v0.4.5: VMware UEFI fix, static musl binary, Forms auth + SSO config

VMware UEFI / Casper boot fix:
- Linux cmdline for Debian/Ubuntu/Mint/Pop!_OS/elementary now uses the
  canonical Casper `iso-url=` option and `ds=nocloud`, matching the
  fix Bootimus shipped in v0.1.67. The previous
  `boot=casper netboot=url url=… ip=dhcp ---` form booted fine on
  bare-metal UEFI but hung at "cloud-init running" on VMware guests
  because subiquity / cloud-init can't reach a metadata datasource
  through PXE.

Static binary (matches Bootimus v0.1.70):
- Dockerfile build stage now compiles against
  x86_64-unknown-linux-musl. The resulting /openpxe has no glibc
  dependency at all; the runtime stage still ships Debian slim for the
  samba/wimtools/nfs-common shellouts, but a future scratch/distroless
  variant is now a one-line swap. Cuts a class of "GLIBC_2.39 not
  found" surprises on older RHEL/Rocky hosts.

Forms auth (Sonarr/Radarr-style):
- New AdminStore in openpxe-core: single admin record persisted to
  <work_dir>/auth.json, bcrypt-hashed credentials, rotation requires
  current password.
- New SessionStore in openpxe-http-api: in-memory UUID-keyed sessions
  with 24h sliding TTL, openpxe_session HttpOnly cookie.
- Endpoints: POST /api/setup (first-run), POST /api/login, POST
  /api/logout, GET /api/me, PUT /api/me/credentials (rotates and
  revokes every other session).
- Auth middleware gates /api/* once the admin is configured;
  passes through entirely until then (tests + fresh installs ride this
  path). Allowlists PXE-essential paths (/boot.ipxe, /iso/*, /ipxe/*,
  /api/queue/join, /api/queue/poll/*) so iPXE clients still work
  without a cookie they can't send.
- WebUI: first-run setup card, login card, logout chip in the sidebar
  footer, Account card in Settings for rotating creds. Auth screen is
  fully styled (centered narrow card, matches Sonarr layout).

SSO config (FleetDM-shaped, storage-only):
- New SsoStore in openpxe-core: { enabled, idp_name, metadata,
  metadata_url } persisted to <work_dir>/sso.json with size caps and
  URL-scheme validation.
- Endpoints: GET /api/sso, PUT /api/sso. Validation: enabling SSO
  without either metadata or metadata_url returns 400.
- WebUI: SSO card in Settings with a URL-vs-XML mode switch and an
  inert "Sign in with X" button on the login screen while runtime
  flow is pending. Per the brief: no Entity ID field (defaults to the
  advertised public_base_url internally when SAML wiring lands).

Quality:
- 132 tests passing (was 106 in v0.4.4): +5 auth unit tests, +5 SSO
  unit tests, +7 auth integration tests, +1 SSO integration test, +1
  regression guard pinning the new Casper cmdline.
- cargo clippy --workspace --all-targets clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

.gitignore

@@ -1,5 +1,4 @@
 /target
-Cargo.lock
 data/isos/*.iso
 data/isos/*.partial
 data/isos/*.meta.json

Cargo.toml

@@ -12,9 +12,9 @@ members = [
 ]
 
 [workspace.package]
-version = "0.3.1"
+version = "0.4.5"
 edition = "2021"
-rust-version = "1.80"
+rust-version = "1.95"
 license = "MIT OR Apache-2.0"
 repository = "https://gitea.milesward.dev/mward4/OpenPXE"
 authors = ["OpenPXE contributors"]

README.md

@@ -5,12 +5,12 @@ Container-native PXE boot server. A Rust reimplementation of
 for Docker/OCI and OpenShift. Upload `.iso` files via the web UI; network
 clients PXE-boot them.
 
-> **Status:** v0.2.0 / pre-beta. Phases 1–5 complete: full PXE stack,
+> **Status:** v0.4.1 / pre-beta. Phases 1–5 complete: full PXE stack,
 > Queued Deployment queue, NFS-share ISO sources, live tracing log + an
-> operator terminal, per-MAC host bindings (Tinkerbell-style),
-> Prometheus `/metrics`, light/dark theme toggle, animated anvil
-> imaging-progress widget. **66 tests passing**, clippy clean. Ready
-> for real-hardware validation.
+> operator terminal, per-MAC host bindings, Prometheus `/metrics`,
+> light/dark theme toggle, animated OpenPXE imaging-progress widget,
+> chunked ISO uploads, and per-ISO boot passwords. The test suite and
+> clippy are part of the release checklist. Ready for real-hardware validation.
 
 ## Design non-negotiables
 
@@ -41,18 +41,17 @@ clients PXE-boot them.
    Tools          > Utilities / OpenPXE Shell / Network Card Info
    Queued Deployment
    ```
-6. **Queued Deployment queue** — the "horse race" launch flow. A client that
+6. **Queued Deployment queue** — the coordinated launch flow. A client that
    selects *Queued Deployment* gets a numbered position and waits. The
    operator picks an ISO in the web UI and fires it to every waiting
    client simultaneously.
-7. **Web UI** (Netbox-style): sidebar nav (Dashboard / Network / Forge
-   Gate / Storage / Hosts / Terminal / About), light + dark themes
-   (toggle top-right or press `T`), animated anvil "forge progress"
+7. **Web UI** (Netbox-style): sidebar nav (Dashboard / Network / Queue /
+   Storage / Hosts / Terminal / About), light + dark themes
+   (toggle top-right or press `T`), animated OpenPXE progress
    widget when devices are imaging. All assets served from the binary —
    no external requests.
 8. **Per-MAC host bindings.** Pin a MAC to a boot target and the client
-   skips the menu, chains straight through. Inspired by Tinkerbell's
-   `smee` MAC-prepended URL pattern.
+   skips the menu, chains straight through.
 9. **Prometheus metrics** at `/metrics` — DHCP replies by arch, TFTP
    transfer counts and bytes, HTTP request counts by route, queue /
    imaging gauges, uptime, build info. Plain text exposition format,
@@ -81,7 +80,7 @@ skip TFTP and respond with an HTTP URL.
 ./scripts/fetch-ipxe.sh
 
 # 2. Build the container image (~3 min first time).
-docker buildx build -f deploy/docker/Dockerfile -t openpxe:0.1.0 --load .
+docker buildx build -f deploy/docker/Dockerfile -t openpxe:0.4.1 --load .
 
 # 3. Run it on the box plugged into your PXE network. Set PUBLIC_IP to
 #    this host's LAN address so advertised iPXE URLs are reachable.
@@ -91,7 +90,7 @@ docker run -d --name openpxe \
   -e OPENPXE_DHCP_MODE=proxy \
   -v $PWD/data/isos:/var/lib/openpxe/isos \
   -v $PWD/data/work:/var/lib/openpxe/work \
-  openpxe:0.1.0
+  openpxe:0.4.1
 
 # 4. Open the UI and drop an ISO in.
 open http://10.0.0.5
@@ -122,7 +121,7 @@ docker buildx create --name openpxe-multi --driver docker-container --use
 # Build + push both linux/amd64 and linux/arm64 under one tag.
 docker buildx build --builder openpxe-multi \
   --platform linux/amd64,linux/arm64 \
-  -t ghcr.io/YOUR-ORG/openpxe:0.1.0 \
+  -t ghcr.io/YOUR-ORG/openpxe:0.4.1 \
   --push \
   -f deploy/docker/Dockerfile .
 ```
@@ -155,10 +154,10 @@ docker run --rm \
   -v /my/iso-library:/seed:ro \
   -v openpxe-data:/var/lib/openpxe/isos \
   -e OPENPXE_PUBLIC_IP=10.0.0.5 \
-  openpxe:0.1.0 seed --from /seed
+  openpxe:0.4.1 seed --from /seed
 
 # Dry run first to see what would be imported:
-docker run --rm -v /my/iso-library:/seed:ro openpxe:0.1.0 seed --from /seed --dry-run
+docker run --rm -v /my/iso-library:/seed:ro openpxe:0.4.1 seed --from /seed --dry-run
 ```
 
 ### Environment overrides
@@ -273,7 +272,7 @@ operational constraints inherited from the design:
 
 ## Queued Deployment
 
-The "horse race" launch flow, end to end:
+The coordinated launch flow, end to end:
 
 1. A client boots and picks **Queued Deployment** in the PXE menu (or falls
    through on timeout with the default `timeout_action`).
@@ -285,8 +284,9 @@ The "horse race" launch flow, end to end:
    The server broadcasts the assignment to every queued client via a
    `tokio::sync::Notify`; each client's next poll returns the boot script
    for the chosen image.
-5. Every client chains the same image at effectively the same moment — the
-   queue releases and the horses run together.
+5. Every client chains the same image at effectively the same moment. The
+   queue stays visible until the operator releases entries, which keeps a
+   useful audit trail during hardware testing.
 
 No user-facing iPXE anywhere in this flow. The client only ever runs
 scripts we generate; the operator only interacts with the web UI.

crates/core/Cargo.toml

@@ -21,6 +21,9 @@ time.workspace = true
 uuid.workspace = true
 parking_lot.workspace = true
 tokio = { workspace = true, features = ["sync", "rt", "macros", "time"] }
+# bcrypt for the admin Forms auth (v0.4.5). Already in the workspace
+# for per-ISO boot passwords; just re-exported here.
+bcrypt.workspace = true
 
 [dev-dependencies]
 tempfile = "3.12"

crates/core/src/arch.rs

@@ -126,7 +126,10 @@ mod tests {
     fn bootfile_names_stable() {
         assert_eq!(ClientArch::LegacyX86.ipxe_bootfile(), Some("undionly.kpxe"));
         assert_eq!(ClientArch::X64Uefi.ipxe_bootfile(), Some("snponly.efi"));
-        assert_eq!(ClientArch::Arm64Uefi.ipxe_bootfile(), Some("snponly-arm64.efi"));
+        assert_eq!(
+            ClientArch::Arm64Uefi.ipxe_bootfile(),
+            Some("snponly-arm64.efi")
+        );
         assert_eq!(ClientArch::Unknown(0xFFFF).ipxe_bootfile(), None);
     }
 

