dir: PathBuf::from("/var/lib/pxeforge/work"),
-            ipxe_dir: PathBuf::from("/usr/share/pxeforge/ipxe"),
+            iso_dir: PathBuf::from("/var/lib/openpxe/isos"),
+            work_dir: PathBuf::from("/var/lib/openpxe/work"),
+            ipxe_dir: PathBuf::from("/usr/share/openpxe/ipxe"),
             wimboot_path: None,
-            smb_dir: PathBuf::from("/var/lib/pxeforge/smb"),
+            smb_dir: PathBuf::from("/var/lib/openpxe/smb"),
         }
     }
 }
@@ -124,38 +124,46 @@ impl Config {
     }
 
     /// Apply environment variable overrides. Env var names follow the pattern
-    /// `PXEFORGE_<SECTION>_<FIELD>`, uppercase. Unknown vars are ignored.
+    /// `OPENPXE_<SECTION>_<FIELD>`, uppercase. Unknown vars are ignored.
     /// Call this after loading the TOML file so env takes precedence.
     pub fn apply_env(&mut self) {
-        if let Ok(v) = std::env::var("PXEFORGE_HTTP_PORT") {
-            if let Ok(p) = v.parse() { self.server.http_port = p; }
+        if let Ok(v) = std::env::var("OPENPXE_HTTP_PORT") {
+            if let Ok(p) = v.parse() {
+                self.server.http_port = p;
+            }
         }
-        if let Ok(v) = std::env::var("PXEFORGE_TFTP_PORT") {
-            if let Ok(p) = v.parse() { self.server.tftp_port = p; }
+        if let Ok(v) = std::env::var("OPENPXE_TFTP_PORT") {
+            if let Ok(p) = v.parse() {
+                self.server.tftp_port = p;
+            }
         }
-        if let Ok(v) = std::env::var("PXEFORGE_DHCP_PORT") {
-            if let Ok(p) = v.parse() { self.network.dhcp_port = p; }
+        if let Ok(v) = std::env::var("OPENPXE_DHCP_PORT") {
+            if let Ok(p) = v.parse() {
+                self.network.dhcp_port = p;
+            }
         }
-        if let Ok(v) = std::env::var("PXEFORGE_PUBLIC_IP") {
-            if let Ok(ip) = v.parse() { self.server.public_ip = Some(ip); }
+        if let Ok(v) = std::env::var("OPENPXE_PUBLIC_IP") {
+            if let Ok(ip) = v.parse() {
+                self.server.public_ip = Some(ip);
+            }
         }
-        if let Ok(v) = std::env::var("PXEFORGE_DHCP_MODE") {
+        if let Ok(v) = std::env::var("OPENPXE_DHCP_MODE") {
             self.network.dhcp_mode = match v.to_ascii_lowercase().as_str() {
                 "proxy" => DhcpMode::Proxy,
                 "disabled" | "off" | "none" => DhcpMode::Disabled,
                 _ => self.network.dhcp_mode,
             };
         }
-        if let Ok(v) = std::env::var("PXEFORGE_ISO_DIR") {
+        if let Ok(v) = std::env::var("OPENPXE_ISO_DIR") {
             self.paths.iso_dir = PathBuf::from(v);
         }
-        if let Ok(v) = std::env::var("PXEFORGE_WORK_DIR") {
+        if let Ok(v) = std::env::var("OPENPXE_WORK_DIR") {
             self.paths.work_dir = PathBuf::from(v);
         }
-        if let Ok(v) = std::env::var("PXEFORGE_IPXE_DIR") {
+        if let Ok(v) = std::env::var("OPENPXE_IPXE_DIR") {
             self.paths.ipxe_dir = PathBuf::from(v);
         }
-        if let Ok(v) = std::env::var("PXEFORGE_SMB_DIR") {
+        if let Ok(v) = std::env::var("OPENPXE_SMB_DIR") {
             self.paths.smb_dir = PathBuf::from(v);
         }
     }

crates/core/src/host_bindings.rs

@@ -1,10 +1,9 @@
 //! Per-MAC host bindings.
 //!
-//! Inspired by the Tinkerbell `smee` "MAC-prepended URL" pattern: an
-//! operator can attach a preferred boot target (a `BootEntry::id`) to a
-//! specific MAC address. When a client with that MAC arrives, the
-//! top-level boot script chains straight to that target instead of
-//! showing the interactive menu.
+//! Operators can attach a preferred boot target (a `BootEntry::id`) to a
+//! specific MAC address. When a client with that MAC arrives, the top-level
+//! boot script chains straight to that target instead of showing the
+//! interactive menu.
 //!
 //! Use cases:
 //! - "This rack of Dell servers always images with Ubuntu Server 24.04"
@@ -29,7 +28,7 @@ pub struct HostBinding {
     /// don't have to worry about case.
     pub mac: String,
     /// Preferred boot entry id (matches a `BootEntry::id` in the iso
-    /// store) OR one of the reserved menu names: `_local`, `_gate`,
+    /// store) OR one of the reserved menu names: `_local`, `_queue`,
     /// `_tools_menu`. Empty string falls back to the menu.
     pub target: String,
     /// Optional human-readable label shown in the UI (`"Tom's laptop"`,
@@ -73,7 +72,7 @@ impl HostBindings {
                 }
                 Err(e) => {
                     tracing::warn!(
-                        target: "pxeforge::hosts",
+                        target: "openpxe::hosts",
                         "hosts.json present but unreadable ({e}); starting empty"
                     );
                     Inner::default()
@@ -149,7 +148,7 @@ impl HostBindings {
         let body = match serde_json::to_vec_pretty(&items) {
             Ok(b) => b,
             Err(e) => {
-                tracing::warn!(target: "pxeforge::hosts", "serialize hosts.json: {e}");
+                tracing::warn!(target: "openpxe::hosts", "serialize hosts.json: {e}");
                 return;
             }
         };
@@ -158,11 +157,11 @@ impl HostBindings {
             let _ = std::fs::create_dir_all(parent);
         }
         if let Err(e) = std::fs::write(&tmp, body) {
-            tracing::warn!(target: "pxeforge::hosts", "write hosts.json tmp: {e}");
+            tracing::warn!(target: "openpxe::hosts", "write hosts.json tmp: {e}");
             return;
         }
         if let Err(e) = std::fs::rename(&tmp, self.path.as_path()) {
-            tracing::warn!(target: "pxeforge::hosts", "rename hosts.json: {e}");
+            tracing::warn!(target: "openpxe::hosts", "rename hosts.json: {e}");
         }
     }
 }

crates/core/src/lib.rs

@@ -1,23 +1,27 @@
-//! PXEForge shared core: config, arch detection, client state registry,
-//! runtime settings, and the Gated Deployment queue.
+//! OpenPXE shared core: config, arch detection, client state registry,
+//! runtime settings, and the Queued Deployment queue.
 #![forbid(unsafe_code)]
 
 pub mod arch;
+pub mod boot_log;
+pub mod branding;
 pub mod client;
 pub mod config;
 pub mod error;
-pub mod gate;
 pub mod host_bindings;
 pub mod log_bus;
 pub mod metrics;
+pub mod queue;
 pub mod settings;
 
 pub use arch::{ClientArch, FirmwareClass};
+pub use boot_log::{BootEvent, BootLog};
+pub use branding::{ext_for_mime, BrandingStore, ALLOWED_LOGO_MIMES, MAX_LOGO_BYTES};
 pub use client::{ClientEvent, ClientRegistry, ClientSnapshot};
 pub use config::{Config, DhcpMode, NetworkConfig, Paths, ServerConfig};
 pub use error::{Error, Result};
-pub use gate::{Gate, GateQueue};
 pub use host_bindings::{normalize_mac, HostBinding, HostBindings};
 pub use log_bus::{LogBus, LogBusLayer, LogLine};
 pub use metrics::{HttpRoute, Metrics};
+pub use queue::{DeploymentQueue, QueueEntry};
 pub use settings::{Settings, SettingsStore, TimeoutAction};

crates/core/src/log_bus.rs

@@ -38,7 +38,7 @@ impl LogLine {
     /// Compact one-line "tail -f"-style render.
     #[must_use]
     pub fn render(&self) -> String {
-        // 2026-04-29T12:34:56Z [info]  pxeforge::http: HTTP listening on 0.0.0.0:80
+        // 2026-04-29T12:34:56Z [info]  openpxe::http: HTTP listening on 0.0.0.0:80
         let ts = self
             .timestamp
             .format(&time::format_description::well_known::Rfc3339)

crates/core/src/metrics.rs

@@ -1,21 +1,21 @@
 //! Tiny lock-free Prometheus-compatible metrics.
 //!
 //! We don't pull in `prometheus` or `metrics-rs` for this — they bring
-//! their own runtime, registry, and complexity. PXEForge has a fixed,
+//! their own runtime, registry, and complexity. OpenPXE has a fixed,
 //! tiny set of counters/gauges and the exposition format is plain text.
 //! A handful of `AtomicU64`s and a `Display` impl gets us everything
 //! Prometheus / Grafana / VictoriaMetrics needs to scrape:
 //!
-//!   pxeforge_dhcp_replies_total       counter (per arch label)
-//!   pxeforge_tftp_transfers_total     counter (per status label)
-//!   pxeforge_tftp_bytes_total         counter
-//!   pxeforge_http_requests_total      counter (per route label)
-//!   pxeforge_iso_count                gauge
-//!   pxeforge_client_count             gauge
-//!   pxeforge_gate_count               gauge
-//!   pxeforge_gate_imaging             gauge
-//!   pxeforge_uptime_seconds           gauge
-//!   pxeforge_build_info{version}      gauge (always 1)
+//!   openpxe_dhcp_replies_total       counter (per arch label)
+//!   openpxe_tftp_transfers_total     counter (per status label)
+//!   openpxe_tftp_bytes_total         counter
+//!   openpxe_http_requests_total      counter (per route label)
+//!   openpxe_iso_count                gauge
+//!   openpxe_client_count             gauge
+//!   openpxe_queue_count               gauge
+//!   openpxe_queue_imaging             gauge
+//!   openpxe_uptime_seconds           gauge
+//!   openpxe_build_info{version}      gauge (always 1)
 //!
 //! Cheap to clone — internal state is a couple of arcs. Counters use
 //! `Relaxed` ordering: we don't synchronise across counters, just need
@@ -47,8 +47,8 @@ struct Inner {
     // Gauges (set explicitly; not cumulative)
     iso_count: AtomicU64,
     client_count: AtomicU64,
-    gate_count: AtomicU64,
-    gate_imaging: AtomicU64,
+    queue_count: AtomicU64,
+    queue_imaging: AtomicU64,
     nfs_mounts_active: AtomicU64,
 }
 
@@ -87,7 +87,9 @@ impl Metrics {
     }
 
     pub fn record_tftp_err(&self) {
-        self.inner.tftp_transfers_err.fetch_add(1, Ordering::Relaxed);
+        self.inner
+            .tftp_transfers_err
+            .fetch_add(1, Ordering::Relaxed);
     }
 
     // ── HTTP ───────────────────────────────────────────────────────────
@@ -113,9 +115,9 @@ impl Metrics {
         self.inner.client_count.store(n, Ordering::Relaxed);
     }
 
-    pub fn set_gate_counts(&self, total: u64, imaging: u64) {
-        self.inner.gate_count.store(total, Ordering::Relaxed);
-        self.inner.gate_imaging.store(imaging, Ordering::Relaxed);
+    pub fn set_queue_counts(&self, total: u64, imaging: u64) {
+        self.inner.queue_count.store(total, Ordering::Relaxed);
+        self.inner.queue_imaging.store(imaging, Ordering::Relaxed);
     }
 
     pub fn set_nfs_active(&self, n: u64) {
@@ -151,58 +153,64 @@ impl Metrics {
         };
 
         // Counters with one HELP/TYPE per metric name and per-label rows.
-        let _ = writeln!(out, "# HELP pxeforge_dhcp_replies_total Number of proxyDHCP replies sent, by client architecture.");
-        let _ = writeln!(out, "# TYPE pxeforge_dhcp_replies_total counter");
+        let _ = writeln!(out, "# HELP openpxe_dhcp_replies_total Number of proxyDHCP replies sent, by client architecture.");
+        let _ = writeln!(out, "# TYPE openpxe_dhcp_replies_total counter");
         let _ = writeln!(
             out,
-            "pxeforge_dhcp_replies_total{{arch=\"bios\"}} {}",
+            "openpxe_dhcp_replies_total{{arch=\"bios\"}} {}",
             i.dhcp_replies_legacy.load(Ordering::Relaxed)
         );
         let _ = writeln!(
             out,
-            "pxeforge_dhcp_replies_total{{arch=\"uefi\"}} {}",
+            "openpxe_dhcp_replies_total{{arch=\"uefi\"}} {}",
             i.dhcp_replies_uefi.load(Ordering::Relaxed)
         );
         let _ = writeln!(
             out,
-            "pxeforge_dhcp_replies_total{{arch=\"arm64\"}} {}",
+            "openpxe_dhcp_replies_total{{arch=\"arm64\"}} {}",
             i.dhcp_replies_arm64.load(Ordering::Relaxed)
         );
         let _ = writeln!(
             out,
-            "pxeforge_dhcp_replies_total{{arch=\"unknown\"}} {}",
+            "openpxe_dhcp_replies_total{{arch=\"unknown\"}} {}",
             i.dhcp_replies_unknown.load(Ordering::Relaxed)
         );
         write_counter(
             &mut out,
-            "pxeforge_dhcp_declined_total",
+            "openpxe_dhcp_declined_total",
             "DHCP requests we saw but did not reply to (mac filter, arch unsupported, etc).",
             i.dhcp_declined.load(Ordering::Relaxed),
             "",
         );
 
-        let _ = writeln!(out, "# HELP pxeforge_tftp_transfers_total TFTP transfers, by status.");
-        let _ = writeln!(out, "# TYPE pxeforge_tftp_transfers_total counter");
         let _ = writeln!(
             out,
-            "pxeforge_tftp_transfers_total{{status=\"ok\"}} {}",
+            "# HELP openpxe_tftp_transfers_total TFTP transfers, by status."
+        );
+        let _ = writeln!(out, "# TYPE openpxe_tftp_transfers_total counter");
+        let _ = writeln!(
+            out,
+            "openpxe_tftp_transfers_total{{status=\"ok\"}} {}",
             i.tftp_transfers_ok.load(Ordering::Relaxed)
         );
         let _ = writeln!(
             out,
-            "pxeforge_tftp_transfers_total{{status=\"err\"}} {}",
+            "openpxe_tftp_transfers_total{{status=\"err\"}} {}",
             i.tftp_transfers_err.load(Ordering::Relaxed)
         );
         write_counter(
             &mut out,
-            "pxeforge_tftp_bytes_total",
+            "openpxe_tftp_bytes_total",
             "Total bytes successfully delivered over TFTP.",
             i.tftp_bytes.load(Ordering::Relaxed),
             "",
         );
 
-        let _ = writeln!(out, "# HELP pxeforge_http_requests_total HTTP requests served, by route family.");
-        let _ = writeln!(out, "# TYPE pxeforge_http_requests_total counter");
+        let _ = writeln!(
+            out,
+            "# HELP openpxe_http_requests_total HTTP requests served, by route family."
+        );
+        let _ = writeln!(out, "# TYPE openpxe_http_requests_total counter");
         for (label, counter) in [
             ("boot_script", &i.http_boot_script),
             ("iso_range", &i.http_iso_range),
@@ -212,22 +220,61 @@ impl Metrics {
         ] {
             let _ = writeln!(
                 out,
-                "pxeforge_http_requests_total{{route=\"{label}\"}} {}",
+                "openpxe_http_requests_total{{route=\"{label}\"}} {}",
                 counter.load(Ordering::Relaxed)
             );
         }
 
         // Gauges.
-        write_gauge(&mut out, "pxeforge_iso_count", "ISOs currently registered (local + NFS).", i.iso_count.load(Ordering::Relaxed), "");
-        write_gauge(&mut out, "pxeforge_client_count", "PXE clients seen this process lifetime.", i.client_count.load(Ordering::Relaxed), "");
-        write_gauge(&mut out, "pxeforge_gate_count", "Clients currently waiting at the deployment gate.", i.gate_count.load(Ordering::Relaxed), "");
-        write_gauge(&mut out, "pxeforge_gate_imaging", "Clients currently imaging (gate + assigned target).", i.gate_imaging.load(Ordering::Relaxed), "");
-        write_gauge(&mut out, "pxeforge_nfs_mounts_active", "NFS shares currently mounted.", i.nfs_mounts_active.load(Ordering::Relaxed), "");
-        write_gauge(&mut out, "pxeforge_uptime_seconds", "Seconds since this PXEForge instance started.", uptime_secs, "");
+        write_gauge(
+            &mut out,
+            "openpxe_iso_count",
+            "ISOs currently registered (local + NFS).",
+            i.iso_count.load(Ordering::Relaxed),
+            "",
+        );
+        write_gauge(
+            &mut out,
+            "openpxe_client_count",
+            "PXE clients seen this process lifetime.",
+            i.client_count.load(Ordering::Relaxed),
+            "",
+        );
+        write_gauge(
+            &mut out,
+            "openpxe_queue_count",
+            "Clients currently waiting at the deployment queue.",
+            i.queue_count.load(Ordering::Relaxed),
+            "",
+        );
+        write_gauge(
+            &mut out,
+            "openpxe_queue_imaging",
+            "Clients currently imaging (queue + assigned target).",
+            i.queue_imaging.load(Ordering::Relaxed),
+            "",
+        );
+        write_gauge(
+            &mut out,
+            "openpxe_nfs_mounts_active",
+            "NFS shares currently mounted.",
+            i.nfs_mounts_active.load(Ordering::Relaxed),
+            "",
+        );
+        write_gauge(
+            &mut out,
+            "openpxe_uptime_seconds",
+            "Seconds since this OpenPXE instance started.",
+            uptime_secs,
+            "",
+        );
 
-        let _ = writeln!(out, "# HELP pxeforge_build_info Build metadata. Always 1; the version is in the label.");
-        let _ = writeln!(out, "# TYPE pxeforge_build_info gauge");
-        let _ = writeln!(out, "pxeforge_build_info{{version=\"{version}\"}} 1");
+        let _ = writeln!(
+            out,
+            "# HELP openpxe_build_info Build metadata. Always 1; the version is in the label."
+        );
+        let _ = writeln!(out, "# TYPE openpxe_build_info gauge");
+        let _ = writeln!(out, "openpxe_build_info{{version=\"{version}\"}} 1");
 
         out
     }
@@ -259,16 +306,20 @@ mod tests {
         m.record_http(HttpRoute::Api);
         m.set_iso_count(3);
         let out = m.render("0.2.0", 42);
-        assert_eq!(out.matches("# TYPE pxeforge_dhcp_replies_total counter").count(), 1);
-        assert_eq!(out.matches("# TYPE pxeforge_iso_count gauge").count(), 1);
-        assert!(out.contains("pxeforge_dhcp_replies_total{arch=\"uefi\"} 1"));
-        assert!(out.contains("pxeforge_dhcp_replies_total{arch=\"bios\"} 1"));
-        assert!(out.contains("pxeforge_tftp_transfers_total{status=\"ok\"} 1"));
-        assert!(out.contains("pxeforge_tftp_bytes_total 1024"));
-        assert!(out.contains("pxeforge_http_requests_total{route=\"api\"} 1"));
-        assert!(out.contains("pxeforge_iso_count 3"));
-        assert!(out.contains("pxeforge_uptime_seconds 42"));
-        assert!(out.contains("pxeforge_build_info{version=\"0.2.0\"} 1"));
+        assert_eq!(
+            out.matches("# TYPE openpxe_dhcp_replies_total counter")
+                .count(),
+            1
+        );
+        assert_eq!(out.matches("# TYPE openpxe_iso_count gauge").count(), 1);
+        assert!(out.contains("openpxe_dhcp_replies_total{arch=\"uefi\"} 1"));
+        assert!(out.contains("openpxe_dhcp_replies_total{arch=\"bios\"} 1"));
+        assert!(out.contains("openpxe_tftp_transfers_total{status=\"ok\"} 1"));
+        assert!(out.contains("openpxe_tftp_bytes_total 1024"));
+        assert!(out.contains("openpxe_http_requests_total{route=\"api\"} 1"));
+        assert!(out.contains("openpxe_iso_count 3"));
+        assert!(out.contains("openpxe_uptime_seconds 42"));
+        assert!(out.contains("openpxe_build_info{version=\"0.2.0\"} 1"));
     }
 
     #[test]
@@ -278,6 +329,6 @@ mod tests {
         a.record_dhcp_reply("bios");
         b.record_dhcp_reply("bios");
         let out = a.render("test", 0);
-        assert!(out.contains("pxeforge_dhcp_replies_total{arch=\"bios\"} 2"));
+        assert!(out.contains("openpxe_dhcp_replies_total{arch=\"bios\"} 2"));
     }
 }

crates/core/src/queue.rs

@@ -1,16 +1,16 @@
-//! Gated Deployment queue.
+//! Queued Deployment queue.
 //!
-//! When a client selects "Gated Deployment" at the PXE menu, iPXE POSTs to
-//! `/api/gate/join` and receives a gate position. It then enters a poll
-//! loop hitting `/api/gate/poll/<id>`; the server holds the request open
+//! When a client selects "Queued Deployment" at the PXE menu, iPXE POSTs to
+//! `/api/queue/join` and receives a queue position. It then enters a poll
+//! loop hitting `/api/queue/poll/<id>`; the server holds the request open
 //! until either (a) the operator assigns an ISO from the WebUI, in which
 //! case the poll returns an iPXE `chain` URL, or (b) the poll times out
 //! (iPXE's HTTP client has its own timeout), in which case iPXE re-POSTs.
 //!
-//! The WebUI shows the queue (`GET /api/gate`) and issues
-//! `POST /api/gate/assign { iso_id, gate_ids: [...] }` to launch a single
-//! ISO across many gated clients at once. This is the "horse-race gate"
-//! UX the user asked for — every horse leaves the line simultaneously.
+//! The WebUI shows the queue (`GET /api/queue`) and issues
+//! `POST /api/queue/assign { iso_id, entry_ids: [...] }` to launch a single
+//! ISO across many queued clients at once. Every waiting machine receives
+//! the assignment without operator visits at the rack.
 
 use parking_lot::RwLock;
 use serde::{Deserialize, Serialize};
@@ -23,11 +23,11 @@ use uuid::Uuid;
 
 use crate::ClientArch;
 
-/// Per-gate state visible to the WebUI.
+/// Per-client queue state visible to the WebUI.
 #[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct Gate {
+pub struct QueueEntry {
     pub id: String,
-    /// 1-based race-gate position — position 1 is whoever got there first.
+    /// 1-based queue position — position 1 is whoever got there first.
     pub position: u32,
     pub mac: String,
     pub ip: Option<IpAddr>,
@@ -40,7 +40,7 @@ pub struct Gate {
 }
 
 #[derive(Debug)]
-struct GateInner {
+struct QueueEntryInner {
     id: String,
     position: u32,
     mac: String,
@@ -54,9 +54,9 @@ struct GateInner {
     notify: Arc<Notify>,
 }
 
-impl GateInner {
-    fn snapshot(&self) -> Gate {
-        Gate {
+impl QueueEntryInner {
+    fn snapshot(&self) -> QueueEntry {
+        QueueEntry {
             id: self.id.clone(),
             position: self.position,
             mac: self.mac.clone(),
@@ -70,34 +70,38 @@ impl GateInner {
 }
 
 #[derive(Debug, Default)]
-pub struct GateQueue {
-    inner: RwLock<HashMap<String, GateInner>>,
+pub struct DeploymentQueue {
+    inner: RwLock<HashMap<String, QueueEntryInner>>,
 }
 
-impl GateQueue {
+impl DeploymentQueue {
     #[must_use]
     pub fn new() -> Arc<Self> {
         Arc::new(Self::default())
     }
 
-    /// Add a client to the gate. Returns the new `Gate` snapshot. If the
-    /// MAC is already queued, the existing gate is returned unchanged —
+    /// Add a client to the queue. Returns the current queue snapshot. If the
+    /// MAC is already queued, the existing entry is returned unchanged —
     /// retrying iPXE clients don't duplicate their slot.
-    pub fn join(&self, mac: &str, ip: Option<IpAddr>, arch: Option<ClientArch>) -> Gate {
+    pub fn join(&self, mac: &str, ip: Option<IpAddr>, arch: Option<ClientArch>) -> QueueEntry {
         let now = OffsetDateTime::now_utc();
         let mut guard = self.inner.write();
 
         if let Some(existing) = guard.values_mut().find(|g| g.mac == mac) {
             existing.last_poll_at = now;
-            if ip.is_some() { existing.ip = ip; }
-            if arch.is_some() { existing.arch = arch; }
+            if ip.is_some() {
+                existing.ip = ip;
+            }
+            if arch.is_some() {
+                existing.arch = arch;
+            }
             return existing.snapshot();
         }
 
-        // Race position = max(position) + 1, or 1 if empty.
+        // Queue position = max(position) + 1, or 1 if empty.
         let next_pos = guard.values().map(|g| g.position).max().unwrap_or(0) + 1;
         let id = Uuid::new_v4().to_string();
-        let inner = GateInner {
+        let inner = QueueEntryInner {
             id: id.clone(),
             position: next_pos,
             mac: mac.to_string(),
@@ -113,29 +117,29 @@ impl GateQueue {
         snap
     }
 
-    /// Look up the `Notify` primitive for a given gate id, for long-polling.
+    /// Look up the `Notify` primitive for a given queue entry id, for long-polling.
     #[must_use]
-    pub fn notifier(&self, gate_id: &str) -> Option<Arc<Notify>> {
-        self.inner.read().get(gate_id).map(|g| g.notify.clone())
+    pub fn notifier(&self, entry_id: &str) -> Option<Arc<Notify>> {
+        self.inner.read().get(entry_id).map(|g| g.notify.clone())
     }
 
-    /// Update the last-poll timestamp (keeps the gate's "live" indicator
+    /// Update the last-poll timestamp (keeps the queue's "live" indicator
     /// fresh in the UI) and return the current snapshot. Returns None if
-    /// the gate was released/expired between requests.
-    pub fn touch(&self, gate_id: &str) -> Option<Gate> {
+    /// the entry was released/expired between requests.
+    pub fn touch(&self, entry_id: &str) -> Option<QueueEntry> {
         let mut guard = self.inner.write();
-        let g = guard.get_mut(gate_id)?;
+        let g = guard.get_mut(entry_id)?;
         g.last_poll_at = OffsetDateTime::now_utc();
         Some(g.snapshot())
     }
 
-    /// Operator assigns an ISO entry (boot_entry id) to one or more gates.
-    /// Returns the number of gates that were updated. Gates not in the
+    /// Operator assigns an ISO entry (boot_entry id) to one or more clients.
+    /// Returns the number of queue entries that were updated. Entries not in the
     /// queue are silently skipped.
-    pub fn assign(&self, gate_ids: &[String], target: &str) -> usize {
+    pub fn assign(&self, entry_ids: &[String], target: &str) -> usize {
         let mut guard = self.inner.write();
         let mut updated = 0;
-        for id in gate_ids {
+        for id in entry_ids {
             if let Some(g) = guard.get_mut(id) {
                 g.assigned_target = Some(target.to_string());
                 g.notify.notify_waiters();
@@ -145,11 +149,11 @@ impl GateQueue {
         updated
     }
 
-    /// Remove a gate and return its final snapshot. Called after the client
+    /// Remove a queue entry and return its final snapshot. Called after the client
     /// has successfully chained onto its assignment.
-    pub fn release(&self, gate_id: &str) -> Option<Gate> {
+    pub fn release(&self, entry_id: &str) -> Option<QueueEntry> {
         let mut guard = self.inner.write();
-        let g = guard.remove(gate_id)?;
+        let g = guard.remove(entry_id)?;
         g.notify.notify_waiters();
         // Renumber positions so the display stays contiguous (1..N). This
         // is O(N) but the queue is expected to be small (dozens of hosts).
@@ -162,9 +166,9 @@ impl GateQueue {
     }
 
     #[must_use]
-    pub fn list(&self) -> Vec<Gate> {
+    pub fn list(&self) -> Vec<QueueEntry> {
         let guard = self.inner.read();
-        let mut v: Vec<_> = guard.values().map(GateInner::snapshot).collect();
+        let mut v: Vec<_> = guard.values().map(QueueEntryInner::snapshot).collect();
         v.sort_by_key(|g| g.position);
         v
     }
@@ -186,7 +190,7 @@ mod tests {
 
     #[test]
     fn join_assigns_sequential_positions() {
-        let q = GateQueue::new();
+        let q = DeploymentQueue::new();
         let g1 = q.join("aa:bb:cc:00:00:01", None, None);
         let g2 = q.join("aa:bb:cc:00:00:02", None, None);
         let g3 = q.join("aa:bb:cc:00:00:03", None, None);
@@ -197,7 +201,7 @@ mod tests {
 
     #[test]
     fn rejoining_same_mac_is_idempotent() {
-        let q = GateQueue::new();
+        let q = DeploymentQueue::new();
         let g1 = q.join("aa:bb:cc:00:00:01", None, None);
         let g2 = q.join("aa:bb:cc:00:00:01", None, None);
         assert_eq!(g1.id, g2.id);
@@ -207,7 +211,7 @@ mod tests {
 
     #[test]
     fn assign_broadcasts_target() {
-        let q = GateQueue::new();
+        let q = DeploymentQueue::new();
         let g1 = q.join("aa:bb:cc:00:00:01", None, None);
         let g2 = q.join("aa:bb:cc:00:00:02", None, None);
         let n = q.assign(&[g1.id.clone(), g2.id.clone()], "ubuntu-24-04-linux");
@@ -219,7 +223,7 @@ mod tests {
 
     #[test]
     fn release_renumbers() {
-        let q = GateQueue::new();
+        let q = DeploymentQueue::new();
         let a = q.join("aa:00:00:00:00:01", None, None);
         let _b = q.join("aa:00:00:00:00:02", None, None);
         let c = q.join("aa:00:00:00:00:03", None, None);
@@ -234,7 +238,7 @@ mod tests {
 
     #[tokio::test]
     async fn assign_wakes_waiter() {
-        let q = GateQueue::new();
+        let q = DeploymentQueue::new();
         let g = q.join("aa:00:00:00:00:01", None, None);
         let notify = q.notifier(&g.id).unwrap();
 

crates/core/src/settings.rs

@@ -47,13 +47,13 @@ pub struct Settings {
     /// `timeout_action = LocalHdd`).
     pub default_local_hdd: bool,
 
-    /// When a client hits the Gated Deployment item, how long (seconds) to
-    /// hold it at the gate before giving up and falling back to the menu.
+    /// When a client hits the Queued Deployment item, how long (seconds) to
+    /// hold it in queue before giving up and falling back to the menu.
     /// 0 = forever.
-    pub gate_wait_max_secs: u32,
+    pub queue_wait_max_secs: u32,
 
     /// Optional DNS server advertised on the Network tab. Purely
-    /// informational today — PXEForge does not run a DNS server, but
+    /// informational today — OpenPXE does not run a DNS server, but
     /// operators expect to be able to record what the upstream DNS is.
     /// Empty string = unset (UI shows placeholder).
     pub dns_server: String,
@@ -66,21 +66,22 @@ pub enum TimeoutAction {
     Stay,
     /// Chain the "Boot from Local HDD" entry.
     LocalHdd,
-    /// Put the client into the gate queue, waiting for operator assignment.
+    /// Put the client into the deployment queue, waiting for operator
+    /// assignment.
     #[default]
-    GatedDeployment,
+    QueuedDeployment,
 }
 
 impl Default for Settings {
     fn default() -> Self {
         Self {
             boot_menu_timeout_secs: 600,
-            timeout_action: TimeoutAction::GatedDeployment,
+            timeout_action: TimeoutAction::QueuedDeployment,
             windows_enabled: false,
             smb_host_override: String::new(),
             extra_kernel_args: String::new(),
             default_local_hdd: true,
-            gate_wait_max_secs: 0,
+            queue_wait_max_secs: 0,
             dns_server: String::new(),
         }
     }
@@ -103,7 +104,7 @@ impl SettingsStore {
                 Ok(s) => s,
                 Err(e) => {
                     tracing::warn!(
-                        target: "pxeforge::settings",
+                        target: "openpxe::settings",
                         "settings.json present but unreadable ({e}); falling back to defaults"
                     );
                     Settings::default()
@@ -111,7 +112,10 @@ impl SettingsStore {
             },
             Err(_) => Settings::default(),
         };
-        Arc::new(Self { path, inner: RwLock::new(initial) })
+        Arc::new(Self {
+            path,
+            inner: RwLock::new(initial),
+        })
     }
 
     #[must_use]
@@ -130,7 +134,7 @@ impl SettingsStore {
         }
         let snap = self.snapshot();
         if let Err(e) = self.persist(&snap) {
-            tracing::warn!(target: "pxeforge::settings", "failed to persist settings: {e}");
+            tracing::warn!(target: "openpxe::settings", "failed to persist settings: {e}");
         }
     }
 
@@ -157,7 +161,7 @@ mod tests {
         let store = SettingsStore::load_or_default(dir.path());
         let s = store.snapshot();
         assert_eq!(s.boot_menu_timeout_secs, 600);
-        assert_eq!(s.timeout_action, TimeoutAction::GatedDeployment);
+        assert_eq!(s.timeout_action, TimeoutAction::QueuedDeployment);
         assert!(!s.windows_enabled);
     }
 
@@ -177,6 +181,12 @@ mod tests {
         assert!(s.windows_enabled);
     }
 
+    #[test]
+    fn settings_serialize_queue_naming() {
+        let text = serde_json::to_string(&Settings::default()).unwrap();
+        assert!(text.contains("queue_wait_max_secs"));
+    }
+
     #[test]
     fn corrupt_file_falls_back_to_default() {
         let dir = tempdir().unwrap();

crates/dhcp-proxy/Cargo.toml

@@ -1,16 +1,16 @@
 [package]
-name = "pxeforge-dhcp-proxy"
+name = "openpxe-dhcp-proxy"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
 authors.workspace = true
-description = "DHCP proxy (RFC 4578) for PXEForge — serves boot info, does not lease IPs"
+description = "DHCP proxy (RFC 4578) for OpenPXE — serves boot info, does not lease IPs"
 
 [lints]
 workspace = true
 
 [dependencies]
-pxeforge-core.workspace = true
+openpxe-core.workspace = true
 tokio.workspace = true
 socket2.workspace = true
 dhcproto.workspace = true

crates/dhcp-proxy/src/reply.rs

@@ -9,7 +9,7 @@
 //!     pass, or the HTTP URL of the boot script once iPXE has chained.
 
 use dhcproto::v4::{DhcpOption, Message, MessageType, Opcode, OptionCode};
-use pxeforge_core::{ClientArch, FirmwareClass};
+use openpxe_core::{ClientArch, FirmwareClass};
 use std::net::Ipv4Addr;
 
 /// Where the reply directs the client next.
@@ -56,11 +56,17 @@ pub fn decide(ctx: &ReplyContext<'_>) -> BootDirective {
             // it'll then do the same script-fetch the iPXE path does.
             let name = ctx.arch.ipxe_bootfile().unwrap_or("snponly.efi");
             BootDirective::HttpScript {
-                url: format!("{}/ipxe/{}", ctx.public_base_url.trim_end_matches('/'), name),
+                url: format!(
+                    "{}/ipxe/{}",
+                    ctx.public_base_url.trim_end_matches('/'),
+                    name
+                ),
             }
         }
         FirmwareClass::PxeClient => match ctx.arch.ipxe_bootfile() {
-            Some(name) => BootDirective::TftpIpxe { filename: name.to_string() },
+            Some(name) => BootDirective::TftpIpxe {
+                filename: name.to_string(),
+            },
             None => BootDirective::Ignore,
         },
         FirmwareClass::Other => BootDirective::Ignore,
@@ -107,12 +113,16 @@ pub fn build_reply(ctx: &ReplyContext<'_>, directive: &BootDirective) -> Option<
 
     match directive {
         BootDirective::TftpIpxe { filename } => {
-            opts.insert(DhcpOption::TFTPServerName(ctx.our_ip.to_string().into_bytes()));
+            opts.insert(DhcpOption::TFTPServerName(
+                ctx.our_ip.to_string().into_bytes(),
+            ));
             opts.insert(DhcpOption::BootfileName(filename.as_bytes().to_vec()));
         }
         BootDirective::HttpScript { url } => {
             opts.insert(DhcpOption::BootfileName(url.as_bytes().to_vec()));
-            opts.insert(DhcpOption::TFTPServerName(ctx.our_ip.to_string().into_bytes()));
+            opts.insert(DhcpOption::TFTPServerName(
+                ctx.our_ip.to_string().into_bytes(),
+            ));
         }
         BootDirective::Ignore => return None,
     }

crates/dhcp-proxy/src/server.rs

@@ -4,9 +4,7 @@
 use crate::reply::{build_reply, decide, BootDirective, ReplyContext};
 use dhcproto::v4::{DhcpOption, Message, OptionCode};
 use dhcproto::{Decodable, Decoder, Encodable, Encoder};
-use pxeforge_core::{
-    ClientArch, ClientEvent, ClientRegistry, FirmwareClass,
-};
+use openpxe_core::{ClientArch, ClientEvent, ClientRegistry, FirmwareClass};
 use socket2::{Domain, Protocol, Socket, Type};
 use std::net::{IpAddr, Ipv4Addr, SocketAddr, SocketAddrV4};
 use std::sync::Arc;
@@ -19,7 +17,7 @@ pub struct DhcpProxyServer {
     our_ip: Ipv4Addr,
     public_base_url: String,
     clients: Arc<ClientRegistry>,
-    metrics: pxeforge_core::Metrics,
+    metrics: openpxe_core::Metrics,
 }
 
 impl DhcpProxyServer {
@@ -30,7 +28,7 @@ impl DhcpProxyServer {
         our_ip: Ipv4Addr,
         public_base_url: String,
         clients: Arc<ClientRegistry>,
-        metrics: pxeforge_core::Metrics,
+        metrics: openpxe_core::Metrics,
     ) -> Self {
         Self {
             bind,
@@ -47,7 +45,7 @@ impl DhcpProxyServer {
         let dhcp_sock = bind_udp(self.bind, self.dhcp_port, true)?;
         let pxe_sock = bind_udp(self.bind, self.pxe_port, false)?;
         tracing::info!(
-            target: "pxeforge::dhcp",
+            target: "openpxe::dhcp",
             "DHCP proxy listening on {}:{} and :{}",
             self.bind, self.dhcp_port, self.pxe_port
         );
@@ -67,12 +65,12 @@ impl DhcpProxyServer {
             let (n, from) = match sock.recv_from(&mut buf).await {
                 Ok(v) => v,
                 Err(e) => {
-                    tracing::warn!(target: "pxeforge::dhcp", port=label, "recv error: {e}");
+                    tracing::warn!(target: "openpxe::dhcp", port=label, "recv error: {e}");
                     continue;
                 }
             };
             if let Err(e) = self.handle_datagram(&sock, &buf[..n], from, label).await {
-                tracing::warn!(target: "pxeforge::dhcp", port=label, "handle error: {e}");
+                tracing::warn!(target: "openpxe::dhcp", port=label, "handle error: {e}");
             }
         }
     }
@@ -86,11 +84,22 @@ impl DhcpProxyServer {
     ) -> anyhow::Result<()> {
         let request = Message::decode(&mut Decoder::new(data))?;
 