crates/core/src/auth.rs

@@ -0,0 +1,353 @@
+//! Operator authentication — Sonarr/Radarr-style single-admin Forms model.
+//!
+//! On a fresh install, no admin account exists; the WebUI's first-run
+//! flow prompts the operator to create one. After that the chosen
+//! credentials gate `/api/*` access. The admin can rotate username +
+//! password from Settings → Account.
+//!
+//! Multi-user RBAC isn't a goal for OpenPXE — the user explicitly asked
+//! for "you have access or you don't". When SSO is configured, additional
+//! users come in through the IdP; the locally-stored admin is the
+//! fallback owner who can change SSO config or the seal-breaker for an
+//! IdP outage. So one record is enough.
+//!
+//! Storage policy mirrors [`crate::host_bindings::HostBindings`] and
+//! [`crate::boot_log::BootLog`]: in-memory authoritative; disk is the
+//! crash-survival cache; a corrupt `auth.json` falls back to "no admin
+//! configured" rather than blocking startup, which puts the UI back
+//! into setup mode rather than locking the operator out.
+
+use parking_lot::RwLock;
+use serde::{Deserialize, Serialize};
+use std::path::PathBuf;
+use std::sync::Arc;
+use time::OffsetDateTime;
+
+use crate::{Error, Result};
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct AdminAccount {
+    pub username: String,
+    /// bcrypt hash (cost 10). The plaintext password never leaves the
+    /// request that set it — same discipline as the per-ISO boot password.
+    pub password_hash: String,
+    #[serde(with = "time::serde::rfc3339")]
+    pub created_at: OffsetDateTime,
+    #[serde(with = "time::serde::rfc3339")]
+    pub updated_at: OffsetDateTime,
+}
+
+/// Public projection — no hash, safe to ship to the WebUI.
+#[derive(Debug, Clone, Serialize)]
+pub struct AdminPublic {
+    pub username: String,
+    #[serde(with = "time::serde::rfc3339")]
+    pub created_at: OffsetDateTime,
+    #[serde(with = "time::serde::rfc3339")]
+    pub updated_at: OffsetDateTime,
+}
+
+impl From<&AdminAccount> for AdminPublic {
+    fn from(a: &AdminAccount) -> Self {
+        Self {
+            username: a.username.clone(),
+            created_at: a.created_at,
+            updated_at: a.updated_at,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+struct Inner {
+    admin: Option<AdminAccount>,
+}
+
+/// In-memory + on-disk admin registry. Cheap to clone.
+#[derive(Debug, Clone)]
+pub struct AdminStore {
+    path: Arc<PathBuf>,
+    inner: Arc<RwLock<Inner>>,
+}
+
+impl AdminStore {
+    /// Load from `<work_dir>/auth.json`, or start empty. A bad file
+    /// logs a warning and falls back to "no admin configured" — better
+    /// to surface the setup flow than lock the operator out of their
+    /// own install.
+    #[must_use]
+    pub fn load_or_default(work_dir: &std::path::Path) -> Self {
+        let path = work_dir.join("auth.json");
+        let inner = match std::fs::read_to_string(&path) {
+            Ok(text) => match serde_json::from_str::<Inner>(&text) {
+                Ok(parsed) => parsed,
+                Err(e) => {
+                    tracing::warn!(
+                        target: "openpxe::auth",
+                        "auth.json present but unreadable ({e}); starting in setup mode"
+                    );
+                    Inner::default()
+                }
+            },
+            Err(_) => Inner::default(),
+        };
+        Self {
+            path: Arc::new(path),
+            inner: Arc::new(RwLock::new(inner)),
+        }
+    }
+
+    /// Has an admin been bootstrapped? Drives the first-run / login
+    /// fork in the HTTP layer.
+    #[must_use]
+    pub fn is_configured(&self) -> bool {
+        self.inner.read().admin.is_some()
+    }
+
+    /// Public-safe snapshot for the WebUI.
+    #[must_use]
+    pub fn snapshot(&self) -> Option<AdminPublic> {
+        self.inner.read().admin.as_ref().map(AdminPublic::from)
+    }
+
+    /// First-run setup: create the admin account. Fails if one already
+    /// exists — the HTTP layer surfaces that as 409.
+    pub fn bootstrap(&self, username: &str, password: &str) -> Result<AdminPublic> {
+        validate_username(username)?;
+        validate_password(password)?;
+        let hash = bcrypt_hash(password)?;
+        let now = OffsetDateTime::now_utc();
+        let admin = AdminAccount {
+            username: username.trim().to_string(),
+            password_hash: hash,
+            created_at: now,
+            updated_at: now,
+        };
+        {
+            let mut g = self.inner.write();
+            if g.admin.is_some() {
+                return Err(Error::Invalid(
+                    "admin account already configured".into(),
+                ));
+            }
+            g.admin = Some(admin.clone());
+        }
+        self.persist();
+        tracing::info!(
+            target: "openpxe::auth",
+            username = %admin.username,
+            "admin account created (first-run setup)"
+        );
+        Ok((&admin).into())
+    }
+
+    /// Verify credentials. Returns the admin record (public projection)
+    /// on success, `Ok(None)` on mismatch, `Err` on systemic bcrypt
+    /// failure (treated as "auth not available right now" by callers).
+    pub fn verify(&self, username: &str, password: &str) -> Result<Option<AdminPublic>> {
+        let Some(admin) = self.inner.read().admin.clone() else {
+            return Ok(None);
+        };
+        if username.trim() != admin.username {
+            return Ok(None);
+        }
+        // bcrypt compares in constant time relative to the same hash.
+        // Doing the username check first is fine — a username mismatch
+        // returns immediately, but the only thing leaked is "this isn't
+        // the admin's username" which the operator already knows.
+        match bcrypt::verify(password, &admin.password_hash) {
+            Ok(true) => Ok(Some((&admin).into())),
+            Ok(false) => Ok(None),
+            Err(e) => Err(Error::Other(e.into())),
+        }
+    }
+
+    /// Rotate username and/or password. `current_password` must match
+    /// the *existing* hash — same flow as Sonarr's "current password
+    /// required to change". `new_username`/`new_password` are optional:
+    /// pass only what you want to change.
+    pub fn update_credentials(
+        &self,
+        current_password: &str,
+        new_username: Option<&str>,
+        new_password: Option<&str>,
+    ) -> Result<AdminPublic> {
+        // Re-check ownership before any state mutation.
+        let existing = self
+            .inner
+            .read()
+            .admin
+            .clone()
+            .ok_or_else(|| Error::Invalid("no admin configured".into()))?;
+        match bcrypt::verify(current_password, &existing.password_hash) {
+            Ok(true) => {}
+            Ok(false) => return Err(Error::Invalid("current password is incorrect".into())),
+            Err(e) => return Err(Error::Other(e.into())),
+        }
+
+        let mut updated = existing.clone();
+        if let Some(u) = new_username {
+            validate_username(u)?;
+            updated.username = u.trim().to_string();
+        }
+        if let Some(p) = new_password {
+            validate_password(p)?;
+            updated.password_hash = bcrypt_hash(p)?;
+        }
+        updated.updated_at = OffsetDateTime::now_utc();
+
+        {
+            let mut g = self.inner.write();
+            g.admin = Some(updated.clone());
+        }
+        self.persist();
+        tracing::info!(
+            target: "openpxe::auth",
+            username = %updated.username,
+            "admin credentials updated"
+        );
+        Ok((&updated).into())
+    }
+
+    fn persist(&self) {
+        let snap = self.inner.read().clone();
+        let body = match serde_json::to_vec_pretty(&snap) {
+            Ok(b) => b,
+            Err(e) => {
+                tracing::warn!(target: "openpxe::auth", "serialize auth.json: {e}");
+                return;
+            }
+        };
+        if let Some(parent) = self.path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        let tmp = self.path.with_extension("json.tmp");
+        if let Err(e) = std::fs::write(&tmp, body) {
+            tracing::warn!(target: "openpxe::auth", "write auth.json tmp: {e}");
+            return;
+        }
+        if let Err(e) = std::fs::rename(&tmp, self.path.as_path()) {
+            tracing::warn!(target: "openpxe::auth", "rename auth.json: {e}");
+        }
+    }
+}
+
+fn validate_username(u: &str) -> Result<()> {
+    let u = u.trim();
+    if u.is_empty() {
+        return Err(Error::Invalid("username must not be empty".into()));
+    }
+    if u.len() > 64 {
+        return Err(Error::Invalid("username must be 64 chars or fewer".into()));
+    }
+    if !u.chars().all(|c| c.is_ascii_graphic() && c != ':') {
+        return Err(Error::Invalid(
+            "username must be ASCII printable with no ':' character".into(),
+        ));
+    }
+    Ok(())
+}
+
+fn validate_password(p: &str) -> Result<()> {
+    if p.len() < 8 {
+        return Err(Error::Invalid(
+            "password must be at least 8 characters".into(),
+        ));
+    }
+    if p.len() > 256 {
+        return Err(Error::Invalid(
+            "password must be 256 characters or fewer".into(),
+        ));
+    }
+    Ok(())
+}
+
+fn bcrypt_hash(password: &str) -> Result<String> {
+    bcrypt::hash(password, bcrypt::DEFAULT_COST).map_err(|e| Error::Other(e.into()))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::tempdir;
+
+    #[test]
+    fn empty_after_load_when_no_file() {
+        let dir = tempdir().unwrap();
+        let s = AdminStore::load_or_default(dir.path());
+        assert!(!s.is_configured());
+        assert!(s.snapshot().is_none());
+    }
+
+    #[test]
+    fn bootstrap_then_verify_round_trip() {
+        let dir = tempdir().unwrap();
+        let s = AdminStore::load_or_default(dir.path());
+        let pub_ = s.bootstrap("admin", "hunter2hunter2").unwrap();
+        assert_eq!(pub_.username, "admin");
+        assert!(s.is_configured());
+
+        // Correct creds match; wrong creds don't.
+        assert!(s.verify("admin", "hunter2hunter2").unwrap().is_some());
+        assert!(s.verify("admin", "wrong").unwrap().is_none());
+        assert!(s.verify("nobody", "hunter2hunter2").unwrap().is_none());
+    }
+
+    #[test]
+    fn bootstrap_rejects_second_call() {
+        let dir = tempdir().unwrap();
+        let s = AdminStore::load_or_default(dir.path());
+        s.bootstrap("admin", "hunter2hunter2").unwrap();
+        let r = s.bootstrap("other", "anotherpass1");
+        assert!(matches!(r, Err(Error::Invalid(_))));
+    }
+
+    #[test]
+    fn round_trip_survives_disk_reload() {
+        let dir = tempdir().unwrap();
+        let s = AdminStore::load_or_default(dir.path());
+        s.bootstrap("admin", "hunter2hunter2").unwrap();
+        drop(s);
+        let s2 = AdminStore::load_or_default(dir.path());
+        assert!(s2.is_configured());
+        assert!(s2.verify("admin", "hunter2hunter2").unwrap().is_some());
+    }
+
+    #[test]
+    fn update_credentials_requires_current_password() {
+        let dir = tempdir().unwrap();
+        let s = AdminStore::load_or_default(dir.path());
+        s.bootstrap("admin", "hunter2hunter2").unwrap();
+        // Wrong current password → no change.
+        let r = s.update_credentials("nope", None, Some("newpassword1"));
+        assert!(matches!(r, Err(Error::Invalid(_))));
+        assert!(s.verify("admin", "hunter2hunter2").unwrap().is_some());
+
+        // Correct current password rotates only what's supplied.
+        s.update_credentials("hunter2hunter2", Some("alice"), Some("newpassword1"))
+            .unwrap();
+        assert!(s.verify("admin", "hunter2hunter2").unwrap().is_none());
+        assert!(s.verify("alice", "newpassword1").unwrap().is_some());
+    }
+
+    #[test]
+    fn update_credentials_partial_password_only_keeps_username() {
+        let dir = tempdir().unwrap();
+        let s = AdminStore::load_or_default(dir.path());
+        s.bootstrap("admin", "hunter2hunter2").unwrap();
+        s.update_credentials("hunter2hunter2", None, Some("newpassword1"))
+            .unwrap();
+        assert!(s.verify("admin", "newpassword1").unwrap().is_some());
+    }
+
+    #[test]
+    fn validates_username_and_password() {
+        let dir = tempdir().unwrap();
+        let s = AdminStore::load_or_default(dir.path());
+        assert!(s.bootstrap("", "hunter2hunter2").is_err());
+        assert!(s.bootstrap("ad:min", "hunter2hunter2").is_err()); // ':' reserved
+        assert!(s.bootstrap("admin", "short").is_err()); // <8 chars
+        // 65-char username is too long.
+        let long = "a".repeat(65);
+        assert!(s.bootstrap(&long, "hunter2hunter2").is_err());
+    }
+}