-        let vendor_class = request.opts().get(OptionCode::ClassIdentifier).and_then(|o| {
-            if let DhcpOption::ClassIdentifier(v) = o { Some(v.as_slice()) } else { None }
-        });
+        let vendor_class = request
+            .opts()
+            .get(OptionCode::ClassIdentifier)
+            .and_then(|o| {
+                if let DhcpOption::ClassIdentifier(v) = o {
+                    Some(v.as_slice())
+                } else {
+                    None
+                }
+            });
         let user_class = request.opts().get(OptionCode::UserClass).and_then(|o| {
-            if let DhcpOption::UserClass(v) = o { Some(v.as_slice()) } else { None }
+            if let DhcpOption::UserClass(v) = o {
+                Some(v.as_slice())
+            } else {
+                None
+            }
         });
         let class = FirmwareClass::classify(vendor_class, user_class);
         if matches!(class, FirmwareClass::Other) {
@@ -128,21 +137,23 @@ impl DhcpProxyServer {
         if matches!(directive, BootDirective::Ignore) {
             self.metrics.record_dhcp_decline();
             tracing::debug!(
-                target: "pxeforge::dhcp",
+                target: "openpxe::dhcp",
                 mac=%mac, arch=?arch, "ignoring — no bootfile for arch"
             );
             return Ok(());
         }
         self.metrics.record_dhcp_reply(arch.as_str());
 
-        let Some(reply) = build_reply(&ctx, &directive) else { return Ok(()); };
+        let Some(reply) = build_reply(&ctx, &directive) else {
+            return Ok(());
+        };
         let mut out = Vec::with_capacity(512);
         reply.encode(&mut Encoder::new(&mut out))?;
 
         let dest = reply_destination(&request, from);
         sock.send_to(&out, dest).await?;
         tracing::info!(
-            target: "pxeforge::dhcp",
+            target: "openpxe::dhcp",
             mac=%mac, arch=arch.as_str(), class=?class, dest=%dest, directive=?directive,
             "PXE reply sent"
         );
@@ -203,7 +214,10 @@ fn bind_udp(bind: IpAddr, port: u16, broadcast: bool) -> anyhow::Result<UdpSocke
 
 fn format_mac(chaddr: &[u8]) -> String {
     let take = chaddr.iter().take(6).copied().collect::<Vec<_>>();
-    take.iter().map(|b| format!("{b:02x}")).collect::<Vec<_>>().join(":")
+    take.iter()
+        .map(|b| format!("{b:02x}"))
+        .collect::<Vec<_>>()
+        .join(":")
 }
 
 /// Walk raw DHCP options looking for option 93 (Client System Architecture)
@@ -217,10 +231,17 @@ fn extract_raw_arch(packet: &[u8]) -> Option<u16> {
     let mut i = 0;
     while i < opts.len() {
         let code = opts[i];
-        if code == 0xff { return None; }     // END
-        if code == 0x00 { i += 1; continue; } // PAD
+        if code == 0xff {
+            return None;
+        } // END
+        if code == 0x00 {
+            i += 1;
+            continue;
+        } // PAD
         i += 1;
-        if i >= opts.len() { return None; }
+        if i >= opts.len() {
+            return None;
+        }
         let len = opts[i] as usize;
         i += 1;
         if code == 93 && len >= 2 && i + 2 <= opts.len() {
@@ -240,7 +261,7 @@ mod tests {
         // Minimal BOOTP header + magic cookie + option 93 (arch)=0x0007 + END.
         let mut pkt = vec![0u8; 240];
         pkt[236..240].copy_from_slice(&[99, 130, 83, 99]); // magic cookie
-        pkt.extend_from_slice(&[53, 1, 1]);  // option 53 DHCPDISCOVER
+        pkt.extend_from_slice(&[53, 1, 1]); // option 53 DHCPDISCOVER
         pkt.extend_from_slice(&[93, 2, 0x00, 0x07]);
         pkt.push(0xff);
         assert_eq!(extract_raw_arch(&pkt), Some(0x0007));

crates/http-api/Cargo.toml

@@ -1,5 +1,5 @@
 [package]
-name = "pxeforge-http-api"
+name = "openpxe-http-api"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
@@ -10,10 +10,10 @@ description = "HTTP server: ISO uploads, iPXE script generation, ISO streaming"
 workspace = true
 
 [dependencies]
-pxeforge-core.workspace = true
-pxeforge-iso-store.workspace = true
-pxeforge-ipxe-assets.workspace = true
-pxeforge-webui.workspace = true
+openpxe-core.workspace = true
+openpxe-iso-store.workspace = true
+openpxe-ipxe-assets.workspace = true
+openpxe-webui.workspace = true
 tokio.workspace = true
 tokio-util.workspace = true
 tokio-stream.workspace = true
@@ -31,6 +31,7 @@ bytes.workspace = true
 futures.workspace = true
 mime.workspace = true
 mime_guess.workspace = true
+uuid.workspace = true
 
 [dev-dependencies]
 tokio = { workspace = true, features = ["macros", "rt", "rt-multi-thread", "time"] }

crates/http-api/src/ipxe_script.rs

@@ -8,12 +8,12 @@
 //!     > Boot from Local HDD
 //!   Installers
 //!     > Linux Installers   -> submenu of Linux ISOs
-//!     > Windows Installers -> submenu of Windows ISOs  (gated by Settings::windows_enabled)
+//!     > Windows Installers -> submenu of Windows ISOs  (controlled by Settings::windows_enabled)
 //!   Tools
 //!     > Utilities          -> memtest, etc. (embedded assets only)
-//!     > PXEForge Shell     -> drop to iPXE shell with branded prompt
+//!     > OpenPXE Shell     -> drop to iPXE shell with branded prompt
 //!     > Network Card Info  -> ifstat / config / route dump
-//!   Gated Deployment       -> join the gate queue
+//!   Queued Deployment       -> join the deployment queue
 //! ```
 //!
 //! ## iPXE is entirely backend — users do not see or write iPXE
@@ -22,12 +22,12 @@
 //! those knobs into iPXE primitives (chain, menu, item, choose, etc.).
 //! There is intentionally no UI path to upload a custom `.ipxe` script.
 
-use pxeforge_core::{Settings, TimeoutAction};
-use pxeforge_iso_store::{BootEntry, BootKind, IsoMeta};
-use pxeforge_iso_store::introspect::DistroFamily;
+use openpxe_core::{Settings, TimeoutAction};
+use openpxe_iso_store::introspect::DistroFamily;
+use openpxe_iso_store::{BootEntry, BootKind, IsoMeta};
 use std::fmt::Write as _;
 
-/// Top-level PXEForge boot menu. Serialized identically for BIOS and UEFI
+/// Top-level OpenPXE boot menu. Serialized identically for BIOS and UEFI
 /// clients because iPXE normalises the menu primitives across firmwares.
 #[must_use]
 pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> String {
@@ -35,7 +35,7 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
     let base = base_url.trim_end_matches('/');
     let timeout_ms = settings.boot_menu_timeout_secs.saturating_mul(1000);
     let default_item = match settings.timeout_action {
-        TimeoutAction::GatedDeployment => "gate",
+        TimeoutAction::QueuedDeployment => "queue",
         // Stay -> iPXE's `--timeout 0` is "no timeout". Pick any default
         // label; the client waits for keypress. We use the same label as
         // LocalHdd to keep the menu's pre-highlight stable.
@@ -43,15 +43,21 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
     };
 
     let _ = writeln!(s, "#!ipxe");
-    let _ = writeln!(s, "# PXEForge top-level menu - auto-generated, do not edit");
+    let _ = writeln!(s, "# OpenPXE top-level menu - auto-generated, do not edit");
     let _ = writeln!(s, "set base-url {base}");
     let _ = writeln!(s, "set esc:hex 1b");
     let _ = writeln!(s, "set cls ${{esc:string}}[2J");
     let _ = writeln!(s, ":menu");
-    let _ = writeln!(s, "menu PXEForge - network boot menu");
-    let _ = writeln!(s, "item --gap -- ------------------------- Default -------------------------");
+    let _ = writeln!(s, "menu OpenPXE - network boot menu");
+    let _ = writeln!(
+        s,
+        "item --gap -- ------------------------- Default -------------------------"
+    );
     let _ = writeln!(s, "item local            Boot from Local HDD");
-    let _ = writeln!(s, "item --gap -- ----------------------- Installers -----------------------");
+    let _ = writeln!(
+        s,
+        "item --gap -- ----------------------- Installers -----------------------"
+    );
     if has_family(isos, is_linux_family) {
         let _ = writeln!(s, "item linux            Linux Installers  >");
     } else {
@@ -64,28 +70,55 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
     } else {
         let _ = writeln!(s, "item --gap -- (Windows support disabled in Settings)");
     }
-    let _ = writeln!(s, "item --gap -- -------------------------- Tools --------------------------");
+    let _ = writeln!(
+        s,
+        "item --gap -- -------------------------- Tools --------------------------"
+    );
     let _ = writeln!(s, "item tools            Tools  >");
-    let _ = writeln!(s, "item --gap -- ---------------------- Gated Deployment ---------------------");
-    let _ = writeln!(s, "item gate             Gated Deployment  (join queue)");
+    let _ = writeln!(
+        s,
+        "item --gap -- ---------------------- Queued Deployment ---------------------"
+    );
+    let _ = writeln!(s, "item queue            Queued Deployment  (join queue)");
     let _ = writeln!(s, "item --gap");
     let _ = writeln!(s, "item --key x exit     Exit iPXE");
 
     if matches!(settings.timeout_action, TimeoutAction::Stay) {
         let _ = writeln!(s, "choose --default {default_item} target || goto menu");
     } else {
-        let _ = writeln!(s, "choose --default {default_item} --timeout {timeout_ms} target || goto menu");
+        let _ = writeln!(
+            s,
+            "choose --default {default_item} --timeout {timeout_ms} target || goto menu"
+        );
     }
 
     // iPXE's `||` is strict about what follows. Each test uses `goto menu`
     // as the fallthrough target so the parser never sees a bare `||` with
     // trailing whitespace — some iPXE builds reject that.
-    let _ = writeln!(s, "iseq ${{target}} local   && chain {base}/boot/_local.ipxe        || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} linux   && chain {base}/boot/_linux_menu.ipxe   || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} windows && chain {base}/boot/_windows_menu.ipxe || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} tools   && chain {base}/boot/_tools_menu.ipxe   || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} gate    && chain {base}/boot/_gate.ipxe         || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} exit    && exit                                 || goto menu");
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} local   && chain {base}/boot/_local.ipxe        || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} linux   && chain {base}/boot/_linux_menu.ipxe   || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} windows && chain {base}/boot/_windows_menu.ipxe || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} tools   && chain {base}/boot/_tools_menu.ipxe   || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} queue   && chain {base}/boot/_queue.ipxe         || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} exit    && exit                                 || goto menu"
+    );
     let _ = writeln!(s, "goto menu");
     s
 }
@@ -95,25 +128,51 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
 #[must_use]
 pub fn render_family_menu(isos: &[IsoMeta], base_url: &str, is_windows: bool) -> String {
     let base = base_url.trim_end_matches('/');
-    let title = if is_windows { "Windows Installers" } else { "Linux Installers" };
+    let title = if is_windows {
+        "Windows Installers"
+    } else {
+        "Linux Installers"
+    };
     let label = if is_windows { "windows" } else { "linux" };
     let mut s = String::new();
     let _ = writeln!(s, "#!ipxe");
     let _ = writeln!(s, "set base-url {base}");
     let _ = writeln!(s, ":menu");
-    let _ = writeln!(s, "menu PXEForge - {title}");
-    let filter: fn(DistroFamily) -> bool =
-        if is_windows { is_windows_family } else { is_linux_family };
+    let _ = writeln!(s, "menu OpenPXE - {title}");
+    let filter: fn(DistroFamily) -> bool = if is_windows {
+        is_windows_family
+    } else {
+        is_linux_family
+    };
     let mut count = 0;
     for iso in isos {
-        if !filter(iso.introspection.family) { continue; }
+        if !filter(iso.introspection.family) {
+            continue;
+        }
+        // v0.4.4: ISOs the operator flipped to the Tools category move
+        // out of the OS installer submenus entirely — they only appear
+        // under Tools. Without this filter the operator would see the
+        // same ISO in both menus.
+        if matches!(iso.category, openpxe_iso_store::IsoCategory::Tools) {
+            continue;
+        }
         for entry in &iso.boot_entries {
             let size_label = fmt_size_mib(iso.size_bytes);
             let key = hotkey_for_index(count);
+            // Visual hint: a leading `*` marks password-protected entries.
+            // ASCII only — iPXE's menu console mangles non-ASCII on some
+            // firmwares.
+            let lock = if iso.is_password_protected() {
+                "*"
+            } else {
+                " "
+            };
             let _ = writeln!(
-                s, "item {}{} [{:>6}] {}",
+                s,
+                "item {}{} {}[{:>6}] {}",
                 key,
                 entry.id,
+                lock,
                 size_label,
                 escape_label(&entry.title),
             );
@@ -126,8 +185,18 @@ pub fn render_family_menu(isos: &[IsoMeta], base_url: &str, is_windows: bool) ->
     let _ = writeln!(s, "item --gap");
     let _ = writeln!(s, "item --key b back   < Back to main menu");
     let _ = writeln!(s, "choose target || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} back && chain {base}/boot.ipxe || goto menu");
-    let _ = writeln!(s, "chain {base}/boot/${{target}}.ipxe || goto menu");
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} back && chain {base}/boot.ipxe || goto menu"
+    );
+    // Pass `?mac=${mac}` so the per-entry handler can record the booting
+    // client into the Host log. iPXE substitutes `${mac}` before
+    // the HTTP fetch; if the firmware can't resolve it the literal
+    // `${mac}` is sent and the server treats it as "unknown".
+    let _ = writeln!(
+        s,
+        "chain {base}/boot/${{target}}.ipxe?mac=${{mac}} || goto menu"
+    );
     s
 }
 
@@ -148,17 +217,54 @@ fn hotkey_for_index(i: usize) -> String {
     }
 }
 
-/// Tools submenu — Utilities, Shell, NIC Info, Reboot, Exit to firmware.
+/// Tools submenu — Utilities, Shell, NIC Info, Reboot, Exit to firmware,
+/// plus any ISOs the operator flipped to [`IsoCategory::Tools`] in the
+/// Storage tab. The category-Tools ISOs render first so frequently used
+/// recovery / hardware tools are reachable with a single number key
+/// before the built-in shortcuts.
 #[must_use]
-pub fn render_tools_menu(base_url: &str) -> String {
+pub fn render_tools_menu(isos: &[IsoMeta], base_url: &str) -> String {
     let base = base_url.trim_end_matches('/');
     let mut s = String::new();
     let _ = writeln!(s, "#!ipxe");
     let _ = writeln!(s, "set base-url {base}");
     let _ = writeln!(s, ":menu");
-    let _ = writeln!(s, "menu PXEForge - Tools");
+    let _ = writeln!(s, "menu OpenPXE - Tools");
+
+    // Operator-categorized tool ISOs (hotkeys 1..9), each chained the
+    // same way as a per-family menu pick — through the boot-entry id
+    // route, carrying `?mac=${mac}` for Host log attribution.
+    let mut count = 0;
+    for iso in isos {
+        if !matches!(iso.category, openpxe_iso_store::IsoCategory::Tools) {
+            continue;
+        }
+        for entry in &iso.boot_entries {
+            let size_label = fmt_size_mib(iso.size_bytes);
+            let key = hotkey_for_index(count);
+            let lock = if iso.is_password_protected() {
+                "*"
+            } else {
+                " "
+            };
+            let _ = writeln!(
+                s,
+                "item {}{} {}[{:>6}] {}",
+                key,
+                entry.id,
+                lock,
+                size_label,
+                escape_label(&entry.title),
+            );
+            count += 1;
+        }
+    }
+    if count > 0 {
+        let _ = writeln!(s, "item --gap");
+    }
+
     let _ = writeln!(s, "item --key u util     Utilities  (memtest, ...)");
-    let _ = writeln!(s, "item --key s shell    PXEForge Shell");
+    let _ = writeln!(s, "item --key s shell    OpenPXE Shell");
     let _ = writeln!(s, "item --key n nic      Network Card Info");
     let _ = writeln!(s, "item --gap");
     let _ = writeln!(s, "item --key r reboot   Reboot Computer");
@@ -166,13 +272,36 @@ pub fn render_tools_menu(base_url: &str) -> String {
     let _ = writeln!(s, "item --gap");
     let _ = writeln!(s, "item --key b back     < Back to main menu");
     let _ = writeln!(s, "choose target || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} util     && chain {base}/boot/_util.ipxe  || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} shell    && chain {base}/boot/_shell.ipxe || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} nic      && chain {base}/boot/_nic.ipxe   || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} reboot   && reboot                        || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} firmware && exit 0                        || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} back     && chain {base}/boot.ipxe        || goto menu");
-    let _ = writeln!(s, "goto menu");
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} util     && chain {base}/boot/_util.ipxe  || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} shell    && chain {base}/boot/_shell.ipxe || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} nic      && chain {base}/boot/_nic.ipxe   || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} reboot   && reboot                        || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} firmware && exit 0                        || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} back     && chain {base}/boot.ipxe        || goto menu"
+    );
+    // Fall-through for category-Tools ISO ids — same as the family
+    // submenu, carrying `?mac=${mac}` for the boot log.
+    let _ = writeln!(
+        s,
+        "chain {base}/boot/${{target}}.ipxe?mac=${{mac}} || goto menu"
+    );
     s
 }
 
@@ -185,8 +314,15 @@ pub fn render_local_hdd(base_url: &str) -> String {
     let mut s = String::new();
     let _ = writeln!(s, "#!ipxe");
     let _ = writeln!(s, "# Boot from Local HDD - platform-sensitive");
-    let _ = writeln!(s, "iseq ${{platform}} pcbios && sanboot --no-describe --drive 0x80 || ");
-    let _ = writeln!(s, "# UEFI path: fall through to the firmware's next boot entry");
+    let _ = writeln!(
+        s,
+        "iseq ${{platform}} pcbios && sanboot --no-describe --drive 0x80 || goto uefi"
+    );
+    let _ = writeln!(s, ":uefi");
+    let _ = writeln!(
+        s,
+        "# UEFI path: fall through to the firmware's next boot entry"
+    );
     let _ = writeln!(s, "exit 0");
     let _ = writeln!(s, "# If the above exit returns, loop back to the main menu");
     let _ = writeln!(s, "chain {base}/boot.ipxe");
@@ -202,25 +338,31 @@ pub fn render_util(base_url: &str) -> String {
     let mut s = String::new();
     let _ = writeln!(s, "#!ipxe");
     let _ = writeln!(s, ":menu");
-    let _ = writeln!(s, "menu PXEForge - Utilities");
+    let _ = writeln!(s, "menu OpenPXE - Utilities");
     let _ = writeln!(s, "item memtest      MemTest86+ (RAM diagnostic)");
     let _ = writeln!(s, "item --gap");
     let _ = writeln!(s, "item back         < Back");
     let _ = writeln!(s, "choose target || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} memtest && chain {base}/ipxe/memtest.bin || ");
-    let _ = writeln!(s, "iseq ${{target}} back && chain {base}/boot/_tools_menu.ipxe || ");
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} memtest && chain {base}/ipxe/memtest.bin || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} back && chain {base}/boot/_tools_menu.ipxe || goto menu"
+    );
     let _ = writeln!(s, "goto menu");
     s
 }
 
-/// "PXEForge Shell" — iPXE shell, branded.
+/// "OpenPXE Shell" — iPXE shell, branded.
 #[must_use]
 pub fn render_shell(base_url: &str) -> String {
     let base = base_url.trim_end_matches('/');
     let mut s = String::new();
     let _ = writeln!(s, "#!ipxe");
     let _ = writeln!(s, "echo ==========================================");
-    let _ = writeln!(s, "echo   PXEForge Shell");
+    let _ = writeln!(s, "echo   OpenPXE Shell");
     let _ = writeln!(s, "echo   'exit' returns to the main menu");
     let _ = writeln!(s, "echo ==========================================");
     let _ = writeln!(s, "shell");
@@ -247,20 +389,23 @@ pub fn render_nic_info(base_url: &str) -> String {
     s
 }
 
-/// Gated Deployment entry point. Joins the queue, then enters a long-poll
+/// Queued Deployment entry point. Joins the queue, then enters a long-poll
 /// loop (iPXE repeats the chain on 3xx redirects / HTTP errors until a
 /// real script comes back).
 #[must_use]
-pub fn render_gate_entry(base_url: &str) -> String {
+pub fn render_queue_entry(base_url: &str) -> String {
     let base = base_url.trim_end_matches('/');
     let mut s = String::new();
     let _ = writeln!(s, "#!ipxe");
-    let _ = writeln!(s, "# Gated Deployment - join the queue and wait for operator");
-    let _ = writeln!(s, "echo Joining gate queue...");
+    let _ = writeln!(
+        s,
+        "# Queued Deployment - join the queue and wait for operator"
+    );
+    let _ = writeln!(s, "echo Joining deployment queue...");
     // imgfetch writes the body to a file in iPXE's transient FS; we read
-    // the gate id out of the Location-style header by asking the server
+    // the queue entry id out of the Location-style header by asking the server
     // to put it in the response body as a single token.
-    let _ = writeln!(s, "chain --replace {base}/api/gate/join?mac=${{mac}}");
+    let _ = writeln!(s, "chain --replace {base}/api/queue/join?mac=${{mac}}");
     s
 }
 
@@ -272,7 +417,11 @@ pub fn render_entry(entry: &BootEntry, settings: &Settings, base_url: &str) -> S
     let _ = writeln!(s, "#!ipxe");
     let _ = writeln!(s, "set base-url {base}");
     match &entry.kind {
-        BootKind::LinuxKernel { kernel_url, initrd_urls, args } => {
+        BootKind::LinuxKernel {
+            kernel_url,
+            initrd_urls,
+            args,
+        } => {
             let mut cmdline = args.cmdline.replace("${base-url}", base);
             if !settings.extra_kernel_args.trim().is_empty() {
                 cmdline.push(' ');
@@ -323,5 +472,129 @@ fn has_family(isos: &[IsoMeta], pred: fn(DistroFamily) -> bool) -> bool {
 }
 
 fn escape_label(s: &str) -> String {
-    s.chars().map(|c| match c { '\n' | '\r' => ' ', c => c }).collect()
+    s.chars()
+        .map(|c| match c {
+            '\n' | '\r' => ' ',
+            c => c,
+        })
+        .collect()
+}
+
+/// Render the password-prompt script for a protected boot entry.
+///
+/// Flow on the client:
+///   1. iPXE clears any leftover ${password}, prints a banner naming the
+///      ISO so the operator knows what they're being asked for.
+///   2. `read --secret password` accepts input without echoing it to
+///      the screen.
+///   3. An empty input bails back to the main menu (lets the operator
+///      back out of a misclick).
+///   4. Otherwise the script chains the same /boot/<id>.ipxe URL but
+///      with `?token=${password:uristring}`. iPXE's `:uristring`
+///      modifier URL-encodes the value so `&`, `?`, `=`, spaces, etc.
+///      survive transport.
+///   5. The server replies with either the boot script (correct
+///      password) or [`render_password_failed`] (wrong password). On
+///      transport failure we fall back to the main menu.
+#[must_use]
+pub fn render_password_prompt(entry_id: &str, iso_filename: &str, base_url: &str) -> String {
+    let base = base_url.trim_end_matches('/');
+    let label = escape_label(iso_filename);
+    let mut s = String::new();
+    let _ = writeln!(s, "#!ipxe");
+    let _ = writeln!(s, "# OpenPXE password prompt for {label}");
+    let _ = writeln!(s, "echo");
+    let _ = writeln!(s, "echo ==========================================");
+    let _ = writeln!(s, "echo   This image requires a password");
+    let _ = writeln!(s, "echo   {label}");
+    let _ = writeln!(s, "echo   (enter alone returns to main menu)");
+    let _ = writeln!(s, "echo ==========================================");
+    let _ = writeln!(s, "set password ");
+    let _ = writeln!(s, "read --secret password");
+    let _ = writeln!(
+        s,
+        "iseq ${{password}} \"\" && chain {base}/boot.ipxe || goto submit"
+    );
+    let _ = writeln!(s, ":submit");
+    let _ = writeln!(s, "echo Verifying...");
+    // Carry `mac=${mac}` alongside the token so a successful unlock
+    // records the actual client MAC into the Host log. On
+    // older iPXE that can't resolve `${mac}` the server just stores it
+    // as "unknown" rather than refusing to boot.
+    let _ = writeln!(
+        s,
+        "chain {base}/boot/{entry_id}.ipxe?token=${{password:uristring}}&mac=${{mac}} \
+         || chain {base}/boot.ipxe"
+    );
+    s
+}
+
+/// Render the "wrong password" script. Tells the operator, sleeps for
+/// two seconds (gives the eye time to register the message and dampens
+/// brute-force rate without help from the server), and chains back to
+/// the same entry — which sends them through the prompt flow again.
+#[must_use]
+pub fn render_password_failed(entry_id: &str, base_url: &str) -> String {
+    let base = base_url.trim_end_matches('/');
+    let mut s = String::new();
+    let _ = writeln!(s, "#!ipxe");
+    let _ = writeln!(s, "echo");
+    let _ = writeln!(s, "echo Wrong password.");
+    let _ = writeln!(s, "sleep 2");
+    let _ = writeln!(
+        s,
+        "chain {base}/boot/{entry_id}.ipxe || chain {base}/boot.ipxe"
+    );
+    s
+}
+
+#[cfg(test)]
+mod password_tests {
+    use super::*;
+
+    #[test]
+    fn prompt_uses_secret_read_and_uri_escape() {
+        let s = render_password_prompt("alpha-linux", "Alpha Test.iso", "http://10.0.0.5");
+        assert!(s.starts_with("#!ipxe\n"));
+        assert!(s.contains("read --secret password"));
+        assert!(s.contains("Alpha Test.iso"));
+        // URI-string modifier on the var so passwords with `&`/spaces survive.
+        assert!(s.contains("token=${password:uristring}"));
+        // Empty enter sends back to the main menu, not back into the prompt
+        // (avoids a wedged client if the operator chose by mistake).
+        assert!(s.contains("&& chain http://10.0.0.5/boot.ipxe || goto submit"));
+        // Never log/echo the value.
+        assert!(!s.contains("echo ${password"));
+    }
+
+    #[test]
+    fn failed_chains_back_to_entry() {
+        let s = render_password_failed("alpha-linux", "http://10.0.0.5");
+        assert!(s.contains("Wrong password."));
+        // Re-target the entry so the prompt flow runs again.
+        assert!(s.contains("chain http://10.0.0.5/boot/alpha-linux.ipxe"));
+    }
+
+    #[test]
+    fn generated_scripts_do_not_emit_bare_or_trailing_fallbacks() {
+        let settings = Settings::default();
+        let scripts = [
+            render_menu(&[], &settings, "http://10.0.0.5"),
+            render_tools_menu(&[], "http://10.0.0.5"),
+            render_local_hdd("http://10.0.0.5"),
+            render_util("http://10.0.0.5"),
+            render_shell("http://10.0.0.5"),
+            render_nic_info("http://10.0.0.5"),
+            render_queue_entry("http://10.0.0.5"),
+            render_password_failed("alpha-linux", "http://10.0.0.5"),
+        ];
+        for script in scripts {
+            for line in script.lines() {
+                assert!(
+                    !line.trim_end().ends_with("||"),
+                    "bare iPXE fallback operator in line: {line}\nscript:\n{script}"
+                );
+            }
+        }
+    }
 }

crates/http-api/src/iso_fs.rs

@@ -31,7 +31,9 @@ pub fn lookup(iso_path: &Path, in_iso_path: &str) -> Option<FileLocation> {
         .split('/')
         .filter(|c| !c.is_empty())
         .collect();
-    if components.is_empty() { return None; }
+    if components.is_empty() {
+        return None;
+    }
     walk(&mut f, root.offset, root.length, &components)
 }
 
@@ -40,11 +42,16 @@ fn read_root_directory(f: &mut std::fs::File) -> Option<FileLocation> {
     let mut pvd = [0u8; 2048];
     f.seek(SeekFrom::Start(16 * SECTOR)).ok()?;
     f.read_exact(&mut pvd).ok()?;
-    if pvd[0] != 0x01 || &pvd[1..6] != b"CD001" { return None; }
+    if pvd[0] != 0x01 || &pvd[1..6] != b"CD001" {
+        return None;
+    }
     // Root directory record is at offset 156, length 34.
     let rec = &pvd[156..156 + 34];
     let (offset, length) = parse_dir_record_ext(rec)?;
-    Some(FileLocation { offset: offset * SECTOR, length })
+    Some(FileLocation {
+        offset: offset * SECTOR,
+        length,
+    })
 }
 
 /// Walk components down the directory tree starting at `dir_offset`.
@@ -66,21 +73,29 @@ fn walk(
         if len == 0 {
             // Padding to sector boundary.
             let next = (i / SECTOR as usize + 1) * SECTOR as usize;
-            if next <= i { break; }
+            if next <= i {
+                break;
+            }
             i = next;
             continue;
         }
-        if i + len > dir.len() { break; }
+        if i + len > dir.len() {
+            break;
+        }
         let rec = &dir[i..i + len];
         let name = dir_record_name(rec);
         let is_dir = (rec.get(25).copied().unwrap_or(0) & 0x02) != 0;
         // Skip "." (0x00) and ".." (0x01) pseudo-entries.
-        let is_pseudo = matches!(rec.get(32).copied(), Some(1)) && rec.get(33).copied() == Some(0x00)
+        let is_pseudo = matches!(rec.get(32).copied(), Some(1))
+            && rec.get(33).copied() == Some(0x00)
             || matches!(rec.get(32).copied(), Some(1)) && rec.get(33).copied() == Some(0x01);
         if !is_pseudo && name.eq_ignore_ascii_case(target) {
             let (child_off, child_len) = parse_dir_record_ext(rec)?;
             if rest.is_empty() && !is_dir {
-                return Some(FileLocation { offset: child_off * SECTOR, length: child_len });
+                return Some(FileLocation {
+                    offset: child_off * SECTOR,
+                    length: child_len,
+                });
             } else if !rest.is_empty() && is_dir {
                 return walk(f, child_off * SECTOR, child_len, rest);
             }
@@ -94,7 +109,9 @@ fn walk(
 /// Layout per ISO9660: bytes 2..10 extent LBA (LE+BE duplicate), 10..18
 /// data length (LE+BE duplicate). We trust the little-endian copy.
 fn parse_dir_record_ext(rec: &[u8]) -> Option<(u64, u64)> {
-    if rec.len() < 34 { return None; }
+    if rec.len() < 34 {
+        return None;
+    }
     let lba = u32::from_le_bytes(rec[2..6].try_into().ok()?) as u64;
     let len = u32::from_le_bytes(rec[10..14].try_into().ok()?) as u64;
     Some((lba, len))
@@ -104,9 +121,15 @@ fn parse_dir_record_ext(rec: &[u8]) -> Option<(u64, u64)> {
 /// `;1` version suffix.
 fn dir_record_name(rec: &[u8]) -> String {
     let name_len = *rec.get(32).unwrap_or(&0) as usize;
-    if name_len == 0 || rec.len() < 33 + name_len { return String::new(); }
+    if name_len == 0 || rec.len() < 33 + name_len {
+        return String::new();
+    }
     let raw = &rec[33..33 + name_len];
     let s = String::from_utf8_lossy(raw).to_string();
     // Strip `;N` version suffix.
-    if let Some(i) = s.rfind(';') { s[..i].to_string() } else { s }
+    if let Some(i) = s.rfind(';') {
+        s[..i].to_string()
+    } else {
+        s
+    }
 }

crates/http-api/src/lib.rs

@@ -1,5 +1,5 @@
 //! HTTP server — single axum app that serves:
-//!   - `/`                   the web UI (static assets from `pxeforge-webui`)
+//!   - `/`                   the web UI (static assets from `openpxe-webui`)
 //!   - `/api/*`              JSON API for the web UI
 //!   - `/boot.ipxe`          the generated top-level iPXE boot menu
 //!   - `/boot/<entry>.ipxe`  per-entry iPXE scripts (one per boot target)
@@ -19,6 +19,7 @@ pub mod iso_fs;
 pub mod log_stream;
 pub mod state;
 pub mod terminal;
+pub mod uploads;
 
 pub use app::build_router;
 pub use state::AppState;

crates/http-api/src/log_stream.rs

@@ -12,7 +12,7 @@ use axum::{
     Json,
 };
 use futures::stream::{Stream, StreamExt};
-use pxeforge_core::LogLine;
+use openpxe_core::LogLine;
 use serde_json::json;
 use std::convert::Infallible;
 use std::time::Duration;
@@ -36,9 +36,11 @@ pub async fn stream(
     let rx = state.log_bus.subscribe();
     let live = BroadcastStream::new(rx).map(|res| match res {
         Ok(line) => Ok(Event::default().data(line_json(&line))),
-        Err(tokio_stream::wrappers::errors::BroadcastStreamRecvError::Lagged(n)) => Ok(Event::default()
-            .event("lagged")
-            .data(json!({ "skipped": n }).to_string())),
+        Err(tokio_stream::wrappers::errors::BroadcastStreamRecvError::Lagged(n)) => {
+            Ok(Event::default()
+                .event("lagged")
+                .data(json!({ "skipped": n }).to_string()))
+        }
     });
 
     Sse::new(recent_stream.chain(live))
@@ -55,9 +57,11 @@ pub async fn recent(State(state): State<AppState>) -> Json<serde_json::Value> {
 /// keep streaming new lines as they arrive).
 pub async fn clear(State(state): State<AppState>) -> Json<serde_json::Value> {
     state.log_bus.clear();
-    state
-        .log_bus
-        .push("info", "pxeforge::terminal", "log buffer cleared by operator");
+    state.log_bus.push(
+        "info",
+        "openpxe::terminal",
+        "log buffer cleared by operator",
+    );
     Json(json!({ "ok": true }))
 }
 

crates/http-api/src/state.rs

@@ -1,5 +1,9 @@
-use pxeforge_core::{ClientRegistry, GateQueue, HostBindings, LogBus, Metrics, SettingsStore};
-use pxeforge_iso_store::{IsoStore, NfsManager, SmbManager};
+use crate::uploads::UploadSessions;
+use openpxe_core::{
+    BootLog, BrandingStore, ClientRegistry, DeploymentQueue, HostBindings, LogBus, Metrics,
+    SettingsStore,
+};
+use openpxe_iso_store::{IsoStore, NfsManager, SmbManager};
 use std::sync::Arc;
 use time::OffsetDateTime;
 
@@ -8,11 +12,19 @@ pub struct AppState {
     pub iso_store: IsoStore,
     pub clients: Arc<ClientRegistry>,
     pub settings: Arc<SettingsStore>,
-    pub gates: Arc<GateQueue>,
+    pub queue: Arc<DeploymentQueue>,
     /// Per-MAC iPXE script overrides. When a client matching one of
     /// these MACs requests `/boot.ipxe`, we chain straight to the
     /// configured target instead of rendering the menu.
     pub hosts: HostBindings,
+    /// Persistent boot-event log surfaced under the Hosts tab. Records
+    /// every `/boot/<entry>.ipxe` chain that goes on to serve a script
+    /// (i.e. an image actually starting to install on a machine).
+    pub boot_log: BootLog,
+    /// Operator-controlled UI overrides (custom logo). When the
+    /// operator hasn't uploaded anything, the WebUI serves the bundled
+    /// rainbow-horizon mark.
+    pub branding: BrandingStore,
     /// Lock-free metrics counters surfaced at `/metrics` in Prometheus
     /// text format. Cheap to clone (handles to atomics).
     pub metrics: Metrics,
@@ -25,6 +37,10 @@ pub struct AppState {
     /// available in the runtime image. Surfaces errors per-mount rather
     /// than failing the global state.
     pub nfs: NfsManager,
+    /// Browser chunked upload state. Multipart uploads still go straight
+    /// through `IsoStore`, but the UI uses sessions so large ISO transfers
+    /// can show deterministic progress and leave visible partial files.
+    pub uploads: UploadSessions,
     /// Live log bus consumed by the Terminal tab via SSE. Operator-issued
     /// terminal commands also push synthetic lines onto it so the tail
     /// shows them inline.

crates/http-api/src/terminal.rs

@@ -31,12 +31,17 @@ pub async fn run_command(
 ) -> impl IntoResponse {
     let line = req.command.trim();
     if line.is_empty() {
-        return (StatusCode::OK, Json(json!({ "output": HELP_TEXT, "ok": true })));
+        return (
+            StatusCode::OK,
+            Json(json!({ "output": HELP_TEXT, "ok": true })),
+        );
     }
 
     // Echo the typed command into the live log so the Terminal tab shows
     // operator activity in-band with server-emitted log lines.
-    state.log_bus.push("info", "pxeforge::terminal", format!("> {line}"));
+    state
+        .log_bus
+        .push("info", "openpxe::terminal", format!("> {line}"));
 
     let argv = shell_split(line);
     if argv.is_empty() {
@@ -55,14 +60,18 @@ pub async fn run_command(
     // so reading the live tail tells the same story as scrolling the
     // terminal pane.
     let mirror = if output.len() > 1024 {
-        format!("{}\n... ({} bytes truncated)", &output[..1024], output.len() - 1024)
+        format!(
+            "{}\n... ({} bytes truncated)",
+            &output[..1024],
+            output.len() - 1024
+        )
     } else {
         output.clone()
     };
     if ok {
-        state.log_bus.push("info", "pxeforge::terminal", mirror);
+        state.log_bus.push("info", "openpxe::terminal", mirror);
     } else {
-        state.log_bus.push("warn", "pxeforge::terminal", mirror);
+        state.log_bus.push("warn", "openpxe::terminal", mirror);
     }
 
     (StatusCode::OK, Json(json!({ "output": output, "ok": ok })))
@@ -73,12 +82,12 @@ async fn dispatch(state: &AppState, argv: &[String]) -> Result<String, String> {
     let tail = &argv[1..];
     match head {
         "help" | "?" => Ok(HELP_TEXT.to_string()),
-        "version" => Ok(format!("pxeforge {}", env!("CARGO_PKG_VERSION"))),
+        "version" => Ok(format!("openpxe {}", env!("CARGO_PKG_VERSION"))),
         "uptime" => Ok(uptime_string(state)),
         "status" => Ok(status_text(state)),
         "isos" | "images" => Ok(isos_text(state)),
         "clients" => Ok(clients_text(state)),
-        "gate" => gate_command(state, tail).await,
+        "queue" => queue_command(state, tail).await,
         "nfs" => nfs_command(state, tail).await,
         "smb" => smb_command(state, tail).await,
         "log" => log_command(state, tail),
@@ -96,29 +105,39 @@ async fn dispatch(state: &AppState, argv: &[String]) -> Result<String, String> {
 fn status_text(s: &AppState) -> String {
     let isos = s.iso_store.list();
     let clients = s.clients.list();
-    let gates = s.gates.list();
+    let queue_entries = s.queue.list();
     let smb = s.smb.as_ref().map(|m| m.snapshot());
     let nfs = s.nfs.list();
     let nfs_active = nfs.iter().filter(|m| m.mounted).count();
     format!(
-        "PXEForge {ver}\n\
+        "OpenPXE {ver}\n\
          base url:     {base}\n\
          interface:    {nic}\n\
          uptime:       {up}\n\
          isos:         {n_isos}  (local: {n_local}, nfs: {n_nfs})\n\
          clients:      {n_clients}\n\
-         gates:        {n_gates}\n\
+         queue:        {n_entries}\n\
          smb:          {smb}\n\
          nfs mounts:   {n_total} configured ({n_active} active)\n",
         ver = env!("CARGO_PKG_VERSION"),
         base = s.public_base_url,
-        nic = if s.nic_name.is_empty() { "?" } else { s.nic_name.as_str() },
+        nic = if s.nic_name.is_empty() {
+            "?"
+        } else {
+            s.nic_name.as_str()
+        },
         up = uptime_string(s),
         n_isos = isos.len(),
-        n_local = isos.iter().filter(|i| matches!(i.source, pxeforge_iso_store::IsoSource::Local)).count(),
-        n_nfs = isos.iter().filter(|i| !matches!(i.source, pxeforge_iso_store::IsoSource::Local)).count(),
+        n_local = isos
+            .iter()
+            .filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Local))
+            .count(),
+        n_nfs = isos
+            .iter()
+            .filter(|i| !matches!(i.source, openpxe_iso_store::IsoSource::Local))
+            .count(),
         n_clients = clients.len(),
-        n_gates = gates.len(),
+        n_entries = queue_entries.len(),
         smb = smb.map_or_else(|| "(disabled)".into(), |s| format!("{s:?}")),
         n_total = nfs.len(),
         n_active = nfs_active,
@@ -138,8 +157,8 @@ fn isos_text(s: &AppState) -> String {
     );
     for i in isos {
         let src = match i.source {
-            pxeforge_iso_store::IsoSource::Local => "local".to_string(),
-            pxeforge_iso_store::IsoSource::Nfs { mount_id, .. } => format!("nfs:{mount_id}"),
+            openpxe_iso_store::IsoSource::Local => "local".to_string(),
+            openpxe_iso_store::IsoSource::Nfs { mount_id, .. } => format!("nfs:{mount_id}"),
         };
         let _ = writeln!(
             out,
@@ -159,11 +178,7 @@ fn clients_text(s: &AppState) -> String {
         return "(no clients yet)".into();
     }
     let mut out = String::new();
-    let _ = writeln!(
-        out,
-        "{:<19} {:<16} {:<8} LAST SEEN",
-        "MAC", "IP", "EVENTS"
-    );
+    let _ = writeln!(out, "{:<19} {:<16} {:<8} LAST SEEN", "MAC", "IP", "EVENTS");
     for c in clients {
         let ip = c.last_ip.map_or_else(|| "-".into(), |i| i.to_string());
         let _ = writeln!(
@@ -180,35 +195,35 @@ fn clients_text(s: &AppState) -> String {
     out
 }
 
-// ── gate ───────────────────────────────────────────────────────────────
+// ── queue ──────────────────────────────────────────────────────────────
 
-// `async` for symmetry with the other dispatch helpers — gate operations
+// `async` for symmetry with the other dispatch helpers — queue operations
 // are sync today but might grow to await on a database in a future phase.
 #[allow(clippy::unused_async)]
-async fn gate_command(s: &AppState, args: &[String]) -> Result<String, String> {
+async fn queue_command(s: &AppState, args: &[String]) -> Result<String, String> {
     match args.first().map(String::as_str) {
         None | Some("list") => {
-            let gs = s.gates.list();
-            if gs.is_empty() {
-                return Ok("(no gates)".into());
+            let entries = s.queue.list();
+            if entries.is_empty() {
+                return Ok("(queue empty)".into());
             }
             let mut out = String::new();
-            for g in gs {
+            for entry in entries {
                 let _ = writeln!(
                     out,
                     "#{:<3} {:<19} {:<16} target={}",
-                    g.position,
-                    g.mac,
-                    g.id,
-                    g.assigned_target.unwrap_or_else(|| "-".into())
+                    entry.position,
+                    entry.mac,
+                    entry.id,
+                    entry.assigned_target.unwrap_or_else(|| "-".into())
                 );
             }
             Ok(out)
         }
         Some("assign-all") => {
-            let target = args.get(1).ok_or_else(|| {
-                "usage: gate assign-all <iso_boot_entry_id>".to_string()
-            })?;
+            let target = args
+                .get(1)
+                .ok_or_else(|| "usage: queue assign-all <iso_boot_entry_id>".to_string())?;
             let found = s
                 .iso_store
                 .list()
@@ -217,32 +232,34 @@ async fn gate_command(s: &AppState, args: &[String]) -> Result<String, String> {
             if !found {
                 return Err(format!("no such boot entry: {target}"));
             }
-            let ids: Vec<_> = s.gates.list().into_iter().map(|g| g.id).collect();
-            let n = s.gates.assign(&ids, target);
-            Ok(format!("assigned {n} gates -> {target}"))
+            let ids: Vec<_> = s.queue.list().into_iter().map(|g| g.id).collect();
+            let n = s.queue.assign(&ids, target);
+            Ok(format!("assigned {n} queue entries -> {target}"))
         }
         Some("assign") => {
-            let gate_id = args
+            let entry_id = args
                 .get(1)
-                .ok_or_else(|| "usage: gate assign <gate_id> <iso_boot_entry_id>".to_string())?;
+                .ok_or_else(|| "usage: queue assign <entry_id> <iso_boot_entry_id>".to_string())?;
             let target = args
                 .get(2)
-                .ok_or_else(|| "usage: gate assign <gate_id> <iso_boot_entry_id>".to_string())?;
-            let n = s.gates.assign(std::slice::from_ref(gate_id), target);
+                .ok_or_else(|| "usage: queue assign <entry_id> <iso_boot_entry_id>".to_string())?;
+            let n = s.queue.assign(std::slice::from_ref(entry_id), target);
             if n == 0 {
-                return Err(format!("no such gate: {gate_id}"));
+                return Err(format!("no such queue entry: {entry_id}"));
             }
-            Ok(format!("assigned 1 gate -> {target}"))
+            Ok(format!("assigned 1 queue entry -> {target}"))
         }
         Some("release") => {
-            let gate_id = args.get(1).ok_or_else(|| "usage: gate release <gate_id>".to_string())?;
-            match s.gates.release(gate_id) {
-                Some(_) => Ok(format!("released {gate_id}")),
-                None => Err(format!("no such gate: {gate_id}")),
+            let entry_id = args
+                .get(1)
+                .ok_or_else(|| "usage: queue release <entry_id>".to_string())?;
+            match s.queue.release(entry_id) {
+                Some(_) => Ok(format!("released {entry_id}")),
+                None => Err(format!("no such queue entry: {entry_id}")),
             }
         }
         Some(other) => Err(format!(
-            "unknown gate subcommand: {other}\ntry: gate [list|assign-all|assign|release]"
+            "unknown queue subcommand: {other}\ntry: queue [list|assign-all|assign|release]"
         )),
     }
 }
@@ -269,8 +286,8 @@ async fn nfs_command(s: &AppState, args: &[String]) -> Result<String, String> {
                     "{:<24} {:<6} {:<7} {:<6} {}:{}",
                     truncate(&m.id, 24),
                     match m.version {
-                        pxeforge_iso_store::NfsVersion::V3 => "v3",
-                        pxeforge_iso_store::NfsVersion::V41 => "v4.1",
+                        openpxe_iso_store::NfsVersion::V3 => "v3",
+                        openpxe_iso_store::NfsVersion::V41 => "v4.1",
                     },
                     status,
                     m.iso_count,
@@ -292,12 +309,14 @@ async fn nfs_command(s: &AppState, args: &[String]) -> Result<String, String> {
                 .split_once(':')
                 .ok_or_else(|| "target must be 'server:/export'".to_string())?;
             let version = match args.get(2).map(String::as_str) {
-                Some("v3") => pxeforge_iso_store::NfsVersion::V3,
-                Some("v41") | None => pxeforge_iso_store::NfsVersion::V41,
-                Some(other) => return Err(format!("unknown nfs version: {other} (expect v3 or v41)")),
+                Some("v3") => openpxe_iso_store::NfsVersion::V3,
+                Some("v41") | None => openpxe_iso_store::NfsVersion::V41,
+                Some(other) => {
+                    return Err(format!("unknown nfs version: {other} (expect v3 or v41)"))
+                }
             };
             let read_only = !matches!(args.get(3).map(String::as_str), Some("rw"));
-            let req = pxeforge_iso_store::NfsAddRequest {
+            let req = openpxe_iso_store::NfsAddRequest {
                 server: server.to_string(),
                 export: export.to_string(),
                 version,
@@ -309,14 +328,18 @@ async fn nfs_command(s: &AppState, args: &[String]) -> Result<String, String> {
             }
         }
         Some("unmount") => {
-            let id = args.get(1).ok_or_else(|| "usage: nfs unmount <id>".to_string())?;
+            let id = args
+                .get(1)
+                .ok_or_else(|| "usage: nfs unmount <id>".to_string())?;
             match s.nfs.remove(id).await {
                 Ok(()) => Ok(format!("unmounted {id}")),
                 Err(e) => Err(format!("unmount failed: {e}")),
             }
         }
         Some("scan") => {
-            let id = args.get(1).ok_or_else(|| "usage: nfs scan <id>".to_string())?;
+            let id = args
+                .get(1)
+                .ok_or_else(|| "usage: nfs scan <id>".to_string())?;
             match s.nfs.rescan(id).await {
                 Ok(n) => Ok(format!("re-scanned {id}: {n} isos")),
                 Err(e) => Err(format!("scan failed: {e}")),
@@ -368,10 +391,7 @@ fn log_command(s: &AppState, args: &[String]) -> Result<String, String> {
             Ok("log buffer cleared".into())
         }
         Some("tail") => {
-            let n: usize = args
-                .get(1)
-                .and_then(|v| v.parse().ok())
-                .unwrap_or(20);
+            let n: usize = args.get(1).and_then(|v| v.parse().ok()).unwrap_or(20);
             let lines = s.log_bus.recent();
             let start = lines.len().saturating_sub(n);
             let mut out = String::new();
@@ -453,7 +473,7 @@ pub fn shell_split(input: &str) -> Vec<String> {
 }
 
 const HELP_TEXT: &str = "\
-PXEForge terminal — available commands:
+OpenPXE terminal — available commands:
 
   help                              show this help
   version                           print server version
@@ -462,10 +482,10 @@ PXEForge terminal — available commands:
 
   isos                              list registered ISOs
   clients                           list PXE clients seen this session
-  gate list                         list gated-deployment queue
-  gate assign <gate_id> <target>    assign one gate to a boot entry
-  gate assign-all <target>          assign every waiting gate
-  gate release <gate_id>            release one gate
+  queue list                        list queued clients
+  queue assign <entry_id> <target>   assign one queued client to a boot entry
+  queue assign-all <target>         assign every waiting client
+  queue release <entry_id>           release one queued client
 
   nfs list                          list NFS mounts
   nfs mount <s>:<e> [v3|v41] [ro|rw]  add and mount an NFS share
@@ -521,4 +541,10 @@ mod tests {
         assert_eq!(truncate("hi", 10), "hi");
         assert_eq!(truncate("longerthanfive", 5), "long…");
     }
+
+    #[test]
+    fn help_uses_queue_language() {
+        assert!(HELP_TEXT.contains("queue list"));
+        assert!(HELP_TEXT.contains("queued clients"));
+    }
 }

crates/http-api/src/uploads.rs

@@ -0,0 +1,180 @@
+//! Chunked upload sessions for browser-driven ISO uploads.
+//!
+//! The legacy multipart endpoint still exists for simple API clients, but
+//! browsers get a better failure mode with raw chunks: progress advances after
+//! each acknowledged write, partial files appear in the ISO directory
+//! immediately, and reverse proxies are less likely to buffer an entire DVD
+//! image before OpenPXE sees byte one.
+
+use bytes::Bytes;
+use openpxe_core::{Error, Result};
+use openpxe_iso_store::{IsoMeta, IsoStore, UploadHandle};
+use serde::Serialize;
+use std::collections::HashMap;
+use std::sync::Arc;
+use tokio::sync::Mutex;
+use uuid::Uuid;
+
+const DEFAULT_CHUNK_SIZE: u64 = 8 * 1024 * 1024;
+
+#[derive(Clone, Default)]
+pub struct UploadSessions {
+    inner: Arc<Mutex<HashMap<String, Arc<Mutex<UploadSession>>>>>,
+}
+
+struct UploadSession {
+    filename: String,
+    expected_size: Option<u64>,
+    offset: u64,
+    handle: Option<UploadHandle>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct UploadStarted {
+    pub upload_id: String,
+    pub iso_id: String,
+    pub filename: String,
+    pub offset: u64,
+    pub chunk_size: u64,
+}
+
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum UploadAppend {
+    Progress { offset: u64 },
+    Complete { offset: u64, iso: Box<IsoMeta> },
+}
+
+impl UploadSessions {
+    pub async fn begin(
+        &self,
+        store: &IsoStore,
+        filename: &str,
+        expected_size: Option<u64>,
+    ) -> Result<UploadStarted> {
+        if !filename.to_ascii_lowercase().ends_with(".iso") {
+            return Err(Error::Invalid("only .iso uploads accepted".to_string()));
+        }
+
+        let handle = store.begin_upload(filename).await?;
+        let iso_id = handle.id.clone();
+        let upload_id = Uuid::new_v4().to_string();
+        let session = UploadSession {
+            filename: filename.to_string(),
+            expected_size,
+            offset: 0,
+            handle: Some(handle),
+        };
+
+        self.inner
+            .lock()
+            .await
+            .insert(upload_id.clone(), Arc::new(Mutex::new(session)));
+
+        Ok(UploadStarted {
+            upload_id,
+            iso_id,
+            filename: filename.to_string(),
+            offset: 0,
+            chunk_size: DEFAULT_CHUNK_SIZE,
+        })
+    }
+
+    pub async fn append(
+        &self,
+        store: &IsoStore,
+        upload_id: &str,
+        offset: u64,
+        chunk: Bytes,
+        complete: bool,
+    ) -> Result<UploadAppend> {
+        let Some(session_lock) = self.inner.lock().await.get(upload_id).cloned() else {
+            return Err(Error::Invalid(format!("no such upload '{upload_id}'")));
+        };
+
+        let mut session = session_lock.lock().await;
+        if session.offset != offset {
+            return Err(Error::Invalid(format!(
+                "expected offset {}, got {offset}",
+                session.offset
+            )));
+        }
+
+        let new_offset = session
+            .offset
+            .checked_add(chunk.len() as u64)
+            .ok_or_else(|| Error::Invalid("upload offset overflow".to_string()))?;
+
+        if let Some(expected) = session.expected_size {
+            if new_offset > expected {
+                return Err(Error::Invalid(format!(
+                    "chunk exceeds declared upload size {expected}"
+                )));
+            }
+        }
+
+        let Some(handle) = session.handle.as_mut() else {
+            return Err(Error::Invalid("upload already completed".to_string()));
+        };
+        if let Err(e) = handle.write_chunk(&chunk).await {
+            let handle = session.handle.take();
+            drop(session);
+            self.inner.lock().await.remove(upload_id);
+            if let Some(handle) = handle {
+                let _ = handle.abort().await;
+            }
+            return Err(e);
+        }
+
+        session.offset = new_offset;
+        if !complete {
+            return Ok(UploadAppend::Progress { offset: new_offset });
+        }
+
+        if let Some(expected) = session.expected_size {
+            if new_offset != expected {
+                return Err(Error::Invalid(format!(
+                    "final chunk ended at {new_offset}, expected {expected}"
+                )));
+            }
+        }
+
+        let Some(handle) = session.handle.take() else {
+            return Err(Error::Invalid("upload already completed".to_string()));
+        };
+        let filename = session.filename.clone();
+        drop(session);
+
+        tracing::info!(
+            target: "openpxe::http::upload",
+            upload_id,
+            filename = %filename,
+            received_bytes = new_offset,
+            "chunked upload body complete; introspecting"
+        );
+
+        let meta = match handle.finish(store).await {
+            Ok(meta) => meta,
+            Err(e) => {
+                self.inner.lock().await.remove(upload_id);
+                return Err(e);
+            }
+        };
+        self.inner.lock().await.remove(upload_id);
+        Ok(UploadAppend::Complete {
+            offset: new_offset,
+            iso: Box::new(meta),
+        })
+    }
+
+    pub async fn abort(&self, upload_id: &str) -> Result<()> {
+        let Some(session_lock) = self.inner.lock().await.remove(upload_id) else {
+            return Err(Error::Invalid(format!("no such upload '{upload_id}'")));
+        };
+        let mut session = session_lock.lock().await;
+        if let Some(handle) = session.handle.take() {
+            handle.abort().await?;
+        }
+        Ok(())
+    }
+}

crates/ipxe-assets/Cargo.toml

@@ -1,16 +1,16 @@
 [package]
-name = "pxeforge-ipxe-assets"
+name = "openpxe-ipxe-assets"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
 authors.workspace = true
-description = "Bundled iPXE binaries and default chain scripts for PXEForge"
+description = "Bundled iPXE binaries and default chain scripts for OpenPXE"
 
 [lints]
 workspace = true
 
 [dependencies]
-pxeforge-core.workspace = true
+openpxe-core.workspace = true
 rust-embed.workspace = true
 tracing.workspace = true
 thiserror.workspace = true

crates/ipxe-assets/src/lib.rs

@@ -1,7 +1,7 @@
 //! Bundled iPXE boot binaries and default chain script.
 //!
 //! At build time, we expect the iPXE binaries to live at `assets/ipxe/` at
-//! the workspace root. They are embedded into the PXEForge binary via
+//! the workspace root. They are embedded into the OpenPXE binary via
 //! `rust-embed` so the container image is self-contained. If a binary is
 //! missing, that architecture simply won't have PXE support — we log at
 //! startup and serve what we have.
@@ -16,7 +16,7 @@
 //!   - `wimboot`             — Windows boot shim (fetched separately for WIM chains)
 #![forbid(unsafe_code)]
 
-use pxeforge_core::ClientArch;
+use openpxe_core::ClientArch;
 use rust_embed::Embed;
 
 #[derive(Embed)]
@@ -51,7 +51,9 @@ pub fn asset_slice(name: &str) -> Option<std::borrow::Cow<'static, [u8]>> {
 /// Enumerate embedded asset filenames. Useful for startup logging so the
 /// operator can immediately tell which architectures will work.
 pub fn list_assets() -> Vec<String> {
-    IpxeAssets::iter().map(std::borrow::Cow::into_owned).collect()
+    IpxeAssets::iter()
+        .map(std::borrow::Cow::into_owned)
+        .collect()
 }
 
 /// Log at startup which iPXE binaries are present and which are missing.
@@ -66,10 +68,10 @@ pub fn log_availability() {
     ];
     for (arch, name) in needed {
         if have.contains(name) {
-            tracing::info!(target: "pxeforge::ipxe", "bundled iPXE for {}: {}", arch.as_str(), name);
+            tracing::info!(target: "openpxe::ipxe", "bundled iPXE for {}: {}", arch.as_str(), name);
         } else {
             tracing::warn!(
-                target: "pxeforge::ipxe",
+                target: "openpxe::ipxe",
                 "MISSING iPXE binary for {}: {} — clients of this arch will not PXE boot",
                 arch.as_str(), name
             );

crates/iso-store/Cargo.toml

@@ -1,16 +1,16 @@
 [package]
-name = "pxeforge-iso-store"
+name = "openpxe-iso-store"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
 authors.workspace = true
-description = "ISO upload, storage, introspection, and boot-entry generation for PXEForge"
+description = "ISO upload, storage, introspection, and boot-entry generation for OpenPXE"
 
 [lints]
 workspace = true
 
 [dependencies]
-pxeforge-core.workspace = true
+openpxe-core.workspace = true
 tokio = { workspace = true }
 tokio-util = { workspace = true }
 serde.workspace = true
@@ -20,6 +20,7 @@ thiserror.workspace = true
 anyhow.workspace = true
 sha2.workspace = true
 hex.workspace = true
+bcrypt.workspace = true
 uuid.workspace = true
 time.workspace = true
 parking_lot.workspace = true

crates/iso-store/src/introspect.rs

@@ -49,7 +49,7 @@ pub fn introspect(path: &Path) -> IntrospectionReport {
     };
 
     let Ok(mut f) = std::fs::File::open(path) else {
-        tracing::warn!(target: "pxeforge::iso", "cannot open ISO for introspection: {}", path.display());
+        tracing::warn!(target: "openpxe::iso", "cannot open ISO for introspection: {}", path.display());
         return report;
     };
 
@@ -78,7 +78,9 @@ pub fn introspect(path: &Path) -> IntrospectionReport {
     let mut haystack = Vec::with_capacity(scan_bytes.min(32 * 1024 * 1024));
     while read_total < scan_bytes {
         let n = f.read(&mut buf).unwrap_or(0);
-        if n == 0 { break; }
+        if n == 0 {
+            break;
+        }
         haystack.extend_from_slice(&buf[..n]);
         read_total += n;
     }
@@ -107,8 +109,11 @@ fn family_from_label(label: &str) -> DistroFamily {
     let l = label.to_ascii_lowercase();
     if l.contains("ubuntu") || l.contains("debian") || l.contains("mint") {
         DistroFamily::DebianUbuntu
-    } else if l.contains("rhel") || l.contains("centos") || l.contains("fedora")
-        || l.contains("rocky") || l.contains("alma")
+    } else if l.contains("rhel")
+        || l.contains("centos")
+        || l.contains("fedora")
+        || l.contains("rocky")
+        || l.contains("alma")
     {
         DistroFamily::RhelFedora
     } else if l.contains("suse") || l.contains("opensuse") {
@@ -127,17 +132,30 @@ fn family_from_label(label: &str) -> DistroFamily {
 fn guess_kernel_initrd(family: DistroFamily) -> (Option<&'static str>, Vec<&'static str>) {
     match family {
         DistroFamily::DebianUbuntu => (Some("/casper/vmlinuz"), vec!["/casper/initrd"]),
-        DistroFamily::RhelFedora => (Some("/images/pxeboot/vmlinuz"), vec!["/images/pxeboot/initrd.img"]),
-        DistroFamily::OpenSuse => (Some("/boot/x86_64/loader/linux"), vec!["/boot/x86_64/loader/initrd"]),
-        DistroFamily::Arch => (Some("/arch/boot/x86_64/vmlinuz-linux"), vec!["/arch/boot/x86_64/initramfs-linux.img"]),
+        DistroFamily::RhelFedora => (
+            Some("/images/pxeboot/vmlinuz"),
+            vec!["/images/pxeboot/initrd.img"],
+        ),
+        DistroFamily::OpenSuse => (
+            Some("/boot/x86_64/loader/linux"),
+            vec!["/boot/x86_64/loader/initrd"],
+        ),
+        DistroFamily::Arch => (
+            Some("/arch/boot/x86_64/vmlinuz-linux"),
+            vec!["/arch/boot/x86_64/initramfs-linux.img"],
+        ),
         DistroFamily::Alpine => (Some("/boot/vmlinuz-lts"), vec!["/boot/initramfs-lts"]),
         DistroFamily::WindowsPe | DistroFamily::Unknown => (None, Vec::new()),
     }
 }
 
 fn contains_ascii(haystack: &[u8], needle: &[u8]) -> bool {
-    if needle.is_empty() || haystack.len() < needle.len() { return false; }
-    haystack.windows(needle.len()).any(|w| w.eq_ignore_ascii_case(needle))
+    if needle.is_empty() || haystack.len() < needle.len() {
+        return false;
+    }
+    haystack
+        .windows(needle.len())
+        .any(|w| w.eq_ignore_ascii_case(needle))
 }
 
 #[cfg(test)]
@@ -146,9 +164,18 @@ mod tests {
 
     #[test]
     fn label_matching() {
-        assert_eq!(family_from_label("Ubuntu 24.04"), DistroFamily::DebianUbuntu);
-        assert_eq!(family_from_label("Rocky-9-x86_64-dvd"), DistroFamily::RhelFedora);
-        assert_eq!(family_from_label("openSUSE-Leap-15.6"), DistroFamily::OpenSuse);
+        assert_eq!(
+            family_from_label("Ubuntu 24.04"),
+            DistroFamily::DebianUbuntu
+        );
+        assert_eq!(
+            family_from_label("Rocky-9-x86_64-dvd"),
+            DistroFamily::RhelFedora
+        );
+        assert_eq!(
+            family_from_label("openSUSE-Leap-15.6"),
+            DistroFamily::OpenSuse
+        );
         assert_eq!(family_from_label("ARCH_202604"), DistroFamily::Arch);
         assert_eq!(family_from_label("weird-custom"), DistroFamily::Unknown);
     }

crates/iso-store/src/lib.rs

@@ -27,5 +27,8 @@ pub use entry::{BootEntry, BootKind, KernelArgs};
 pub use introspect::{DistroFamily, IntrospectionReport};
 pub use nfs::{NfsAddRequest, NfsManager, NfsMount, NfsVersion};
 pub use smb::{extract_windows_iso, SmbManager, SmbState};
-pub use store::{generate_boot_entries_for, slugify_str, IsoMeta, IsoSource, IsoStore, UploadHandle};
+pub use store::{
+    generate_boot_entries_for, slugify_str, IsoCategory, IsoMeta, IsoSource, IsoStore,
+    UploadHandle,
+};
 pub use windows::{WimPatcher, WinPatchState};

crates/iso-store/src/nfs.rs

@@ -36,8 +36,8 @@
 
 use crate::introspect::{introspect, IntrospectionReport};
 use crate::store::{generate_boot_entries_for, slugify_str, IsoSource, IsoStore};
+use openpxe_core::{Error, Result};
 use parking_lot::Mutex;
-use pxeforge_core::{Error, Result};
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
 use std::path::{Path, PathBuf};
@@ -76,7 +76,7 @@ pub struct NfsMount {
     pub export: String,
     pub version: NfsVersion,
     /// Read-only by default — most ISO libraries are. Operators that need
-    /// write can flip this off but PXEForge itself never writes.
+    /// write can flip this off but OpenPXE itself never writes.
     pub read_only: bool,
     /// Local mount point under `<work_dir>/nfs/`.
     pub local_path: PathBuf,
@@ -168,7 +168,7 @@ impl NfsManager {
             self.inner.lock().mounts.insert(m.id.clone(), m.clone());
             if let Err(e) = self.try_mount(&m.id).await {
                 tracing::warn!(
-                    target: "pxeforge::nfs",
+                    target: "openpxe::nfs",
                     id = %m.id, error = %e,
                     "could not remount NFS share on startup"
                 );
@@ -299,7 +299,7 @@ impl NfsManager {
         match output {
             Ok(out) if out.status.success() => {
                 tracing::info!(
-                    target: "pxeforge::nfs",
+                    target: "openpxe::nfs",
                     id = %id, server = %m.server, export = %m.export,
                     version = ?m.version,
                     "NFS mount succeeded"
@@ -315,13 +315,13 @@ impl NfsManager {
                     out.status.code().unwrap_or(-1),
                     String::from_utf8_lossy(&out.stderr).trim()
                 );
-                tracing::warn!(target: "pxeforge::nfs", id = %id, "{err}");
+                tracing::warn!(target: "openpxe::nfs", id = %id, "{err}");
                 self.update_status(id, false, Some(err.clone()), now);
                 Err(Error::Invalid(err))
             }
             Err(e) => {
                 let err = format!("could not exec /bin/mount: {e}");
-                tracing::error!(target: "pxeforge::nfs", id = %id, "{err}");
+                tracing::error!(target: "openpxe::nfs", id = %id, "{err}");
                 self.update_status(id, false, Some(err.clone()), now);
                 Err(Error::Invalid(err))
             }
@@ -403,14 +403,8 @@ impl NfsManager {
                 mount_id: m.id.clone(),
                 relative_path: filename.clone(),
             };
-            self.iso_store.register_external(
-                id,
-                filename,
-                size,
-                report,
-                boot_entries,
-                source,
-            );
+            self.iso_store
+                .register_external(id, filename, size, report, boot_entries, source);
             count += 1;
         }
         Ok(count)
@@ -442,7 +436,7 @@ impl NfsManager {
         let body = match serde_json::to_vec_pretty(&mounts) {
             Ok(b) => b,
             Err(e) => {
-                tracing::warn!(target: "pxeforge::nfs", "serialize NFS state: {e}");
+                tracing::warn!(target: "openpxe::nfs", "serialize NFS state: {e}");
                 return;
             }
         };
@@ -450,11 +444,11 @@ impl NfsManager {
             let _ = std::fs::create_dir_all(parent);
         }
         if let Err(e) = std::fs::write(&tmp, body) {
-            tracing::warn!(target: "pxeforge::nfs", "write NFS state tmp: {e}");
+            tracing::warn!(target: "openpxe::nfs", "write NFS state tmp: {e}");
             return;
         }
         if let Err(e) = std::fs::rename(&tmp, path) {
-            tracing::warn!(target: "pxeforge::nfs", "rename NFS state: {e}");
+            tracing::warn!(target: "openpxe::nfs", "rename NFS state: {e}");
         }
     }
 }

crates/iso-store/src/smb.rs

@@ -20,16 +20,16 @@
 //!   - SMB2 minimum (no SMB1 legacy, not needed for WinPE).
 //!   - Bound to 0.0.0.0:445; operator MUST put this on a trusted install
 //!     VLAN — guest SMB is not for the general internet.
-//!   - smbd runs as the same non-root uid as pxeforge (10001).
+//!   - smbd runs as the same non-root uid as openpxe (10001).
 //!   - If `smbd` isn't on PATH (e.g. lightweight container build without
 //!     Samba), we return `SmbState::SmbdMissing` and the UI surfaces the
 //!     gap. No panics, no retries, no silent failure.
 
+use parking_lot::Mutex;
 use serde::{Deserialize, Serialize};
 use std::path::{Path, PathBuf};
 use std::process::{Child, Command, Stdio};
 use std::sync::Arc;
-use parking_lot::Mutex;
 
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(rename_all = "snake_case", tag = "state")]
@@ -72,7 +72,9 @@ impl SmbManager {
     /// ISO under `smb_dir/<slug>/` becomes a share named `<slug>`. Returns
     /// the sorted list.
     pub fn discover_shares(&self) -> Vec<String> {
-        let Ok(rd) = std::fs::read_dir(&self.smb_dir) else { return vec![]; };
+        let Ok(rd) = std::fs::read_dir(&self.smb_dir) else {
+            return vec![];
+        };
         let mut out: Vec<String> = rd
             .flatten()
             .filter(|e| e.path().is_dir())
@@ -100,7 +102,7 @@ impl SmbManager {
                 conf,
                 "\n[{name}]\n\
                  path = {}\n\
-                 comment = PXEForge Windows install media ({name})\n\
+                 comment = OpenPXE Windows install media ({name})\n\
                  read only = yes\n\
                  guest ok = yes\n\
                  guest only = yes\n\
@@ -130,7 +132,9 @@ impl SmbManager {
         let shares = match self.write_conf() {
             Ok(v) => v,
             Err(e) => {
-                let s = SmbState::Failed { reason: format!("write smb.conf: {e}") };
+                let s = SmbState::Failed {
+                    reason: format!("write smb.conf: {e}"),
+                };
                 *self.state.lock() = s.clone();
                 return s;
             }
@@ -139,7 +143,8 @@ impl SmbManager {
             .args([
                 "--foreground",
                 "--no-process-group",
-                "--configfile", self.conf_path.to_str().unwrap_or(""),
+                "--configfile",
+                self.conf_path.to_str().unwrap_or(""),
                 "--log-stdout",
             ])
             .stdin(Stdio::null())
@@ -152,11 +157,13 @@ impl SmbManager {
                 *g = Some(c);
                 let s = SmbState::Running { pid, shares };
                 *self.state.lock() = s.clone();
-                tracing::info!(target: "pxeforge::smb", pid, shares=?self.state.lock(), "smbd started");
+                tracing::info!(target: "openpxe::smb", pid, shares=?self.state.lock(), "smbd started");
                 s
             }
             Err(e) => {
-                let s = SmbState::Failed { reason: format!("spawn smbd: {e}") };
+                let s = SmbState::Failed {
+                    reason: format!("spawn smbd: {e}"),
+                };
                 *self.state.lock() = s.clone();
                 s
             }
@@ -168,11 +175,15 @@ impl SmbManager {
     #[allow(unsafe_code)]
     pub fn reconcile(&self) -> SmbState {
         let mut g = self.child.lock();
-        if g.is_none() { return self.state.lock().clone(); }
+        if g.is_none() {
+            return self.state.lock().clone();
+        }
         let shares = match self.write_conf() {
             Ok(v) => v,
             Err(e) => {
-                let s = SmbState::Failed { reason: format!("write smb.conf: {e}") };
+                let s = SmbState::Failed {
+                    reason: format!("write smb.conf: {e}"),
+                };
                 *self.state.lock() = s.clone();
                 return s;
             }
@@ -191,8 +202,13 @@ impl SmbManager {
             // covers this is `nix`, which pulls ~40 transitive deps for a
             // single signal send. One documented unsafe call is the better
             // tradeoff for a container-first project.
-            unsafe { libc::kill(pid, libc::SIGHUP); }
-            let s = SmbState::Running { pid: pid as u32, shares };
+            unsafe {
+                libc::kill(pid, libc::SIGHUP);
+            }
+            let s = SmbState::Running {
+                pid: pid as u32,
+                shares,
+            };
             *self.state.lock() = s.clone();
             s
         } else {
@@ -212,15 +228,19 @@ impl SmbManager {
 }
 
 fn smbd_present() -> bool {
-    let Ok(paths) = std::env::var("PATH") else { return false; };
+    let Ok(paths) = std::env::var("PATH") else {
+        return false;
+    };
     for dir in std::env::split_paths(&paths) {
-        if dir.join("smbd").is_file() { return true; }
+        if dir.join("smbd").is_file() {
+            return true;
+        }
     }
     false
 }
 
 const SMB_CONF_GLOBAL: &str = r"[global]
-workgroup = PXEFORGE
+workgroup = OPENPXE
 server min protocol = SMB2
 smb ports = 445
 log level = 1
@@ -235,6 +255,15 @@ lock directory = /tmp
 state directory = /tmp
 cache directory = /tmp
 pid directory = /tmp
+# WinPE reconnect hardening. Windows Setup can reboot mid-install and
+# reconnect from the same IP; stale sessions/oplocks otherwise cause
+# intermittent `net use` failures on the second stage.
+reset on zero vc = yes
+oplocks = no
+kernel oplocks = no
+level2 oplocks = no
+strict locking = no
+deadtime = 1
 ";
 
 /// Extract a Windows ISO at `iso_path` into `smb_dir/<slug>/`. Uses
@@ -245,10 +274,14 @@ pid directory = /tmp
 /// Idempotent: if the target dir already contains `sources/boot.wim`, we
 /// skip extraction. Callers who want a forced re-extract should remove the
 /// dir first.
-pub fn extract_windows_iso(iso_path: &Path, smb_dir: &Path, slug: &str) -> std::io::Result<PathBuf> {
+pub fn extract_windows_iso(
+    iso_path: &Path,
+    smb_dir: &Path,
+    slug: &str,
+) -> std::io::Result<PathBuf> {
     let target = smb_dir.join(slug);
     if target.join("sources").join("boot.wim").is_file() {
-        tracing::debug!(target: "pxeforge::smb", slug, "ISO already extracted, skipping");
+        tracing::debug!(target: "openpxe::smb", slug, "ISO already extracted, skipping");
         return Ok(target);
     }
     std::fs::create_dir_all(&target)?;
@@ -263,9 +296,11 @@ pub fn extract_windows_iso(iso_path: &Path, smb_dir: &Path, slug: &str) -> std::
             .stdout(Stdio::null())
             .stderr(Stdio::piped())
             .output()?;
-        if out.status.success() { return Ok(target); }
+        if out.status.success() {
+            return Ok(target);
+        }
         tracing::warn!(
-            target: "pxeforge::smb",
+            target: "openpxe::smb",
             stderr=%String::from_utf8_lossy(&out.stderr),
             "7z extract failed, trying bsdtar"
         );
@@ -278,7 +313,9 @@ pub fn extract_windows_iso(iso_path: &Path, smb_dir: &Path, slug: &str) -> std::
             .args(["-C"])
             .arg(&target)
             .output()?;
-        if out.status.success() { return Ok(target); }
+        if out.status.success() {
+            return Ok(target);
+        }
         return Err(std::io::Error::other(format!(
             "bsdtar failed: {}",
             String::from_utf8_lossy(&out.stderr)
@@ -294,7 +331,9 @@ fn which(cmd: &str) -> Option<PathBuf> {
     let paths = std::env::var_os("PATH")?;
     for dir in std::env::split_paths(&paths) {
         let p = dir.join(cmd);
-        if p.is_file() { return Some(p); }
+        if p.is_file() {
+            return Some(p);
+        }
     }
     None
 }
@@ -315,12 +354,14 @@ mod tests {
     fn start_without_smbd_reports_missing() {
         // Drop smbd from PATH for this test.
         let saved = std::env::var_os("PATH");
-        std::env::set_var("PATH", "/usr/nowhere-pxeforge-test");
+        std::env::set_var("PATH", "/usr/nowhere-openpxe-test");
         let dir = tempdir().unwrap();
         let m = SmbManager::new(dir.path().into());
         let st = m.start();
         // Restore PATH before asserting so any subsequent failure is legible.
-        if let Some(p) = saved { std::env::set_var("PATH", p); }
+        if let Some(p) = saved {
+            std::env::set_var("PATH", p);
+        }
         assert_eq!(st, SmbState::SmbdMissing);
     }
 
@@ -347,5 +388,27 @@ mod tests {
         assert!(conf.contains("guest ok = yes"));
         assert!(conf.contains("read only = yes"));
         assert!(conf.contains("server min protocol = SMB2"));
+        assert!(conf.contains("workgroup = OPENPXE"));
+    }
+
+    #[test]
+    fn write_conf_includes_winpe_reconnect_tuning() {
+        let dir = tempdir().unwrap();
+        let m = SmbManager::new(dir.path().into());
+        m.write_conf().unwrap();
+        let conf = std::fs::read_to_string(dir.path().join("smb.conf")).unwrap();
+        for expected in [
+            "reset on zero vc = yes",
+            "oplocks = no",
+            "kernel oplocks = no",
+            "level2 oplocks = no",
+            "strict locking = no",
+            "deadtime = 1",
+        ] {
+            assert!(
+                conf.contains(expected),
+                "missing Windows reconnect Samba option {expected} in:\n{conf}"
+            );
+        }
     }
 }

crates/iso-store/src/store.rs

@@ -3,8 +3,8 @@
 use crate::entry::{BootEntry, BootKind, KernelArgs};
 use crate::introspect::{introspect, DistroFamily, IntrospectionReport};
 use bytes::Bytes;
+use openpxe_core::{Error, Result};
 use parking_lot::RwLock;
-use pxeforge_core::{Error, Result};
 use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
 use std::collections::HashMap;
@@ -31,6 +31,30 @@ pub enum IsoSource {
     },
 }
 