crates/core/src/boot_log.rs

@@ -0,0 +1,249 @@
+//! Boot-event log — "who installed what, when, from where".
+//!
+//! Each `/boot/<entry>.ipxe` fetch that actually goes on to serve a boot
+//! script lands an entry here. The log is bounded in memory (newest-first,
+//! ring-buffered at [`BootLog::CAP`]) and is mirrored append-only to
+//! `<work_dir>/boot_log.jsonl`. Mirrors `HostBindings`'s "in-memory is
+//! authoritative, disk is a cache" policy — a corrupt log file should
+//! never block PXE for the network.
+//!
+//! We deliberately don't push these onto the `LogBus` (the operator
+//! terminal stream). The terminal already shows the http traces; the
+//! Host log is a curated, persistent, easy-to-scan view of "what got
+//! imaged on what hardware" and conflating the two would be noisy.
+
+use parking_lot::RwLock;
+use serde::{Deserialize, Serialize};
+use std::collections::VecDeque;
+use std::io::Write;
+use std::net::IpAddr;
+use std::path::PathBuf;
+use std::sync::Arc;
+use time::OffsetDateTime;
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct BootEvent {
+    #[serde(with = "time::serde::rfc3339")]
+    pub timestamp: OffsetDateTime,
+    /// Lowercase, colon-separated. `None` when iPXE didn't supply
+    /// `?mac=${mac}` in the chain URL (older bookmarks, custom scripts).
+    pub mac: Option<String>,
+    /// Connecting peer's IP — taken from the TCP socket when available
+    /// (PXE clients connect direct, no reverse proxy), and falls back to
+    /// `X-Forwarded-For` for the rare case where one is present.
+    pub ip: Option<IpAddr>,
+    /// `BootEntry::id` — the same id used in `/boot/<id>.ipxe`.
+    pub target_id: String,
+    /// Human-friendly label: the ISO's filename / volume label / entry
+    /// title. Pre-resolved at log time so the UI can render without
+    /// joining against the ISO store (and so "what image was installed?"
+    /// survives the operator deleting the ISO later).
+    pub target_title: String,
+}
+
+/// In-memory ring + disk-backed append log of boot events. Cheap to
+/// clone; the inner state is `Arc<RwLock<_>>`.
+#[derive(Debug, Clone)]
+pub struct BootLog {
+    path: Arc<PathBuf>,
+    inner: Arc<RwLock<VecDeque<BootEvent>>>,
+}
+
+impl BootLog {
+    /// Newest entries we retain in memory. Past this, the oldest gets
+    /// evicted — the on-disk JSONL keeps the full history for offline
+    /// inspection. 500 covers a typical install-day's worth without
+    /// turning the Hosts tab into a wall of text.
+    pub const CAP: usize = 500;
+
+    /// Load up to `CAP` newest events from `<work_dir>/boot_log.jsonl`,
+    /// or start empty if the file is missing / unreadable.
+    #[must_use]
+    pub fn load_or_default(work_dir: &std::path::Path) -> Self {
+        let path = work_dir.join("boot_log.jsonl");
+        let mut events = VecDeque::with_capacity(Self::CAP);
+        if let Ok(text) = std::fs::read_to_string(&path) {
+            for line in text.lines() {
+                if line.trim().is_empty() {
+                    continue;
+                }
+                match serde_json::from_str::<BootEvent>(line) {
+                    Ok(ev) => {
+                        if events.len() == Self::CAP {
+                            events.pop_front();
+                        }
+                        events.push_back(ev);
+                    }
+                    Err(e) => {
+                        tracing::warn!(
+                            target: "openpxe::boot_log",
+                            "skipping unparseable boot_log line: {e}"
+                        );
+                    }
+                }
+            }
+        }
+        Self {
+            path: Arc::new(path),
+            inner: Arc::new(RwLock::new(events)),
+        }
+    }
+
+    /// Append an event. Persistence is best-effort and never blocks the
+    /// caller on a failed write (the in-memory copy is the source of
+    /// truth for the live UI; the JSONL is just for crash survival).
+    pub fn record(&self, ev: &BootEvent) {
+        // Push into the ring first so a slow / failing disk doesn't lose
+        // events for the live UI.
+        {
+            let mut g = self.inner.write();
+            if g.len() == Self::CAP {
+                g.pop_front();
+            }
+            g.push_back(ev.clone());
+        }
+        tracing::info!(
+            target: "openpxe::boot_log",
+            mac = ev.mac.as_deref().unwrap_or("?"),
+            ip = ev.ip.map(|i| i.to_string()).as_deref().unwrap_or("?"),
+            target = %ev.target_id,
+            "boot event"
+        );
+        // Append to disk. We tolerate write failures — they'd show up as
+        // missing entries on the next restart only.
+        let mut line = match serde_json::to_string(ev) {
+            Ok(s) => s,
+            Err(e) => {
+                tracing::warn!(target: "openpxe::boot_log", "serialize boot event: {e}");
+                return;
+            }
+        };
+        line.push('\n');
+        if let Some(parent) = self.path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        match std::fs::OpenOptions::new()
+            .create(true)
+            .append(true)
+            .open(self.path.as_path())
+        {
+            Ok(mut f) => {
+                if let Err(e) = f.write_all(line.as_bytes()) {
+                    tracing::warn!(target: "openpxe::boot_log", "append boot_log.jsonl: {e}");
+                }
+            }
+            Err(e) => {
+                tracing::warn!(target: "openpxe::boot_log", "open boot_log.jsonl: {e}");
+            }
+        }
+    }
+
+    /// Newest-first snapshot, up to `CAP` entries.
+    #[must_use]
+    pub fn list(&self) -> Vec<BootEvent> {
+        let g = self.inner.read();
+        // VecDeque preserves insertion order; reverse so newest is first.
+        g.iter().rev().cloned().collect()
+    }
+
+    #[must_use]
+    pub fn len(&self) -> usize {
+        self.inner.read().len()
+    }
+
+    #[must_use]
+    pub fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+
+    /// Wipe in-memory + the on-disk file. Used by the `terminal clear`
+    /// equivalent or future operator action; not currently wired to a UI
+    /// button but exposed for completeness.
+    pub fn clear(&self) {
+        self.inner.write().clear();
+        let _ = std::fs::remove_file(self.path.as_path());
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::tempdir;
+
+    fn ev(target: &str, mac: Option<&str>) -> BootEvent {
+        BootEvent {
+            timestamp: OffsetDateTime::now_utc(),
+            mac: mac.map(str::to_string),
+            ip: Some("10.0.0.42".parse().unwrap()),
+            target_id: target.into(),
+            target_title: format!("{target}.iso"),
+        }
+    }
+
+    #[test]
+    fn record_then_list_is_newest_first() {
+        let dir = tempdir().unwrap();
+        let log = BootLog::load_or_default(dir.path());
+        assert!(log.is_empty());
+        log.record(&ev("alpha", Some("aa:bb:cc:00:00:01")));
+        log.record(&ev("beta", Some("aa:bb:cc:00:00:02")));
+        let list = log.list();
+        assert_eq!(list.len(), 2);
+        assert_eq!(list[0].target_id, "beta");
+        assert_eq!(list[1].target_id, "alpha");
+    }
+
+    #[test]
+    fn round_trip_through_disk() {
+        let dir = tempdir().unwrap();
+        let log = BootLog::load_or_default(dir.path());
+        log.record(&ev("alpha", Some("aa:bb:cc:00:00:01")));
+        log.record(&ev("beta", None));
+        drop(log);
+        let log2 = BootLog::load_or_default(dir.path());
+        assert_eq!(log2.len(), 2);
+        let list = log2.list();
+        assert_eq!(list[0].target_id, "beta");
+        assert_eq!(list[1].target_id, "alpha");
+        assert!(list[0].mac.is_none());
+        assert_eq!(list[1].mac.as_deref(), Some("aa:bb:cc:00:00:01"));
+    }
+
+    #[test]
+    fn ring_evicts_oldest_past_cap() {
+        let dir = tempdir().unwrap();
+        let log = BootLog::load_or_default(dir.path());
+        for i in 0..(BootLog::CAP + 5) {
+            log.record(&ev(&format!("e{i}"), None));
+        }
+        assert_eq!(log.len(), BootLog::CAP);
+        let list = log.list();
+        // Newest first; the most recent push is the last index inserted.
+        assert_eq!(list[0].target_id, format!("e{}", BootLog::CAP + 4));
+        // Oldest in-memory should be the 6th push (0..5 were evicted).
+        assert_eq!(list[BootLog::CAP - 1].target_id, "e5");
+    }
+
+    #[test]
+    fn clear_wipes_memory_and_disk() {
+        let dir = tempdir().unwrap();
+        let log = BootLog::load_or_default(dir.path());
+        log.record(&ev("alpha", None));
+        log.clear();
+        assert!(log.is_empty());
+        let log2 = BootLog::load_or_default(dir.path());
+        assert!(log2.is_empty());
+    }
+
+    #[test]
+    fn corrupt_disk_lines_are_skipped_not_fatal() {
+        // Write a file with one valid + one garbage line; loader should
+        // surface the valid one and skip the garbage.
+        let dir = tempdir().unwrap();
+        let path = dir.path().join("boot_log.jsonl");
+        let valid = serde_json::to_string(&ev("ok", Some("aa:bb:cc:00:00:09"))).unwrap();
+        std::fs::write(&path, format!("{valid}\nNOT_JSON\n{valid}\n")).unwrap();
+        let log = BootLog::load_or_default(dir.path());
+        assert_eq!(log.len(), 2);
+    }
+}