+/// Where the ISO lands in the PXE menu hierarchy.
+///
+/// Auto-detected family (Debian, Windows, …) still drives BIOS/UEFI
+/// behaviour and per-entry boot args, but the *menu placement* is
+/// operator-controlled — an operator who's uploaded a TinyCore live ISO
+/// to use as a recovery shim, or a SystemRescue image, can flip its
+/// category to `Tools` so it lands next to memtest/shell instead of
+/// under Linux Installers.
+///
+/// Old `meta.json` files without this field deserialize as `Os`, which
+/// matches v0.4.1 behaviour (everything goes under OS Installers).
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum IsoCategory {
+    /// "OS Installer" — routed via the auto-detected family into the
+    /// Linux / Windows installer submenus.
+    #[default]
+    Os,
+    /// "Tool" — surfaced under the Tools menu next to memtest, shell,
+    /// NIC info, etc. Family detection still decides BIOS/UEFI vs
+    /// wimboot vs sanboot at boot time.
+    Tools,
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct IsoMeta {
     /// Stable slug used in URLs (derived from the uploaded filename).
@@ -48,6 +72,29 @@ pub struct IsoMeta {
     /// Old `meta.json` files without this field deserialize as `Local`.
     #[serde(default)]
     pub source: IsoSource,
+    /// Optional bcrypt hash of an operator-set password. When present,
+    /// `/boot/<entry>.ipxe` returns a `read --secret` prompt instead of
+    /// the boot script until the client chains back with the correct
+    /// `?token=...`. We never store, log, or transmit the plaintext.
+    /// Skipped on serialize when None to keep meta.json clean for
+    /// the common no-password case.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub password_hash: Option<String>,
+    /// Where the ISO sits in the PXE menu hierarchy — operator-controlled,
+    /// not driven by family detection. Defaults to [`IsoCategory::Os`].
+    #[serde(default)]
+    pub category: IsoCategory,
+}
+
+impl IsoMeta {
+    /// Convenience predicate the HTTP layer + UI can both use.
+    #[must_use]
+    pub fn is_password_protected(&self) -> bool {
+        self.password_hash
+            .as_deref()
+            .map(str::trim)
+            .is_some_and(|h| !h.is_empty())
+    }
 }
 
 pub struct UploadHandle {
@@ -94,6 +141,8 @@ impl UploadHandle {
             introspection,
             boot_entries,
             source: IsoSource::Local,
+            password_hash: None,
+            category: IsoCategory::default(),
         };
         store.persist_meta(&meta).await?;
         store.insert(meta.clone());
@@ -150,7 +199,9 @@ impl IsoStore {
         let mut entries = tokio::fs::read_dir(self.iso_dir.as_path()).await?;
         while let Some(e) = entries.next_entry().await? {
             let p = e.path();
-            if p.extension().and_then(|s| s.to_str()) != Some("json") { continue; }
+            if p.extension().and_then(|s| s.to_str()) != Some("json") {
+                continue;
+            }
             if !p
                 .file_name()
                 .and_then(|s| s.to_str())
@@ -194,6 +245,9 @@ impl IsoStore {
             return Err(Error::Invalid(format!("iso '{id}' already exists")));
         }
         let partial_path = self.iso_dir.join(format!("{id}.partial"));
+        if partial_path.exists() {
+            return Err(Error::Invalid(format!("iso '{id}' is already uploading")));
+        }
         let file = tokio::fs::File::create(&partial_path).await?;
         Ok(UploadHandle {
             id,
@@ -256,7 +310,10 @@ impl IsoStore {
     /// share or unmount the NFS share entirely.
     pub async fn delete(&self, id: &str) -> Result<()> {
         let meta = self.get(id);
-        let is_local = matches!(meta.as_ref().map(|m| &m.source), Some(IsoSource::Local) | None);
+        let is_local = matches!(
+            meta.as_ref().map(|m| &m.source),
+            Some(IsoSource::Local) | None
+        );
         if is_local {
             let iso = self.iso_path(id);
             let meta_path = self.meta_path(id);
@@ -289,6 +346,8 @@ impl IsoStore {
             introspection,
             boot_entries,
             source,
+            password_hash: None,
+            category: IsoCategory::default(),
         };
         self.inner.write().isos.insert(id, meta);
     }
@@ -298,10 +357,138 @@ impl IsoStore {
     /// to clean out stale entries.
     pub fn drop_external_source(&self, mount_id: &str) {
         let mut g = self.inner.write();
-        g.isos.retain(|_, m| {
-            !matches!(&m.source, IsoSource::Nfs { mount_id: mid, .. } if mid == mount_id)
-        });
+        g.isos.retain(
+            |_, m| !matches!(&m.source, IsoSource::Nfs { mount_id: mid, .. } if mid == mount_id),
+        );
     }
+
+    /// Set or clear an ISO's boot password.
+    ///
+    /// `Some("plaintext")` hashes via bcrypt (cost 10 — fast enough for
+    /// an interactive iPXE prompt, slow enough to be hostile to brute
+    /// force on a leaked meta.json) and persists.
+    ///
+    /// `None` removes the password — the next /boot/<id>.ipxe request
+    /// returns the script directly without a prompt.
+    ///
+    /// We never store, log, or transmit the plaintext.
+    pub async fn set_password(&self, id: &str, password: Option<&str>) -> Result<()> {
+        let new_hash = match password {
+            None => None,
+            Some(pw) => {
+                let pw = pw.trim();
+                if pw.is_empty() {
+                    None
+                } else {
+                    let h = bcrypt::hash(pw, bcrypt::DEFAULT_COST)
+                        .map_err(|e| Error::Other(e.into()))?;
+                    Some(h)
+                }
+            }
+        };
+
+        // Update in-memory + grab a clone for persistence outside the lock.
+        let updated = {
+            let mut g = self.inner.write();
+            let m = g
+                .isos
+                .get_mut(id)
+                .ok_or_else(|| Error::Invalid(format!("no such iso '{id}'")))?;
+            m.password_hash = new_hash;
+            m.clone()
+        };
+        // NFS-sourced ISOs have no on-disk meta.json — skip persistence
+        // for them (the password lives in memory until the manager
+        // re-scans the share, then it's gone). Document this in the API
+        // handler so the operator knows.
+        if matches!(updated.source, IsoSource::Local) {
+            self.persist_meta(&updated).await?;
+        }
+        Ok(())
+    }
+
+    /// Flip an ISO's menu category. Persists to `meta.json` for local
+    /// ISOs; NFS-sourced ISOs keep the change in memory only (the next
+    /// re-scan would overwrite it anyway).
+    pub async fn set_category(&self, id: &str, category: IsoCategory) -> Result<IsoMeta> {
+        let updated = {
+            let mut g = self.inner.write();
+            let m = g
+                .isos
+                .get_mut(id)
+                .ok_or_else(|| Error::Invalid(format!("no such iso '{id}'")))?;
+            m.category = category;
+            m.clone()
+        };
+        if matches!(updated.source, IsoSource::Local) {
+            self.persist_meta(&updated).await?;
+        }
+        Ok(updated)
+    }
+
+    /// Absolute path to the directory holding local ISO uploads. Used
+    /// by the HTTP layer for the disk-space endpoint — the volume that
+    /// hosts this directory is what runs out of room first.
+    #[must_use]
+    pub fn iso_dir(&self) -> PathBuf {
+        self.iso_dir.as_path().to_path_buf()
+    }
+
+    /// `(total_bytes, available_bytes)` for the filesystem hosting the
+    /// ISO directory. Returns `None` if `statvfs` fails (read-only
+    /// filesystem with no quota, mount disappeared, …) — callers
+    /// should treat that as "unknown" rather than zero.
+    ///
+    /// Lives here rather than the HTTP crate because `http-api`'s
+    /// `#![forbid(unsafe_code)]` rules out the libc FFI directly, and
+    /// because this is naturally an `IsoStore` question — the volume
+    /// of interest is whatever's hosting the iso dir.
+    #[must_use]
+    pub fn disk_usage(&self) -> Option<(u64, u64)> {
+        disk_usage_for(self.iso_dir.as_path())
+    }
+
+    /// Verify a candidate password against the stored bcrypt hash.
+    /// Returns:
+    /// - `Ok(true)`   — match (or the ISO has no password set; boot is open)
+    /// - `Ok(false)`  — mismatch
+    /// - `Err(_)`     — id not found, or bcrypt error
+    pub fn verify_password(&self, id: &str, candidate: &str) -> Result<bool> {
+        let meta = self
+            .get(id)
+            .ok_or_else(|| Error::Invalid(format!("no such iso '{id}'")))?;
+        let Some(hash) = meta.password_hash else {
+            return Ok(true); // no password set — anyone can boot
+        };
+        bcrypt::verify(candidate, &hash).map_err(|e| Error::Other(e.into()))
+    }
+}
+
+/// Resolve `(total, available)` bytes for the filesystem hosting `path`.
+/// Returns `None` if `statvfs` fails.
+#[allow(unsafe_code)]
+fn disk_usage_for(path: &std::path::Path) -> Option<(u64, u64)> {
+    use std::ffi::CString;
+    use std::os::unix::ffi::OsStrExt;
+    let c = CString::new(path.as_os_str().as_bytes()).ok()?;
+    // SAFETY: `statvfs` is repr(C); a zeroed value is a valid initial
+    // state per POSIX. The FFI call writes every field we then read.
+    let mut stat: libc::statvfs = unsafe { std::mem::zeroed() };
+    // SAFETY: `c` is a NUL-terminated C string pointing into a stack
+    // CString that outlives this call; `&mut stat` is a unique aligned
+    // pointer to a stack-local `statvfs`. The kernel writes through
+    // it but does not retain the pointer past return.
+    let rc = unsafe { libc::statvfs(c.as_ptr(), &raw mut stat) };
+    if rc != 0 {
+        return None;
+    }
+    // Use f_frsize (fundamental block size). f_bsize is "preferred I/O
+    // block" and doesn't always match the unit f_blocks is denominated
+    // in — on some BSDs it would over-report by a factor of 8.
+    let frsize = stat.f_frsize as u64;
+    let total = stat.f_blocks as u64 * frsize;
+    let avail = stat.f_bavail as u64 * frsize;
+    Some((total, avail))
 }
 
 fn slugify(filename: &str) -> String {
@@ -346,7 +533,10 @@ pub fn generate_boot_entries_for(
 /// Build `BootEntry`s from the introspection report. URLs are relative —
 /// the HTTP layer rewrites them with the public base URL per request.
 fn generate_boot_entries(id: &str, filename: &str, r: &IntrospectionReport) -> Vec<BootEntry> {
-    let title = r.volume_label.clone().unwrap_or_else(|| filename.to_string());
+    let title = r
+        .volume_label
+        .clone()
+        .unwrap_or_else(|| filename.to_string());
     match r.family {
         DistroFamily::WindowsPe if r.has_boot_wim => {
             // Standard wimboot chain. Paths are in-ISO; the HTTP layer maps
@@ -370,12 +560,22 @@ fn generate_boot_entries(id: &str, filename: &str, r: &IntrospectionReport) -> V
         fam if r.kernel_path.is_some() => {
             let base = format!("iso/{id}");
             let kernel_url = format!("{base}{}", r.kernel_path.as_deref().unwrap_or(""));
-            let initrd_urls = r.initrd_paths.iter().map(|p| format!("{base}{p}")).collect();
-            let args = KernelArgs { cmdline: linux_cmdline(fam, id) };
+            let initrd_urls = r
+                .initrd_paths
+                .iter()
+                .map(|p| format!("{base}{p}"))
+                .collect();
+            let args = KernelArgs {
+                cmdline: linux_cmdline(fam, id),
+            };
             vec![BootEntry {
                 id: format!("{id}-linux"),
                 title,
-                kind: BootKind::LinuxKernel { kernel_url, initrd_urls, args },
+                kind: BootKind::LinuxKernel {
+                    kernel_url,
+                    initrd_urls,
+                    args,
+                },
             }]
         }
         _ => {
@@ -384,7 +584,9 @@ fn generate_boot_entries(id: &str, filename: &str, r: &IntrospectionReport) -> V
             vec![BootEntry {
                 id: format!("{id}-sanboot"),
                 title: format!("{title} (SAN boot — may fail for >1GiB ISOs)"),
-                kind: BootKind::SanBootIso { iso_url: format!("iso/{id}.iso") },
+                kind: BootKind::SanBootIso {
+                    iso_url: format!("iso/{id}.iso"),
+                },
             }]
         }
     }
@@ -416,6 +618,8 @@ fn linux_cmdline(family: DistroFamily, id: &str) -> String {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::introspect::{DistroFamily, IntrospectionReport};
+    use tempfile::tempdir;
 
     #[test]
     fn slugify_basic() {
@@ -427,4 +631,101 @@ mod tests {
         // If a path sneaks in, file_stem strips the directory — OK, not a hazard.
         assert_eq!(slugify("/etc/passwd"), "passwd");
     }
+
+    fn fake_meta(id: &str) -> IsoMeta {
+        IsoMeta {
+            id: id.into(),
+            filename: format!("{id}.iso"),
+            size_bytes: 0,
+            sha256_hex: None,
+            uploaded_at: OffsetDateTime::now_utc(),
+            introspection: IntrospectionReport {
+                family: DistroFamily::Unknown,
+                volume_label: None,
+                kernel_path: None,
+                initrd_paths: vec![],
+                has_boot_wim: false,
+            },
+            boot_entries: vec![],
+            source: IsoSource::Local,
+            password_hash: None,
+            category: IsoCategory::default(),
+        }
+    }
+
+    #[tokio::test]
+    async fn password_round_trip_set_verify_clear() {
+        let dir = tempdir().unwrap();
+        let store = IsoStore::new(dir.path().to_path_buf());
+        store.ensure_dirs().await.unwrap();
+        store
+            .inner
+            .write()
+            .isos
+            .insert("alpha".into(), fake_meta("alpha"));
+
+        // No password set — verify_password returns Ok(true) for any input.
+        assert!(store.verify_password("alpha", "anything").unwrap());
+        assert!(!store.get("alpha").unwrap().is_password_protected());
+
+        // Set a password.
+        store.set_password("alpha", Some("hunter2")).await.unwrap();
+        let m = store.get("alpha").unwrap();
+        assert!(m.is_password_protected());
+        assert!(m.password_hash.unwrap().starts_with("$2"));
+
+        // Verify correct + wrong.
+        assert!(store.verify_password("alpha", "hunter2").unwrap());
+        assert!(!store.verify_password("alpha", "wrong").unwrap());
+        assert!(!store.verify_password("alpha", "").unwrap());
+
+        // Clear by passing None or an empty string.
+        store.set_password("alpha", None).await.unwrap();
+        assert!(!store.get("alpha").unwrap().is_password_protected());
+        store.set_password("alpha", Some("again")).await.unwrap();
+        store.set_password("alpha", Some("   ")).await.unwrap();
+        assert!(!store.get("alpha").unwrap().is_password_protected());
+    }
+
+    #[tokio::test]
+    async fn set_password_for_unknown_id_errors() {
+        let dir = tempdir().unwrap();
+        let store = IsoStore::new(dir.path().to_path_buf());
+        store.ensure_dirs().await.unwrap();
+        let r = store.set_password("does-not-exist", Some("pw")).await;
+        assert!(matches!(r, Err(Error::Invalid(_))));
+    }
+
+    #[tokio::test]
+    async fn begin_upload_rejects_existing_partial_file() {
+        let dir = tempdir().unwrap();
+        let store = IsoStore::new(dir.path().to_path_buf());
+        store.ensure_dirs().await.unwrap();
+        tokio::fs::write(dir.path().join("ubuntu.partial"), b"in-flight")
+            .await
+            .unwrap();
+
+        let r = store.begin_upload("ubuntu.iso").await;
+        assert!(matches!(r, Err(Error::Invalid(_))));
+    }
+
+    #[tokio::test]
+    async fn password_persists_via_meta_json_for_local_isos() {
+        // Hash makes it onto disk so it survives a restart.
+        let dir = tempdir().unwrap();
+        let store = IsoStore::new(dir.path().to_path_buf());
+        store.ensure_dirs().await.unwrap();
+        let meta = fake_meta("alpha");
+        store.persist_meta(&meta).await.unwrap();
+        store.insert(meta);
+        store.set_password("alpha", Some("s3cret")).await.unwrap();
+
+        // Re-load from disk and confirm the hash came back.
+        let store2 = IsoStore::new(dir.path().to_path_buf());
+        store2.load_from_disk().await.unwrap();
+        let reloaded = store2.get("alpha").expect("reloaded");
+        assert!(reloaded.is_password_protected());
+        assert!(store2.verify_password("alpha", "s3cret").unwrap());
+        assert!(!store2.verify_password("alpha", "wrong").unwrap());
+    }
 }

crates/iso-store/src/windows.rs

@@ -54,7 +54,10 @@ pub struct WimPatcher {
 impl WimPatcher {
     #[must_use]
     pub fn new(smb_host: String, smb_share: String) -> Self {
-        Self { smb_host, smb_share }
+        Self {
+            smb_host,
+            smb_share,
+        }
     }
 
     /// Apply WinPE patches to `boot.wim` inside `extracted_iso_dir`. Returns
@@ -72,31 +75,40 @@ impl WimPatcher {
 
         let work = match tempfile::tempdir() {
             Ok(d) => d,
-            Err(e) => return WinPatchState::Failed { reason: format!("tempdir: {e}") },
+            Err(e) => {
+                return WinPatchState::Failed {
+                    reason: format!("tempdir: {e}"),
+                }
+            }
         };
 
         // Stage the two files we want present at /Windows/System32/.
         let staging = work.path().join("stage/Windows/System32");
         if let Err(e) = std::fs::create_dir_all(&staging) {
-            return WinPatchState::Failed { reason: format!("staging mkdir: {e}") };
+            return WinPatchState::Failed {
+                reason: format!("staging mkdir: {e}"),
+            };
         }
         if let Err(e) = std::fs::write(staging.join("winpeshl.ini"), WINPESHL_INI) {
-            return WinPatchState::Failed { reason: format!("write winpeshl.ini: {e}") };
+            return WinPatchState::Failed {
+                reason: format!("write winpeshl.ini: {e}"),
+            };
         }
         let startnet = render_startnet(&self.smb_host, &self.smb_share);
         if let Err(e) = std::fs::write(staging.join("startnet.cmd"), startnet) {
-            return WinPatchState::Failed { reason: format!("write startnet.cmd: {e}") };
+            return WinPatchState::Failed {
+                reason: format!("write startnet.cmd: {e}"),
+            };
         }
 
         // Build a wimlib update command file:
         //   add <stage>/Windows/System32 /Windows/System32
         let update_file = work.path().join("update.cmd");
-        let update_cmd = format!(
-            "add \"{}\" \"/Windows/System32\"\n",
-            staging.display()
-        );
+        let update_cmd = format!("add \"{}\" \"/Windows/System32\"\n", staging.display());
         if let Err(e) = std::fs::write(&update_file, update_cmd) {
-            return WinPatchState::Failed { reason: format!("write update.cmd: {e}") };
+            return WinPatchState::Failed {
+                reason: format!("write update.cmd: {e}"),
+            };
         }
 
         // Run wimlib-imagex update against image index 2 (WinPE).
@@ -120,7 +132,9 @@ impl WimPatcher {
                     String::from_utf8_lossy(&o.stderr)
                 ),
             },
-            Err(e) => WinPatchState::Failed { reason: format!("spawn wimlib-imagex: {e}") },
+            Err(e) => WinPatchState::Failed {
+                reason: format!("spawn wimlib-imagex: {e}"),
+            },
         }
     }
 }
@@ -133,7 +147,9 @@ fn which(cmd: &str) -> Option<PathBuf> {
     let paths = std::env::var_os("PATH")?;
     for dir in std::env::split_paths(&paths) {
         let p = dir.join(cmd);
-        if p.is_file() { return Some(p); }
+        if p.is_file() {
+            return Some(p);
+        }
     }
     None
 }
@@ -160,7 +176,7 @@ fn render_startnet(host: &str, share: &str) -> String {
     // Bootimus v0.1.58 lesson: surface `net use` errors instead of
     // tight-looping on a blind retry. We retry but log every miss.
     s.push_str("@echo off\r\n");
-    s.push_str("echo PXEForge WinPE bootstrap\r\n");
+    s.push_str("echo OpenPXE WinPE bootstrap\r\n");
     s.push_str("wpeinit\r\n");
     // v0.1.58: explicitly start Workstation before mapping the share —
     // `net use` otherwise lazily inits SMB-client and races wpeinit.
@@ -174,7 +190,11 @@ fn render_startnet(host: &str, share: &str) -> String {
     )
     .unwrap();
     s.push_str(":havenet\r\n");
-    writeln!(s, "echo Mapping install media from \\\\{host}\\{share}...\r").unwrap();
+    writeln!(
+        s,
+        "echo Mapping install media from \\\\{host}\\{share}...\r"
+    )
+    .unwrap();
     writeln!(
         s,
         ":mapshare\r\nnet use Z: \\\\{host}\\{share} /user:guest \"\" /persistent:no && goto mapped\r\n\
@@ -205,6 +225,23 @@ mod tests {
         assert!(s.contains("setup.exe"));
     }
 
+    #[test]
+    fn startnet_primes_workstation_and_surfaces_mapping_errors() {
+        let s = render_startnet("10.0.0.5", "win11");
+        assert!(
+            s.contains("net start Workstation"),
+            "WinPE should explicitly start the SMB client before net use:\n{s}"
+        );
+        let net_use_line = s
+            .lines()
+            .find(|line| line.contains("net use Z:"))
+            .expect("net use line");
+        assert!(
+            !net_use_line.contains(">nul"),
+            "net use errors must remain visible in WinPE console: {net_use_line}"
+        );
+    }
+
     #[test]
     fn patcher_reports_wimlib_missing_gracefully() {
         // We don't assume wimlib is present in CI; this checks the missing

crates/openpxe/Cargo.toml

@@ -1,5 +1,5 @@
 [package]
-name = "pxeforge"
+name = "openpxe"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
@@ -10,16 +10,16 @@ description = "Container-native PXE boot server — a lightweight Rust clone of
 workspace = true
 
 [[bin]]
-name = "pxeforge"
+name = "openpxe"
 path = "src/main.rs"
 
 [dependencies]
-pxeforge-core.workspace = true
-pxeforge-dhcp-proxy.workspace = true
-pxeforge-tftp.workspace = true
-pxeforge-http-api.workspace = true
-pxeforge-iso-store.workspace = true
-pxeforge-ipxe-assets.workspace = true
+openpxe-core.workspace = true
+openpxe-dhcp-proxy.workspace = true
+openpxe-tftp.workspace = true
+openpxe-http-api.workspace = true
+openpxe-iso-store.workspace = true
+openpxe-ipxe-assets.workspace = true
 tokio.workspace = true
 axum.workspace = true
 tracing.workspace = true

crates/openpxe/src/main.rs

@@ -1,27 +1,27 @@
-//! PXEForge entry point. Wires the three protocol servers (DHCP proxy,
+//! OpenPXE entry point. Wires the three protocol servers (DHCP proxy,
 //! TFTP, HTTP) to the shared ISO store and client registry, then runs
 //! them concurrently.
 
 use clap::{Parser, Subcommand};
-use pxeforge_core::{
-    ClientRegistry, Config, DhcpMode, GateQueue, HostBindings, LogBus, LogBusLayer, Metrics,
+use openpxe_core::{
+    ClientRegistry, Config, DeploymentQueue, DhcpMode, HostBindings, LogBus, LogBusLayer, Metrics,
     SettingsStore,
 };
-use pxeforge_dhcp_proxy::DhcpProxyServer;
-use pxeforge_http_api::{build_router, AppState};
-use pxeforge_iso_store::{IsoStore, NfsManager, SmbManager};
-use std::sync::Arc;
-use pxeforge_tftp::TftpServer;
+use openpxe_dhcp_proxy::DhcpProxyServer;
+use openpxe_http_api::{build_router, AppState};
+use openpxe_iso_store::{IsoStore, NfsManager, SmbManager};
+use openpxe_tftp::TftpServer;
 use std::net::{Ipv4Addr, SocketAddr};
 use std::path::PathBuf;
+use std::sync::Arc;
 use tokio::io::AsyncReadExt;
 
 #[derive(Debug, Parser)]
-#[command(name = "pxeforge", about = "Container-native PXE boot server", version)]
+#[command(name = "openpxe", about = "Container-native PXE boot server", version)]
 struct Cli {
     /// Path to a TOML config file. All fields have sensible defaults and can
-    /// also be overridden with env vars (PXEFORGE_*).
-    #[arg(long, env = "PXEFORGE_CONFIG")]
+    /// also be overridden with env vars (OPENPXE_*).
+    #[arg(long, env = "OPENPXE_CONFIG")]
     config: Option<PathBuf>,
 
     #[command(subcommand)]
@@ -38,8 +38,8 @@ enum Command {
     /// Example:
     ///   docker run --rm \
     ///     -v /my/isos:/seed:ro \
-    ///     -v pxeforge-data:/var/lib/pxeforge/isos \
-    ///     pxeforge:0.1.0 seed --from /seed
+    ///     -v openpxe-data:/var/lib/openpxe/isos \
+    ///     openpxe:0.4.1 seed --from /seed
     Seed {
         /// Source directory containing one or more `.iso` files.
         #[arg(long)]
@@ -70,7 +70,7 @@ async fn main() -> anyhow::Result<()> {
         return run_command(cmd, config).await;
     }
 
-    pxeforge_ipxe_assets::log_availability();
+    openpxe_ipxe_assets::log_availability();
 
     let our_ip = match config.server.public_ip {
         Some(ip) => {
@@ -88,7 +88,7 @@ async fn main() -> anyhow::Result<()> {
                 // message instead of serving a broken deployment.
                 anyhow::bail!(
                     "could not detect a non-loopback IPv4 address for this host. \
-                     Set PXEFORGE_PUBLIC_IP=<your-ip> (e.g. `-e PXEFORGE_PUBLIC_IP=10.0.0.5` \
+                     Set OPENPXE_PUBLIC_IP=<your-ip> (e.g. `-e OPENPXE_PUBLIC_IP=10.0.0.5` \
                      in docker, or the env block in OpenShift Deployment) to advertise \
                      a specific IP to PXE clients."
                 );
@@ -100,9 +100,11 @@ async fn main() -> anyhow::Result<()> {
     let iso_store = IsoStore::new(config.paths.iso_dir.clone());
     iso_store.load_from_disk().await?;
     let clients = ClientRegistry::new();
-    let gates = GateQueue::new();
+    let queue = DeploymentQueue::new();
     let settings = SettingsStore::load_or_default(&config.paths.work_dir);
     let hosts = HostBindings::load_or_default(&config.paths.work_dir);
+    let boot_log = openpxe_core::BootLog::load_or_default(&config.paths.work_dir);
+    let branding = openpxe_core::BrandingStore::load_or_default(&config.paths.work_dir);
     let metrics = Metrics::new();
 
     // Build the SMB manager unconditionally — it starts/stops on the
@@ -120,7 +122,7 @@ async fn main() -> anyhow::Result<()> {
     let nfs = NfsManager::new(&config.paths.work_dir, iso_store.clone());
     iso_store.set_nfs_root(nfs.mount_root());
     if let Err(e) = nfs.load_and_remount().await {
-        tracing::warn!(target: "pxeforge::nfs", "could not reload NFS mounts: {e}");
+        tracing::warn!(target: "openpxe::nfs", "could not reload NFS mounts: {e}");
     }
 
     // Sniff network details for the Network tab. None of these are
@@ -129,7 +131,7 @@ async fn main() -> anyhow::Result<()> {
     // own gateway.
     let net = detect_network_info(our_ip);
     tracing::info!(
-        target: "pxeforge::net",
+        target: "openpxe::net",
         nic = %net.nic_name, mask = %net.subnet_mask, gateway = %net.gateway,
         "network info"
     );
@@ -138,11 +140,14 @@ async fn main() -> anyhow::Result<()> {
         iso_store: iso_store.clone(),
         clients: clients.clone(),
         settings: settings.clone(),
-        gates: gates.clone(),
+        queue: queue.clone(),
         hosts: hosts.clone(),
+        boot_log: boot_log.clone(),
+        branding: branding.clone(),
         metrics: metrics.clone(),
         smb: Some(smb.clone()),
         nfs: nfs.clone(),
+        uploads: openpxe_http_api::uploads::UploadSessions::default(),
         log_bus: log_bus.clone(),
         started_at: time::OffsetDateTime::now_utc(),
         public_base_url: public_base_url.clone(),
@@ -155,8 +160,16 @@ async fn main() -> anyhow::Result<()> {
     let router = build_router(state);
     let http_task = tokio::spawn(async move {
         let listener = tokio::net::TcpListener::bind(http_addr).await?;
-        tracing::info!(target: "pxeforge::http", "HTTP listening on {http_addr}");
-        axum::serve(listener, router).await?;
+        tracing::info!(target: "openpxe::http", "HTTP listening on {http_addr}");
+        // `into_make_service_with_connect_info` is required so per-request
+        // `ConnectInfo<SocketAddr>` extractors can resolve the peer IP —
+        // used by `/boot/<entry>.ipxe` to record the booting client's
+        // address into the Host log. Without this the extractor 500s.
+        axum::serve(
+            listener,
+            router.into_make_service_with_connect_info::<std::net::SocketAddr>(),
+        )
+        .await?;
         Ok::<_, anyhow::Error>(())
     });
 
@@ -182,7 +195,7 @@ async fn main() -> anyhow::Result<()> {
             tokio::spawn(s.run())
         }
         DhcpMode::Disabled => {
-            tracing::info!(target: "pxeforge::dhcp", "DHCP disabled — external DHCP must set next-server + filename");
+            tracing::info!(target: "openpxe::dhcp", "DHCP disabled — external DHCP must set next-server + filename");
             tokio::spawn(async { futures_forever().await })
         }
     };
@@ -210,7 +223,11 @@ async fn run_command(cmd: Command, config: Config) -> anyhow::Result<()> {
 /// Reuses `IsoStore::begin_upload` / `finish` so the resulting meta on disk
 /// is identical to a web upload — same slug rules, same introspection, same
 /// sha256.
-async fn seed_from_dir(src: &std::path::Path, config: &Config, dry_run: bool) -> anyhow::Result<()> {
+async fn seed_from_dir(
+    src: &std::path::Path,
+    config: &Config,
+    dry_run: bool,
+) -> anyhow::Result<()> {
     let store = IsoStore::new(config.paths.iso_dir.clone());
     store.load_from_disk().await?;
     let mut entries = tokio::fs::read_dir(src).await?;
@@ -218,7 +235,12 @@ async fn seed_from_dir(src: &std::path::Path, config: &Config, dry_run: bool) ->
     let mut skipped = 0u32;
     while let Some(entry) = entries.next_entry().await? {
         let p = entry.path();
-        if p.extension().and_then(|e| e.to_str()).map(str::to_ascii_lowercase).as_deref() != Some("iso") {
+        if p.extension()
+            .and_then(|e| e.to_str())
+            .map(str::to_ascii_lowercase)
+            .as_deref()
+            != Some("iso")
+        {
             continue;
         }
         let filename = p
@@ -226,12 +248,18 @@ async fn seed_from_dir(src: &std::path::Path, config: &Config, dry_run: bool) ->
             .and_then(|s| s.to_str())
             .ok_or_else(|| anyhow::anyhow!("non-utf8 filename: {}", p.display()))?
             .to_string();
-        println!("  {} ({} bytes)", filename, tokio::fs::metadata(&p).await?.len());
-        if dry_run { continue; }
+        println!(
+            "  {} ({} bytes)",
+            filename,
+            tokio::fs::metadata(&p).await?.len()
+        );
+        if dry_run {
+            continue;
+        }
 
         let mut handle = match store.begin_upload(&filename).await {
             Ok(h) => h,
-            Err(pxeforge_core::Error::Invalid(e)) => {
+            Err(openpxe_core::Error::Invalid(e)) => {
                 eprintln!("    skip: {e}");
                 skipped += 1;
                 continue;
@@ -242,15 +270,23 @@ async fn seed_from_dir(src: &std::path::Path, config: &Config, dry_run: bool) ->
         let mut buf = vec![0u8; 1024 * 1024];
         loop {
             let n = file.read(&mut buf).await?;
-            if n == 0 { break; }
+            if n == 0 {
+                break;
+            }
             let chunk: bytes::Bytes = buf[..n].to_vec().into();
             handle.write_chunk(&chunk).await?;
         }
         let meta = handle.finish(&store).await?;
-        println!("    -> id={} family={:?}", meta.id, meta.introspection.family);
+        println!(
+            "    -> id={} family={:?}",
+            meta.id, meta.introspection.family
+        );
         imported += 1;
     }
-    println!("\nimported={imported}  skipped={skipped}  {}", if dry_run { "(dry run)" } else { "" });
+    println!(
+        "\nimported={imported}  skipped={skipped}  {}",
+        if dry_run { "(dry run)" } else { "" }
+    );
     Ok(())
 }
 
@@ -258,7 +294,7 @@ async fn seed_from_dir(src: &std::path::Path, config: &Config, dry_run: bool) ->
 /// detection fails — callers should fail startup rather than silently using
 /// a loopback address (which would give every PXE client an unreachable
 /// `http://127.0.0.1/...`). Users in multi-homed setups should set
-/// `PXEFORGE_PUBLIC_IP` explicitly.
+/// `OPENPXE_PUBLIC_IP` explicitly.
 fn detect_primary_ipv4() -> Option<Ipv4Addr> {
     // First try: route to the public internet. `UdpSocket::connect` to a
     // well-known external address causes the OS to populate `local_addr`
@@ -294,15 +330,14 @@ fn hostname() -> std::io::Result<String> {
     if let Ok(h) = std::fs::read_to_string("/proc/sys/kernel/hostname") {
         return Ok(h.trim().to_string());
     }
-    std::env::var("HOSTNAME").map_err(|_| std::io::Error::new(
-        std::io::ErrorKind::NotFound, "no hostname",
-    ))
+    std::env::var("HOSTNAME")
+        .map_err(|_| std::io::Error::new(std::io::ErrorKind::NotFound, "no hostname"))
 }
 
 fn init_tracing(bus: Arc<LogBus>) {
     use tracing_subscriber::{fmt, prelude::*, EnvFilter};
-    let filter = EnvFilter::try_from_env("PXEFORGE_LOG")
-        .unwrap_or_else(|_| EnvFilter::new("info,pxeforge=debug"));
+    let filter = EnvFilter::try_from_env("OPENPXE_LOG")
+        .unwrap_or_else(|_| EnvFilter::new("info,openpxe=debug"));
     tracing_subscriber::registry()
         .with(filter)
         .with(fmt::layer().with_target(true))
@@ -328,7 +363,10 @@ fn detect_network_info(our_ip: Ipv4Addr) -> NetworkInfo {
 
     // `ip -o -f inet addr show` lists every interface with its
     // `inet a.b.c.d/mask`. We match the line that mentions our IP.
-    if let Ok(out) = Command::new("ip").args(["-o", "-f", "inet", "addr", "show"]).output() {
+    if let Ok(out) = Command::new("ip")
+        .args(["-o", "-f", "inet", "addr", "show"])
+        .output()
+    {
         if let Ok(text) = String::from_utf8(out.stdout) {
             for line in text.lines() {
                 if !line.contains(&our_ip.to_string()) {
@@ -353,7 +391,10 @@ fn detect_network_info(our_ip: Ipv4Addr) -> NetworkInfo {
     }
 
     // `ip route show default` -> "default via 10.0.0.1 dev enp1s0 ..."
-    if let Ok(out) = Command::new("ip").args(["route", "show", "default"]).output() {
+    if let Ok(out) = Command::new("ip")
+        .args(["route", "show", "default"])
+        .output()
+    {
         if let Ok(text) = String::from_utf8(out.stdout) {
             if let Some(line) = text.lines().next() {
                 let mut parts = line.split_whitespace();
@@ -374,7 +415,11 @@ fn detect_network_info(our_ip: Ipv4Addr) -> NetworkInfo {
 
 fn prefix_to_dotted(prefix: u8) -> String {
     let prefix = prefix.min(32);
-    let mask: u32 = if prefix == 0 { 0 } else { u32::MAX << (32 - prefix) };
+    let mask: u32 = if prefix == 0 {
+        0
+    } else {
+        u32::MAX << (32 - prefix)
+    };
     format!(
         "{}.{}.{}.{}",
         (mask >> 24) & 0xff,

crates/tftp/Cargo.toml

@@ -1,5 +1,5 @@
 [package]
-name = "pxeforge-tftp"
+name = "openpxe-tftp"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
@@ -10,8 +10,8 @@ description = "TFTP server (RFC 1350/2347/2348/2349/7440) for iPXE chainload"
 workspace = true
 
 [dependencies]
-pxeforge-core.workspace = true
-pxeforge-ipxe-assets.workspace = true
+openpxe-core.workspace = true
+openpxe-ipxe-assets.workspace = true
 tokio.workspace = true
 socket2.workspace = true
 tracing.workspace = true

crates/tftp/src/server.rs

@@ -7,12 +7,12 @@
 //! `tftpd`/`in.tftpd` works and is why TFTP is awkward behind stateful NAT:
 //! the ephemeral ports must be reachable from the client.
 //!
-//! We only serve files from `pxeforge_ipxe_assets::asset_bytes` — that is,
+//! We only serve files from `openpxe_ipxe_assets::asset_bytes` — that is,
 //! the bundled iPXE binaries and wimboot. No filesystem is ever opened, so
 //! `../` path traversal attempts simply return ENOENT.
 
-use pxeforge_core::{ClientEvent, ClientRegistry};
-use pxeforge_ipxe_assets::asset_bytes;
+use openpxe_core::{ClientEvent, ClientRegistry};
+use openpxe_ipxe_assets::asset_bytes;
 use socket2::{Domain, Protocol, Socket, Type};
 use std::net::{IpAddr, SocketAddr};
 use std::sync::Arc;
@@ -35,7 +35,7 @@ pub struct TftpServer {
     bind: IpAddr,
     port: u16,
     clients: Arc<ClientRegistry>,
-    metrics: pxeforge_core::Metrics,
+    metrics: openpxe_core::Metrics,
 }
 
 impl TftpServer {
@@ -43,14 +43,19 @@ impl TftpServer {
         bind: IpAddr,
         port: u16,
         clients: Arc<ClientRegistry>,
-        metrics: pxeforge_core::Metrics,
+        metrics: openpxe_core::Metrics,
     ) -> Self {
-        Self { bind, port, clients, metrics }
+        Self {
+            bind,
+            port,
+            clients,
+            metrics,
+        }
     }
 
     pub async fn run(self) -> anyhow::Result<()> {
         let sock = bind_udp(self.bind, self.port)?;
-        tracing::info!(target: "pxeforge::tftp", "TFTP listening on {}:{}", self.bind, self.port);
+        tracing::info!(target: "openpxe::tftp", "TFTP listening on {}:{}", self.bind, self.port);
         let clients = self.clients.clone();
         let metrics = self.metrics.clone();
         let mut buf = vec![0u8; 2048];
@@ -58,7 +63,7 @@ impl TftpServer {
             let (n, from) = match sock.recv_from(&mut buf).await {
                 Ok(v) => v,
                 Err(e) => {
-                    tracing::warn!(target: "pxeforge::tftp", "recv error: {e}");
+                    tracing::warn!(target: "openpxe::tftp", "recv error: {e}");
                     continue;
                 }
             };
@@ -69,7 +74,7 @@ impl TftpServer {
             tokio::spawn(async move {
                 if let Err(e) = handle_rrq(data, from, bind_ip, clients, metrics.clone()).await {
                     metrics.record_tftp_err();
-                    tracing::warn!(target: "pxeforge::tftp", peer=%from, "handler error: {e}");
+                    tracing::warn!(target: "openpxe::tftp", peer=%from, "handler error: {e}");
                 }
             });
         }
@@ -81,30 +86,34 @@ async fn handle_rrq(
     peer: SocketAddr,
     bind_ip: IpAddr,
     clients: Arc<ClientRegistry>,
-    metrics: pxeforge_core::Metrics,
+    metrics: openpxe_core::Metrics,
 ) -> anyhow::Result<()> {
     let Some(req) = parse_rrq(&packet) else {
         return Ok(());
     };
-    let Request { filename, options, .. } = req;
+    let Request {
+        filename, options, ..
+    } = req;
 
     // Per-transfer ephemeral socket.
     let sock = bind_udp(bind_ip, 0)?;
 
     let Some(file_bytes) = asset_bytes(&filename) else {
         let _ = send_error(&sock, peer, ERR_FILE_NOT_FOUND, "no such file").await;
-        tracing::info!(target: "pxeforge::tftp", peer=%peer, file=%filename, "404");
+        tracing::info!(target: "openpxe::tftp", peer=%peer, file=%filename, "404");
         clients.record(
             &peer.ip().to_string(),
             Some(peer.ip()),
             None,
-            ClientEvent::TftpRead { file: filename.clone() },
+            ClientEvent::TftpRead {
+                file: filename.clone(),
+            },
         );
         return Ok(());
     };
 
     tracing::info!(
-        target: "pxeforge::tftp",
+        target: "openpxe::tftp",
         peer=%peer, file=%filename, size=file_bytes.len(),
         "serving"
     );
@@ -112,7 +121,9 @@ async fn handle_rrq(
         &peer.ip().to_string(),
         Some(peer.ip()),
         None,
-        ClientEvent::TftpRead { file: filename.clone() },
+        ClientEvent::TftpRead {
+            file: filename.clone(),
+        },
     );
 
     // Negotiate options.
@@ -173,7 +184,9 @@ async fn handle_rrq(
 
         // Send one window worth of DATA.
         for _ in 0..window {
-            if offset >= total { break; }
+            if offset >= total {
+                break;
+            }
             let end = (offset + blksize).min(total);
             let chunk = &file_bytes[offset..end];
             let pkt = encode_data(block_no, chunk);
@@ -200,7 +213,7 @@ async fn handle_rrq(
                     tries += 1;
                     if tries > 5 {
                         tracing::warn!(
-                            target: "pxeforge::tftp",
+                            target: "openpxe::tftp",
                             peer=%peer, last_block=last_block_in_window,
                             "timeout after {tries} retries, aborting transfer"
                         );
@@ -241,7 +254,7 @@ async fn handle_rrq(
         let _ = tokio::time::timeout(Duration::from_secs(3), recv_ack(&sock, peer)).await;
     }
 
-    tracing::debug!(target: "pxeforge::tftp", peer=%peer, bytes=total, "transfer complete");
+    tracing::debug!(target: "openpxe::tftp", peer=%peer, bytes=total, "transfer complete");
     metrics.record_tftp_ok(total as u64);
     Ok(())
 }
@@ -255,20 +268,30 @@ struct Request {
 }
 
 fn parse_rrq(pkt: &[u8]) -> Option<Request> {
-    if pkt.len() < 4 { return None; }
+    if pkt.len() < 4 {
+        return None;
+    }
     let op = u16::from_be_bytes([pkt[0], pkt[1]]);
-    if op != OP_RRQ { return None; }
+    if op != OP_RRQ {
+        return None;
+    }
     let mut rest = &pkt[2..];
     let filename = read_cstr(&mut rest)?;
     let mode = read_cstr(&mut rest)?;
     let mut options = Vec::new();
     while !rest.is_empty() {
         let Some(k) = read_cstr(&mut rest) else { break };
-        if k.is_empty() { break; }
+        if k.is_empty() {
+            break;
+        }
         let v = read_cstr(&mut rest).unwrap_or_default();
         options.push((k.to_ascii_lowercase(), v));
     }
-    Some(Request { filename, mode, options })
+    Some(Request {
+        filename,
+        mode,
+        options,
+    })
 }
 
 fn read_cstr(buf: &mut &[u8]) -> Option<String> {
@@ -316,8 +339,12 @@ async fn recv_ack(sock: &UdpSocket, peer: SocketAddr) -> anyhow::Result<u16> {
     let mut buf = [0u8; 32];
     loop {
         let (n, from) = sock.recv_from(&mut buf).await?;
-        if from.ip() != peer.ip() { continue; }
-        if n < 4 { continue; }
+        if from.ip() != peer.ip() {
+            continue;
+        }
+        if n < 4 {
+            continue;
+        }
         let op = u16::from_be_bytes([buf[0], buf[1]]);
         match op {
             OP_ACK => return Ok(u16::from_be_bytes([buf[2], buf[3]])),
@@ -344,14 +371,19 @@ async fn wait_for_ack(
             Ok(Ok(_)) => {}
             Ok(Err(_)) | Err(_) => {
                 tries += 1;
-                if tries > 5 { return Ok(false); }
+                if tries > 5 {
+                    return Ok(false);
+                }
             }
         }
     }
 }
 
 fn bind_udp(bind: IpAddr, port: u16) -> anyhow::Result<UdpSocket> {
-    let domain = match bind { IpAddr::V4(_) => Domain::IPV4, IpAddr::V6(_) => Domain::IPV6 };
+    let domain = match bind {
+        IpAddr::V4(_) => Domain::IPV4,
+        IpAddr::V6(_) => Domain::IPV6,
+    };
     let sock = Socket::new(domain, Type::DGRAM, Some(Protocol::UDP))?;
     sock.set_reuse_address(true)?;
     sock.set_nonblocking(true)?;
@@ -382,7 +414,9 @@ pub fn plan_window(
     let mut o = offset;
     let mut b = starting_block;
     for _ in 0..window {
-        if o >= total { break; }
+        if o >= total {
+            break;
+        }
         let end = (o + blksize).min(total);
         out.push((b, end - o));
         o = end;
@@ -453,7 +487,7 @@ mod tests {
         assert_eq!(p, vec![(65534, 1024), (65535, 1024)]);
         let p2 = plan_window(2048, 2048, 1024, 2, 0);
         assert!(p2.is_empty()); // nothing past EOF
-        // And a cross-boundary case:
+                                // And a cross-boundary case:
         let p3 = plan_window(3072, 0, 1024, 3, 65535);
         assert_eq!(p3, vec![(65535, 1024), (0, 1024), (1, 1024)]);
     }

crates/webui/Cargo.toml

@@ -1,10 +1,10 @@
 [package]
-name = "pxeforge-webui"
+name = "openpxe-webui"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
 authors.workspace = true
-description = "Embedded single-file web UI for PXEForge"
+description = "Embedded single-file web UI for OpenPXE"
 
 [lints]
 workspace = true

crates/webui/src/anvil-forge.svg

@@ -1,81 +0,0 @@
-<svg viewBox="0 0 200 200" xmlns="http://www.w3.org/2000/svg" fill="none">
-  <title>PXEForge — forging</title>
-  <defs>
-    <linearGradient id="afBody" x1="0" y1="0" x2="0" y2="1">
-      <stop offset="0%" stop-color="#aab3c2"/>
-      <stop offset="55%" stop-color="#7d8696"/>
-      <stop offset="100%" stop-color="#525a6b"/>
-    </linearGradient>
-    <linearGradient id="afFace" x1="0" y1="0" x2="0" y2="1">
-      <stop offset="0%" stop-color="#cdd5e1"/>
-      <stop offset="100%" stop-color="#9aa3b3"/>
-    </linearGradient>
-    <linearGradient id="afBase" x1="0" y1="0" x2="0" y2="1">
-      <stop offset="0%" stop-color="#3b4252"/>
-      <stop offset="100%" stop-color="#252a36"/>
-    </linearGradient>
-    <radialGradient id="afSpark" cx="50%" cy="50%" r="50%">
-      <stop offset="0%" stop-color="#fff5b8" stop-opacity="1"/>
-      <stop offset="40%" stop-color="#ff9a3a" stop-opacity="0.9"/>
-      <stop offset="100%" stop-color="#ff5a18" stop-opacity="0"/>
-    </radialGradient>
-    <radialGradient id="afEmber" cx="50%" cy="50%" r="50%">
-      <stop offset="0%" stop-color="#ffd47a" stop-opacity="1"/>
-      <stop offset="100%" stop-color="#ff7322" stop-opacity="0"/>
-    </radialGradient>
-  </defs>
-
-  <!-- Anvil shifted down so sparks have room to rise above -->
-  <g transform="translate(0,40)">
-    <!-- Horn + face -->
-    <path d="M14 36 L72 30 L162 30 L162 46 L72 46 Z"
-          fill="url(#afFace)" stroke="#1d2330" stroke-width="2.4" stroke-linejoin="round"/>
-    <!-- Body / waist -->
-    <path d="M70 46 L160 46 L142 70 L88 70 Z"
-          fill="url(#afBody)" stroke="#1d2330" stroke-width="2.4" stroke-linejoin="round"/>
-    <!-- Pillar -->
-    <rect x="92" y="70" width="46" height="26" fill="url(#afBody)"
-          stroke="#1d2330" stroke-width="2.4"/>
-    <!-- Base -->
-    <path d="M62 96 L168 96 L160 110 L70 110 Z"
-          fill="url(#afBase)" stroke="#0d1018" stroke-width="2.4" stroke-linejoin="round"/>
-    <line x1="74" y1="34" x2="158" y2="34" stroke="#e6ecf5" stroke-width="1.2" opacity="0.7"/>
-    <!-- Soft underglow on top face where the sparks land -->
-    <ellipse cx="115" cy="33" rx="42" ry="6" fill="url(#afEmber)" opacity="0.55">
-      <animate attributeName="opacity" values="0.35;0.7;0.35"
-               dur="1.6s" repeatCount="indefinite"/>
-    </ellipse>
-  </g>
-
-  <!-- Sparks. SMIL animations only — no JS, no CSS needed. Each spark
-       rises, fades, restarts at a staggered delay for an organic feel. -->
-  <g class="sparks">
-    <circle cx="116" cy="62" r="3.4" fill="url(#afSpark)" opacity="0">
-      <animate attributeName="cy" from="62" to="14" dur="1.4s" repeatCount="indefinite"/>
-      <animate attributeName="cx" values="116;112;120;116" dur="1.4s" repeatCount="indefinite"/>
-      <animate attributeName="r" values="2;3.6;1.4" dur="1.4s" repeatCount="indefinite"/>
-      <animate attributeName="opacity" values="0;1;0" dur="1.4s" repeatCount="indefinite"/>
-    </circle>
-    <circle cx="105" cy="62" r="2.4" fill="url(#afSpark)" opacity="0">
-      <animate attributeName="cy" from="62" to="22" dur="1.7s" begin="0.25s" repeatCount="indefinite"/>
-      <animate attributeName="cx" values="105;101;108;104" dur="1.7s" begin="0.25s" repeatCount="indefinite"/>
-      <animate attributeName="r" values="1.6;2.8;1" dur="1.7s" begin="0.25s" repeatCount="indefinite"/>
-      <animate attributeName="opacity" values="0;1;0" dur="1.7s" begin="0.25s" repeatCount="indefinite"/>
-    </circle>
-    <circle cx="125" cy="62" r="2.8" fill="url(#afSpark)" opacity="0">
-      <animate attributeName="cy" from="62" to="6" dur="1.9s" begin="0.55s" repeatCount="indefinite"/>
-      <animate attributeName="cx" values="125;130;121;127" dur="1.9s" begin="0.55s" repeatCount="indefinite"/>
-      <animate attributeName="r" values="1.8;3.2;1.2" dur="1.9s" begin="0.55s" repeatCount="indefinite"/>
-      <animate attributeName="opacity" values="0;1;0" dur="1.9s" begin="0.55s" repeatCount="indefinite"/>
-    </circle>
-    <circle cx="113" cy="62" r="2" fill="url(#afEmber)" opacity="0">
-      <animate attributeName="cy" from="62" to="32" dur="1.2s" begin="0.9s" repeatCount="indefinite"/>
-      <animate attributeName="opacity" values="0;0.9;0" dur="1.2s" begin="0.9s" repeatCount="indefinite"/>
-    </circle>
-    <circle cx="132" cy="62" r="2.2" fill="url(#afSpark)" opacity="0">
-      <animate attributeName="cy" from="62" to="20" dur="1.5s" begin="1.2s" repeatCount="indefinite"/>
-      <animate attributeName="cx" values="132;138;128" dur="1.5s" begin="1.2s" repeatCount="indefinite"/>
-      <animate attributeName="opacity" values="0;1;0" dur="1.5s" begin="1.2s" repeatCount="indefinite"/>
-    </circle>
-  </g>
-</svg>

crates/webui/src/app.css

@@ -1,4 +1,4 @@
-/* PXEForge web UI — Netbox-style minimal layout, fully offline.
+/* OpenPXE web UI — Netbox-style minimal layout, fully offline.
  *
  * Theme tokens live on `:root` (dark default) and `:root[data-theme=light]`.
  * Both palettes share variable *names*, so component CSS uses
@@ -8,23 +8,26 @@
  * CSS lands). */
 
 :root {
-  /* Dark palette (default). */
-  --bg:           #0b1018;
-  --bg-panel:    #121826;
-  --bg-panel-2:  #1a2334;
-  --bg-elev:     #223047;
-  --fg:           #e4e8ef;
-  --fg-dim:      #8a94a7;
-  --fg-dimmer:   #5a6379;
-  --accent:       #00d4b4;   /* Netbox-ish teal */
+  /* Jet-black dark palette (default). Modelled on Netbox Labs's
+     near-black product chrome, with surfaces stepping subtly upward
+     rather than the previous blue-tinted ramp, so the UI reads as a
+     genuine "dark" rather than "dim navy". */
+  --bg:           #030303;
+  --bg-panel:    #0a0a0a;
+  --bg-panel-2:  #141414;
+  --bg-elev:     #1c1c1c;
+  --fg:           #e8eaed;
+  --fg-dim:      #9aa0a6;
+  --fg-dimmer:   #6b7077;
+  --accent:       #00d4b4;   /* Netbox-ish teal — kept for brand */
   --accent-dim:  #07a38c;
   --warn:         #ffb347;
   --err:          #ef6e6e;
   --ok:           #4ade80;
-  --border:       #223047;
-  --border-soft: #172033;
-  --terminal-bg: #06090e;
-  --shadow-card: 0 1px 0 rgba(255,255,255,0.02), 0 8px 24px rgba(0,0,0,0.25);
+  --border:       #1f1f1f;
+  --border-soft: #141414;
+  --terminal-bg: #050505;
+  --shadow-card: 0 1px 0 rgba(255,255,255,0.02), 0 8px 24px rgba(0,0,0,0.55);
   --radius:      6px;
   --radius-lg:  10px;
   --sidebar-w:  240px;
@@ -38,7 +41,7 @@
      consistency. Designed against Netbox Labs's reference screenshot:
      near-white surfaces, soft grey dividers, dark text. */
   --bg:           #f6f8fb;
-  --bg-panel:    #ffffff;
+  --bg-panel:    #fbfcfe;
   --bg-panel-2:  #f0f3f8;
   --bg-elev:     #e6ebf2;
   --fg:           #1c2330;
@@ -51,7 +54,11 @@
   --ok:           #1f9b54;
   --border:       #d8dde6;
   --border-soft: #e7eaf0;
-  --terminal-bg: #0d1219; /* terminal stays dark even in light mode */
+  /* Light-mode terminal: the pane background and chrome track the rest
+     of the light theme. Per-level text colours below recolour-on-light
+     so log lines stay readable on a pale background — previously the
+     terminal was locked to dark and looked like a stuck panel. */
+  --terminal-bg: #ffffff;
   --shadow-card: 0 1px 0 rgba(0,0,0,0.02), 0 6px 18px rgba(20,28,52,0.06);
 }
 
@@ -84,14 +91,23 @@ code, kbd { font-family: var(--mono); font-size: 12.5px;
   border-right: 1px solid var(--border);
   display: flex; flex-direction: column;
 }
+/* The brand block sits flush with the topbar so the sidebar+topbar reads
+   as one continuous bar across the top of the app, rather than a chunky
+   2-line logo block plus a separate (smaller-typeface) page title. The
+   height/border-bottom match the topbar exactly so the divider runs
+   straight across without a step. */
 .sidebar .brand {
   display: flex; align-items: center; gap: 12px;
-  padding: 14px 18px;
+  padding: 0 18px;
+  height: var(--topbar-h);
   border-bottom: 1px solid var(--border);
 }
-.sidebar .brand img { width: 40px; height: auto; }
-.sidebar .brand strong { font-size: 16px; letter-spacing: 0.4px; }
-.sidebar .brand .sub { color: var(--fg-dim); font-size: 11px; }
+.sidebar .brand img { width: 26px; height: 26px; flex: none; }
+.sidebar .brand strong {
+  font-size: 15px; font-weight: 600;
+  letter-spacing: 0.2px;
+  color: var(--fg);
+}
 .sidebar nav { padding: 10px 0; flex: 1; overflow-y: auto; }
 .sidebar nav a {
   display: flex; align-items: center; gap: 10px;
@@ -113,10 +129,40 @@ code, kbd { font-family: var(--mono); font-size: 12.5px;
 }
 .sidebar nav a.active .count { background: var(--accent); color: #002923; }
 .sidebar .footer {
-  padding: 10px 18px; border-top: 1px solid var(--border);
+  padding: 12px 18px; border-top: 1px solid var(--border);
   color: var(--fg-dimmer); font-size: 11px;
+  display: flex; flex-direction: column; gap: 4px;
+}
+.sidebar .footer code { background: transparent; color: var(--fg-dim); padding: 0;
+  font-size: 11px; word-break: break-all; }
+.sidebar .footer .status-row {
+  display: flex; align-items: center; gap: 8px;
+  margin-bottom: 4px;
+}
+.sidebar .footer .status-row .dot {
+  width: 8px; height: 8px; border-radius: 50%; display: inline-block;
+  background: var(--fg-dimmer); flex: none;
+}
+.sidebar .footer .status-row .dot.ok   { background: var(--ok);
+  box-shadow: 0 0 6px color-mix(in srgb, var(--ok) 60%, transparent); }
+.sidebar .footer .status-row .dot.err  { background: var(--err); }
+.sidebar .footer .status-row .dot.warn { background: var(--warn); }
+.sidebar .footer .status-label { color: var(--fg-dim); }
+.sidebar .footer .status-value { color: var(--fg); font-weight: 600; }
+.sidebar .footer .status-value.ok   { color: var(--ok); }
+.sidebar .footer .status-value.err  { color: var(--err); }
+.sidebar .footer .status-value.warn { color: var(--warn); }
+.sidebar .footer .footer-sub { color: var(--fg-dimmer); margin-top: 2px; }
+/* Persistent backend identity. Sits below the advertised URL so even
+   when an operator has uploaded their own logo, "what is this" stays
+   answerable from the bottom-left of every page. */
+.sidebar .footer .footer-version {
+  margin-top: 8px; padding-top: 8px;
+  border-top: 1px dashed var(--border-soft);
+  color: var(--fg-dim);
+  font-variant-numeric: tabular-nums;
+  letter-spacing: 0.2px;
 }
-.sidebar .footer code { background: transparent; color: var(--fg-dim); padding: 0; }
 
 /* ── Top bar ───────────────────────────────────────────────────────── */
 
@@ -230,7 +276,7 @@ button, .btn {
   cursor: pointer;
   transition: background 0.12s ease;
 }
-button:hover, .btn:hover { background: var(--accent-dim); color: #fff; }
+button:hover, .btn:hover { background: var(--accent-dim); color: #f4fffd; }
 button.ghost { background: transparent; color: var(--fg); border: 1px solid var(--border); }
 button.ghost:hover { background: var(--bg-panel-2); color: var(--fg); }
 button.danger { background: transparent; color: var(--err); border: 1px solid color-mix(in srgb, var(--err) 35%, transparent); }
@@ -279,35 +325,34 @@ label.check input { accent-color: var(--accent); }
 .progress.active { display: block; }
 .progress .bar { height: 100%; width: 0%; background: var(--accent); transition: width .25s; }
 
-/* ── Forge progress widget ─────────────────────────────────────────
-   Anvil-with-sparks animation paired with a horizontal progress bar.
-   Used on the Forge Gate tab to give a sense of the "in-flight"
-   imaging count without having to read a number. */
-.forge-progress {
+/* ── Imaging progress widget ───────────────────────────────────────
+   Animated brand mark paired with a horizontal progress bar; surfaces
+   on Dashboard and the Queue tab. */
+.queue-progress {
   display: flex; align-items: center; gap: 16px;
   padding: 16px;
 }
-.forge-progress .anvil {
-  width: 64px; height: 64px; flex: none;
-  background: url("/assets/anvil-forge.svg") no-repeat center / contain;
-  filter: drop-shadow(0 0 14px color-mix(in srgb, var(--warn) 40%, transparent));
+.queue-progress .mark {
+  width: 56px; height: 56px; flex: none; border-radius: 50%;
+  background: url("/assets/loader.svg") no-repeat center / contain;
+  filter: drop-shadow(0 0 16px rgba(255, 255, 255, 0.10));
 }
-.forge-progress .info { flex: 1; min-width: 0; }
-.forge-progress .info .label {
+.queue-progress .info { flex: 1; min-width: 0; }
+.queue-progress .info .label {
   font-size: 12.5px; color: var(--fg-dim); margin-bottom: 6px;
 }
-.forge-progress .bar-track {
+.queue-progress .bar-track {
   height: 8px; background: var(--bg-elev); border-radius: 4px;
   overflow: hidden; position: relative;
 }
-.forge-progress .bar-fill {
+.queue-progress .bar-fill {
   height: 100%;
-  background: linear-gradient(90deg, var(--warn), var(--accent));
+  background: linear-gradient(90deg, var(--accent-dim), var(--accent));
   width: 0%;
   transition: width 0.4s ease;
   position: relative;
 }
-.forge-progress .bar-fill::after {
+.queue-progress .bar-fill::after {
   /* Subtle moving sheen so the bar feels alive even at 0% movement. */
   content: ""; position: absolute; inset: 0;
   background: linear-gradient(
@@ -315,24 +360,24 @@ label.check input { accent-color: var(--accent); }
     rgba(255,255,255,0) 0%,
     rgba(255,255,255,0.18) 50%,
     rgba(255,255,255,0) 100%);
-  animation: forge-sheen 1.6s linear infinite;
+  animation: queue-sheen 1.6s linear infinite;
 }
-@keyframes forge-sheen {
+@keyframes queue-sheen {
   from { transform: translateX(-100%); }
   to   { transform: translateX(100%); }
 }
-.forge-progress.idle .anvil { filter: none; opacity: 0.45; }
-.forge-progress.idle .bar-fill::after { animation: none; }
+.queue-progress.idle .mark { filter: grayscale(0.85) opacity(0.55); }
+.queue-progress.idle .bar-fill::after { animation: none; }
 
-/* ── Page-load anvil ──────────────────────────────────────────────── */
+/* ── Page-load loader ────────────────────────────────────────────── */
 .loader {
   display: flex; flex-direction: column; align-items: center; gap: 12px;
   padding: 40px 20px;
   color: var(--fg-dim);
 }
-.loader .anvil {
-  width: 110px; height: 110px;
-  background: url("/assets/anvil-forge.svg") no-repeat center / contain;
+.loader .mark {
+  width: 96px; height: 96px;
+  background: url("/assets/loader.svg") no-repeat center / contain;
 }
 
 /* ── Top bar readiness chip ──────────────────────────────────────── */
@@ -380,23 +425,23 @@ tr.unbootable td:first-child { border-left: 3px solid var(--warn); }
 .form-row { display: grid; grid-template-columns: repeat(4, 1fr); gap: 10px 14px; }
 @media (max-width: 900px) { .form-row { grid-template-columns: 1fr; } }
 
-/* ── Gate queue "horse race" visual ──────────────────────────────── */
-.gate-track {
+/* ── Queued deployment visual ────────────────────────────────────── */
+.queue-track {
   display: grid; gap: 6px;
   padding: 10px 0;
 }
-.gate-row {
+.queue-row {
   display: grid; grid-template-columns: 32px 1fr auto auto; align-items: center;
   gap: 14px;
   padding: 8px 14px;
   background: var(--bg-panel-2); border-radius: var(--radius);
   border-left: 3px solid var(--accent);
 }
-.gate-row.assigned { border-left-color: var(--ok); }
-.gate-row .pos { font-family: var(--mono); font-size: 15px; color: var(--accent); font-weight: 600; }
-.gate-row.assigned .pos { color: var(--ok); }
-.gate-row .mac { font-family: var(--mono); font-size: 13px; }
-.gate-row .meta { color: var(--fg-dim); font-size: 12px; }
+.queue-row.assigned { border-left-color: var(--ok); }
+.queue-row .pos { font-family: var(--mono); font-size: 15px; color: var(--accent); font-weight: 600; }
+.queue-row.assigned .pos { color: var(--ok); }
+.queue-row .mac { font-family: var(--mono); font-size: 13px; }
+.queue-row .meta { color: var(--fg-dim); font-size: 12px; }
 
 .empty { color: var(--fg-dim); padding: 30px; text-align: center; }
 .msg { color: var(--fg-dim); font-size: 12.5px; margin-top: 8px; }
@@ -414,52 +459,124 @@ tr.unbootable td:first-child { border-left: 3px solid var(--warn); }
   min-height: 480px;
   box-shadow: var(--shadow-card);
 }
+/* Terminal pane colours follow the active theme. Hard-coded hexes
+   (#050505, #181818, #cfd6e2 etc.) were leaving the light-mode pane
+   looking dark; we keep palette-aware vars instead so the toggle works. */
 .terminal .pane {
   flex: 1; overflow: auto;
   padding: 10px 14px;
   font-family: var(--mono); font-size: 12.5px; line-height: 1.5;
-  color: #cfd6e2;
+  color: var(--fg);
   white-space: pre-wrap; word-break: break-word;
 }
 .terminal .pane .lvl-error { color: var(--err); }
 .terminal .pane .lvl-warn  { color: var(--warn); }
-.terminal .pane .lvl-info  { color: #cfd6e2; }
-.terminal .pane .lvl-debug { color: #8b94a8; }
-.terminal .pane .lvl-trace { color: #5a6379; }
-.terminal .pane .ts        { color: #5a6379; }
-.terminal .pane .tg        { color: #7cd3ff; }
+.terminal .pane .lvl-info  { color: var(--fg); }
+.terminal .pane .lvl-debug { color: var(--fg-dim); }
+.terminal .pane .lvl-trace { color: var(--fg-dimmer); }
+.terminal .pane .ts        { color: var(--fg-dimmer); }
+.terminal .pane .tg        { color: var(--accent); }
 .terminal .pane .echo      { color: var(--accent); }
 .terminal .input-row {
   display: flex; align-items: center; gap: 8px;
   padding: 8px 14px;
-  background: #0a0e15;
-  border-top: 1px solid #1d2330;
+  background: var(--bg-panel-2);
+  border-top: 1px solid var(--border);
 }
 .terminal .input-row .prompt { color: var(--accent); font-family: var(--mono); }
 .terminal .input-row input {
-  flex: 1; background: transparent; border: 0; color: #e4e8ef;
+  flex: 1; background: transparent; border: 0; color: var(--fg);
   font: inherit; font-family: var(--mono); font-size: 13px;
   outline: none; padding: 4px 0;
 }
 .terminal .toolbar {
   display: flex; gap: 8px; align-items: center;
   padding: 8px 14px;
-  background: #0a0e15;
-  border-bottom: 1px solid #1d2330;
-  font-size: 12px; color: #8a94a7;
+  background: var(--bg-panel-2);
+  border-bottom: 1px solid var(--border);
+  font-size: 12px; color: var(--fg-dim);
 }
 .terminal .toolbar .right { margin-left: auto; display: flex; gap: 6px; }
 .terminal .toolbar button {
   padding: 3px 9px; font-size: 11px;
-  background: transparent; color: #8a94a7; border: 1px solid #1d2330;
+  background: transparent; color: var(--fg-dim); border: 1px solid var(--border);
   font-weight: 500;
 }
-.terminal .toolbar button:hover { color: #e4e8ef; background: #1d2330; }
+.terminal .toolbar button:hover { color: var(--fg); background: var(--bg-elev); }
 
 /* ── About card ─────────────────────────────────────────────────── */
 .about-hero { padding: 20px 24px; }
 .about-hero h2 { font-size: 22px; margin: 0 0 8px; color: var(--fg); }
-.about-hero .lead { color: var(--fg-dim); font-size: 14px; max-width: 60ch; }
+/* Span the full main column rather than capping at 60ch — the page is
+   read at typical desktop widths and the cap was leaving the right two
+   thirds of the panel awkwardly empty. */
+.about-hero .lead { color: var(--fg-dim); font-size: 14px; max-width: none; }
 .about-hero .who { margin-top: 18px; font-size: 13px; }
 .about-hero .who span { color: var(--fg-dim); }
 .about-hero .who strong { color: var(--accent); }
+.about-hero a { color: var(--accent); }
+
+/* ── API reference (Settings → bottom) ─────────────────────────── */
+.api-ref { display: grid; gap: 18px; padding: 16px; }
+.api-ref .group h3 {
+  margin: 0 0 8px; font-size: 13px; color: var(--fg-dim);
+  text-transform: uppercase; letter-spacing: 0.8px;
+}
+.api-ref .ep {
+  display: grid; grid-template-columns: 64px minmax(200px, 1fr) 2fr;
+  gap: 12px; align-items: baseline;
+  padding: 6px 0; border-top: 1px solid var(--border-soft);
+  font-size: 13px;
+}
+.api-ref .ep:first-child { border-top: 0; }
+.api-ref .ep .method {
+  font-family: var(--mono); font-weight: 600; font-size: 11px;
+  padding: 2px 6px; border-radius: 4px;
+  text-align: center; letter-spacing: 0.6px;
+}
+.api-ref .ep .method.get    { background: color-mix(in srgb, var(--ok) 22%, transparent);     color: var(--ok); }
+.api-ref .ep .method.post   { background: color-mix(in srgb, var(--accent) 22%, transparent); color: var(--accent); }
+.api-ref .ep .method.put    { background: color-mix(in srgb, var(--warn) 22%, transparent);   color: var(--warn); }
+.api-ref .ep .method.delete { background: color-mix(in srgb, var(--err) 22%, transparent);    color: var(--err); }
+.api-ref .ep .path { font-family: var(--mono); color: var(--fg); word-break: break-all; }
+.api-ref .ep .desc { color: var(--fg-dim); }
+@media (max-width: 900px) {
+  .api-ref .ep { grid-template-columns: 1fr; gap: 4px; }
+  .api-ref .ep .method { justify-self: start; }
+}
+
+/* ── Disk space card ───────────────────────────────────────────── */
+.diskbar {
+  height: 10px; border-radius: 5px;
+  background: var(--bg-elev);
+  overflow: hidden; margin-top: 8px;
+}
+.diskbar .fill {
+  height: 100%;
+  background: linear-gradient(90deg, var(--accent-dim), var(--accent));
+  transition: width 0.4s ease;
+}
+.diskbar.warn .fill { background: var(--warn); }
+.diskbar.full .fill { background: var(--err); }
+.disk-meta { display: flex; gap: 14px; font-size: 12px; color: var(--fg-dim); margin-top: 8px; flex-wrap: wrap; }
+.disk-meta strong { color: var(--fg); font-weight: 600; font-variant-numeric: tabular-nums; }
+
+/* ── Logo upload (Settings) ────────────────────────────────────── */
+.logo-preview {
+  display: flex; align-items: center; gap: 14px;
+  padding: 12px;
+  background: var(--bg-panel-2);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+}
+.logo-preview .swatch {
+  width: 56px; height: 56px;
+  display: flex; align-items: center; justify-content: center;
+  background: var(--bg); border: 1px solid var(--border);
+  border-radius: var(--radius);
+  flex: none;
+}
+.logo-preview .swatch img { max-width: 48px; max-height: 48px; }
+.logo-preview .info { flex: 1; min-width: 0; }
+.logo-preview .info .name { color: var(--fg); font-weight: 600; }
+.logo-preview .info .meta { color: var(--fg-dim); font-size: 12px; margin-top: 2px; }

crates/webui/src/app.js

@@ -1,7 +1,7 @@
-// PXEForge web UI — vanilla JS, no build step, no framework, no network
+// OpenPXE web UI — vanilla JS, no build step, no framework, no network
 // dependencies. Uses fetch() + EventSource only.
 //
-// Tabs (Phase 4): Dashboard / Network / Forge Gate / Storage / Terminal /
+// Tabs (Phase 4): Dashboard / Network / Queue / Storage / Terminal /
 // About. The shell swaps a single view into #view-root.
 //
 // Keep this readable — nobody wants to debug a clever vanilla-JS
@@ -75,19 +75,19 @@
     return fetch(url, {method:'POST', headers:{'Content-Type':'application/json'}, body: JSON.stringify(body)});
   }
 
-  // Animated "anvil + progress bar" widget. Built once here and inlined
-  // wherever a card wants to convey "an image is being forged onto the
-  // bench right now." Used on the dashboard and on the Forge Gate.
-  function forgeProgressWidget(imaging, gateTotal) {
-    const total = Math.max(gateTotal, imaging, 1);
+  // Animated brand-mark + progress bar widget. Built once here and inlined
+  // wherever a card wants to convey "an image is being deployed onto a
+  // queued client right now." Used on the Dashboard and the Queue tab.
+  function queueProgressWidget(imaging, queueTotal) {
+    const total = Math.max(queueTotal, imaging, 1);
     const pct = imaging > 0 ? Math.round((imaging / total) * 100) : 0;
-    const root = el('div', {class: 'forge-progress' + (imaging === 0 ? ' idle' : '')}, [
-      el('div', {class: 'anvil', 'aria-hidden': 'true'}),
+    const root = el('div', {class: 'queue-progress' + (imaging === 0 ? ' idle' : '')}, [
+      el('div', {class: 'mark', 'aria-hidden': 'true'}),
       el('div', {class: 'info'}, [
         el('div', {class: 'label'},
           imaging === 0
             ? 'No active imaging'
-            : (imaging + ' of ' + total + ' device' + (total === 1 ? '' : 's') + ' being forged')),
+            : (imaging + ' of ' + total + ' device' + (total === 1 ? '' : 's') + ' deploying')),
         el('div', {class: 'bar-track'},
           el('div', {class: 'bar-fill', style: 'width:' + pct + '%'})),
       ]),
@@ -120,7 +120,7 @@
       const status = await getJSON('/api/status');
       const isos = await getJSON('/api/isos');
       const clients = (await getJSON('/api/clients')).clients || [];
-      const gates = (await getJSON('/api/gate')).gates || [];
+      const entries = (await getJSON('/api/queue')).entries || [];
 
       const ipxeOk = (status.ipxe_assets || []).length > 0;
       const stats = el('div', {class: 'statstrip'}, [
@@ -136,9 +136,9 @@
           el('div', {class: 'stat', style: 'padding-bottom:0'}, [
             el('div', {class: 'label'}, 'Imaging now'),
             el('div', {class: 'value'}, String(status.imaging_count || 0)),
-            el('div', {class: 'trend'}, (status.waiting_count || 0) + ' waiting at gate'),
+            el('div', {class: 'trend'}, (status.waiting_count || 0) + ' waiting in queue'),
           ]),
-          forgeProgressWidget(status.imaging_count || 0, status.gate_count || 0),
+          queueProgressWidget(status.imaging_count || 0, status.queue_count || 0),
         ]),
         el('div', {class: 'card'}, el('div', {class: 'stat'}, [
           el('div', {class: 'label'}, 'Images available'),
@@ -151,7 +151,7 @@
         el('div', {class: 'card'}, el('div', {class: 'stat'}, [
           el('div', {class: 'label'}, 'Uptime'),
           el('div', {class: 'value', style: 'font-size:22px'}, fmtUptime(status.uptime_secs)),
-          el('div', {class: 'trend'}, 'PXEForge ' + status.version),
+          el('div', {class: 'trend'}, 'OpenPXE ' + status.version),
         ])),
       ]);
 
@@ -159,10 +159,10 @@
       // boot" log. Use last_seen desc (already sorted by API).
       const recent = clients.slice(0, 8);
       const recentRows = recent.map(c => {
-        const g = gates.find(g => g.mac === c.mac);
+        const g = entries.find(g => g.mac === c.mac);
         let status = el('span', {class: 'tag ok'}, 'active');
         if (g && g.assigned_target) status = el('span', {class:'tag ok'}, 'assigned: ' + g.assigned_target);
-        else if (g) status = el('span', {class:'tag accent'}, '#' + g.position + ' at gate');
+        else if (g) status = el('span', {class:'tag accent'}, '#' + g.position + ' in queue');
         return el('tr', {}, [
           el('td', {class: 'mono'}, c.mac),
           el('td', {}, c.last_ip ? String(c.last_ip) : '-'),
@@ -229,13 +229,13 @@
           ]),
           el('p', {class:'msg'},
             'Server IP, NIC, mask, and gateway are auto-detected at startup. ' +
-            'To change them, set PXEFORGE_PUBLIC_IP and restart — editing them ' +
+            'To change them, set OPENPXE_PUBLIC_IP and restart — editing them ' +
             'from a hot UI would silently break PXE for every client mid-boot.'),
           el('label', {class:'field', style:'margin-top:18px'}, [
             el('span', {class:'name'}, 'DNS server (optional, informational)'),
             dns,
             el('span', {class:'hint'},
-              'PXEForge does not run a DNS server itself; this field records ' +
+              'OpenPXE does not run a DNS server itself; this field records ' +
               'what your upstream DNS is so you don\'t have to dig it out at ' +
               '3 AM during a deployment.'),
           ]),
@@ -246,9 +246,9 @@
       return el('div', {class:'grid'}, [networkCard]);
     },
 