crates/core/src/branding.rs

@@ -0,0 +1,339 @@
+//! Operator-controlled branding overrides.
+//!
+//! The browser tab's logo (`/assets/logo.svg`) defaults to the bundled
+//! rainbow-horizon mark. Operators who deploy OpenPXE behind their own
+//! branding can upload a replacement that lives at
+//! `<work_dir>/branding/logo.<ext>` and is served in preference to the
+//! bundled SVG when present. Borrowed-from-FleetDM: tenant chrome, same
+//! product.
+//!
+//! Storage policy mirrors `HostBindings` / `BootLog`: in-memory cache is
+//! authoritative for the current process, disk is the source of truth on
+//! restart, and a corrupt cache file falls back to the bundled default
+//! rather than blocking startup.
+
+use parking_lot::RwLock;
+use serde::{Deserialize, Serialize};
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+
+/// Allowed MIME types for an uploaded logo. We deliberately keep this
+/// narrow — anything that can be `<img src="...">`'d into the brand
+/// block, no scripts. SVG carries the obvious XSS risk for raw inline
+/// HTML; we always serve the bytes as a separate asset with a strict
+/// content-type rather than inlining, so SVG is safe.
+pub const ALLOWED_LOGO_MIMES: &[&str] = &[
+    "image/svg+xml",
+    "image/png",
+    "image/jpeg",
+    "image/webp",
+    "image/gif",
+];
+
+/// Disk cap for an uploaded logo. PXE WebUIs are operator-facing — even
+/// a generous 2 MB cap is comfortable for any reasonable brand mark and
+/// puts a clear bound on memory + serialization cost.
+pub const MAX_LOGO_BYTES: usize = 2 * 1024 * 1024;
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+struct Inner {
+    /// File name (relative to the branding dir) for the active logo, if
+    /// any. Always under `<work_dir>/branding/`; never an absolute path
+    /// from the operator.
+    logo_filename: Option<String>,
+    /// MIME of the active logo, mirroring `logo_filename`. Cached here
+    /// so the HTTP layer can set Content-Type without re-sniffing.
+    logo_mime: Option<String>,
+}
+
+/// In-memory + on-disk override registry. Cheap to clone; locks are
+/// brief. The `branding.json` cache lives alongside the active asset
+/// inside `<work_dir>/branding/`.
+#[derive(Debug, Clone)]
+pub struct BrandingStore {
+    /// Root directory: `<work_dir>/branding/`. Created on first write.
+    dir: Arc<PathBuf>,
+    inner: Arc<RwLock<Inner>>,
+}
+
+impl BrandingStore {
+    /// Load (or initialise empty) from `<work_dir>/branding/`. Tolerates
+    /// missing directories, partial state, and corrupt JSON — a bad
+    /// cache should never block PXE for the network.
+    #[must_use]
+    pub fn load_or_default(work_dir: &Path) -> Self {
+        let dir = work_dir.join("branding");
+        let path = dir.join("branding.json");
+        let mut inner = Inner::default();
+        if let Ok(text) = std::fs::read_to_string(&path) {
+            match serde_json::from_str::<Inner>(&text) {
+                Ok(parsed) => {
+                    // Sanity: if the JSON says we have a logo but the
+                    // file is gone, clear the in-memory pointer so
+                    // /assets/logo.svg falls back to the bundled SVG
+                    // rather than 500ing on a missing file.
+                    if let Some(name) = parsed.logo_filename.as_deref() {
+                        if dir.join(name).is_file() {
+                            inner = parsed;
+                        } else {
+                            tracing::warn!(
+                                target: "openpxe::branding",
+                                file = %name,
+                                "branding.json points at missing file; clearing"
+                            );
+                        }
+                    } else {
+                        inner = parsed;
+                    }
+                }
+                Err(e) => {
+                    tracing::warn!(
+                        target: "openpxe::branding",
+                        "branding.json present but unreadable ({e}); starting empty"
+                    );
+                }
+            }
+        }
+        Self {
+            dir: Arc::new(dir),
+            inner: Arc::new(RwLock::new(inner)),
+        }
+    }
+
+    /// Absolute path to the active logo, if one is set and present on
+    /// disk. `None` means the HTTP layer should serve the bundled SVG.
+    #[must_use]
+    pub fn logo_path(&self) -> Option<PathBuf> {
+        let g = self.inner.read();
+        g.logo_filename.as_deref().map(|n| self.dir.join(n))
+    }
+
+    /// MIME of the active logo, if any. The HTTP layer pairs this with
+    /// the bytes returned by [`Self::logo_path`].
+    #[must_use]
+    pub fn logo_mime(&self) -> Option<String> {
+        self.inner.read().logo_mime.clone()
+    }
+
+    /// Replace the active logo. Returns the chosen on-disk filename so
+    /// the caller can echo it back in the API response. Old logos are
+    /// removed best-effort.
+    pub fn set_logo(&self, mime: &str, ext: &str, bytes: &[u8]) -> std::io::Result<String> {
+        std::fs::create_dir_all(self.dir.as_path())?;
+        // Single canonical filename per upload — overwriting the old one
+        // (after clearing it) keeps the directory tidy and avoids any
+        // path-traversal concern: the operator never supplies the name.
+        let safe_ext = sanitize_ext(ext);
+        let filename = format!("logo.{safe_ext}");
+        let final_path = self.dir.join(&filename);
+        // Atomic write: tmp -> rename. Guarantees the file is either
+        // entirely the old logo or entirely the new one.
+        let tmp = final_path.with_extension(format!("{safe_ext}.tmp"));
+        std::fs::write(&tmp, bytes)?;
+        std::fs::rename(&tmp, &final_path)?;
+        // Clean up any sibling logo.<otherext> so there's exactly one
+        // canonical file at any time.
+        if let Ok(entries) = std::fs::read_dir(self.dir.as_path()) {
+            for e in entries.flatten() {
+                let p = e.path();
+                let name = p
+                    .file_name()
+                    .and_then(|s| s.to_str())
+                    .unwrap_or("");
+                if name.starts_with("logo.") && name != filename {
+                    let _ = std::fs::remove_file(&p);
+                }
+            }
+        }
+
+        {
+            let mut g = self.inner.write();
+            g.logo_filename = Some(filename.clone());
+            g.logo_mime = Some(mime.to_string());
+        }
+        self.persist();
+        tracing::info!(
+            target: "openpxe::branding",
+            file = %filename, mime = %mime, size = bytes.len(),
+            "custom logo installed"
+        );
+        Ok(filename)
+    }
+
+    /// Drop the override and return to the bundled SVG.
+    pub fn clear_logo(&self) -> std::io::Result<()> {
+        let removed = {
+            let mut g = self.inner.write();
+            let removed = g.logo_filename.take();
+            g.logo_mime = None;
+            removed
+        };
+        if let Some(name) = removed {
+            let p = self.dir.join(&name);
+            let _ = std::fs::remove_file(&p);
+            tracing::info!(target: "openpxe::branding", file = %name, "custom logo cleared");
+        }
+        self.persist();
+        Ok(())
+    }
+
+    /// Convenience: true if a custom logo is configured. Surfaces on
+    /// `/api/status` so the WebUI can show "Custom logo: yes" without
+    /// fetching the asset itself.
+    #[must_use]
+    pub fn has_logo(&self) -> bool {
+        self.inner.read().logo_filename.is_some()
+    }
+
+    fn persist(&self) {
+        let snap = self.inner.read().clone();
+        let body = match serde_json::to_vec_pretty(&snap) {
+            Ok(b) => b,
+            Err(e) => {
+                tracing::warn!(target: "openpxe::branding", "serialize branding.json: {e}");
+                return;
+            }
+        };
+        if let Err(e) = std::fs::create_dir_all(self.dir.as_path()) {
+            tracing::warn!(target: "openpxe::branding", "mkdir branding/: {e}");
+            return;
+        }
+        let path = self.dir.join("branding.json");
+        let tmp = path.with_extension("json.tmp");
+        if let Err(e) = std::fs::write(&tmp, body) {
+            tracing::warn!(target: "openpxe::branding", "write branding.json tmp: {e}");
+            return;
+        }
+        if let Err(e) = std::fs::rename(&tmp, &path) {
+            tracing::warn!(target: "openpxe::branding", "rename branding.json: {e}");
+        }
+    }
+}
+
+/// Trim arbitrary operator-supplied extension strings to a small, safe
+/// alphanumeric form. Anything weird collapses to `bin`. We never let
+/// the extension affect the path beyond the final segment of `logo.<x>`.
+fn sanitize_ext(ext: &str) -> String {
+    let lc: String = ext
+        .chars()
+        .filter(char::is_ascii_alphanumeric)
+        .map(|c| c.to_ascii_lowercase())
+        .collect();
+    if lc.is_empty() || lc.len() > 5 {
+        "bin".into()
+    } else {
+        lc
+    }
+}
+
+/// Pick a safe filesystem extension from a MIME type. Returns `None`
+/// if the MIME isn't on the [`ALLOWED_LOGO_MIMES`] allowlist.
+#[must_use]
+pub fn ext_for_mime(mime: &str) -> Option<&'static str> {
+    match mime {
+        "image/svg+xml" => Some("svg"),
+        "image/png" => Some("png"),
+        "image/jpeg" => Some("jpg"),
+        "image/webp" => Some("webp"),
+        "image/gif" => Some("gif"),
+        _ => None,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::tempdir;
+
+    #[test]
+    fn empty_after_load_when_no_branding_dir() {
+        let dir = tempdir().unwrap();
+        let b = BrandingStore::load_or_default(dir.path());
+        assert!(!b.has_logo());
+        assert!(b.logo_path().is_none());
+        assert!(b.logo_mime().is_none());
+    }
+
+    #[test]
+    fn set_clear_round_trip_persists() {
+        let dir = tempdir().unwrap();
+        let b = BrandingStore::load_or_default(dir.path());
+        let name = b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake").unwrap();
+        assert_eq!(name, "logo.png");
+        assert!(b.has_logo());
+        assert_eq!(b.logo_mime().as_deref(), Some("image/png"));
+        let p = b.logo_path().unwrap();
+        assert!(p.is_file());
+
+        // Re-open and confirm the override survives a restart.
+        drop(b);
+        let b2 = BrandingStore::load_or_default(dir.path());
+        assert!(b2.has_logo());
+        assert_eq!(b2.logo_mime().as_deref(), Some("image/png"));
+
+        // Clear; the file goes away and has_logo flips off.
+        b2.clear_logo().unwrap();
+        assert!(!b2.has_logo());
+        assert!(!p.exists());
+    }
+
+    #[test]
+    fn replacing_logo_removes_old_extension_sibling() {
+        // PNG then SVG; only the SVG should remain on disk.
+        let dir = tempdir().unwrap();
+        let b = BrandingStore::load_or_default(dir.path());
+        b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake").unwrap();
+        b.set_logo("image/svg+xml", "svg", br#"<svg xmlns="http://www.w3.org/2000/svg"/>"#).unwrap();
+        let entries: Vec<_> = std::fs::read_dir(dir.path().join("branding"))
+            .unwrap()
+            .filter_map(|e| e.ok().map(|e| e.file_name().to_string_lossy().into_owned()))
+            .collect();
+        assert!(entries.iter().any(|n| n == "logo.svg"), "got {entries:?}");
+        assert!(!entries.iter().any(|n| n == "logo.png"), "stale PNG left over: {entries:?}");
+    }
+
+    #[test]
+    fn sanitize_ext_strips_separators_and_path_chars() {
+        assert_eq!(sanitize_ext("svg"), "svg");
+        // Path separators and non-alphanumerics filter out, leaving just
+        // letters. The remaining "etcpasswd" exceeds the 5-char cap so
+        // it collapses to `bin` rather than producing `etcpa`.
+        assert_eq!(sanitize_ext("../etc/passwd"), "bin");
+        // Short alphanumeric strip-through stays itself.
+        assert_eq!(sanitize_ext("../svg"), "svg");
+        assert_eq!(sanitize_ext(""), "bin");
+        assert_eq!(sanitize_ext("PNG"), "png");
+        // Anything past five chars is suspicious — collapse to `bin`.
+        assert_eq!(sanitize_ext("svgvvvv"), "bin");
+    }
+
+    #[test]
+    fn missing_file_referenced_by_json_resolves_to_empty() {
+        // If the operator nukes the file out from under the JSON cache,
+        // we should silently fall back to no-override rather than
+        // hanging on to a bogus path.
+        let dir = tempdir().unwrap();
+        let brand_dir = dir.path().join("branding");
+        std::fs::create_dir_all(&brand_dir).unwrap();
+        // Hand-write a branding.json claiming logo.png exists.
+        let inner = Inner {
+            logo_filename: Some("logo.png".into()),
+            logo_mime: Some("image/png".into()),
+        };
+        std::fs::write(
+            brand_dir.join("branding.json"),
+            serde_json::to_vec_pretty(&inner).unwrap(),
+        )
+        .unwrap();
+        let b = BrandingStore::load_or_default(dir.path());
+        assert!(!b.has_logo(), "should fall back when referenced file is missing");
+    }
+
+    #[test]
+    fn ext_for_mime_only_accepts_known_types() {
+        assert_eq!(ext_for_mime("image/png"), Some("png"));
+        assert_eq!(ext_for_mime("image/svg+xml"), Some("svg"));
+        assert_eq!(ext_for_mime("application/octet-stream"), None);
+        assert_eq!(ext_for_mime("text/html"), None);
+    }
+}