-    gate: async () => {
-      const [{ gates = [] }, isos] = await Promise.all([
-        getJSON('/api/gate'), getJSON('/api/isos'),
+    queue: async () => {
+      const [{ entries = [] }, isos] = await Promise.all([
+        getJSON('/api/queue'), getJSON('/api/isos'),
       ]);
       const targets = isos.flatMap(i => i.boot_entries.map(e => ({
         id: e.id, title: e.title + '  — ' + familyLabel(i.introspection.family)
@@ -261,18 +261,18 @@
       const msg = el('div', {class:'msg'});
       launch.onclick = async () => {
         if (!pick.value) { msg.textContent = 'Pick an image first.'; msg.className='msg err'; return; }
-        const r = await postJSON('/api/gate/assign', { target: pick.value, gate_ids: [] });
+        const r = await postJSON('/api/queue/assign', { target: pick.value, entry_ids: [] });
         if (!r.ok) { msg.textContent = 'Assign failed: ' + r.status; msg.className='msg err'; return; }
         const j = await r.json();
         if (!j.ok) { msg.textContent = 'Assign failed: ' + (j.error || 'unknown'); msg.className='msg err'; return; }
         msg.textContent = 'Launched ' + j.assigned + ' client' + (j.assigned===1?'':'s') + ' → ' + j.target;
         msg.className = 'msg ok';
-        render('gate');
+        render('queue');
       };
 
-      const track = gates.length
-        ? el('div', {class:'gate-track'},
-            gates.map(g => el('div', {class:'gate-row' + (g.assigned_target ? ' assigned' : '')}, [
+      const track = entries.length
+        ? el('div', {class:'queue-track'},
+            entries.map(g => el('div', {class:'queue-row' + (g.assigned_target ? ' assigned' : '')}, [
               el('div', {class:'pos'}, '#' + g.position),
               el('div', {}, [
                 el('div', {class:'mac'}, g.mac),
@@ -283,23 +283,23 @@
                 ? el('span', {class:'tag ok'}, '→ ' + g.assigned_target)
                 : el('span', {class:'tag accent'}, 'waiting')),
               el('button', {class:'ghost', onclick: async () => {
-                await fetch('/api/gate/' + encodeURIComponent(g.id), {method:'DELETE'});
-                render('gate');
+                await fetch('/api/queue/' + encodeURIComponent(g.id), {method:'DELETE'});
+                render('queue');
               }}, 'Release'),
             ]))
           )
         : el('div', {class:'empty'},
-            'No clients at the gate. Boot a client and choose "Gated Deployment" in the PXE menu.');
+            'No clients queued. Boot a client and choose "Queued Deployment" in the PXE menu.');
 
-      const imaging = gates.filter(g => g.assigned_target).length;
+      const imaging = entries.filter(g => g.assigned_target).length;
 
       return el('div', {class:'grid'}, [
         el('div', {class:'card'}, [
-          el('header', {}, el('h2', {}, 'Forge')),
-          forgeProgressWidget(imaging, gates.length),
+          el('header', {}, el('h2', {}, 'Status')),
+          queueProgressWidget(imaging, entries.length),
         ]),
         el('div', {class:'card'}, [
-          el('header', {}, el('h2', {}, 'Launch an image across the gate')),
+          el('header', {}, el('h2', {}, 'Launch image for queued clients')),
           el('div', {class:'body'}, [
             el('label', {class:'field'}, [
               el('span', {class:'name'}, 'Target image'),
@@ -312,8 +312,8 @@
         ]),
         el('div', {class:'card'}, [
           el('header', {}, [
-            el('h2', {}, 'Gate positions'),
-            el('span', {class:'sub'}, gates.length + ' waiting'),
+            el('h2', {}, 'Queue positions'),
+            el('span', {class:'sub'}, entries.length + ' waiting'),
           ]),
           el('div', {class:'body'}, track),
         ]),
@@ -321,8 +321,11 @@
     },
 
     storage: async () => {
-      const [isos, settings, nfsRes] = await Promise.all([
+      const [isos, settings, nfsRes, disk] = await Promise.all([
         getJSON('/api/isos'), getJSON('/api/settings'), getJSON('/api/nfs'),
+        getJSON('/api/storage/disk').catch(() => ({
+          total_bytes: 0, available_bytes: 0, used_bytes: 0, path: '?',
+        })),
       ]);
       const mounts = nfsRes.mounts || [];
 
@@ -346,66 +349,245 @@
       });
       file.onchange = () => { if (file.files[0]) upload(file.files[0]); };
 
-      function upload(f) {
-        upMsg.textContent = 'Uploading ' + f.name + ' (' + fmtBytes(f.size) + ')…';
-        upMsg.className = 'msg';
+      // Chunked upload telemetry. The old browser path posted one huge
+      // multipart body, which left operators staring at 0% when a reverse
+      // proxy buffered or rejected the request before OpenPXE saw it. This
+      // path writes small raw chunks; each acknowledged chunk advances the
+      // bar and leaves a visible .partial file in the ISO directory.
+      async function upload(f) {
+        const started = Date.now();
+        const bar = $('#bar');
+        const setStatus = (text, cls) => { upMsg.textContent = text; upMsg.className = 'msg ' + (cls || ''); };
+        const update = (loaded, total, phase) => {
+          const pct = total > 0 ? Math.min(100, (loaded / total) * 100) : 100;
+          bar.style.width = pct.toFixed(1) + '%';
+          const elapsed = Math.max(0.001, (Date.now() - started) / 1000);
+          const rate = loaded > 0 ? loaded / elapsed : 0;
+          const remain = rate > 0 ? (total - loaded) / rate : 0;
+          setStatus(
+            phase + ' ' + f.name + ' - ' +
+            fmtBytes(loaded) + ' of ' + fmtBytes(total) +
+            ' (' + pct.toFixed(1) + '%, ' + fmtBytes(rate) + '/s' +
+            (remain > 0 ? ', ' + Math.ceil(remain) + 's left' : '') + ')');
+        };
+        const failText = async (r) => {
+          const text = (await r.text()).slice(0, 240);
+          let hint = '';
+          if (r.status === 413)      hint = ' - body too large. A proxy likely rejected this chunk.';
+          else if (r.status === 502) hint = ' - bad gateway. Proxy lost the upstream mid-stream.';
+          else if (r.status === 504) hint = ' - gateway timeout. Try the LAN IP directly.';
+          else if (r.status === 409) hint = ' - name conflict or offset mismatch. Remove the old ISO and retry.';
+          return 'HTTP ' + r.status + ' ' + text + hint;
+        };
+
+        let uploadId = null;
+        setStatus('Preparing upload for ' + f.name + ' (' + fmtBytes(f.size) + ')');
         prog.classList.add('active');
-        const fd = new FormData(); fd.append('file', f);
-        const xhr = new XMLHttpRequest();
-        xhr.upload.onprogress = e => {
-          if (e.lengthComputable) $('#bar').style.width = (e.loaded/e.total*100).toFixed(1) + '%';
-        };
-        xhr.onload = () => {
-          prog.classList.remove('active');
-          $('#bar').style.width = '0';
-          if (xhr.status >= 200 && xhr.status < 300) {
-            upMsg.textContent = 'Uploaded & analyzed.'; upMsg.className = 'msg ok';
-            render('storage');
-          } else {
-            upMsg.textContent = 'Upload failed: ' + xhr.status + ' ' + xhr.responseText;
-            upMsg.className = 'msg err';
+        bar.style.width = '1%';
+
+        try {
+          const begin = await postJSON('/api/uploads', {
+            filename: f.name,
+            size_bytes: f.size,
+          });
+          if (!begin.ok) throw new Error(await failText(begin));
+          const session = await begin.json();
+          uploadId = session.upload_id;
+          const chunkSize = Math.max(1024 * 1024, Number(session.chunk_size || 8 * 1024 * 1024));
+
+          let offset = Number(session.offset || 0);
+          let finished = null;
+          do {
+            const end = Math.min(offset + chunkSize, f.size);
+            const complete = end >= f.size;
+            const r = await fetch('/api/uploads/' + encodeURIComponent(uploadId), {
+              method: 'PUT',
+              headers: {
+                'x-openpxe-upload-offset': String(offset),
+                'x-openpxe-upload-complete': complete ? 'true' : 'false',
+              },
+              body: f.slice(offset, end),
+            });
+            if (!r.ok) throw new Error(await failText(r));
+            const j = await r.json();
+            offset = Number(j.offset || end);
+            update(offset, f.size, complete ? 'Analyzing' : 'Uploading');
+            if (j.complete) finished = j.iso || true;
+          } while (!finished);
+
+          setStatus('Uploaded and analyzed: ' + f.name + ' (' + fmtBytes(f.size) + ')', 'ok');
+          render('storage');
+        } catch (err) {
+          if (uploadId) {
+            try { await fetch('/api/uploads/' + encodeURIComponent(uploadId), {method: 'DELETE'}); }
+            catch {}
           }
-        };
-        xhr.onerror = () => { upMsg.textContent = 'Network error.'; upMsg.className = 'msg err'; };
-        xhr.open('POST', '/api/isos');
-        xhr.send(fd);
+          setStatus('Upload failed: ' + (err && err.message ? err.message : String(err)), 'err');
+        } finally {
+          prog.classList.remove('active');
+          if (!upMsg.className.includes('ok')) bar.style.width = '0';
+        }
       }
 
       // ── ISO table (mixed local + NFS) ──
-      const rows = isos.map(i => {
+      // Each row gets a "Password" cell that toggles a small inline
+      // editor (a checkbox + a password field + Save button) inside the
+      // *next* row of the table. Keeps the markup flat and avoids the
+      // overhead of a real modal.
+      const rowsAndEditors = [];
+      isos.forEach(i => {
         const b = bootability(i, settings);
         const isNfs = i.source && i.source.kind === 'nfs';
+        const protectedNow = !!i.password_hash;
+
+        // The inline editor row is hidden by default; the Password
+        // button toggles its `display`. Pre-built so toggle is cheap.
+        const pwCheck = el('input', {type:'checkbox'});
+        pwCheck.checked = protectedNow;
+        const pwInput = el('input', {
+          type: 'password', spellcheck: 'false',
+          autocomplete: 'new-password', autocapitalize: 'off',
+          placeholder: protectedNow ? '(unchanged — type to replace)' : 'choose a password',
+        });
+        const pwInputWrap = el('label', {class:'field', style:'flex:1;margin:0'}, [
+          el('span', {class:'name'}, 'Password'),
+          pwInput,
+        ]);
+        // Toggle the password field's visibility off when the checkbox
+        // is unchecked, so the operator's intent is unambiguous on Save.
+        const refreshFieldVisibility = () => {
+          pwInputWrap.style.display = pwCheck.checked ? '' : 'none';
+        };
+        pwCheck.onchange = refreshFieldVisibility;
+        const pwMsg = el('div', {class:'msg', style:'margin-top:6px'});
+        const pwSave = el('button', {style:'flex:none', onclick: async () => {
+          let resp;
+          if (pwCheck.checked) {
+            // Empty input + previously protected = keep the old password
+            // (operator just toggled the box on but didn't type). We
+            // detect this by sending the API only when the field has
+            // content; otherwise no-op + show hint.
+            if (!pwInput.value && !protectedNow) {
+              pwMsg.textContent = 'Enter a password to enable.';
+              pwMsg.className = 'msg err';
+              return;
+            }
+            if (!pwInput.value && protectedNow) {
+              pwMsg.textContent = 'Password unchanged.';
+              pwMsg.className = 'msg ok';
+              return;
+            }
+            resp = await putJSON(
+              '/api/isos/' + encodeURIComponent(i.id) + '/password',
+              { password: pwInput.value });
+          } else {
+            resp = await fetch(
+              '/api/isos/' + encodeURIComponent(i.id) + '/password',
+              {method: 'DELETE'});
+          }
+          if (resp.ok || resp.status === 204) {
+            // Wipe the input field before re-rendering so the
+            // plaintext doesn't sit in DOM longer than necessary.
+            pwInput.value = '';
+            render('storage');
+          } else {
+            const t = await resp.text();
+            pwMsg.textContent = 'Save failed: ' + t;
+            pwMsg.className = 'msg err';
+          }
+        }}, 'Save password');
+
+        const editorCells = el('td', {colspan: '7', style:'background:var(--bg-panel-2);padding:14px 18px'}, [
+          el('div', {style:'display:flex;align-items:flex-end;gap:14px;flex-wrap:wrap'}, [
+            el('label', {class:'check', style:'flex:none;margin:0'}, [
+              pwCheck,
+              el('span', {}, 'Password protect this image'),
+            ]),
+            pwInputWrap,
+            pwSave,
+          ]),
+          el('div', {class:'msg', style:'margin-top:8px;font-size:11.5px'},
+            'Operators booting this ISO will be prompted on the PXE client. ' +
+            'Stored bcrypt-hashed; the plaintext never leaves the request.'),
+          pwMsg,
+        ]);
+        const editorRow = el('tr', {style:'display:none'}, editorCells);
+        refreshFieldVisibility();
+
+        // Type cell becomes an OS/Tools <select>. Default is OS (everything
+        // routes through the family-detected installer submenu); switching
+        // to Tools moves the ISO into the Tools submenu next to memtest.
+        // The detected family stays visible as a small subtitle below the
+        // selector so the operator hasn't lost that information.
+        const catSel = el('select', {
+          style: 'min-width:96px;background:var(--bg);color:var(--fg);' +
+                 'border:1px solid var(--border);border-radius:var(--radius);' +
+                 'padding:4px 8px;font:inherit;font-size:12px'
+        }, [
+          el('option', {value: 'os'},    'OS'),
+          el('option', {value: 'tools'}, 'Tools'),
+        ]);
+        catSel.value = (i.category || 'os');
+        catSel.onchange = async () => {
+          const r = await putJSON('/api/isos/' + encodeURIComponent(i.id) + '/category',
+            { category: catSel.value });
+          if (!r.ok) {
+            const t = await r.text();
+            alert('Category change failed: ' + t);
+          }
+          render('storage');
+        };
+
         const tr = el('tr', b.ok ? {} : {class: 'unbootable'}, [
           el('td', {}, [
-            el('div', {}, i.filename),
+            el('div', {style:'display:flex;align-items:center;gap:8px'}, [
+              protectedNow ? el('span', {
+                title: 'Password protected',
+                style:'color:var(--accent);font-size:13px'
+              }, '🔒') : null,
+              el('span', {}, i.filename),
+            ]),
             !b.ok ? el('div', {class:'row-warn'}, '⚠ ' + b.reason)
                   : (b.warn ? el('div', {class:'row-warn'}, '⚠ ' + b.warn) : null),
           ]),
-          el('td', {}, el('span', {class:'tag'}, familyLabel(i.introspection.family))),
+          el('td', {}, [
+            catSel,
+            el('div', {style:'color:var(--fg-dim);font-size:11px;margin-top:4px'},
+              familyLabel(i.introspection.family)),
+          ]),
           el('td', {class:'num'}, fmtBytes(i.size_bytes)),
           el('td', {},
             el('span', {class:'src-badge' + (isNfs ? ' nfs' : '')},
               isNfs ? ('nfs:' + i.source.mount_id) : 'local')),
+          el('td', {},
+            protectedNow
+              ? el('span', {class:'tag accent'}, 'protected')
+              : el('span', {class:'tag', style:'opacity:.55'}, 'open')),
           el('td', {}, fmtAgo(i.uploaded_at)),
-          el('td', {style:'text-align:right'},
+          el('td', {style:'text-align:right;white-space:nowrap'}, [
+            el('button', {class:'ghost', style:'margin-right:6px', onclick: () => {
+              editorRow.style.display = (editorRow.style.display === 'none') ? '' : 'none';
+            }}, protectedNow ? 'Password ✎' : 'Set password'),
             isNfs
-              ? el('span', {class:'tag', style:'opacity:.6'}, 'manage on NFS share')
+              ? el('span', {class:'tag', style:'opacity:.6'}, 'on NFS')
               : el('button', {class:'danger', onclick: async () => {
                   if (!confirm('Remove this image?')) return;
                   await fetch('/api/isos/' + encodeURIComponent(i.id), {method:'DELETE'});
                   render('storage');
-                }}, 'Remove')),
+                }}, 'Remove'),
+          ]),
         ]);
-        return tr;
+        rowsAndEditors.push(tr, editorRow);
       });
       const isoTable = isos.length
         ? el('table', {}, [
             el('thead', {}, el('tr', {}, [
               el('th',{},'Name'), el('th',{},'Type'),
               el('th',{class:'num'},'Size'),
-              el('th',{},'Source'), el('th',{},'Uploaded'), el('th',{},''),
+              el('th',{},'Source'), el('th',{},'Auth'),
+              el('th',{},'Uploaded'), el('th',{},''),
             ])),
-            el('tbody', {}, rows),
+            el('tbody', {}, rowsAndEditors),
           ])
         : el('div', {class:'empty'}, 'No images yet. Upload an ISO or mount an NFS share.');
 
@@ -458,7 +640,48 @@
         el('span'),
       ])) : [el('div', {class:'empty'}, 'No NFS shares mounted.')];
 
+      // Disk-space card. Free + used + total for the volume hosting the
+      // ISO directory, with a coloured bar. Warns at 80% and goes red at
+      // 95% so the operator sees the runway shrinking before uploads
+      // start failing with ENOSPC.
+      const total = Number(disk.total_bytes || 0);
+      const avail = Number(disk.available_bytes || 0);
+      const used  = Number(disk.used_bytes  || 0);
+      const pctUsed = total > 0 ? (used / total) * 100 : 0;
+      let barClass = 'diskbar';
+      if (pctUsed >= 95)      barClass += ' full';
+      else if (pctUsed >= 80) barClass += ' warn';
+      const diskCard = el('div', {class:'card'}, [
+        el('header', {}, [
+          el('h2', {}, 'Disk space'),
+          el('span', {class:'sub'},
+            total > 0
+              ? (pctUsed.toFixed(1) + '% used')
+              : 'unavailable'),
+        ]),
+        el('div', {class:'body'}, [
+          el('div', {style:'color:var(--fg-dim);font-size:12px;word-break:break-all'},
+            disk.path ? ('Volume: ' + disk.path) : 'Volume path unknown'),
+          el('div', {class: barClass},
+            el('div', {class:'fill',
+              style:'width:' + Math.min(100, pctUsed).toFixed(1) + '%'})),
+          el('div', {class:'disk-meta'}, [
+            el('span', {}, ['Used ',  el('strong', {}, fmtBytes(used))]),
+            el('span', {}, ['Free ',  el('strong', {}, fmtBytes(avail))]),
+            el('span', {}, ['Total ', el('strong', {}, fmtBytes(total))]),
+          ]),
+          pctUsed >= 95
+            ? el('p', {class:'msg err', style:'margin-top:10px'},
+                '⚠ Less than 5% free. Remove old ISOs or grow the volume before uploading more.')
+            : (pctUsed >= 80
+                ? el('p', {class:'msg', style:'color:var(--warn);margin-top:10px'},
+                    'Volume is getting full. Consider pruning old ISOs.')
+                : null),
+        ]),
+      ]);
+
       return el('div', {class:'grid'}, [
+        diskCard,
         el('div', {class:'card'}, [
           el('header', {}, el('h2', {}, 'Upload ISO')),
           el('div', {class:'body'}, [drop, file, prog, upMsg]),
@@ -506,9 +729,11 @@
     },
 
     hosts: async () => {
-      const [{ hosts = [] }, isos] = await Promise.all([
+      const [{ hosts = [] }, isos, bootLogRes] = await Promise.all([
         getJSON('/api/hosts'), getJSON('/api/isos'),
+        getJSON('/api/boot-log').catch(() => ({ events: [] })),
       ]);
+      const bootEvents = bootLogRes.events || [];
       const targets = isos.flatMap(i => i.boot_entries.map(e => ({
         id: e.id, title: e.title + '  — ' + familyLabel(i.introspection.family),
       })));
@@ -516,7 +741,7 @@
       // Reserved menu shortcuts that the operator might want to bind.
       const reserved = [
         {id: '_local',        title: '↳ Boot from Local HDD (built-in)'},
-        {id: '_gate',         title: '↳ Gated Deployment (built-in)'},
+        {id: '_queue',         title: '↳ Queued Deployment (built-in)'},
         {id: '_tools_menu',   title: '↳ Tools menu (built-in)'},
       ];
 
@@ -583,9 +808,8 @@
             ]),
             upsertBtn, msg,
             el('p', {class:'msg', style:'margin-top:14px'},
-              'When a client with a bound MAC requests boot.ipxe, PXEForge ' +
-              'short-circuits past the interactive menu and chains directly. ' +
-              'Inspired by Tinkerbell smee\'s MAC-prepended URL pattern.'),
+              'When a client with a bound MAC requests boot.ipxe, OpenPXE ' +
+              'short-circuits past the interactive menu and chains directly.'),
           ]),
         ]),
         el('div', {class:'card'}, [
@@ -595,6 +819,37 @@
           ]),
           table,
         ]),
+        el('div', {class:'card'}, [
+          el('header', {}, [
+            el('h2', {}, 'Host log'),
+            el('span', {class:'sub'},
+              bootEvents.length + ' event' + (bootEvents.length === 1 ? '' : 's')),
+          ]),
+          bootEvents.length
+            ? el('table', {}, [
+                el('thead', {}, el('tr', {}, [
+                  el('th', {}, 'Time'),
+                  el('th', {}, 'MAC'),
+                  el('th', {}, 'IP'),
+                  el('th', {}, 'Image'),
+                ])),
+                el('tbody', {},
+                  bootEvents.map(e => el('tr', {}, [
+                    el('td', {}, fmtAgo(e.timestamp)),
+                    el('td', {class:'mono'}, e.mac || el('span', {class:'tag'}, '(unknown)')),
+                    el('td', {class:'mono'}, e.ip ? String(e.ip) : '—'),
+                    el('td', {}, [
+                      el('span', {style:'font-weight:600'}, e.target_title || e.target_id),
+                      el('div', {class:'meta',
+                        style:'color:var(--fg-dim);font-size:11.5px;margin-top:2px'},
+                        e.target_id),
+                    ]),
+                  ]))),
+              ])
+            : el('div', {class:'empty'},
+                'No boot events yet. When a PXE client chains a boot entry, ' +
+                'it lands here with the MAC, IP, and image it received.'),
+        ]),
       ]);
     },
 
@@ -629,7 +884,7 @@
         const ts = (line.timestamp || new Date().toISOString()).replace(/\.\d+/, '').replace('T', ' ').replace('Z', '');
         const span = el('span', {class: 'lvl-' + lvl}, [
           el('span', {class:'ts'}, ts + '  '),
-          el('span', {class:'tg'}, '[' + (line.target || 'pxeforge') + '] '),
+          el('span', {class:'tg'}, '[' + (line.target || 'openpxe') + '] '),
           line.message,
           '\n',
         ]);
@@ -647,7 +902,7 @@
         const r = await getJSON('/api/log/recent');
         for (const l of (r.lines || [])) append(l);
       } catch (e) {
-        append({timestamp: new Date().toISOString(), level:'warn', target:'pxeforge::ui',
+        append({timestamp: new Date().toISOString(), level:'warn', target:'openpxe::ui',
                 message: 'failed to load recent logs: ' + e.message});
       }
 
@@ -655,12 +910,12 @@
       const es = new EventSource('/api/log/stream');
       es.onmessage = (ev) => {
         try { append(JSON.parse(ev.data)); }
-        catch { append({timestamp: new Date().toISOString(), level:'debug', target:'pxeforge::ui', message: ev.data}); }
+        catch { append({timestamp: new Date().toISOString(), level:'debug', target:'openpxe::ui', message: ev.data}); }
       };
       es.addEventListener('lagged', (ev) => {
         const j = JSON.parse(ev.data || '{}');
         append({timestamp: new Date().toISOString(), level:'warn',
-                target:'pxeforge::ui',
+                target:'openpxe::ui',
                 message: 'log stream lagged: ' + (j.skipped || '?') + ' lines skipped'});
       });
       es.onerror = () => {
@@ -668,7 +923,7 @@
         // We only append once, on transition from connected → erroring.
         if (!term._notedErr) {
           term._notedErr = true;
-          append({timestamp: new Date().toISOString(), level:'warn', target:'pxeforge::ui',
+          append({timestamp: new Date().toISOString(), level:'warn', target:'openpxe::ui',
                   message: 'log stream connection lost — auto-reconnecting'});
           setTimeout(() => { term._notedErr = false; }, 5000);
         }
@@ -701,7 +956,7 @@
                     target: 'terminal-output', message: out});
           } catch (err) {
             append({timestamp: new Date().toISOString(), level:'error',
-                    target:'pxeforge::ui', message: 'command failed: ' + err.message});
+                    target:'openpxe::ui', message: 'command failed: ' + err.message});
           }
         } else if (e.key === 'ArrowUp') {
           if (history.length === 0) return;
@@ -716,7 +971,7 @@
       });
 
       // Welcome banner.
-      append({timestamp: new Date().toISOString(), level:'info', target:'pxeforge::terminal',
+      append({timestamp: new Date().toISOString(), level:'info', target:'openpxe::terminal',
               message: 'Connected. Type "help" for available commands.'});
 
       // Focus the input on next tick (after view swap completes).
@@ -725,11 +980,147 @@
       return term;
     },
 
+    settings: async () => {
+      const [status, docs] = await Promise.all([
+        getJSON('/api/status'),
+        getJSON('/api/docs').catch(() => ({ groups: [] })),
+      ]);
+      const hasLogo = !!status.custom_logo;
+
+      // ── Identity & access placeholder.
+      // We haven't shipped auth yet — but operators looking at this tab
+      // need to see *where* it'll live so they're not surprised when an
+      // upgrade lights up real config controls under the same heading.
+      const accessCard = el('div', {class:'card'}, [
+        el('header', {}, el('h2', {}, 'Identity & access')),
+        el('div', {class:'body'}, [
+          el('p', {class:'msg'},
+            'LDAP, SSO (OIDC), and operator user management are planned ' +
+            'for a future release. Today, OpenPXE assumes a single trusted ' +
+            'operator on a flat L2 network and provides no built-in ' +
+            'authentication on the WebUI or HTTP API. Run behind your ' +
+            'identity-aware reverse proxy (Authentik, Authelia, oauth2-proxy) ' +
+            'for a hardened deployment until first-class support lands here.'),
+          el('div', {class:'form-row', style:'opacity:.55;pointer-events:none'}, [
+            el('label', {class:'field'}, [
+              el('span', {class:'name'}, 'LDAP server URL'),
+              el('input', {type:'text', placeholder:'ldaps://dc.example.com:636', disabled:'disabled'}),
+            ]),
+            el('label', {class:'field'}, [
+              el('span', {class:'name'}, 'OIDC issuer'),
+              el('input', {type:'text', placeholder:'https://idp.example.com/realms/openpxe', disabled:'disabled'}),
+            ]),
+            el('label', {class:'field'}, [
+              el('span', {class:'name'}, 'User management'),
+              el('input', {type:'text', placeholder:'configurable in a future release', disabled:'disabled'}),
+            ]),
+          ]),
+        ]),
+      ]);
+
+      // ── Custom logo upload.
+      // Single-file drop-zone; PNG/SVG/JPEG/WebP/GIF up to 2 MB.
+      // Persisted as <work_dir>/branding/logo.<ext> and served from
+      // /assets/logo.svg in preference to the bundled mark.
+      const logoFile = el('input', {
+        type:'file',
+        accept:'image/svg+xml,image/png,image/jpeg,image/webp,image/gif',
+        style:'display:none', id:'logo-file',
+      });
+      const logoMsg = el('div', {class:'msg', style:'margin-top:10px'});
+      const logoBust = '?v=' + Date.now(); // bust the browser cache after upload
+      logoFile.onchange = async () => {
+        if (!logoFile.files[0]) return;
+        const f = logoFile.files[0];
+        const fd = new FormData(); fd.append('file', f, f.name);
+        logoMsg.textContent = 'Uploading ' + f.name + ' (' + fmtBytes(f.size) + ')…';
+        logoMsg.className = 'msg';
+        const r = await fetch('/api/branding/logo', {method:'POST', body: fd});
+        if (r.ok) {
+          logoMsg.textContent = 'Custom logo installed. Reloading…';
+          logoMsg.className = 'msg ok';
+          setTimeout(() => location.reload(), 600);
+        } else {
+          const t = await r.text();
+          logoMsg.textContent = 'Upload failed: ' + t;
+          logoMsg.className = 'msg err';
+        }
+      };
+      const logoCard = el('div', {class:'card'}, [
+        el('header', {}, el('h2', {}, 'Branding')),
+        el('div', {class:'body'}, [
+          el('p', {class:'msg', style:'margin-bottom:14px'},
+            'Override the top-left brand mark with your own logo. Up to 2 MB; ' +
+            'PNG, SVG, JPEG, WebP, or GIF. The original OpenPXE version is ' +
+            'always shown in the bottom-left for support purposes.'),
+          el('div', {class:'logo-preview'}, [
+            el('div', {class:'swatch'},
+              el('img', {src: '/assets/logo.svg' + logoBust, alt:'current logo'})),
+            el('div', {class:'info'}, [
+              el('div', {class:'name'}, hasLogo ? 'Custom logo (uploaded)' : 'Default OpenPXE mark'),
+              el('div', {class:'meta'},
+                hasLogo
+                  ? 'Operator-uploaded; served from <work_dir>/branding/.'
+                  : 'Bundled rainbow-horizon mark. Upload an image to override.'),
+            ]),
+            el('div', {style:'display:flex;gap:8px;flex-wrap:wrap'}, [
+              el('button', {onclick: () => logoFile.click()},
+                hasLogo ? 'Replace logo' : 'Upload logo'),
+              hasLogo
+                ? el('button', {class:'danger', onclick: async () => {
+                    if (!confirm('Remove custom logo and revert to the OpenPXE mark?')) return;
+                    const r = await fetch('/api/branding/logo', {method:'DELETE'});
+                    if (r.ok || r.status === 204) {
+                      logoMsg.textContent = 'Reverted to default mark. Reloading…';
+                      logoMsg.className = 'msg ok';
+                      setTimeout(() => location.reload(), 500);
+                    } else {
+                      const t = await r.text();
+                      logoMsg.textContent = 'Clear failed: ' + t;
+                      logoMsg.className = 'msg err';
+                    }
+                  }}, 'Remove')
+                : null,
+            ]),
+          ]),
+          logoFile, logoMsg,
+        ]),
+      ]);
+
+      // ── API reference (always at the bottom of Settings).
+      // Sourced from /api/docs so the hand-curated list stays the
+      // single source of truth and the UI doesn't need its own copy
+      // baked into the JS bundle.
+      const groups = docs.groups || [];
+      const apiCard = el('div', {class:'card'}, [
+        el('header', {}, [
+          el('h2', {}, 'API reference'),
+          el('span', {class:'sub'},
+            groups.reduce((n, g) => n + (g.endpoints || []).length, 0) + ' endpoints'),
+        ]),
+        el('div', {class:'api-ref'},
+          groups.length
+            ? groups.map(g => el('div', {class:'group'}, [
+                el('h3', {}, g.name),
+                ...(g.endpoints || []).map(ep => el('div', {class:'ep'}, [
+                  el('span', {class:'method ' + (ep.method || 'get').toLowerCase()},
+                    ep.method || 'GET'),
+                  el('span', {class:'path'}, ep.path || '?'),
+                  el('span', {class:'desc'}, ep.summary || ''),
+                ])),
+              ]))
+            : el('div', {class:'empty'},
+                'No API documentation returned by /api/docs.')),
+      ]);
+
+      return el('div', {class:'grid'}, [accessCard, logoCard, apiCard]);
+    },
+
     about: async () => {
       const status = await getJSON('/api/status');
       return el('div', {class:'card'}, [
         el('div', {class:'about-hero'}, [
-          el('h2', {}, 'PXEForge'),
+          el('h2', {}, 'OpenPXE'),
           el('p', {class:'lead'},
             'Air-gapped network PXE boot, container-native, that anyone can run. ' +
             'No CDN calls, no telemetry, no surprise external dependencies — ship ' +
@@ -737,7 +1128,10 @@
           el('div', {class:'who'}, [
             el('span', {}, 'Developer: '), el('strong', {}, 'Miles Ward'), el('br'),
             el('span', {}, 'Version: '), el('strong', {}, status.version || '?'), el('br'),
-            el('span', {}, 'Base URL: '), el('strong', {}, status.public_base_url),
+            el('span', {}, 'Base URL: '), el('strong', {}, status.public_base_url), el('br'),
+            el('span', {}, 'Docs: '),
+            el('a', {href:'https://openpxe.com/', target:'_blank', rel:'noopener noreferrer'},
+              'https://openpxe.com/'),
           ]),
           el('p', {class:'msg', style:'margin-top:18px'},
             'iPXE is an internal implementation detail. Everything the firmware ' +
@@ -758,10 +1152,11 @@
   const viewTitles = {
     dashboard: 'Dashboard',
     network: 'Network',
-    gate: 'Forge Gate',
+    queue: 'Queue',
     storage: 'Storage',
     hosts: 'Hosts',
     terminal: 'Terminal',
+    settings: 'Settings',
     about: 'About',
   };
 
@@ -769,7 +1164,7 @@
   // script in index.html before paint; we just flip it here and persist.
   function applyTheme(theme) {
     document.documentElement.setAttribute('data-theme', theme);
-    try { localStorage.setItem('pxeforge-theme', theme); } catch {}
+    try { localStorage.setItem('openpxe-theme', theme); } catch {}
   }
   function currentTheme() {
     return document.documentElement.getAttribute('data-theme') === 'light' ? 'light' : 'dark';
@@ -801,12 +1196,12 @@
       try { currentBody._cleanup(); } catch (e) { /* ignore */ }
     }
     root.innerHTML = '';
-    // Animated anvil loader. Replaces the old text "Loading…" so the
-    // user gets a sense of "the forge is heating up" instead of a flat
-    // spinner. The SVG itself drives all animation via SMIL, no JS.
+    // Animated rainbow-mark loader replacing the old plain-text
+    // \"Loading…\". The SVG drives all animation via SMIL — no JS, no
+    // CSS keyframes.
     root.appendChild(el('div', {class:'loader'}, [
-      el('div', {class:'anvil'}),
-      el('div', {}, 'Heating the forge…'),
+      el('div', {class:'mark'}),
+      el('div', {}, 'Loading…'),
     ]));
     try {
       const body = await views[view]();
@@ -819,6 +1214,24 @@
     }
   }
 
+  // Set the sidebar footer "Service status:" line. The chip itself moved
+  // off the topbar in v0.4.x: operators wanted readiness, advertised
+  // URL, and the boot IP grouped together as the bottom-left summary.
+  function setReady(state) {
+    const dot = $('[data-bind=ready_dot]');
+    const lbl = $('[data-bind=ready_label]');
+    if (!dot || !lbl) return;
+    const map = {
+      ready:       { cls: 'ok',  text: 'Ready' },
+      notready:    { cls: 'err', text: 'Not ready' },
+      unreachable: { cls: 'err', text: 'Unreachable' },
+    };
+    const m = map[state] || { cls: 'warn', text: 'Checking…' };
+    dot.className = 'dot ' + m.cls;
+    lbl.className = 'status-value ' + m.cls;
+    lbl.textContent = m.text;
+  }
+
   async function refreshChips() {
     try {
       const s = await getJSON('/api/status');
@@ -826,16 +1239,11 @@
       $$('[data-bind=version]').forEach(n => n.textContent = s.version);
       $$('[data-bind=iso_count],[data-bind=iso_count2]').forEach(n => n.textContent = String(s.iso_count));
       $$('[data-bind=client_count],[data-bind=client_count2]').forEach(n => n.textContent = String(s.client_count));
-      $$('[data-bind=gate_count],[data-bind=gate_count2]').forEach(n => n.textContent = String(s.gate_count));
+      $$('[data-bind=queue_count],[data-bind=queue_count2]').forEach(n => n.textContent = String(s.queue_count));
       $$('[data-bind=host_count]').forEach(n => n.textContent = String(s.host_bindings || 0));
-      const chip = $('[data-bind=ready_chip]');
-      if (chip) {
-        if (r.ok) { chip.textContent = '● ready'; chip.className = 'chip ready'; }
-        else      { chip.textContent = '● not ready'; chip.className = 'chip notready'; }
-      }
+      setReady(r.ok ? 'ready' : 'notready');
     } catch {
-      const chip = $('[data-bind=ready_chip]');
-      if (chip) { chip.textContent = '● unreachable'; chip.className = 'chip notready'; }
+      setReady('unreachable');
     }
   }
 

crates/webui/src/index.html

@@ -4,7 +4,7 @@
   <meta charset="utf-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1" />
   <meta name="color-scheme" content="dark light" />
-  <title>PXEForge</title>
+  <title>OpenPXE</title>
   <link rel="stylesheet" href="/assets/app.css" />
   <link rel="icon" type="image/svg+xml" href="/assets/logo.svg" />
   <!-- Theme is read from localStorage *before* paint to avoid the
@@ -13,7 +13,7 @@
   <script>
     (function() {
       try {
-        var stored = localStorage.getItem('pxeforge-theme');
+        var stored = localStorage.getItem('openpxe-theme');
         var theme = stored || (matchMedia('(prefers-color-scheme: light)').matches ? 'light' : 'dark');
         document.documentElement.setAttribute('data-theme', theme);
       } catch (e) {
@@ -26,18 +26,15 @@
 <div class="shell">
   <aside class="sidebar">
     <div class="brand">
-      <img src="/assets/logo.svg" alt="" />
-      <div>
-        <strong>PXEForge</strong>
-        <div class="sub">v<span data-bind="version">0.2.0</span></div>
-      </div>
+      <img src="/assets/logo.svg" alt="OpenPXE" />
+      <strong>OpenPXE</strong>
     </div>
     <nav>
       <a data-view="dashboard" class="active">Dashboard</a>
       <a data-view="network">Network</a>
-      <a data-view="gate">
-        Forge Gate
-        <span class="count" data-bind="gate_count">0</span>
+      <a data-view="queue">
+        Queue
+        <span class="count" data-bind="queue_count">0</span>
       </a>
       <a data-view="storage">
         Storage
@@ -48,21 +45,30 @@
         <span class="count" data-bind="host_count">0</span>
       </a>
       <a data-view="terminal">Terminal</a>
+      <a data-view="settings">Settings</a>
       <a data-view="about">About</a>
     </nav>
     <div class="footer">
-      Advertised to clients<br/>
+      <div class="status-row">
+        <span class="dot" data-bind="ready_dot" title="Server readiness"></span>
+        <span class="status-label">Service status:</span>
+        <span class="status-value" data-bind="ready_label">checking…</span>
+      </div>
+      <div class="footer-sub">Advertised to clients</div>
       <code>{{BASE_URL}}</code>
+      <!-- The brand badge at the top can be overridden by operator-uploaded
+           logos; keep "OpenPXE v…" pinned in the footer so the backend
+           identity is always visible regardless of branding. -->
+      <div class="footer-version">OpenPXE&nbsp;v<span data-bind="version">0.4.4</span></div>
     </div>
   </aside>
 
   <header class="topbar">
     <h1 data-bind="view_title">Dashboard</h1>
     <div class="spacer"></div>
-    <span class="chip" data-bind="ready_chip" title="Server readiness">checking…</span>
     <span class="chip"><strong data-bind="iso_count2">0</strong>&nbsp;images</span>
     <span class="chip"><strong data-bind="client_count2">0</strong>&nbsp;clients</span>
-    <span class="chip"><strong data-bind="gate_count2">0</strong>&nbsp;at gate</span>
+    <span class="chip"><strong data-bind="queue_count2">0</strong>&nbsp;in queue</span>
     <button id="theme-toggle" class="theme-toggle" type="button"
             aria-label="Toggle light/dark theme" title="Toggle theme (T)">
       <!-- Two glyphs; CSS shows whichever matches the active theme. -->

crates/webui/src/lib.rs

@@ -1,7 +1,7 @@
 //! Offline-only web UI. Everything the browser needs (HTML, CSS, JS, SVG
 //! logo) is embedded in the compiled binary via `include_str!` /
 //! `include_bytes!`. No CDN, no external fonts, no remote images —
-//! PXEForge renders identically on an air-gapped network.
+//! OpenPXE renders identically on an air-gapped network.
 //!
 //! Layout follows the Netbox Labs pattern: dark left sidebar with primary
 //! nav, top bar with secondary tabs, card-dense content panels.
@@ -15,22 +15,30 @@ pub fn index_html(base_url: &str) -> String {
 }
 
 #[must_use]
-pub fn app_js() -> &'static str { APP_JS }
+pub fn app_js() -> &'static str {
+    APP_JS
+}
 
 #[must_use]
-pub fn app_css() -> &'static str { APP_CSS }
+pub fn app_css() -> &'static str {
+    APP_CSS
+}
 
 #[must_use]
-pub fn logo_svg() -> &'static str { LOGO_SVG }
+pub fn logo_svg() -> &'static str {
+    LOGO_SVG
+}
 
-/// Animated forging anvil — sparks rise + glow pulse. Used for the
-/// imaging-progress widget and any "I'm working" loading state. Pure
-/// SVG + SMIL, no JS, no GIF.
+/// Larger, faster-cycling rainbow disc — used for the page-load
+/// transition and the imaging-progress widget on Dashboard / Queue.
+/// Pure SVG + SMIL, no JS, no GIF.
 #[must_use]
-pub fn anvil_forge_svg() -> &'static str { ANVIL_FORGE_SVG }
+pub fn loader_svg() -> &'static str {
+    LOADER_SVG
+}
 
-const INDEX_HTML: &str       = include_str!("index.html");
-const APP_CSS: &str          = include_str!("app.css");
-const APP_JS: &str           = include_str!("app.js");
-const LOGO_SVG: &str         = include_str!("logo.svg");
-const ANVIL_FORGE_SVG: &str  = include_str!("anvil-forge.svg");
+const INDEX_HTML: &str = include_str!("index.html");
+const APP_CSS: &str = include_str!("app.css");
+const APP_JS: &str = include_str!("app.js");
+const LOGO_SVG: &str = include_str!("logo.svg");
+const LOADER_SVG: &str = include_str!("loader.svg");

crates/webui/src/loader.svg

@@ -0,0 +1,36 @@
+<svg viewBox="0 0 64 64" xmlns="http://www.w3.org/2000/svg">
+  <title>OpenPXE — loading</title>
+  <!-- Larger, bolder version of the brand mark for "I'm working" states:
+       page transitions, the imaging-progress widget on Dashboard / Queue.
+       The gradient slide is faster (3s) and we add a subtle scale pulse
+       so the disc looks alive even when paired with a static progress bar.
+       White inner glow keeps the colours legible against the panel bg. -->
+  <defs>
+    <linearGradient id="opxRainbowLg" x1="0" y1="0" x2="1" y2="0">
+      <stop offset="0%"     stop-color="#330f1f"/>
+      <stop offset="12.56%" stop-color="#c83228"/>
+      <stop offset="25.06%" stop-color="#fb8841"/>
+      <stop offset="37.56%" stop-color="#d3dd92"/>
+      <stop offset="50.06%" stop-color="#59824f"/>
+      <stop offset="62.06%" stop-color="#002414"/>
+      <stop offset="74.06%" stop-color="#00143d"/>
+      <stop offset="86.06%" stop-color="#2874d7"/>
+      <stop offset="100%"   stop-color="#99c2ff"/>
+      <animate attributeName="x1" values="0;-1;0" dur="3s" repeatCount="indefinite"/>
+      <animate attributeName="x2" values="1;0;1"  dur="3s" repeatCount="indefinite"/>
+    </linearGradient>
+    <radialGradient id="opxGlow" cx="50%" cy="50%" r="50%">
+      <stop offset="0%"   stop-color="rgba(255,255,255,0.6)"/>
+      <stop offset="60%"  stop-color="rgba(255,255,255,0.05)"/>
+      <stop offset="100%" stop-color="rgba(255,255,255,0)"/>
+    </radialGradient>
+  </defs>
+  <g>
+    <circle cx="32" cy="32" r="26" fill="url(#opxRainbowLg)"
+            stroke="rgba(0,0,0,0.2)" stroke-width="1.2">
+      <animate attributeName="r" values="25;27;25" dur="2.4s" repeatCount="indefinite"/>
+    </circle>
+    <!-- Inner highlight to give the disc a hint of dimensionality. -->
+    <circle cx="28" cy="26" r="14" fill="url(#opxGlow)"/>
+  </g>
+</svg>

crates/webui/src/logo.svg

@@ -1,32 +1,25 @@
-<svg viewBox="0 0 200 130" xmlns="http://www.w3.org/2000/svg" fill="none">
-  <title>PXEForge</title>
+<svg viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
+  <title>OpenPXE</title>
+  <!-- Brand mark to match openpxe.com: a circular medallion filled with
+       the "rainbow-horizon" gradient, sliding 200% across to give a slow
+       hue rotation. Subtle stroke + drop shadow for legibility on either
+       theme. SMIL keeps it self-driving with no JS or CSS dependency. -->
   <defs>
-    <linearGradient id="anvilBody" x1="0" y1="0" x2="0" y2="1">
-      <stop offset="0%" stop-color="#aab3c2"/>
-      <stop offset="55%" stop-color="#7d8696"/>
-      <stop offset="100%" stop-color="#525a6b"/>
-    </linearGradient>
-    <linearGradient id="anvilFace" x1="0" y1="0" x2="0" y2="1">
-      <stop offset="0%" stop-color="#cdd5e1"/>
-      <stop offset="100%" stop-color="#9aa3b3"/>
-    </linearGradient>
-    <linearGradient id="anvilBase" x1="0" y1="0" x2="0" y2="1">
-      <stop offset="0%" stop-color="#3b4252"/>
-      <stop offset="100%" stop-color="#252a36"/>
+    <linearGradient id="opxRainbow" x1="0" y1="0" x2="1" y2="0">
+      <stop offset="0%"     stop-color="#330f1f"/>
+      <stop offset="12.56%" stop-color="#c83228"/>
+      <stop offset="25.06%" stop-color="#fb8841"/>
+      <stop offset="37.56%" stop-color="#d3dd92"/>
+      <stop offset="50.06%" stop-color="#59824f"/>
+      <stop offset="62.06%" stop-color="#002414"/>
+      <stop offset="74.06%" stop-color="#00143d"/>
+      <stop offset="86.06%" stop-color="#2874d7"/>
+      <stop offset="100%"   stop-color="#99c2ff"/>
+      <animate attributeName="x1" values="0;-1;0" dur="12s" repeatCount="indefinite"/>
+      <animate attributeName="x2" values="1;0;1"  dur="12s" repeatCount="indefinite"/>
     </linearGradient>
   </defs>
-  <!-- Horn (left point) + face (top) -->
-  <path d="M14 36 L72 30 L162 30 L162 46 L72 46 Z"
-        fill="url(#anvilFace)" stroke="#1d2330" stroke-width="2.4" stroke-linejoin="round"/>
-  <!-- Body / waist -->
-  <path d="M70 46 L160 46 L142 70 L88 70 Z"
-        fill="url(#anvilBody)" stroke="#1d2330" stroke-width="2.4" stroke-linejoin="round"/>
-  <!-- Base plinth -->
-  <path d="M62 96 L168 96 L160 110 L70 110 Z"
-        fill="url(#anvilBase)" stroke="#0d1018" stroke-width="2.4" stroke-linejoin="round"/>
-  <!-- Pillar between body and base -->
-  <rect x="92" y="70" width="46" height="26" fill="url(#anvilBody)"
-        stroke="#1d2330" stroke-width="2.4"/>
-  <!-- Highlight along top face -->
-  <line x1="74" y1="34" x2="158" y2="34" stroke="#e6ecf5" stroke-width="1.2" opacity="0.7"/>
+  <!-- Outer hairline ring softens the edge in light mode; subtle in dark. -->
+  <circle cx="12" cy="12" r="10.5" fill="url(#opxRainbow)"
+          stroke="rgba(0,0,0,0.18)" stroke-width="0.6"/>
 </svg>

deploy/docker/Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1.7
 #
-# PXEForge — multi-stage build.
+# OpenPXE — multi-stage build.
 #
 # Design:
 #   - stage `fetch`: runs scripts/fetch-ipxe.sh to pull official iPXE binaries
@@ -8,13 +8,13 @@
 #   - stage `build`: compiles the workspace with cargo in release mode.
 #   - stage `runtime`: Debian slim image with setcap for NET_BIND_SERVICE,
 #     running as a non-root UID. No shell in PATH for the service user;
-#     attacker surface is just the pxeforge binary + libc.
+#     attacker surface is just the openpxe binary + libc.
 #
 # Why not distroless? We want setcap support and easy debug (`oc rsh`).
 # Debian slim at ~75 MB + binary ~25 MB is fine for a PXE server that
 # spends most of its life idle.
 
-ARG RUST_VERSION=1.82
+ARG RUST_VERSION=1.95
 
 ########## fetch iPXE binaries ##########
 FROM debian:12-slim AS fetch
@@ -24,7 +24,7 @@ WORKDIR /src
 COPY scripts/fetch-ipxe.sh scripts/fetch-ipxe.sh
 RUN mkdir -p assets/ipxe && bash scripts/fetch-ipxe.sh
 
-########## build pxeforge ##########
+########## build openpxe ##########
 FROM rust:${RUST_VERSION}-bookworm AS build
 WORKDIR /src
 
@@ -33,7 +33,12 @@ WORKDIR /src
 # to silently serve stale stub binaries when cargo's fingerprint didn't
 # notice the source swap. A single build is ~1.5 min longer on cold cache
 # but guarantees the binary reflects the sources we copied.
-COPY Cargo.toml rust-toolchain.toml ./
+# Do not copy rust-toolchain.toml into the image. The local workspace pins
+# developer tooling, but inside Docker we intentionally use the Rust version
+# selected by the base image. Copying rust-toolchain.toml with
+# `channel = "stable"` makes rustup download a second full toolchain during
+# `cargo build`, which is slow and can exhaust small Colima/CI disks.
+COPY Cargo.toml Cargo.lock ./
 COPY crates/ crates/
 COPY --from=fetch /src/assets/ipxe /src/assets/ipxe
 
@@ -43,9 +48,9 @@ COPY --from=fetch /src/assets/ipxe /src/assets/ipxe
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
     --mount=type=cache,target=/src/target,sharing=locked \
     find crates -name '*.rs' -exec touch {} + && \
-    cargo build --release --bin pxeforge && \
-    cp target/release/pxeforge /pxeforge && \
-    ls -l /pxeforge
+    cargo build --release --bin openpxe && \
+    cp target/release/openpxe /openpxe && \
+    ls -l /openpxe
 
 ########## runtime ##########
 FROM debian:12-slim AS runtime
@@ -54,13 +59,13 @@ RUN apt-get update \
         ca-certificates libcap2-bin tini gosu iproute2 \
         wimtools samba nfs-common \
  && rm -rf /var/lib/apt/lists/* \
- && useradd --system --uid 10001 --home-dir /var/lib/pxeforge --shell /usr/sbin/nologin pxeforge \
- && mkdir -p /var/lib/pxeforge/isos /var/lib/pxeforge/work /var/lib/pxeforge/smb \
- && chown -R pxeforge:pxeforge /var/lib/pxeforge
+ && useradd --system --uid 10001 --home-dir /var/lib/openpxe --shell /usr/sbin/nologin openpxe \
+ && mkdir -p /var/lib/openpxe/isos /var/lib/openpxe/work /var/lib/openpxe/smb \
+ && chown -R openpxe:openpxe /var/lib/openpxe
 # Runtime deps explained:
 #   wimtools  - provides `wimlib-imagex`, used to inject startnet.cmd into boot.wim.
 #   samba     - `smbd` serves extracted Windows install media on :445 for WinPE
-#               to `net use`. Guest read-only, scoped to /var/lib/pxeforge/smb.
+#               to `net use`. Guest read-only, scoped to /var/lib/openpxe/smb.
 #   nfs-common - provides `mount.nfs` / `mount.nfs4` for the Storage tab's
 #               NFS share manager. Mount also requires the container to run
 #               with CAP_SYS_ADMIN — without it, mount(2) returns EPERM and
@@ -74,23 +79,23 @@ RUN apt-get update \
 #               bind-mount ownership (common OpenShift/Docker UX issue).
 # Windows-specific tools only activate when the WebUI toggle is on.
 
-COPY --from=build /pxeforge /usr/local/bin/pxeforge
+COPY --from=build /openpxe /usr/local/bin/openpxe
 COPY deploy/docker/entrypoint.sh /usr/local/bin/entrypoint.sh
 RUN chmod +x /usr/local/bin/entrypoint.sh
 
 # Grant the binary the ability to bind <1024 ports as a non-root user.
-# This is the only capability PXEForge needs for proxy-mode DHCP + TFTP + HTTP.
-RUN setcap cap_net_bind_service=+ep /usr/local/bin/pxeforge
+# This is the only capability OpenPXE needs for proxy-mode DHCP + TFTP + HTTP.
+RUN setcap cap_net_bind_service=+ep /usr/local/bin/openpxe
 
-# IMPORTANT: we do NOT `USER pxeforge` here. The entrypoint runs as root,
-# chowns the mounted data dirs, then execs the binary via gosu as pxeforge.
+# IMPORTANT: we do NOT `USER openpxe` here. The entrypoint runs as root,
+# chowns the mounted data dirs, then execs the binary via gosu as openpxe.
 # OpenShift ignores USER directives anyway (it injects its own uid), and
 # there entrypoint.sh's non-root branch just execs directly.
-WORKDIR /var/lib/pxeforge
+WORKDIR /var/lib/openpxe
 
-ENV PXEFORGE_ISO_DIR=/var/lib/pxeforge/isos \
-    PXEFORGE_WORK_DIR=/var/lib/pxeforge/work \
-    PXEFORGE_LOG=info,pxeforge=info
+ENV OPENPXE_ISO_DIR=/var/lib/openpxe/isos \
+    OPENPXE_WORK_DIR=/var/lib/openpxe/work \
+    OPENPXE_LOG=info,openpxe=info
 
 EXPOSE 67/udp 69/udp 4011/udp 80/tcp 445/tcp
 

deploy/docker/entrypoint.sh

@@ -2,9 +2,9 @@
 # Container entrypoint that handles the common bind-mount-as-root case.
 #
 # When volumes are bind-mounted into the container (e.g. `-v ./data/isos:...`),
-# they come up owned by the host uid:gid — often root:root. The pxeforge
+# they come up owned by the host uid:gid — often root:root. The openpxe
 # binary runs as uid 10001 and can't write there. This script, when started
-# as root, chowns the two state dirs to the pxeforge user, then drops
+# as root, chowns the two state dirs to the openpxe user, then drops
 # privileges via gosu before execing the binary.
 #
 # If the container is already running as non-root (OpenShift does this via
@@ -13,20 +13,20 @@
 # or the operator is on their own for permissions.
 set -e
 
-PXEFORGE_UID=${PXEFORGE_UID:-10001}
-PXEFORGE_GID=${PXEFORGE_GID:-10001}
-DATA_DIRS="/var/lib/pxeforge/isos /var/lib/pxeforge/work /var/lib/pxeforge/smb"
+OPENPXE_UID=${OPENPXE_UID:-10001}
+OPENPXE_GID=${OPENPXE_GID:-10001}
+DATA_DIRS="/var/lib/openpxe/isos /var/lib/openpxe/work /var/lib/openpxe/smb"
 
 if [ "$(id -u)" = "0" ]; then
     for d in $DATA_DIRS; do
         if [ -d "$d" ]; then
-            chown -R "${PXEFORGE_UID}:${PXEFORGE_GID}" "$d" 2>/dev/null || true
+            chown -R "${OPENPXE_UID}:${OPENPXE_GID}" "$d" 2>/dev/null || true
         fi
     done
-    # Re-exec ourselves under the pxeforge user so the binary inherits a
+    # Re-exec ourselves under the openpxe user so the binary inherits a
     # clean process environment and a predictable umask.
-    exec gosu "${PXEFORGE_UID}:${PXEFORGE_GID}" /usr/local/bin/pxeforge "$@"
+    exec gosu "${OPENPXE_UID}:${OPENPXE_GID}" /usr/local/bin/openpxe "$@"
 fi
 
 # Non-root: straight exec, no chown attempt.
-exec /usr/local/bin/pxeforge "$@"
+exec /usr/local/bin/openpxe "$@"

deploy/openshift/00-namespace.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: pxeforge
+  name: openpxe
   labels:
     # Allow privileged pods (host-network) in this namespace only. The pod
     # itself still runs non-root with only NET_BIND_SERVICE — privileged

deploy/openshift/10-scc.yaml

@@ -1,5 +1,5 @@
 ---
-# Custom SCC for PXEForge.
+# Custom SCC for OpenPXE.
 #
 # The default `restricted-v2` SCC blocks host network and all capabilities,
 # which PXE cannot tolerate: DHCPDISCOVER is an L2 broadcast that CNI overlays
@@ -19,10 +19,10 @@
 apiVersion: security.openshift.io/v1
 kind: SecurityContextConstraints
 metadata:
-  name: pxeforge-scc
+  name: openpxe-scc
   annotations:
     kubernetes.io/description: >-
-      Minimal SCC for PXEForge: host network + NET_BIND_SERVICE only, no raw
+      Minimal SCC for OpenPXE: host network + NET_BIND_SERVICE only, no raw
       sockets, no privileged mode.
 allowPrivilegedContainer: false
 allowPrivilegeEscalation: false
@@ -54,27 +54,27 @@ volumes:
 users: []
 groups: []
 ---
-# Bind the SCC to the pxeforge service account.
+# Bind the SCC to the openpxe service account.
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: pxeforge-scc-use
+  name: openpxe-scc-use
 rules:
   - apiGroups: ["security.openshift.io"]
     resources: ["securitycontextconstraints"]
-    resourceNames: ["pxeforge-scc"]
+    resourceNames: ["openpxe-scc"]
     verbs: ["use"]
 ---
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: pxeforge-scc-use
-  namespace: pxeforge
+  name: openpxe-scc-use
+  namespace: openpxe
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: pxeforge-scc-use
+  name: openpxe-scc-use
 subjects:
   - kind: ServiceAccount
-    name: pxeforge
-    namespace: pxeforge
+    name: openpxe
+    namespace: openpxe

deploy/openshift/20-sa-pvc-config.yaml

@@ -2,29 +2,29 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: pxeforge
-  namespace: pxeforge
+  name: openpxe
+  namespace: openpxe
 ---
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: pxeforge-config
-  namespace: pxeforge
+  name: openpxe-config
+  namespace: openpxe
 data:
   # Toggle DHCP proxy on or off. "proxy" = answer PXE clients alongside an
   # existing DHCP server. "disabled" = require operator to point an external
   # DHCP at us via next-server/filename.
-  PXEFORGE_DHCP_MODE: "proxy"
+  OPENPXE_DHCP_MODE: "proxy"
   # Override if auto-detection picks the wrong NIC in multi-homed pods.
   # Leave unset to auto-detect from the node's primary IPv4.
-  # PXEFORGE_PUBLIC_IP: "10.0.0.5"
-  PXEFORGE_LOG: "info,pxeforge=info"
+  # OPENPXE_PUBLIC_IP: "10.0.0.5"
+  OPENPXE_LOG: "info,openpxe=info"
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: pxeforge-isos
-  namespace: pxeforge
+  name: openpxe-isos
+  namespace: openpxe
 spec:
   # ReadWriteOnce is fine — we deploy as a single replica since DHCP proxy
   # coordination across replicas is not useful (clients hit whichever node

deploy/openshift/30-deployment.yaml

@@ -2,10 +2,10 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: pxeforge
-  namespace: pxeforge
+  name: openpxe
+  namespace: openpxe
   labels:
-    app.kubernetes.io/name: pxeforge
+    app.kubernetes.io/name: openpxe
 spec:
   # Single replica by design (see PVC comment). If HA is needed later, split
   # the HTTP/web plane (scalable, stateless) from the DHCP-proxy/TFTP plane
@@ -15,13 +15,13 @@ spec:
     type: Recreate
   selector:
     matchLabels:
-      app.kubernetes.io/name: pxeforge
+      app.kubernetes.io/name: openpxe
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: pxeforge
+        app.kubernetes.io/name: openpxe
     spec:
-      serviceAccountName: pxeforge
+      serviceAccountName: openpxe
       # L2 broadcast (DHCPDISCOVER) does not cross most CNI overlays into
       # pod netns. Host network is the working path.
       hostNetwork: true
@@ -33,8 +33,8 @@ spec:
         runAsUser: 10001
         fsGroup: 10001
       containers:
-        - name: pxeforge
-          image: ghcr.io/casperadmin/pxeforge:0.1.0
+        - name: openpxe
+          image: gitea.milesward.dev/mward4/openpxe:0.4.1
           imagePullPolicy: IfNotPresent
           ports:
             - name: dhcp
@@ -59,7 +59,7 @@ spec:
               protocol: TCP
           envFrom:
             - configMapRef:
-                name: pxeforge-config
+                name: openpxe-config
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
@@ -70,9 +70,9 @@ spec:
               add: ["NET_BIND_SERVICE"]
           volumeMounts:
             - name: isos
-              mountPath: /var/lib/pxeforge/isos
+              mountPath: /var/lib/openpxe/isos
             - name: work
-              mountPath: /var/lib/pxeforge/work
+              mountPath: /var/lib/openpxe/work
             - name: tmp
               mountPath: /tmp
           readinessProbe:
@@ -97,7 +97,7 @@ spec:
       volumes:
         - name: isos
           persistentVolumeClaim:
-            claimName: pxeforge-isos
+            claimName: openpxe-isos
         - name: work
           emptyDir: {}
         - name: tmp

deploy/openshift/40-service-route.yaml

@@ -5,14 +5,14 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: pxeforge
-  namespace: pxeforge
+  name: openpxe
+  namespace: openpxe
   labels:
-    app.kubernetes.io/name: pxeforge
+    app.kubernetes.io/name: openpxe
 spec:
   type: ClusterIP
   selector:
-    app.kubernetes.io/name: pxeforge
+    app.kubernetes.io/name: openpxe
   ports:
     - name: http
       port: 80
@@ -29,12 +29,12 @@ spec:
 apiVersion: route.openshift.io/v1
 kind: Route
 metadata:
-  name: pxeforge
-  namespace: pxeforge
+  name: openpxe
+  namespace: openpxe
 spec:
   to:
     kind: Service
-    name: pxeforge
+    name: openpxe
     weight: 100
   port:
     targetPort: http

deploy/unraid/README.md

@@ -1,12 +1,12 @@
-# PXEForge on Unraid
+# OpenPXE on Unraid
 
 Three paths from "I have an Unraid box with Gitea on it" to "PXE clients
-boot from PXEForge". Pick the one that matches what you have.
+boot from OpenPXE". Pick the one that matches what you have.
 
 ## Path A — build on Unraid, push to Gitea registry, pull by tag
 
 Recommended once you've done it once. Image is published to
-`gitea.milesward.dev/mward4/pxeforge:0.1.0` (or your equivalent) and
+`gitea.milesward.dev/mward4/openpxe:0.4.1` (or your equivalent) and
 every Unraid template / docker-compose just references the tag.
 
 Pre-flight:
@@ -24,12 +24,12 @@ Run on the Unraid host (Settings → Terminal, or `ssh root@unraid`):
 GITEA_TOKEN=<your-token>
 curl -fsSL \
   -H "Authorization: token $GITEA_TOKEN" \
-  http://localhost:3000/mward4/PXEForge/raw/branch/main/scripts/build-and-publish-unraid.sh \
-  -o /tmp/pxeforge-publish.sh
+  http://localhost:3000/mward4/OpenPXE/raw/branch/main/scripts/build-and-publish-unraid.sh \
+  -o /tmp/openpxe-publish.sh
 
 # Run it. ~6 min on Unraid hardware (native amd64, no QEMU).
-chmod +x /tmp/pxeforge-publish.sh
-GITEA_TOKEN=$GITEA_TOKEN /tmp/pxeforge-publish.sh
+chmod +x /tmp/openpxe-publish.sh
+GITEA_TOKEN=$GITEA_TOKEN /tmp/openpxe-publish.sh
 ```
 
 What it does:
@@ -40,24 +40,24 @@ What it does:
 3. `docker build` against `deploy/docker/Dockerfile`.
 4. `docker login gitea.milesward.dev:3000` using a temp `DOCKER_CONFIG`
    so the credential never lands in your real `~/.docker/config.json`.
-5. `docker push` both `:0.1.0` and `:latest`.
+5. `docker push` both `:0.4.1` and `:latest`.
 6. Logout, scrub the temp config, delete the workspace.
 
 After it finishes, in Unraid → Docker → Add Container, set:
 
 | Field      | Value                                           |
 |------------|-------------------------------------------------|
-| Repository | `gitea.milesward.dev/mward4/pxeforge:0.1.0`     |
+| Repository | `gitea.milesward.dev/mward4/openpxe:0.4.1`     |
 | Network    | `host`                                          |
 | Extra args | `--cap-add=NET_BIND_SERVICE`                    |
 
 Volume mounts (paths inside container in **bold**):
 
-- **`/var/lib/pxeforge/isos`** ↔ `/mnt/user/appdata/pxeforge/isos`
-- **`/var/lib/pxeforge/work`** ↔ `/mnt/user/appdata/pxeforge/work`
-- **`/var/lib/pxeforge/smb`**  ↔ `/mnt/user/appdata/pxeforge/smb`
+- **`/var/lib/openpxe/isos`** ↔ `/mnt/user/appdata/openpxe/isos`
+- **`/var/lib/openpxe/work`** ↔ `/mnt/user/appdata/openpxe/work`
+- **`/var/lib/openpxe/smb`**  ↔ `/mnt/user/appdata/openpxe/smb`
 
-Or skip the manual UI by dropping `pxeforge.xml` (in this directory)
+Or skip the manual UI by dropping `openpxe.xml` (in this directory)
 into `/boot/config/plugins/dockerMan/templates-user/` and Unraid will
 list it as a one-click template.
 
@@ -70,15 +70,15 @@ Skip the registry entirely. Useful for "hack on it locally" iterations.
 ```bash
 ssh root@unraid
 cd /mnt/user/appdata
-git clone http://localhost:3000/mward4/PXEForge.git pxeforge-src
-cd pxeforge-src
+git clone http://localhost:3000/mward4/OpenPXE.git openpxe-src
+cd openpxe-src
 bash scripts/fetch-ipxe.sh
-docker compose -f docker-compose.yml up -d --build pxeforge
+docker compose -f docker-compose.yml up -d --build openpxe
 ```
 
 The bundled `docker-compose.yml` already wires host networking, the
 right cap_add, and bind-mounts to `./data/`. Edit those bind-mount
-paths if you want them under `/mnt/user/appdata/pxeforge/`.
+paths if you want them under `/mnt/user/appdata/openpxe/`.
 
 ## Path C — `docker load` from a tarball I built off-box
 
@@ -88,14 +88,14 @@ then:
 
 ```bash
 # On the build host
-docker save pxeforge:0.1.0 | gzip > pxeforge-0.1.0.tar.gz
+docker save openpxe:0.4.1 | gzip > openpxe-0.4.1.tar.gz
 
 # Transfer (rsync / scp / SMB / ZFS-replicate / sneakernet)
-scp pxeforge-0.1.0.tar.gz root@unraid:/tmp/
+scp openpxe-0.4.1.tar.gz root@unraid:/tmp/
 