crates/core/src/client.rs

@@ -56,7 +56,9 @@ impl ClientRegistry {
     ) {
         let mut guard = self.inner.write();
         let now = OffsetDateTime::now_utc();
-        let entry = guard.entry(mac.to_string()).or_insert_with(|| ClientSnapshot {
+        let entry = guard
+            .entry(mac.to_string())
+            .or_insert_with(|| ClientSnapshot {
                 mac: mac.to_string(),
                 last_ip: ip,
                 arch,
@@ -67,8 +69,12 @@ impl ClientRegistry {
                 selected_target: None,
             });
         entry.last_seen = now;
-        if ip.is_some() { entry.last_ip = ip; }
-        if arch.is_some() { entry.arch = arch; }
+        if ip.is_some() {
+            entry.last_ip = ip;
+        }
+        if arch.is_some() {
+            entry.arch = arch;
+        }
         entry.events.push((now, event));
         // Cap event history per client to keep memory bounded.
         const MAX_EVENTS: usize = 64;

crates/core/src/config.rs

@@ -68,7 +68,7 @@ pub struct Paths {
     pub work_dir: PathBuf,
     /// Directory containing bundled iPXE binaries (undionly.kpxe, snponly.efi, ...).
     pub ipxe_dir: PathBuf,
-    /// Path to the wimboot binary for Windows ISOs (optional — feature-gated).
+    /// Path to the wimboot binary for Windows ISOs (optional — feature-controlled).
     pub wimboot_path: Option<PathBuf>,
     /// Directory under which Windows ISOs are extracted and served via SMB.
     /// Only used when `settings.windows_enabled = true`. Defaults to
@@ -128,16 +128,24 @@ impl Config {
     /// Call this after loading the TOML file so env takes precedence.
     pub fn apply_env(&mut self) {
         if let Ok(v) = std::env::var("OPENPXE_HTTP_PORT") {
-            if let Ok(p) = v.parse() { self.server.http_port = p; }
+            if let Ok(p) = v.parse() {
+                self.server.http_port = p;
+            }
         }
         if let Ok(v) = std::env::var("OPENPXE_TFTP_PORT") {
-            if let Ok(p) = v.parse() { self.server.tftp_port = p; }
+            if let Ok(p) = v.parse() {
+                self.server.tftp_port = p;
+            }
         }
         if let Ok(v) = std::env::var("OPENPXE_DHCP_PORT") {
-            if let Ok(p) = v.parse() { self.network.dhcp_port = p; }
+            if let Ok(p) = v.parse() {
+                self.network.dhcp_port = p;
+            }
         }
         if let Ok(v) = std::env::var("OPENPXE_PUBLIC_IP") {
-            if let Ok(ip) = v.parse() { self.server.public_ip = Some(ip); }
+            if let Ok(ip) = v.parse() {
+                self.server.public_ip = Some(ip);
+            }
         }
         if let Ok(v) = std::env::var("OPENPXE_DHCP_MODE") {
             self.network.dhcp_mode = match v.to_ascii_lowercase().as_str() {

crates/core/src/host_bindings.rs

@@ -1,10 +1,9 @@
 //! Per-MAC host bindings.
 //!
-//! Inspired by the Tinkerbell `smee` "MAC-prepended URL" pattern: an
-//! operator can attach a preferred boot target (a `BootEntry::id`) to a
-//! specific MAC address. When a client with that MAC arrives, the
-//! top-level boot script chains straight to that target instead of
-//! showing the interactive menu.
+//! Operators can attach a preferred boot target (a `BootEntry::id`) to a
+//! specific MAC address. When a client with that MAC arrives, the top-level
+//! boot script chains straight to that target instead of showing the
+//! interactive menu.
 //!
 //! Use cases:
 //! - "This rack of Dell servers always images with Ubuntu Server 24.04"
@@ -29,7 +28,7 @@ pub struct HostBinding {
     /// don't have to worry about case.
     pub mac: String,
     /// Preferred boot entry id (matches a `BootEntry::id` in the iso
-    /// store) OR one of the reserved menu names: `_local`, `_gate`,
+    /// store) OR one of the reserved menu names: `_local`, `_queue`,
     /// `_tools_menu`. Empty string falls back to the menu.
     pub target: String,
     /// Optional human-readable label shown in the UI (`"Tom's laptop"`,

crates/core/src/lib.rs

@@ -3,21 +3,29 @@
 #![forbid(unsafe_code)]
 
 pub mod arch;
+pub mod auth;
+pub mod boot_log;
+pub mod branding;
 pub mod client;
 pub mod config;
 pub mod error;
-pub mod queue;
 pub mod host_bindings;
 pub mod log_bus;
 pub mod metrics;
+pub mod queue;
 pub mod settings;
+pub mod sso;
 
 pub use arch::{ClientArch, FirmwareClass};
+pub use auth::{AdminAccount, AdminPublic, AdminStore};
+pub use boot_log::{BootEvent, BootLog};
+pub use branding::{ext_for_mime, BrandingStore, ALLOWED_LOGO_MIMES, MAX_LOGO_BYTES};
 pub use client::{ClientEvent, ClientRegistry, ClientSnapshot};
+pub use sso::{SsoConfig, SsoStore};
 pub use config::{Config, DhcpMode, NetworkConfig, Paths, ServerConfig};
 pub use error::{Error, Result};
-pub use queue::{Gate, DeploymentQueue};
 pub use host_bindings::{normalize_mac, HostBinding, HostBindings};
 pub use log_bus::{LogBus, LogBusLayer, LogLine};
 pub use metrics::{HttpRoute, Metrics};
+pub use queue::{DeploymentQueue, QueueEntry};
 pub use settings::{Settings, SettingsStore, TimeoutAction};

crates/core/src/metrics.rs

@@ -87,7 +87,9 @@ impl Metrics {
     }
 
     pub fn record_tftp_err(&self) {
-        self.inner.tftp_transfers_err.fetch_add(1, Ordering::Relaxed);
+        self.inner
+            .tftp_transfers_err
+            .fetch_add(1, Ordering::Relaxed);
     }
 
     // ── HTTP ───────────────────────────────────────────────────────────
@@ -181,7 +183,10 @@ impl Metrics {
             "",
         );
 
-        let _ = writeln!(out, "# HELP openpxe_tftp_transfers_total TFTP transfers, by status.");
+        let _ = writeln!(
+            out,
+            "# HELP openpxe_tftp_transfers_total TFTP transfers, by status."
+        );
         let _ = writeln!(out, "# TYPE openpxe_tftp_transfers_total counter");
         let _ = writeln!(
             out,
@@ -201,7 +206,10 @@ impl Metrics {
             "",
         );
 
-        let _ = writeln!(out, "# HELP openpxe_http_requests_total HTTP requests served, by route family.");
+        let _ = writeln!(
+            out,
+            "# HELP openpxe_http_requests_total HTTP requests served, by route family."
+        );
         let _ = writeln!(out, "# TYPE openpxe_http_requests_total counter");
         for (label, counter) in [
             ("boot_script", &i.http_boot_script),
@@ -218,14 +226,53 @@ impl Metrics {
         }
 
         // Gauges.
-        write_gauge(&mut out, "openpxe_iso_count", "ISOs currently registered (local + NFS).", i.iso_count.load(Ordering::Relaxed), "");
-        write_gauge(&mut out, "openpxe_client_count", "PXE clients seen this process lifetime.", i.client_count.load(Ordering::Relaxed), "");
-        write_gauge(&mut out, "openpxe_queue_count", "Clients currently waiting at the deployment queue.", i.queue_count.load(Ordering::Relaxed), "");
-        write_gauge(&mut out, "openpxe_queue_imaging", "Clients currently imaging (queue + assigned target).", i.queue_imaging.load(Ordering::Relaxed), "");
-        write_gauge(&mut out, "openpxe_nfs_mounts_active", "NFS shares currently mounted.", i.nfs_mounts_active.load(Ordering::Relaxed), "");
-        write_gauge(&mut out, "openpxe_uptime_seconds", "Seconds since this OpenPXE instance started.", uptime_secs, "");
+        write_gauge(
+            &mut out,
+            "openpxe_iso_count",
+            "ISOs currently registered (local + NFS).",
+            i.iso_count.load(Ordering::Relaxed),
+            "",
+        );
+        write_gauge(
+            &mut out,
+            "openpxe_client_count",
+            "PXE clients seen this process lifetime.",
+            i.client_count.load(Ordering::Relaxed),
+            "",
+        );
+        write_gauge(
+            &mut out,
+            "openpxe_queue_count",
+            "Clients currently waiting at the deployment queue.",
+            i.queue_count.load(Ordering::Relaxed),
+            "",
+        );
+        write_gauge(
+            &mut out,
+            "openpxe_queue_imaging",
+            "Clients currently imaging (queue + assigned target).",
+            i.queue_imaging.load(Ordering::Relaxed),
+            "",
+        );
+        write_gauge(
+            &mut out,
+            "openpxe_nfs_mounts_active",
+            "NFS shares currently mounted.",
+            i.nfs_mounts_active.load(Ordering::Relaxed),
+            "",
+        );
+        write_gauge(
+            &mut out,
+            "openpxe_uptime_seconds",
+            "Seconds since this OpenPXE instance started.",
+            uptime_secs,
+            "",
+        );
 
-        let _ = writeln!(out, "# HELP openpxe_build_info Build metadata. Always 1; the version is in the label.");
+        let _ = writeln!(
+            out,
+            "# HELP openpxe_build_info Build metadata. Always 1; the version is in the label."
+        );
         let _ = writeln!(out, "# TYPE openpxe_build_info gauge");
         let _ = writeln!(out, "openpxe_build_info{{version=\"{version}\"}} 1");
 
@@ -259,7 +306,11 @@ mod tests {
         m.record_http(HttpRoute::Api);
         m.set_iso_count(3);
         let out = m.render("0.2.0", 42);
-        assert_eq!(out.matches("# TYPE openpxe_dhcp_replies_total counter").count(), 1);
+        assert_eq!(
+            out.matches("# TYPE openpxe_dhcp_replies_total counter")
+                .count(),
+            1
+        );
         assert_eq!(out.matches("# TYPE openpxe_iso_count gauge").count(), 1);
         assert!(out.contains("openpxe_dhcp_replies_total{arch=\"uefi\"} 1"));
         assert!(out.contains("openpxe_dhcp_replies_total{arch=\"bios\"} 1"));

crates/core/src/queue.rs

@@ -1,16 +1,16 @@
 //! Queued Deployment queue.
 //!
 //! When a client selects "Queued Deployment" at the PXE menu, iPXE POSTs to
-//! `/api/queue/join` and receives a gate position. It then enters a poll
+//! `/api/queue/join` and receives a queue position. It then enters a poll
 //! loop hitting `/api/queue/poll/<id>`; the server holds the request open
 //! until either (a) the operator assigns an ISO from the WebUI, in which
 //! case the poll returns an iPXE `chain` URL, or (b) the poll times out
 //! (iPXE's HTTP client has its own timeout), in which case iPXE re-POSTs.
 //!
-//! The WebUI shows the queue (`GET /api/gate`) and issues
+//! The WebUI shows the queue (`GET /api/queue`) and issues
 //! `POST /api/queue/assign { iso_id, entry_ids: [...] }` to launch a single
-//! ISO across many gated clients at once. This is the "horse-race gate"
-//! UX the user asked for — every horse leaves the line simultaneously.
+//! ISO across many queued clients at once. Every waiting machine receives
+//! the assignment without operator visits at the rack.
 
 use parking_lot::RwLock;
 use serde::{Deserialize, Serialize};
@@ -23,11 +23,11 @@ use uuid::Uuid;
 
 use crate::ClientArch;
 
-/// Per-gate state visible to the WebUI.
+/// Per-client queue state visible to the WebUI.
 #[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct Gate {
+pub struct QueueEntry {
     pub id: String,
-    /// 1-based race-gate position — position 1 is whoever got there first.
+    /// 1-based queue position — position 1 is whoever got there first.
     pub position: u32,
     pub mac: String,
     pub ip: Option<IpAddr>,
@@ -55,8 +55,8 @@ struct QueueEntryInner {
 }
 
 impl QueueEntryInner {
-    fn snapshot(&self) -> Gate {
-        Gate {
+    fn snapshot(&self) -> QueueEntry {
+        QueueEntry {
             id: self.id.clone(),
             position: self.position,
             mac: self.mac.clone(),
@@ -80,21 +80,25 @@ impl DeploymentQueue {
         Arc::new(Self::default())
     }
 
-    /// Add a client to the gate. Returns the new `Gate` snapshot. If the
-    /// MAC is already queued, the existing gate is returned unchanged —
+    /// Add a client to the queue. Returns the current queue snapshot. If the
+    /// MAC is already queued, the existing entry is returned unchanged —
     /// retrying iPXE clients don't duplicate their slot.
-    pub fn join(&self, mac: &str, ip: Option<IpAddr>, arch: Option<ClientArch>) -> Gate {
+    pub fn join(&self, mac: &str, ip: Option<IpAddr>, arch: Option<ClientArch>) -> QueueEntry {
         let now = OffsetDateTime::now_utc();
         let mut guard = self.inner.write();
 
         if let Some(existing) = guard.values_mut().find(|g| g.mac == mac) {
             existing.last_poll_at = now;
-            if ip.is_some() { existing.ip = ip; }
-            if arch.is_some() { existing.arch = arch; }
+            if ip.is_some() {
+                existing.ip = ip;
+            }
+            if arch.is_some() {
+                existing.arch = arch;
+            }
             return existing.snapshot();
         }
 
-        // Race position = max(position) + 1, or 1 if empty.
+        // Queue position = max(position) + 1, or 1 if empty.
         let next_pos = guard.values().map(|g| g.position).max().unwrap_or(0) + 1;
         let id = Uuid::new_v4().to_string();
         let inner = QueueEntryInner {
@@ -113,24 +117,24 @@ impl DeploymentQueue {
         snap
     }
 
-    /// Look up the `Notify` primitive for a given gate id, for long-polling.
+    /// Look up the `Notify` primitive for a given queue entry id, for long-polling.
     #[must_use]
     pub fn notifier(&self, entry_id: &str) -> Option<Arc<Notify>> {
         self.inner.read().get(entry_id).map(|g| g.notify.clone())
     }
 
-    /// Update the last-poll timestamp (keeps the gate's "live" indicator
+    /// Update the last-poll timestamp (keeps the queue's "live" indicator
     /// fresh in the UI) and return the current snapshot. Returns None if
-    /// the gate was released/expired between requests.
-    pub fn touch(&self, entry_id: &str) -> Option<Gate> {
+    /// the entry was released/expired between requests.
+    pub fn touch(&self, entry_id: &str) -> Option<QueueEntry> {
         let mut guard = self.inner.write();
         let g = guard.get_mut(entry_id)?;
         g.last_poll_at = OffsetDateTime::now_utc();
         Some(g.snapshot())
     }
 
-    /// Operator assigns an ISO entry (boot_entry id) to one or more gates.
-    /// Returns the number of gates that were updated. Gates not in the
+    /// Operator assigns an ISO entry (boot_entry id) to one or more clients.
+    /// Returns the number of queue entries that were updated. Entries not in the
     /// queue are silently skipped.
     pub fn assign(&self, entry_ids: &[String], target: &str) -> usize {
         let mut guard = self.inner.write();
@@ -145,9 +149,9 @@ impl DeploymentQueue {
         updated
     }
 
-    /// Remove a gate and return its final snapshot. Called after the client
+    /// Remove a queue entry and return its final snapshot. Called after the client
     /// has successfully chained onto its assignment.
-    pub fn release(&self, entry_id: &str) -> Option<Gate> {
+    pub fn release(&self, entry_id: &str) -> Option<QueueEntry> {
         let mut guard = self.inner.write();
         let g = guard.remove(entry_id)?;
         g.notify.notify_waiters();
@@ -162,7 +166,7 @@ impl DeploymentQueue {
     }
 
     #[must_use]
-    pub fn list(&self) -> Vec<Gate> {
+    pub fn list(&self) -> Vec<QueueEntry> {
         let guard = self.inner.read();
         let mut v: Vec<_> = guard.values().map(QueueEntryInner::snapshot).collect();
         v.sort_by_key(|g| g.position);

crates/core/src/settings.rs

@@ -48,9 +48,9 @@ pub struct Settings {
     pub default_local_hdd: bool,
 
     /// When a client hits the Queued Deployment item, how long (seconds) to
-    /// hold it at the gate before giving up and falling back to the menu.
+    /// hold it in queue before giving up and falling back to the menu.
     /// 0 = forever.
-    pub gate_wait_max_secs: u32,
+    pub queue_wait_max_secs: u32,
 
     /// Optional DNS server advertised on the Network tab. Purely
     /// informational today — OpenPXE does not run a DNS server, but
@@ -67,11 +67,8 @@ pub enum TimeoutAction {
     /// Chain the "Boot from Local HDD" entry.
     LocalHdd,
     /// Put the client into the deployment queue, waiting for operator
-    /// assignment. The serde alias keeps v0.2.0 settings.json files
-    /// readable after the v0.3.0 rename — old `"gated_deployment"`
-    /// values deserialize transparently.
+    /// assignment.
     #[default]
-    #[serde(alias = "gated_deployment")]
     QueuedDeployment,
 }
 
@@ -84,7 +81,7 @@ impl Default for Settings {
             smb_host_override: String::new(),
             extra_kernel_args: String::new(),
             default_local_hdd: true,
-            gate_wait_max_secs: 0,
+            queue_wait_max_secs: 0,
             dns_server: String::new(),
         }
     }
@@ -115,7 +112,10 @@ impl SettingsStore {
             },
             Err(_) => Settings::default(),
         };
-        Arc::new(Self { path, inner: RwLock::new(initial) })
+        Arc::new(Self {
+            path,
+            inner: RwLock::new(initial),
+        })
     }
 
     #[must_use]
@@ -181,6 +181,12 @@ mod tests {
         assert!(s.windows_enabled);
     }
 
+    #[test]
+    fn settings_serialize_queue_naming() {
+        let text = serde_json::to_string(&Settings::default()).unwrap();
+        assert!(text.contains("queue_wait_max_secs"));
+    }
+
     #[test]
     fn corrupt_file_falls_back_to_default() {
         let dir = tempdir().unwrap();