 # On Unraid
-gunzip -c /tmp/pxeforge-0.1.0.tar.gz | docker load
-docker tag pxeforge:0.1.0 gitea.milesward.dev/mward4/pxeforge:0.1.0
+gunzip -c /tmp/openpxe-0.4.1.tar.gz | docker load
+docker tag openpxe:0.4.1 gitea.milesward.dev/mward4/openpxe:0.4.1
 ```
 
 If you want it pullable by tag from other Unraid templates, push to
@@ -119,16 +119,16 @@ show up in the Dashboard's "Recent connections" table within seconds.
 ## Common gotchas
 
 - **DHCP collision.** Don't run two PXE _proxies_ on the same broadcast
-  domain. PXEForge runs in proxy mode and never offers IP leases, so
+  domain. OpenPXE runs in proxy mode and never offers IP leases, so
   it coexists with whatever DHCP server is already on the network —
   but two proxies racing each other will whichever-wins at random.
 - **Host networking only.** Bridge mode containers don't see broadcast
   DHCP. There's no working bridge-mode config for a PXE server.
-- **Permissions on `/mnt/user/appdata/pxeforge`.** The container runs
+- **Permissions on `/mnt/user/appdata/openpxe`.** The container runs
   as uid 10001 by default. The entrypoint chowns the bind mounts to
   10001 on first start, but only if the container itself has root —
   `--user=root` isn't needed; the multi-stage Dockerfile starts as
-  root, fixes perms, then drops to pxeforge via gosu.
+  root, fixes perms, then drops to openpxe via gosu.
 - **NFS mounts in the Storage tab.** Mounting NFS inside the container
   needs `CAP_SYS_ADMIN`. To enable, add `--cap-add=SYS_ADMIN` to the
   Unraid template's "Extra args" — but understand that's a meaningful

deploy/unraid/openpxe.xml

@@ -1,12 +1,12 @@
 <?xml version="1.0"?>
 <!--
-  Unraid Docker template for PXEForge.
+  Unraid Docker template for OpenPXE.
 
   Drop this file into /boot/config/plugins/dockerMan/templates-user/
   on your Unraid box (or import via the Docker tab → "Add Container" →
   "Template Repositories" if you publish it on a Gitea raw URL).
 
-  IMPORTANT: PXEForge needs host networking for DHCP/TFTP raw broadcasts.
+  IMPORTANT: OpenPXE needs host networking for DHCP/TFTP raw broadcasts.
   Bridge mode will NOT work — clients can't see broadcast DHCP from a
   bridged container. The template forces NetworkType=host below.
 
@@ -21,21 +21,21 @@
   Web UI: http://<unraid-ip>/  (port 80)
 -->
 <Container version="2">
-  <Name>PXEForge</Name>
-  <Repository>gitea.milesward.dev/mward4/pxeforge:latest</Repository>
-  <Registry>https://gitea.milesward.dev/mward4/-/packages/container/pxeforge</Registry>
+  <Name>OpenPXE</Name>
+  <Repository>gitea.milesward.dev/mward4/openpxe:latest</Repository>
+  <Registry>https://gitea.milesward.dev/mward4/-/packages/container/openpxe</Registry>
   <Network>host</Network>
   <MyIP/>
   <Shell>sh</Shell>
   <Privileged>false</Privileged>
-  <Support>https://gitea.milesward.dev/mward4/PXEForge/issues</Support>
-  <Project>https://gitea.milesward.dev/mward4/PXEForge</Project>
+  <Support>https://gitea.milesward.dev/mward4/OpenPXE/issues</Support>
+  <Project>https://gitea.milesward.dev/mward4/OpenPXE</Project>
   <Overview>
     Air-gapped network PXE boot server. Container-native Rust
     implementation — DHCP proxy + TFTP + iPXE chainload + HTTP ISO
     streaming, all in one process. Web UI for ISO upload, NFS share
-    mounting, and Gated Deployment ("horse-race" simultaneous launch
-    of one ISO across many waiting clients).
+    mounting, and Queued Deployment for coordinated launch of one ISO
+    across many waiting clients.
 
     NEVER touches the client OS trust store: no test-signed drivers,
     no testsigning toggle, no httpdisk.sys. Windows boot uses vanilla
@@ -44,7 +44,7 @@
   <Category>Network:Other Network:Management</Category>
   <WebUI>http://[IP]/</WebUI>
   <TemplateURL/>
-  <Icon>https://gitea.milesward.dev/mward4/PXEForge/raw/branch/main/crates/webui/src/logo.svg</Icon>
+  <Icon>https://gitea.milesward.dev/mward4/OpenPXE/raw/branch/main/crates/webui/src/logo.svg</Icon>
   <ExtraParams>--cap-add=NET_BIND_SERVICE</ExtraParams>
   <PostArgs/>
   <CPUset/>
@@ -53,23 +53,23 @@
   <DonateLink/>
   <Requires>
     Host networking. Unraid&#39;s built-in DHCP server (if any) must
-    not collide with a network that already has DHCP — PXEForge runs
+    not collide with a network that already has DHCP — OpenPXE runs
     in proxy mode and coexists, but only one DHCP _proxy_ should reply
     per broadcast domain.
   </Requires>
-  <Config Name="ISOs" Target="/var/lib/pxeforge/isos" Default="/mnt/user/appdata/pxeforge/isos"
+  <Config Name="ISOs" Target="/var/lib/openpxe/isos" Default="/mnt/user/appdata/openpxe/isos"
           Mode="rw" Description="Where uploaded and seeded .iso files live."
-          Type="Path" Display="always" Required="true" Mask="false">/mnt/user/appdata/pxeforge/isos</Config>
-  <Config Name="Work dir" Target="/var/lib/pxeforge/work" Default="/mnt/user/appdata/pxeforge/work"
+          Type="Path" Display="always" Required="true" Mask="false">/mnt/user/appdata/openpxe/isos</Config>
+  <Config Name="Work dir" Target="/var/lib/openpxe/work" Default="/mnt/user/appdata/openpxe/work"
           Mode="rw" Description="Settings, NFS state, and runtime scratch. Persisted across restarts."
-          Type="Path" Display="always" Required="true" Mask="false">/mnt/user/appdata/pxeforge/work</Config>
-  <Config Name="SMB share root" Target="/var/lib/pxeforge/smb" Default="/mnt/user/appdata/pxeforge/smb"
+          Type="Path" Display="always" Required="true" Mask="false">/mnt/user/appdata/openpxe/work</Config>
+  <Config Name="SMB share root" Target="/var/lib/openpxe/smb" Default="/mnt/user/appdata/openpxe/smb"
           Mode="rw" Description="Where extracted Windows install media lives. Only used when Windows toggle is on."
-          Type="Path" Display="advanced" Required="false" Mask="false">/mnt/user/appdata/pxeforge/smb</Config>
-  <Config Name="Public IP" Target="PXEFORGE_PUBLIC_IP" Default=""
+          Type="Path" Display="advanced" Required="false" Mask="false">/mnt/user/appdata/openpxe/smb</Config>
+  <Config Name="Public IP" Target="OPENPXE_PUBLIC_IP" Default=""
           Mode="" Description="IP advertised to PXE clients. Leave blank to auto-detect; set explicitly on multi-homed Unraid hosts."
           Type="Variable" Display="always" Required="false" Mask="false"></Config>
-  <Config Name="Log filter" Target="PXEFORGE_LOG" Default="info,pxeforge=debug"
+  <Config Name="Log filter" Target="OPENPXE_LOG" Default="info,openpxe=debug"
           Mode="" Description="tracing-subscriber EnvFilter expression."
-          Type="Variable" Display="advanced" Required="false" Mask="false">info,pxeforge=debug</Config>
+          Type="Variable" Display="advanced" Required="false" Mask="false">info,openpxe=debug</Config>
 </Container>

docker-compose.yml

@@ -5,13 +5,13 @@
 #   1. Local MVP test — host network, proxy-DHCP off (don't fight your
 #      existing DHCP server on the LAN), TFTP + HTTP exposed on the host:
 #
-#         docker compose up pxeforge-dev
+#         docker compose up openpxe-dev
 #
 #   2. Real PXE deployment — host network, proxy-DHCP on, runs on a box
 #      plugged into the PXE network:
 #
-#         # First set PXEFORGE_PUBLIC_IP to this host's LAN address in .env
-#         docker compose up pxeforge
+#         # First set OPENPXE_PUBLIC_IP to this host's LAN address in .env
+#         docker compose up openpxe
 #
 # On Linux hosts, `network_mode: host` gives the container direct access to
 # the physical NIC — required for DHCP proxy because CNI overlays and Docker
@@ -19,13 +19,13 @@
 #
 # On macOS / Windows hosts, `network_mode: host` is limited — the daemon
 # runs in a Linux VM (Colima/Docker Desktop) so the "host" network is the
-# VM, not your Mac. Proxy-DHCP is not feasible on macOS; use `pxeforge-dev`
+# VM, not your Mac. Proxy-DHCP is not feasible on macOS; use `openpxe-dev`
 # with published ports and set DHCP-MODE=disabled.
 
 services:
   # Real PXE deployment (Linux hosts).
-  pxeforge:
-    image: pxeforge:0.1.0
+  openpxe:
+    image: openpxe:0.1.0
     build:
       context: .
       dockerfile: deploy/docker/Dockerfile
@@ -34,33 +34,33 @@ services:
     environment:
       # REQUIRED on multi-homed hosts. Set to this machine's LAN IP so the
       # advertised iPXE URLs actually resolve from the PXE clients. Without
-      # this, PXEForge will refuse to start rather than advertise a
+      # this, OpenPXE will refuse to start rather than advertise a
       # loopback address that can't be reached.
-      PXEFORGE_PUBLIC_IP: ${PXEFORGE_PUBLIC_IP:?set this to the host LAN IP}
-      PXEFORGE_DHCP_MODE: proxy
-      PXEFORGE_LOG: info
+      OPENPXE_PUBLIC_IP: ${OPENPXE_PUBLIC_IP:?set this to the host LAN IP}
+      OPENPXE_DHCP_MODE: proxy
+      OPENPXE_LOG: info
     volumes:
-      - ./data/isos:/var/lib/pxeforge/isos
-      - ./data/work:/var/lib/pxeforge/work
+      - ./data/isos:/var/lib/openpxe/isos
+      - ./data/work:/var/lib/openpxe/work
 
   # Dev / MVP container: published ports, DHCP disabled, HTTP on 8080.
   # Use this on laptops where you want to curl the API or UI without
   # running an actual PXE chain.
-  pxeforge-dev:
-    image: pxeforge:0.1.0
+  openpxe-dev:
+    image: openpxe:0.1.0
     build:
       context: .
       dockerfile: deploy/docker/Dockerfile
     environment:
-      PXEFORGE_PUBLIC_IP: ${PXEFORGE_PUBLIC_IP:-127.0.0.1}
-      PXEFORGE_DHCP_MODE: disabled
-      PXEFORGE_HTTP_PORT: "8080"
-      PXEFORGE_TFTP_PORT: "6969"
-      PXEFORGE_DHCP_PORT: "6767"
-      PXEFORGE_LOG: info,pxeforge=debug
+      OPENPXE_PUBLIC_IP: ${OPENPXE_PUBLIC_IP:-127.0.0.1}
+      OPENPXE_DHCP_MODE: disabled
+      OPENPXE_HTTP_PORT: "8080"
+      OPENPXE_TFTP_PORT: "6969"
+      OPENPXE_DHCP_PORT: "6767"
+      OPENPXE_LOG: info,openpxe=debug
     ports:
       - "8080:8080/tcp"
       - "6969:6969/udp"
     volumes:
-      - ./data/isos:/var/lib/pxeforge/isos
-      - ./data/work:/var/lib/pxeforge/work
+      - ./data/isos:/var/lib/openpxe/isos
+      - ./data/work:/var/lib/openpxe/work

docs/NEXT_PHASE.md

@@ -0,0 +1,156 @@
+# Phase 6 — recommendations
+
+The v0.4.1 cut leaves OpenPXE in a state where the entire protocol stack
+and operator UI are exercised by the automated test suite, the container is
+multi-arch buildable, and the image ships at ~97 MB. What's left before
+this looks and feels like a 1.0 product is mostly **real-hardware
+validation** plus a small batch of features that can only sensibly be
+designed once we've watched real machines image.
+
+This doc is a punch list, ordered by what I'd do first if I had a week.
+
+## Tier 1 — must-do before we call anything "stable"
+
+### 1. Real-hardware validation matrix
+
+We have CI tests for every protocol leg, but no end-to-end PXE on real
+firmware. Build a small matrix:
+
+| client                              | firmware  | OS family  | pass criteria             |
+|-------------------------------------|-----------|------------|---------------------------|
+| any 10-y-old mini-PC                | Legacy BIOS | Ubuntu Server 24.04 | gets to GRUB / installer   |
+| Intel NUC / similar                 | UEFI x64  | Windows 11 | reaches "where do you want to install" |
+| Raspberry Pi 4                      | UEFI ARM64 | Raspberry Pi OS    | gets to login prompt       |
+| Dell / HP business laptop          | UEFI x64  | Fedora     | one of: kernel boot or wimboot |
+
+Add a `docs/HARDWARE_VALIDATION.md` checklist that records what worked,
+firmware versions, and any quirks. Anything weird gets a regression
+test in the relevant crate.
+
+### 2. Boot menu hotkey + UI accessibility audit
+
+The iPXE menu has number-key + letter hotkeys but no documentation on
+what they map to. Generate a printable cheat-sheet from
+`crates/http-api/src/ipxe_script.rs` so operators don't have to read
+the source. Run a screen-reader pass over the web UI — most of it
+should be fine since we're mostly tables + form labels, but the
+Terminal pane and the SSE log output need explicit `aria-live`
+regions.
+
+### 3. Boot.wim re-patch detection
+
+Bootimus v0.1.62's "fingerprint of patched inputs + Save & Re-patch"
+pattern is a small but high-value feature: when an operator changes
+the SMB host override or upgrades wimboot, the existing patched
+boot.wim is silently stale. We should:
+
+- Hash the inputs (smb_host, smb_share, startnet.cmd content,
+  wimboot binary digest) into the IsoMeta;
+- Surface a "needs re-patch" warning on the Storage tab when the
+  hash drifts;
+- Add a "Re-patch SMB" button that re-runs the WimPatcher.
+
+## Tier 2 — features that round out pre-beta
+
+### 4. Auto-install file library
+
+iVentoy and Bootimus both support attaching `autounattend.xml` /
+`preseed.cfg` / `kickstart.cfg` to an image. The mechanics are
+straightforward: store files under `<work_dir>/autoinstall/<distro>/`,
+expose CRUD via `/api/autoinstall-files`, and modify the WimPatcher
++ Linux kernel cmdline to fetch + apply the right file. Placeholders
+worth supporting (Bootimus pattern): `{{MAC}}`, `{{HOSTNAME}}`,
+`{{IP}}`, `{{SERVER_ADDR}}`, `{{IMAGE_FILENAME}}`, substituted
+serve-side per request.
+
+### 5. Wake-on-LAN trigger
+
+A natural pair with per-MAC host bindings: bind a MAC to an image,
+then click "Wake & Image" to send the magic packet and let OpenPXE
+do the rest. Implementation is small (`udp/9` broadcast, magic packet
+construction) but it makes the bound-host workflow feel instant.
+
+### 6. Distro profile manifest
+
+Today, distro detection lives as Rust match arms in `introspect.rs`
+and the kernel cmdline templates live in `store.rs`. Bootimus extracts
+this into a JSON manifest that ships embedded in the binary AND is
+overridable by the operator at runtime — so a new distro can be added
+without rebuilding the container. Worth porting; it'd let community
+contributions land as PRs to a single JSON file.
+
+### 7. Syslog receiver
+
+`smee` ships one. The use case: WinPE / Linux installers can be
+configured to syslog over the network to the PXE server; if we have
+an endpoint and a place in the UI to view per-client diagnostics,
+post-mortem on a failed install gets dramatically easier.
+
+### 8. UEFI HTTP Boot validation
+
+Option 60 = `HTTPClient` is wired up in `decide()` already, but
+we've never tested it on real firmware. Some Dell + Lenovo UEFIs
+prefer it over PXE-via-TFTP. A quick check on a real machine
+(disable TFTP boot in firmware, force HTTP boot) and a regression
+test would be nice.
+
+## Tier 3 — bigger lifts, only if there's demand
+
+### 9. Pure-Rust SMB server
+
+`smbd` from Samba is ~80 MB of the runtime image. There are pure-Rust
+SMB2 server crates (`smbd-server`, `smb-rs`) of varying maturity.
+Replacing the dep would slim the image by ~40% and remove the
+`CAP_SYS_ADMIN` requirement for SMB. Worth a spike, not necessarily
+landable in Phase 6.
+
+### 10. IPv6 / DHCPv6
+
+PXE-over-IPv6 is real (RFC 5970). Some sites are v6-only. Worth
+implementing once we know we have one. Until then, IPv4-only is the
+right default — flipping the bit on v6 without v6 testing is asking
+for silent breakage.
+
+### 11. Multi-replica deployment
+
+The current design assumes one OpenPXE per broadcast domain. Two
+proxies on the same L2 will race; the deployment queue is in-memory, etc.
+For HA we'd need to:
+- Externalize the deployment queue (Redis, etcd) or lean into "the menu is
+  cheap to refetch if a replica dies";
+- Ensure DHCP proxy replies are deterministic so a client always
+  gets the same answer regardless of which replica replied;
+- Document the L2 collision domain story.
+
+This is a large lift and should only happen if someone's actually
+asking for it.
+
+### 12. Pi 4 / SBC quirks
+
+Raspberry Pi netboot uses a specific DHCP option-43 vendor field +
+TFTP path layout that OpenPXE doesn't currently special-case. There's
+a spec; the work is small once we have a Pi to test on.
+
+## What I'd skip
+
+- **A custom DHCP server (not proxy).** The proxy mode is the right
+  abstraction; full DHCP would need raw sockets + a lot of corner-case
+  handling for problems no operator wants us to solve.
+- **A pluggable backend abstraction à la Tinkerbell.** Tinkerbell does
+  it because they integrate with k8s CRDs. OpenPXE's "the file system
+  IS the database" model is simpler and good enough for the target
+  audience. Don't add a Backend trait until something asks for it.
+- **Multiple language UIs.** Bootimus added these in v0.1.62 and the
+  translations are LLM-generated. Skip until we have real users
+  asking for non-English.
+
+## Quick wins (could land in a single afternoon)
+
+- Add a Grafana dashboard JSON to `deploy/grafana/` driven off the
+  new `/metrics` endpoint.
+- A `openpxe bench` subcommand that runs a 10-second internal load
+  test (synthetic queue joins) so an operator can sanity-check tuning.
+- Ship a basic `docker-compose.yml` for the Unraid path that demos
+  the new themes / progress widget.
+- Generate a printable single-page operator runbook from the README
+  + architecture.md (e.g. `cargo xtask runbook`).

docs/architecture.md

@@ -1,4 +1,4 @@
-# PXEForge architecture
+# OpenPXE architecture
 
 ## Protocol stack
 
@@ -8,7 +8,7 @@ Client firmware PXE ROM
         │ DHCPDISCOVER (UDP/67 broadcast, option 60 "PXEClient", option 93 arch)
         ▼
 ┌─────────────────────────────────────────────────────────────────────────┐
-│  PXEForge                                                               │
+│  OpenPXE                                                               │
 │                                                                         │
 │    ┌──────────────┐     ┌──────────────┐      ┌──────────────────────┐  │
 │    │ DHCP proxy   │     │ TFTP server  │      │  HTTP server (axum)  │  │
@@ -33,7 +33,7 @@ Client runs iPXE
         │
         │ DHCPDISCOVER with option 77 "iPXE"
         ▼
-PXEForge sees user-class "iPXE" → replies with HTTP URL: /boot.ipxe
+OpenPXE sees user-class "iPXE" → replies with HTTP URL: /boot.ipxe
         │
         │ HTTP GET /boot.ipxe  (iPXE menu, auto-generated from IsoStore)
         ▼
@@ -48,14 +48,14 @@ Kernel boots with distro-specific args pointing back at /iso/<id>.iso
 
 | Crate               | Responsibility                                                    |
 |---------------------|-------------------------------------------------------------------|
-| `pxeforge-core`     | Shared types: `Config`, `ClientArch`, `FirmwareClass`, `ClientRegistry` |
-| `pxeforge-ipxe-assets` | Embeds bundled iPXE binaries via `rust-embed`                 |
-| `pxeforge-iso-store`   | On-disk ISO store, introspection, boot-entry generation        |
-| `pxeforge-dhcp-proxy`  | UDP listener + `dhcproto` reply builder; pure `decide()` unit-testable |
-| `pxeforge-tftp`        | RFC 1350 + OACK (blksize / tsize / windowsize). Serves only embedded assets — no filesystem |
-| `pxeforge-http-api`    | `axum` router: web UI, API, iPXE script generation, ISO streaming |
-| `pxeforge-webui`       | Single `index.html` served as static string                    |
-| `pxeforge` (bin)       | Wires everything together, runs the three servers concurrently |
+| `openpxe-core`     | Shared types: `Config`, `ClientArch`, `FirmwareClass`, `ClientRegistry` |
+| `openpxe-ipxe-assets` | Embeds bundled iPXE binaries via `rust-embed`                 |
+| `openpxe-iso-store`   | On-disk ISO store, introspection, boot-entry generation        |
+| `openpxe-dhcp-proxy`  | UDP listener + `dhcproto` reply builder; pure `decide()` unit-testable |
+| `openpxe-tftp`        | RFC 1350 + OACK (blksize / tsize / windowsize). Serves only embedded assets — no filesystem |
+| `openpxe-http-api`    | `axum` router: web UI, API, iPXE script generation, ISO streaming |
+| `openpxe-webui`       | Single `index.html` served as static string                    |
+| `openpxe` (bin)       | Wires everything together, runs the three servers concurrently |
 
 ## Key decisions and why
 
@@ -75,11 +75,11 @@ so plain `SOCK_DGRAM` is enough.
 
 1. Firmware PXE ROM sends DHCPDISCOVER with option 60 = `PXEClient`,
    option 93 = arch.
-2. PXEForge replies with TFTP server + arch-specific iPXE binary
+2. OpenPXE replies with TFTP server + arch-specific iPXE binary
    (`undionly.kpxe` for Legacy BIOS, `snponly.efi` for x86_64 UEFI, etc.).
 3. Client TFTPs the iPXE binary and runs it.
 4. iPXE does its own DHCP, setting option 77 (user-class) to `iPXE`.
-5. PXEForge detects the user-class and this time replies with an HTTP URL
+5. OpenPXE detects the user-class and this time replies with an HTTP URL
    in option 67 pointing at `/boot.ipxe`.
 6. iPXE fetches and executes that script, which chains the selected OS.
 
@@ -105,7 +105,7 @@ Whatever we do for Windows, we never:
 - instruct users to enable `bcdedit /set testsigning on`
 - install any certificate into the target's root/trust store
 
-iVentoy's `httpdisk.sys` approach broke this rule. PXEForge doesn't.
+iVentoy's `httpdisk.sys` approach broke this rule. OpenPXE doesn't.
 
 ### Linux ISO boot uses kernel+initrd extraction, not sanboot
 
@@ -157,13 +157,13 @@ release:
   root-owned" problem that breaks ISO upload on standard Docker hosts.
 - `/healthz` and `/readyz` split from `/api/status` — readyz fails if no
   iPXE binaries are bundled, giving K8s probes a real signal.
-- Startup aborts with a clear error if `PXEFORGE_PUBLIC_IP` can't be
+- Startup aborts with a clear error if `OPENPXE_PUBLIC_IP` can't be
   auto-detected (no more silent `127.0.0.1` advertisement).
 - `scripts/fetch-ipxe.sh` fails non-zero if zero binaries download; the
   Dockerfile uses arch-scoped paths (`x86_64-efi/snponly.efi` etc.).
 
 **Windows boot plumbing** (new):
-- `pxeforge-iso-store::smb::SmbManager` supervises `smbd` on the Windows
+- `openpxe-iso-store::smb::SmbManager` supervises `smbd` on the Windows
   toggle: `start` → spawn + write `smb.conf`; `reconcile` → SIGHUP on
   share changes; `stop` → SIGTERM. `SmbState` surfaced to the UI for
   visibility.
@@ -177,32 +177,32 @@ release:
 - ISO sizes in menu labels (`[ 4376 MB]`), iVentoy format.
 - `Reboot Computer` + `Exit and continue BIOS boot` in Tools menu.
 - Number-key hotkeys (1..9) on boot entries, letter hotkeys on tools.
-- Clients tab cross-joins the gate queue so an operator sees "at gate #2"
+- Clients tab cross-joins the deployment queue so an operator sees "in queue #2"
   or "assigned: ubuntu-linux" status inline.
 
 **Developer ergonomics** (new):
-- `pxeforge seed --from <path>` CLI to import ISOs from a directory.
+- `openpxe seed --from <path>` CLI to import ISOs from a directory.
   Same pipeline as web upload (slug, sha256, introspection, boot-entry).
-- `docker-compose.yml` with `pxeforge` (host network, real PXE) and
-  `pxeforge-dev` (published ports, DHCP disabled, for API testing).
+- `docker-compose.yml` with `openpxe` (host network, real PXE) and
+  `openpxe-dev` (published ports, DHCP disabled, for API testing).
 
 **API cleanliness**:
 - All timestamps now serialized as RFC 3339 strings (the `time` crate's
   default 9-tuple broke browser `Date` parsing).
-- Gate poll retains assignment until the operator releases it; if the
+- Queue poll retains assignment until the operator releases it; if the
   client's chain fails, it reuses the assignment instead of falling back
   to the menu.
 
 ## Phase 4 — UI restructure + remote storage
 
-The web UI was rebuilt around six tabs (Dashboard / Network / Forge Gate /
+The web UI was rebuilt around six tabs (Dashboard / Network / Queue /
 Storage / Terminal / About) inspired by the iVentoy layout the user
 attached and Netbox Labs's compact-card pattern. The old hierarchical
 "Monitoring / Content / Configuration" sidebar grouping is gone — every
 tab is one click from the brand bar.
 
 **NFS share manager** (`crates/iso-store/src/nfs.rs`):
-- Operators add a remote share via Storage → NFS shares; PXEForge mounts
+- Operators add a remote share via Storage → NFS shares; OpenPXE mounts
   it under `<work_dir>/nfs/<id>/` and walks it for `*.iso` files.
 - Each ISO found is registered with `IsoStore::register_external` using
   a new `IsoSource::Nfs { mount_id, relative_path }` variant. The store
@@ -227,7 +227,7 @@ tab is one click from the brand bar.
   followed by live updates. Slow clients see a `lagged` event rather
   than dropping the stream.
 - `/api/terminal` accepts a single command line and dispatches to a
-  whitelist (`status`, `isos`, `clients`, `gate {list,assign,release}`,
+  whitelist (`status`, `isos`, `clients`, `queue {list,assign,release}`,
   `nfs {list,mount,unmount,scan}`, `smb {status,start,stop,reload}`,
   `log {clear,tail}`). Output is mirrored onto the LogBus so reading the
   live tail tells the same story as scrolling the terminal pane.
@@ -240,7 +240,7 @@ tab is one click from the brand bar.
   read-only by design — silently changing the public IP on a hot UI
   would break PXE for every client mid-boot.
 - The only writable network field is `dns_server`, an optional
-  informational hint stored in `Settings`. PXEForge does not run a DNS
+  informational hint stored in `Settings`. OpenPXE does not run a DNS
   server; the field exists so operators don't have to dig out the
   upstream DNS at 3 AM.
 
@@ -252,7 +252,7 @@ tab is one click from the brand bar.
   warning.
 - Dashboard surfaces a "Images that won't boot" panel reusing the same
   predicate, so the operator sees the problem before they pick the ISO
-  in the gate.
+  in the queue.
 - Streaming uploads are already in place via axum multipart; the v0.1.62
   fix to "502 on big upload" doesn't apply.
 
@@ -260,15 +260,14 @@ tab is one click from the brand bar.
 
 **Per-MAC host bindings** (`crates/core/src/host_bindings.rs`):
 - New `HostBindings` registry maps a MAC → preferred `BootEntry::id`
-  (or one of the reserved menu shortcuts `_local`, `_gate`,
+  (or one of the reserved menu shortcuts (`_local`, `_queue``,
   `_tools_menu`).
 - Persisted to `<work_dir>/hosts.json`. Like `SettingsStore`, in-memory
   is authoritative — disk corruption falls back to empty rather than
   failing startup.
-- Inspired by Tinkerbell `smee`'s MAC-prepended URL pattern. The DHCP
-  reply now embeds `?mac=${mac}` in the boot.ipxe URL; iPXE substitutes
-  the literal MAC client-side, so the HTTP layer can short-circuit
-  past the menu when a binding exists.
+- The DHCP reply embeds `?mac=${mac}` in the boot.ipxe URL; iPXE
+  substitutes the literal MAC client-side, so the HTTP layer can
+  short-circuit past the menu when a binding exists.
 - `/api/hosts` GET / POST / DELETE drives the **Hosts** tab.
 
 **Prometheus metrics** (`crates/core/src/metrics.rs`):
@@ -278,7 +277,7 @@ tab is one click from the brand bar.
 - Counters: DHCP replies (per arch label), DHCP declined, TFTP
   transfers (per status label), TFTP bytes, HTTP requests (per route
   label).
-- Gauges: ISO count, client count, gate count, gate-imaging count,
+- Gauges: ISO count, client count, queue count, queue-imaging count,
   NFS active mounts, uptime, build info.
 - Exposed as plain Prometheus text at `/metrics`.
 
@@ -288,18 +287,17 @@ warning-free. Replaced `format!()`-into-`String` with
 `Reverse`, fixed `map_or(false, …)` → `is_some_and`, and a handful of
 other idiom fixes.
 
-**UI overhaul** for the v0.2.0 pre-beta milestone:
+**UI overhaul** for the pre-beta milestone:
 - Light + dark themes via `:root[data-theme=light]` token swap.
   Toggled by a top-right button or the `T` key. Persisted in
   localStorage; pre-paint inline script avoids dark→light flash.
-- New SVG logos: a refined anvil (`logo.svg`) and a SMIL-animated
-  `anvil-forge.svg` (rising sparks + pulsing underglow). Pure SVG —
-  no GIFs, no CSS keyframes for the sparks.
-- "Forge progress" widget on the Dashboard and Forge Gate: animated
-  anvil paired with a `linear-gradient(warn → accent)` progress bar
+- New SVG logos: a refined OpenPXE mark (`logo.svg`) and a compact
+  SMIL-animated loader (`loader.svg`). Pure SVG, embedded in the binary.
+- Deployment progress widget on the Dashboard and Queue: animated
+  OpenPXE mark paired with a `linear-gradient(warn → accent)` progress bar
   with a moving sheen. Goes idle (greyscale, no sheen) at zero
   imaging load.
-- Loader replaced "Loading…" text with the same anvil.
+- Loader replaced "Loading..." text with the same OpenPXE mark.
 - Sidebar gains a **Hosts** tab.
 
 **Windows boot validation**:
@@ -317,7 +315,8 @@ other idiom fixes.
   fixes: explicit `net start Workstation` before `net use`, surfaces
   errors instead of blind retries.
 
-**Test count**: 66 → up from 56 in v0.1.0.
+**Test posture**: protocol, HTTP, ISO-store, Windows script, queue, metrics,
+and UI-offline checks all run in the workspace test suite.
 
 ## What's deferred to Phase 6
 

runbooks/linux-network-boot.md

@@ -0,0 +1,403 @@
+# Runbook: Boot a Linux machine from an ISO over the network
+
+End-to-end walkthrough: spin up OpenPXE, load an Ubuntu (or any
+Linux) ISO into it, target a specific bare-metal or VM client by its
+MAC address, and have that machine PXE-boot the installer over the
+LAN — no USB stick, no console babysitting.
+
+This runbook assumes:
+
+- You have **one Linux host** to run the OpenPXE container (any
+  distro with Docker / Podman; 2 GB RAM, ~50 GB disk for the ISO
+  library).
+- That host sits on the **same broadcast domain / VLAN** as the
+  client you want to boot. PXE is L2-broadcast — routed/VLAN’d
+  networks need a DHCP relay and are out of scope here.
+- An **existing DHCP server** is already handing out IP leases on
+  that VLAN (your home router, OPNsense, Windows Server, etc.).
+  OpenPXE runs as a *DHCP proxy* — it never leases IPs, it only
+  layers the boot information on top of the existing DHCP exchange.
+- The target client is configured to **PXE-boot** in BIOS/UEFI
+  firmware (usually `F12` boot menu → Network, or set as first boot
+  device).
+
+If those don’t hold, stop and read [troubleshooting.md](troubleshooting.md)
+or [docs/architecture.md](../docs/architecture.md) first.
+
+---
+
+## 0. Pick your host’s LAN IP
+
+You need the IPv4 address OpenPXE will advertise to clients. From
+the host:
+
+```bash
+ip -4 -o addr show | awk '{print $2, $4}'
+```
+
+Pick the address on the interface that faces the PXE VLAN — for
+example `10.0.0.5/24` on `eno1`. From here on we call it
+`PXE_HOST_IP`.
+
+> **Why this matters.** Every URL handed to clients (TFTP server,
+> iPXE chain URL, ISO URL) is built from this IP. If OpenPXE
+> auto-detects the wrong interface or loopback, clients will fetch
+> from an unreachable address and silently fail. The startup will
+> *fail loudly* if it can only auto-detect a loopback address.
+
+---
+
+## 1. Run OpenPXE
+
+The MVP path is a single `docker run` against the published image,
+with `--network host` so the container can see DHCP broadcasts on
+the LAN.
+
+```bash
+mkdir -p ~/openpxe/isos ~/openpxe/work
+
+docker run -d --name openpxe \
+  --restart unless-stopped \
+  --network host \
+  -e OPENPXE_PUBLIC_IP=10.0.0.5 \
+  -e OPENPXE_DHCP_MODE=proxy \
+  -v ~/openpxe/isos:/var/lib/openpxe/isos \
+  -v ~/openpxe/work:/var/lib/openpxe/work \
+  ghcr.io/YOUR-ORG/openpxe:0.2.0
+```
+
+Substitute your `OPENPXE_PUBLIC_IP`, of course. If you’re building
+from this repo instead of pulling, see the
+[README quick start](../README.md#quick-start--mvp-container-recommended).
+
+### Verify it’s alive
+
+```bash
+curl -fsS http://10.0.0.5/healthz   # → 200 ok
+curl -fsS http://10.0.0.5/readyz    # → 200 ready  (iPXE binaries present)
+curl -fsS http://10.0.0.5/api/status | jq .
+```
+
+If `/readyz` is **not** 200, your container is missing iPXE binaries.
+Fix that before going further — clients have nothing to boot
+otherwise. See [README — Container health probes](../README.md#container-health-probes).
+
+### Check the listening ports
+
+OpenPXE holds three privileged UDP/TCP ports. From another shell on
+the host:
+
+```bash
+sudo ss -lnup | grep -E ':(67|69|4011)\b'   # DHCP proxy + TFTP
+sudo ss -lntp | grep ':80\b'                # HTTP UI / boot scripts
+```
+
+All four should be present. If port 67 is taken by `dnsmasq` or the
+host’s own DHCP, stop that service or run OpenPXE on a separate box —
+two listeners on `:67` will fight.
+
+---
+
+## 2. Load the ISO
+
+Two options. Pick one.
+
+### 2a. Web UI upload (recommended for one-offs)
+
+1. Open `http://10.0.0.5/` in a browser.
+2. Sidebar → **Storage**.
+3. Click **Upload ISO**, pick e.g. `ubuntu-24.04.1-live-server-amd64.iso`.
+4. Wait for upload + introspection. The row turns into a card showing:
+   - Distro family (`debian_ubuntu`)
+   - Volume label
+   - Detected kernel/initrd paths (`/casper/vmlinuz`, `/casper/initrd`)
+   - File size and SHA-256
+
+Big ISOs stream — there is no 2 GB limit, but expect upload to be
+throttled by your browser ↔ host link. The UI shows a progress bar; the
+animated OpenPXE mark on the Dashboard tab fires up while imaging is in
+flight.
+
+### 2b. Bulk seed from a directory (recommended for fresh deploys / CI)
+
+If you already have a folder of ISOs on the host, skip the browser:
+
+```bash
+# Dry run first — see what would be imported, no writes:
+docker exec openpxe openpxe seed \
+  --from /seed \
+  --dry-run
+
+# For real, mount the source dir read-only into the container:
+docker run --rm \
+  -v /my/iso-library:/seed:ro \
+  -v ~/openpxe/isos:/var/lib/openpxe/isos \
+  -v ~/openpxe/work:/var/lib/openpxe/work \
+  -e OPENPXE_PUBLIC_IP=10.0.0.5 \
+  ghcr.io/YOUR-ORG/openpxe:0.2.0 seed --from /seed
+```
+
+Each `*.iso` in `/seed` runs through the same upload pipeline as the
+web UI: copy → introspection → boot-entry generation → metadata
+sidecar. Re-running is idempotent.
+
+### Confirm the ISO is registered
+
+```bash
+curl -fsS http://10.0.0.5/api/isos | jq '.[] | {id, name, family, size}'
+```
+
+You should see something like:
+
+```json
+{
+  "id": "ubuntu-24-04-1-live-server-amd64",
+  "name": "ubuntu-24.04.1-live-server-amd64.iso",
+  "family": "debian_ubuntu",
+  "size": 2748000000
+}
+```
+
+The `id` is the **slug**. Remember it — you’ll bind a MAC to it in
+the next step.
+
+---
+
+## 3. Find the target machine’s MAC address
+
+You need the MAC of the **NIC that will PXE**, not the OS’s
+loopback or wifi.
+
+### 3a. From the target itself (if it’s already running an OS)
+
+```bash
+ip -o link | awk '/ether/ {print $2, $17}'    # Linux
+```
+
+Pick the line for the wired NIC plugged into the PXE VLAN.
+
+### 3b. From the firmware (if it’s a fresh box)
+
+Most BIOS/UEFI screens display the NIC MAC during the network-boot
+attempt — usually as `MAC: AA-BB-CC-DD-EE-FF` flashing on the splash
+right before "PXE-E53: No boot filename received". Write it down.
+
+### 3c. By letting it boot once and watching OpenPXE
+
+Easiest if the box is in front of you:
+
+1. Power on, hit `F12`, pick **Network boot**.
+2. Without any binding configured, the client will land on the
+   OpenPXE menu (Default / Installers / Tools / Queued Deployment).
+3. Don’t pick anything. On your laptop:
+   ```bash
+   curl -fsS http://10.0.0.5/api/clients | jq .
+   ```
+4. The most-recent entry is your target. Copy its `mac`.
+
+From here on we call this MAC `TARGET_MAC` (e.g. `aa:bb:cc:dd:ee:ff`).
+Hyphens vs colons, upper vs lower case — OpenPXE normalizes both.
+
+---
+
+## 4. Pin that machine to the Ubuntu ISO
+
+This is the **per-MAC host binding**. With it set, the client won’t
+see the menu at all — it goes straight to the bound boot entry,
+Tinkerbell-style.
+
+### 4a. Via the web UI
+
+1. Sidebar → **Hosts**.
+2. **Add binding**:
+   - **MAC**: `aa:bb:cc:dd:ee:ff`
+   - **Target**: pick `ubuntu-24-04-1-live-server-amd64` from the dropdown.
+   - **Label**: free-form, e.g. `lab-rack3-node07`.
+3. Save.
+
+### 4b. Via the API
+
+```bash
+curl -fsS -X POST http://10.0.0.5/api/hosts \
+  -H 'content-type: application/json' \
+  -d '{
+    "mac":    "aa:bb:cc:dd:ee:ff",
+    "target": "ubuntu-24-04-1-live-server-amd64",
+    "label":  "lab-rack3-node07"
+  }' | jq .
+```
+
+The binding is persisted to `~/openpxe/work/hosts.json` and survives
+container restart.
+
+### Confirm
+
+```bash
+curl -fsS http://10.0.0.5/api/hosts | jq '.[] | select(.mac=="aa:bb:cc:dd:ee:ff")'
+```
+
+You should see your entry with `created_at` and `updated_at`
+timestamps.
+
+---
+
+## 5. Trigger the network boot on the target
+
+Now actually boot the machine.
+
+### 5a. Boot order
+
+In firmware setup, set the wired NIC as the **first** boot device
+(or hold `F12` / `F9` / `Esc` — vendor-specific — to pick "Network
+Boot" interactively).
+
+### 5b. What you should see on the target screen
+
+In order, with timing:
+
+| Stage | Approximate duration | What appears |
+|-------|---------------------:|--------------|
+| Firmware DHCPDISCOVER | ~1 s   | `Start PXE over IPv4` / `Station IP address …` |
+| TFTP iPXE binary fetch | ~1 s  | `TFTP… snponly.efi` (or `undionly.kpxe` for legacy BIOS) |
+| iPXE banner            | ~1 s  | The blue iPXE splash, version string |
+| iPXE second-stage DHCP | ~1 s  | `Configuring (net0 …)` then `ok` |
+| HTTP boot script fetch | <1 s  | `http://10.0.0.5/boot.ipxe?mac=…` |
+| Per-MAC chain          | <1 s  | `OpenPXE: per-MAC binding -> ubuntu-24-04-1-…` |
+| Kernel + initrd HTTP   | 5–30 s | Two 200-OK fetches against `/iso/<id>/casper/vmlinuz` and `…/initrd` |
+| Kernel boot            | 5–10 s | Kernel banner, then the Ubuntu/cloud-init splash |
+| Installer comes up     | 30–60 s | The distro’s normal Live/installer environment |
+
+If everything works, you’re looking at the Ubuntu Server installer
+welcome screen end-to-end **without ever touching a USB stick**.
+
+### 5c. Watch it from the server
+
+In a third shell, tail the live log:
+
+```bash
+curl -N http://10.0.0.5/api/log/stream
+```
+
+You’ll see each protocol step as it happens:
+
+```
+INFO openpxe::dhcp: reply mac=aa:bb:cc:dd:ee:ff arch=X8664Uefi target=tftp/snponly.efi
+INFO openpxe::tftp: RRQ snponly.efi blksize=1468 windowsize=8 → 982 KiB in 412 ms
+INFO openpxe::dhcp: reply mac=aa:bb:cc:dd:ee:ff (iPXE) target=http/boot.ipxe
+INFO openpxe::http: GET /boot.ipxe?mac=aa:bb:cc:dd:ee:ff → host binding hit
+INFO openpxe::http: GET /iso/ubuntu-…/casper/vmlinuz Range=bytes=0- 200 OK 14 MiB
+INFO openpxe::http: GET /iso/ubuntu-…/casper/initrd  Range=bytes=0- 200 OK 75 MiB
+```
+
+The **Terminal** tab in the web UI shows the same thing live, plus a
+short whitelisted command palette (`status`, `clients`, `queue`,
+`hosts`, `log`).
+
+### 5d. Internet-side ISO sources
+
+The runbook title says “via the internet” — the **client** itself
+boots from your LAN, but the underlying ISO can come from anywhere
+your *host* can reach:
+
+- **Direct upload** from a remote workstation via the web UI (HTTPS
+  reverse-proxied if you put OpenPXE behind nginx/Caddy).
+- **NFS mount** of a remote share — Sidebar → **Storage** → **NFS** →
+  `nfs://files.lab.example.com/exports/isos`. Mounted ISOs show up in
+  the same list and are PXE-bootable directly without copying.
+- **Pre-seed** from a CI job that `curl`s a vendor mirror and runs
+  `openpxe seed --from`.
+
+OpenPXE itself never reaches out to the internet at boot time — all
+client traffic stays on the LAN, served from the host.
+
+---
+
+## 6. After the install
+
+Once Ubuntu has finished installing to the target’s disk, you want
+the next reboot to come up off the new local disk, **not** PXE
+again. Two ways:
+
+### 6a. One-shot — release the binding
+
+```bash
+curl -fsS -X DELETE http://10.0.0.5/api/hosts/aa:bb:cc:dd:ee:ff
+```
+
+Without a binding, the client either gets the menu (BIOS still set
+to PXE first) or boots local disk normally.
+
+### 6b. Permanent — pin to local disk
+
+Re-bind to the reserved local-boot target:
+
+```bash
+curl -fsS -X POST http://10.0.0.5/api/hosts \
+  -H 'content-type: application/json' \
+  -d '{ "mac": "aa:bb:cc:dd:ee:ff", "target": "_local", "label": "lab-rack3-node07 (installed)" }'
+```
+
+Now if anyone hits `F12 → Network` by accident, OpenPXE replies
+with a script that says *"chain back to local HDD"* and the box
+boots its real OS instead of re-imaging itself. This is the safest
+default for production hardware.
+
+---
+
+## 7. Re-imaging — the “Queued Deployment” flow
+
+Different scenario: you have **a rack of 30 servers** to image
+identically, all at once. Don’t bind 30 MACs by hand. Use the queue.
+
+1. **Don’t** create host bindings.
+2. PXE-boot every machine. They land on the menu.
+3. On each: select **Queued Deployment**. They get position #1, #2,
+   …, #30 and start long-polling.
+4. In the UI: **Queue** tab shows all 30 lined up. Pick the
+   ISO, click **Assign to all waiting**.
+5. Every client’s open long-poll wakes up at the same instant and
+   chains the same boot script. They all start imaging
+   simultaneously.
+
+The animated OpenPXE progress widget on the Dashboard runs while any client is
+still in the kernel-fetch phase.
+
+---
+
+## Cheat sheet
+
+| Goal | Command |
+|------|---------|
+| Health check | `curl http://$IP/healthz` |
+| List ISOs | `curl http://$IP/api/isos \| jq .` |
+| List clients seen | `curl http://$IP/api/clients \| jq .` |
+| Bind MAC → ISO | `POST /api/hosts` with `{mac,target,label}` |
+| Bind MAC → local disk | same with `target=_local` |
+| Release binding | `DELETE /api/hosts/<mac>` |
+| Live log | `curl -N http://$IP/api/log/stream` |
+| Prometheus metrics | `curl http://$IP/metrics` |
+| Bulk import folder | `openpxe seed --from /path` |
+
+---
+
+## Where to look when things break
+
+- **Client gets `PXE-E53: No boot filename received`** — DHCP proxy
+  isn’t replying. Check `:67` is bound (`ss -lnup`), check
+  `--network host`, check the host firewall on UDP 67/69/4011.
+- **iPXE shows `No more network devices`** — firmware NIC isn’t in
+  PXE mode, or VLAN tagging is wrong.
+- **iPXE prints `Connection timed out (http://…)`** — `OPENPXE_PUBLIC_IP`
+  is wrong. Clients can’t reach that IP. Check `/api/status` →
+  `public_base_url` and `ping` it from the client subnet.
+- **Kernel panics during initrd load** — corrupt ISO upload. Check
+  `/api/isos`, compare the SHA-256 to the vendor’s, re-upload.
+- **Boot menu shows but the bound entry doesn’t fire** — the binding
+  target slug doesn’t match any ISO `id`. Recheck
+  `GET /api/hosts` against `GET /api/isos`. The binding falls back
+  to the menu on miss (by design — never lock a client out).
+- **General confusion** — Terminal tab → `status`, then `log`. That
+  tells you what protocol stages have run and which haven’t.
+
+For deeper protocol-level debugging, see
+[docs/architecture.md](../docs/architecture.md).

scripts/build-and-publish-unraid.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# build-and-publish-unraid.sh — one-shot: clone PXEForge, build the image,
+# build-and-publish-unraid.sh — one-shot: clone OpenPXE, build the image,
 # push it to your local Gitea container registry. Run this ON the Unraid
 # box (or any host that can reach Gitea on http://localhost:3000 or its
 # LAN IP). No Cloudflare in the way; the proxy doesn't matter for this
@@ -10,31 +10,31 @@
 #   GITEA_HOST      default: localhost:3000  (use 192.168.1.49:3000 if
 #                   you're on the LAN but not on the Unraid host)
 #   GITEA_OWNER     default: mward4
-#   GITEA_REPO      default: PXEForge
+#   GITEA_REPO      default: OpenPXE
 #   IMAGE_TAG       default: 0.1.0  (also tagged :latest)
 #   PLATFORM        default: linux/amd64  (Unraid is x86_64)
-#   WORKDIR         default: /tmp/pxeforge-build  (deleted on success)
+#   WORKDIR         default: /tmp/openpxe-build  (deleted on success)
 #
 # What it does:
-#   1. git clone <gitea>/mward4/PXEForge.git into WORKDIR
+#   1. git clone <gitea>/mward4/OpenPXE.git into WORKDIR
 #   2. fetch iPXE binaries (scripts/fetch-ipxe.sh)
-#   3. docker build deploy/docker/Dockerfile -> pxeforge:$TAG (and :latest)
+#   3. docker build deploy/docker/Dockerfile -> openpxe:$TAG (and :latest)
 #   4. docker login to GITEA_HOST using the token
-#   5. docker push to <gitea>/<owner>/pxeforge:<tag> and :latest
+#   5. docker push to <gitea>/<owner>/openpxe:<tag> and :latest
 #   6. docker logout, scrub creds, clean WORKDIR
 #
 # After this, on any Unraid Docker template, set:
-#   Repository: <gitea>/mward4/pxeforge:0.1.0    (or :latest)
+#   Repository: <gitea>/mward4/openpxe:0.1.0    (or :latest)
 #   Network:    host                             (DHCP/TFTP need raw L2)
 
 set -euo pipefail
 
 GITEA_HOST=${GITEA_HOST:-localhost:3000}
 GITEA_OWNER=${GITEA_OWNER:-mward4}
-GITEA_REPO=${GITEA_REPO:-PXEForge}
+GITEA_REPO=${GITEA_REPO:-OpenPXE}
 IMAGE_TAG=${IMAGE_TAG:-0.1.0}
 PLATFORM=${PLATFORM:-linux/amd64}
-WORKDIR=${WORKDIR:-/tmp/pxeforge-build}
+WORKDIR=${WORKDIR:-/tmp/openpxe-build}
 
 # Lowercase the image name — OCI distribution rejects uppercase paths.
 IMAGE_NAME="$(printf '%s' "$GITEA_REPO" | tr '[:upper:]' '[:lower:]')"

scripts/fetch-ipxe.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # Fetch prebuilt iPXE binaries from the official distribution at
 # https://boot.ipxe.org/ and place them under assets/ipxe/ with the filenames
-# PXEForge's arch mapping expects.
+# OpenPXE's arch mapping expects.
 #
 # Why not build from source?
 #   - Building iPXE requires the toolchain + several megabytes of source, and