crates/core/src/sso.rs

@@ -0,0 +1,267 @@
+//! SAML SSO configuration — FleetDM-shaped, storage-only for v0.4.5.
+//!
+//! The operator pastes their IdP's metadata XML (or its URL) and a
+//! human-readable label; v0.4.5 just persists it. The actual SAML
+//! response-validation / JIT-provisioning flow lands in a later release
+//! — for now we cover the "configurable" half so an operator can teach
+//! OpenPXE about their IdP today and flip the switch on next upgrade.
+//!
+//! Shape borrowed from <https://github.com/fleetdm/fleet>'s app-config
+//! SSO block, minus the user-RBAC fields (OpenPXE is single-tier: you
+//! have access or you don't). Entity ID is omitted from the operator
+//! UI per the v0.4.5 brief — it defaults to the advertised public base
+//! URL when SAML wiring lands, which is what most IdPs expect anyway.
+
+use parking_lot::RwLock;
+use serde::{Deserialize, Serialize};
+use std::path::PathBuf;
+use std::sync::Arc;
+
+use crate::{Error, Result};
+
+/// The configurable surface. `metadata` and `metadata_url` are mutually
+/// exclusive at apply time (one or the other identifies the IdP); the
+/// store keeps both fields so an operator can switch between them
+/// without losing the inactive one.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+pub struct SsoConfig {
+    /// Master switch — when false, all SSO machinery (planned for a
+    /// later release) is skipped regardless of the rest of the fields.
+    #[serde(default)]
+    pub enabled: bool,
+    /// Display name shown on the WebUI's login screen as the "Sign in
+    /// with X" button label. Empty/whitespace falls back to "SSO".
+    #[serde(default)]
+    pub idp_name: String,
+    /// Raw SAML metadata XML pasted by the operator. Mutually exclusive
+    /// with `metadata_url`; if both are set, the URL wins at apply time
+    /// (operators typically forget about a stale XML paste).
+    #[serde(default)]
+    pub metadata: String,
+    /// HTTPS URL where the IdP serves its metadata. Loaded lazily by the
+    /// future SAML flow; not validated here beyond a basic length cap.
+    #[serde(default)]
+    pub metadata_url: String,
+}
+
+impl SsoConfig {
+    /// Returns `true` only when the config is *usable* — enabled, and
+    /// at least one of metadata/metadata_url is present. The future
+    /// login flow will key off this; for v0.4.5 the WebUI uses it to
+    /// surface a yellow "configured but not live yet" hint.
+    #[must_use]
+    pub fn is_usable(&self) -> bool {
+        self.enabled
+            && (!self.metadata.trim().is_empty() || !self.metadata_url.trim().is_empty())
+    }
+}
+
+/// In-memory + on-disk SSO settings registry.
+#[derive(Debug, Clone)]
+pub struct SsoStore {
+    path: Arc<PathBuf>,
+    inner: Arc<RwLock<SsoConfig>>,
+}
+
+impl SsoStore {
+    /// Load from `<work_dir>/sso.json`, or start with the default empty
+    /// (`enabled = false`) config. A corrupt file falls back to default
+    /// rather than blocking startup.
+    #[must_use]
+    pub fn load_or_default(work_dir: &std::path::Path) -> Self {
+        let path = work_dir.join("sso.json");
+        let cfg = match std::fs::read_to_string(&path) {
+            Ok(text) => match serde_json::from_str::<SsoConfig>(&text) {
+                Ok(parsed) => parsed,
+                Err(e) => {
+                    tracing::warn!(
+                        target: "openpxe::sso",
+                        "sso.json present but unreadable ({e}); starting with default config"
+                    );
+                    SsoConfig::default()
+                }
+            },
+            Err(_) => SsoConfig::default(),
+        };
+        Self {
+            path: Arc::new(path),
+            inner: Arc::new(RwLock::new(cfg)),
+        }
+    }
+
+    #[must_use]
+    pub fn snapshot(&self) -> SsoConfig {
+        self.inner.read().clone()
+    }
+
+    /// Replace the whole config in one shot. Light validation: metadata
+    /// XML and URL are length-capped so an operator can't OOM us by
+    /// pasting a 10 GiB blob; the IdP UI tab clamps the input visually,
+    /// but the server enforces a hard ceiling regardless.
+    pub fn replace(&self, mut cfg: SsoConfig) -> Result<SsoConfig> {
+        cfg.idp_name = cfg.idp_name.trim().to_string();
+        cfg.metadata = cfg.metadata.trim().to_string();
+        cfg.metadata_url = cfg.metadata_url.trim().to_string();
+        if cfg.metadata.len() > MAX_METADATA_BYTES {
+            return Err(Error::Invalid(format!(
+                "metadata XML exceeds {MAX_METADATA_BYTES}-byte cap"
+            )));
+        }
+        if cfg.metadata_url.len() > MAX_URL_LEN {
+            return Err(Error::Invalid(format!(
+                "metadata_url exceeds {MAX_URL_LEN}-char cap"
+            )));
+        }
+        if !cfg.metadata_url.is_empty()
+            && !cfg.metadata_url.starts_with("http://")
+            && !cfg.metadata_url.starts_with("https://")
+        {
+            return Err(Error::Invalid(
+                "metadata_url must start with http:// or https://".into(),
+            ));
+        }
+        // If they're trying to *enable* the integration but haven't
+        // supplied either source, reject — saves a "configured but
+        // unusable" surprise later.
+        if cfg.enabled && cfg.metadata.is_empty() && cfg.metadata_url.is_empty() {
+            return Err(Error::Invalid(
+                "enable SSO requires either metadata XML or a metadata URL".into(),
+            ));
+        }
+        {
+            let mut g = self.inner.write();
+            *g = cfg.clone();
+        }
+        self.persist();
+        tracing::info!(
+            target: "openpxe::sso",
+            enabled = cfg.enabled,
+            idp = %cfg.idp_name,
+            has_xml = !cfg.metadata.is_empty(),
+            has_url = !cfg.metadata_url.is_empty(),
+            "sso configuration updated"
+        );
+        Ok(cfg)
+    }
+
+    fn persist(&self) {
+        let snap = self.inner.read().clone();
+        let body = match serde_json::to_vec_pretty(&snap) {
+            Ok(b) => b,
+            Err(e) => {
+                tracing::warn!(target: "openpxe::sso", "serialize sso.json: {e}");
+                return;
+            }
+        };
+        if let Some(parent) = self.path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        let tmp = self.path.with_extension("json.tmp");
+        if let Err(e) = std::fs::write(&tmp, body) {
+            tracing::warn!(target: "openpxe::sso", "write sso.json tmp: {e}");
+            return;
+        }
+        if let Err(e) = std::fs::rename(&tmp, self.path.as_path()) {
+            tracing::warn!(target: "openpxe::sso", "rename sso.json: {e}");
+        }
+    }
+}
+
+/// Saturation caps. The numbers are generous for any real IdP metadata
+/// document — Okta's largest is ~50 KB, Azure AD's ~30 KB.
+const MAX_METADATA_BYTES: usize = 1024 * 1024;
+const MAX_URL_LEN: usize = 2048;
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::tempdir;
+
+    #[test]
+    fn default_is_disabled_and_empty() {
+        let dir = tempdir().unwrap();
+        let s = SsoStore::load_or_default(dir.path());
+        let cfg = s.snapshot();
+        assert!(!cfg.enabled);
+        assert!(cfg.metadata.is_empty());
+        assert!(cfg.metadata_url.is_empty());
+        assert!(!cfg.is_usable());
+    }
+
+    #[test]
+    fn replace_metadata_url_round_trip_via_disk() {
+        let dir = tempdir().unwrap();
+        let s = SsoStore::load_or_default(dir.path());
+        s.replace(SsoConfig {
+            enabled: true,
+            idp_name: "Okta".into(),
+            metadata: String::new(),
+            metadata_url: "https://idp.example.com/metadata".into(),
+        })
+        .unwrap();
+        drop(s);
+        let s2 = SsoStore::load_or_default(dir.path());
+        let cfg = s2.snapshot();
+        assert!(cfg.enabled);
+        assert!(cfg.is_usable());
+        assert_eq!(cfg.idp_name, "Okta");
+        assert_eq!(cfg.metadata_url, "https://idp.example.com/metadata");
+    }
+
+    #[test]
+    fn replace_xml_paste_is_accepted() {
+        let dir = tempdir().unwrap();
+        let s = SsoStore::load_or_default(dir.path());
+        let xml = r#"<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata">test</EntityDescriptor>"#;
+        s.replace(SsoConfig {
+            enabled: true,
+            idp_name: "Test IdP".into(),
+            metadata: xml.into(),
+            metadata_url: String::new(),
+        })
+        .unwrap();
+        assert!(s.snapshot().is_usable());
+    }
+
+    #[test]
+    fn enable_without_source_is_rejected() {
+        let dir = tempdir().unwrap();
+        let s = SsoStore::load_or_default(dir.path());
+        let r = s.replace(SsoConfig {
+            enabled: true,
+            idp_name: "Okta".into(),
+            metadata: String::new(),
+            metadata_url: String::new(),
+        });
+        assert!(matches!(r, Err(Error::Invalid(_))));
+        // …and a disabled blank config is fine.
+        s.replace(SsoConfig::default()).unwrap();
+    }
+
+    #[test]
+    fn metadata_url_must_be_http_scheme() {
+        let dir = tempdir().unwrap();
+        let s = SsoStore::load_or_default(dir.path());
+        let r = s.replace(SsoConfig {
+            enabled: false,
+            idp_name: String::new(),
+            metadata: String::new(),
+            metadata_url: "ftp://idp.example.com/metadata".into(),
+        });
+        assert!(matches!(r, Err(Error::Invalid(_))));
+    }
+
+    #[test]
+    fn metadata_size_cap_enforced() {
+        let dir = tempdir().unwrap();
+        let s = SsoStore::load_or_default(dir.path());
+        let oversize = "a".repeat(MAX_METADATA_BYTES + 1);
+        let r = s.replace(SsoConfig {
+            enabled: false,
+            idp_name: String::new(),
+            metadata: oversize,
+            metadata_url: String::new(),
+        });
+        assert!(matches!(r, Err(Error::Invalid(_))));
+    }
+}

crates/dhcp-proxy/src/reply.rs

@@ -56,11 +56,17 @@ pub fn decide(ctx: &ReplyContext<'_>) -> BootDirective {
             // it'll then do the same script-fetch the iPXE path does.
             let name = ctx.arch.ipxe_bootfile().unwrap_or("snponly.efi");
             BootDirective::HttpScript {
-                url: format!("{}/ipxe/{}", ctx.public_base_url.trim_end_matches('/'), name),
+                url: format!(
+                    "{}/ipxe/{}",
+                    ctx.public_base_url.trim_end_matches('/'),
+                    name
+                ),
             }
         }
         FirmwareClass::PxeClient => match ctx.arch.ipxe_bootfile() {
-            Some(name) => BootDirective::TftpIpxe { filename: name.to_string() },
+            Some(name) => BootDirective::TftpIpxe {
+                filename: name.to_string(),
+            },
             None => BootDirective::Ignore,
         },
         FirmwareClass::Other => BootDirective::Ignore,
@@ -107,12 +113,16 @@ pub fn build_reply(ctx: &ReplyContext<'_>, directive: &BootDirective) -> Option<
 
     match directive {
         BootDirective::TftpIpxe { filename } => {
-            opts.insert(DhcpOption::TFTPServerName(ctx.our_ip.to_string().into_bytes()));
+            opts.insert(DhcpOption::TFTPServerName(
+                ctx.our_ip.to_string().into_bytes(),
+            ));
             opts.insert(DhcpOption::BootfileName(filename.as_bytes().to_vec()));
         }
         BootDirective::HttpScript { url } => {
             opts.insert(DhcpOption::BootfileName(url.as_bytes().to_vec()));
-            opts.insert(DhcpOption::TFTPServerName(ctx.our_ip.to_string().into_bytes()));
+            opts.insert(DhcpOption::TFTPServerName(
+                ctx.our_ip.to_string().into_bytes(),
+            ));
         }
         BootDirective::Ignore => return None,
     }

crates/dhcp-proxy/src/server.rs

@@ -4,9 +4,7 @@
 use crate::reply::{build_reply, decide, BootDirective, ReplyContext};
 use dhcproto::v4::{DhcpOption, Message, OptionCode};
 use dhcproto::{Decodable, Decoder, Encodable, Encoder};
-use openpxe_core::{
-    ClientArch, ClientEvent, ClientRegistry, FirmwareClass,
-};
+use openpxe_core::{ClientArch, ClientEvent, ClientRegistry, FirmwareClass};
 use socket2::{Domain, Protocol, Socket, Type};
 use std::net::{IpAddr, Ipv4Addr, SocketAddr, SocketAddrV4};
 use std::sync::Arc;
@@ -86,11 +84,22 @@ impl DhcpProxyServer {
     ) -> anyhow::Result<()> {
         let request = Message::decode(&mut Decoder::new(data))?;
 
-        let vendor_class = request.opts().get(OptionCode::ClassIdentifier).and_then(|o| {
-            if let DhcpOption::ClassIdentifier(v) = o { Some(v.as_slice()) } else { None }
+        let vendor_class = request
+            .opts()
+            .get(OptionCode::ClassIdentifier)
+            .and_then(|o| {
+                if let DhcpOption::ClassIdentifier(v) = o {
+                    Some(v.as_slice())
+                } else {
+                    None
+                }
             });
         let user_class = request.opts().get(OptionCode::UserClass).and_then(|o| {
-            if let DhcpOption::UserClass(v) = o { Some(v.as_slice()) } else { None }
+            if let DhcpOption::UserClass(v) = o {
+                Some(v.as_slice())
+            } else {
+                None
+            }
         });
         let class = FirmwareClass::classify(vendor_class, user_class);
         if matches!(class, FirmwareClass::Other) {
@@ -135,7 +144,9 @@ impl DhcpProxyServer {
         }
         self.metrics.record_dhcp_reply(arch.as_str());
 
-        let Some(reply) = build_reply(&ctx, &directive) else { return Ok(()); };
+        let Some(reply) = build_reply(&ctx, &directive) else {
+            return Ok(());
+        };
         let mut out = Vec::with_capacity(512);
         reply.encode(&mut Encoder::new(&mut out))?;
 
@@ -203,7 +214,10 @@ fn bind_udp(bind: IpAddr, port: u16, broadcast: bool) -> anyhow::Result<UdpSocke
 
 fn format_mac(chaddr: &[u8]) -> String {
     let take = chaddr.iter().take(6).copied().collect::<Vec<_>>();
-    take.iter().map(|b| format!("{b:02x}")).collect::<Vec<_>>().join(":")
+    take.iter()
+        .map(|b| format!("{b:02x}"))
+        .collect::<Vec<_>>()
+        .join(":")
 }
 
 /// Walk raw DHCP options looking for option 93 (Client System Architecture)
@@ -217,10 +231,17 @@ fn extract_raw_arch(packet: &[u8]) -> Option<u16> {
     let mut i = 0;
     while i < opts.len() {
         let code = opts[i];
-        if code == 0xff { return None; }     // END
-        if code == 0x00 { i += 1; continue; } // PAD
+        if code == 0xff {
+            return None;
+        } // END
+        if code == 0x00 {
             i += 1;
-        if i >= opts.len() { return None; }
+            continue;
+        } // PAD
+        i += 1;
+        if i >= opts.len() {
+            return None;
+        }
         let len = opts[i] as usize;
         i += 1;
         if code == 93 && len >= 2 && i + 2 <= opts.len() {

crates/http-api/Cargo.toml

@@ -31,6 +31,9 @@ bytes.workspace = true
 futures.workspace = true
 mime.workspace = true
 mime_guess.workspace = true
+uuid.workspace = true
+# v0.4.5 Forms auth: lock-free session store and cookie helpers.
+parking_lot.workspace = true
 
 [dev-dependencies]
 tokio = { workspace = true, features = ["macros", "rt", "rt-multi-thread", "time"] }

crates/http-api/src/auth.rs

@@ -0,0 +1,482 @@
+//! Forms auth layer — sessions, login, setup, middleware.
+//!
+//! Three states:
+//!
+//! * **Unconfigured** (`AdminStore::is_configured() == false`). The
+//!   middleware passes every request through — there's no one to gate
+//!   against. The UI's `/api/me` returns `setup_required: true` and the
+//!   front-end pushes the operator into the first-run flow.
+//! * **Logged in**. The session cookie maps to an in-memory session
+//!   record with an idle expiry; `/api/me` returns the username.
+//! * **Logged out**. The middleware bounces `/api/*` (with the PXE
+//!   allowlist below) to `401 Unauthorized`; the front-end intercepts
+//!   that and shows `/login`.
+//!
+//! Allowlist for unauthenticated access *after* the admin is set up:
+//!
+//! * everything outside `/api/*` (the WebUI bundle, asset chrome, PXE
+//!   script endpoints, the bundled iPXE/wimboot binaries, ISO bytes,
+//!   liveness/readiness probes, the Prometheus scrape) — these are
+//!   read-only or PXE-essential and breaking them locks out booting
+//!   machines that have no way to authenticate;
+//! * `/api/setup`, `/api/login`, `/api/me` (the auth surface itself);
+//! * `/api/queue/join`, `/api/queue/poll/:entry_id` (iPXE long-poll for
+//!   Queued Deployment — the iPXE client can't send a session cookie).
+//!
+//! Everything else inside `/api/*` requires a valid session.
+
+use crate::state::AppState;
+use axum::{
+    body::Body,
+    extract::{Request, State},
+    http::{header, HeaderValue, StatusCode},
+    middleware::Next,
+    response::{IntoResponse, Response},
+    Json,
+};
+use openpxe_core::AdminPublic;
+use parking_lot::RwLock;
+use serde::{Deserialize, Serialize};
+use serde_json::json;
+use std::collections::HashMap;
+use std::sync::Arc;
+use std::time::{Duration, Instant};
+use uuid::Uuid;
+
+/// Idle session lifetime. Sliding — every authenticated request resets
+/// the expiry. 24h is the Sonarr default and matches what most operators
+/// expect for an on-prem admin console.
+const SESSION_TTL: Duration = Duration::from_hours(24);
+
+/// Name of the cookie we set/read. Distinct from a generic `session=`
+/// to avoid collisions with anything else sharing the host.
+pub const SESSION_COOKIE: &str = "openpxe_session";
+
+#[derive(Debug, Clone)]
+struct Session {
+    username: String,
+    expires_at: Instant,
+}
+
+/// In-memory session table. Cheap to clone (Arc-shared) and contention
+/// is rare — operators sign in once per browser session.
+#[derive(Debug, Clone, Default)]
+pub struct SessionStore {
+    inner: Arc<RwLock<HashMap<String, Session>>>,
+}
+
+impl SessionStore {
+    /// Mint a fresh session for `username` and return the opaque cookie
+    /// value. UUID v4 gives us 122 random bits — comfortably more than
+    /// the 64-128 bits typical for session IDs.
+    #[must_use]
+    pub fn create(&self, username: &str) -> String {
+        let id = Uuid::new_v4().simple().to_string();
+        let session = Session {
+            username: username.to_string(),
+            expires_at: Instant::now() + SESSION_TTL,
+        };
+        self.inner.write().insert(id.clone(), session);
+        id
+    }
+
+    /// Resolve a cookie value to the owning username, refreshing the
+    /// idle timer. Returns `None` for missing / expired sessions and
+    /// proactively evicts the expired entry so the map doesn't grow
+    /// unbounded across long-lived deployments.
+    pub fn touch(&self, id: &str) -> Option<String> {
+        let mut g = self.inner.write();
+        let s = g.get_mut(id)?;
+        if s.expires_at <= Instant::now() {
+            g.remove(id);
+            return None;
+        }
+        s.expires_at = Instant::now() + SESSION_TTL;
+        Some(s.username.clone())
+    }
+
+    /// Invalidate one session (the user's `/api/logout`).
+    pub fn revoke(&self, id: &str) {
+        self.inner.write().remove(id);
+    }
+
+    /// Invalidate every session — used after a credentials rotation so
+    /// stale cookies for the old password can't keep operating.
+    pub fn revoke_all(&self) {
+        self.inner.write().clear();
+    }
+
+    /// Periodic / opportunistic GC. Not currently scheduled (we evict
+    /// on touch), but exposed for a future janitor task.
+    pub fn gc(&self) {
+        let now = Instant::now();
+        self.inner.write().retain(|_, s| s.expires_at > now);
+    }
+
+    #[must_use]
+    pub fn len(&self) -> usize {
+        self.inner.read().len()
+    }
+
+    #[must_use]
+    pub fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+}
+
+// ── Cookie helpers ────────────────────────────────────────────────────────
+
+fn cookie_attrs(value: &str, max_age: Option<i64>) -> String {
+    // Same flags FleetDM and Sonarr ship by default:
+    //   - HttpOnly: blocks JS access (XSS containment)
+    //   - SameSite=Lax: allows top-level GET navigations from the IdP
+    //     to land authenticated when SSO arrives, but blocks
+    //     cross-site POST CSRF;
+    //   - Path=/: the cookie applies to the whole app;
+    //   - no Secure flag yet — many operators host on plain http://
+    //     LAN IPs (Unraid templates default to that); we'll add Secure
+    //     opportunistically when we add a TLS terminator option.
+    // SESSION_TTL fits in 32 bits comfortably (24h ≈ 86400 seconds); we
+    // never overflow i64, but clippy's `cast_possible_wrap` lint wants
+    // us to be explicit. `cast_signed` is the documented form.
+    let lifetime = max_age.unwrap_or_else(|| SESSION_TTL.as_secs().cast_signed());
+    format!(
+        "{SESSION_COOKIE}={value}; Path=/; HttpOnly; SameSite=Lax; Max-Age={lifetime}"
+    )
+}
+
+fn parse_cookie(headers: &axum::http::HeaderMap) -> Option<String> {
+    // `Cookie: a=b; c=d` parsing — small enough not to drag in a crate.
+    let raw = headers.get(header::COOKIE)?.to_str().ok()?;
+    for part in raw.split(';') {
+        let part = part.trim();
+        if let Some(v) = part.strip_prefix(&format!("{SESSION_COOKIE}=")) {
+            return Some(v.to_string());
+        }
+    }
+    None
+}
+
+// ── Middleware ────────────────────────────────────────────────────────────
+
+/// Return `true` if `path` is on the allowlist and should bypass the
+/// session check. The middleware applies this rule only when the admin
+/// account is configured; before then everything is open.
+fn is_public_path(path: &str) -> bool {
+    // Non-API paths: WebUI bundle, PXE chain, ISO bytes, health probes,
+    // metrics. All read-only / PXE-essential.
+    if !path.starts_with("/api/") {
+        return true;
+    }
+    // Auth surface and iPXE long-poll endpoints (no cookie available).
+    matches!(
+        path,
+        "/api/setup" | "/api/login" | "/api/logout" | "/api/me"
+    ) || path.starts_with("/api/queue/join")
+        || path.starts_with("/api/queue/poll/")
+}
+
+/// Axum middleware: gate `/api/*` behind a valid session, with the
+/// allowlist above. `State<AppState>` reaches in for the admin store +
+/// session store.
+pub async fn require_auth(
+    State(state): State<AppState>,
+    req: Request<Body>,
+    next: Next,
+) -> Response {
+    // Bypass entirely while unconfigured. The /api/setup endpoint is
+    // the only one that can flip this back to "configured", and it
+    // refuses to run a second time. Tests + fresh installs ride this
+    // path.
+    if !state.admin.is_configured() {
+        return next.run(req).await;
+    }
+    let path = req.uri().path();
+    if is_public_path(path) {
+        return next.run(req).await;
+    }
+    // Authenticated path. The cookie must be present, map to a live
+    // session, and the TTL refresh happens as a side-effect.
+    let token = parse_cookie(req.headers());
+    if let Some(t) = token {
+        if state.sessions.touch(&t).is_some() {
+            return next.run(req).await;
+        }
+    }
+    (
+        StatusCode::UNAUTHORIZED,
+        Json(json!({ "error": "authentication required" })),
+    )
+        .into_response()
+}
+
+// ── Handlers ──────────────────────────────────────────────────────────────
+
+#[derive(Debug, Deserialize)]
+pub struct SetupBody {
+    pub username: String,
+    pub password: String,
+}
+
+/// First-run setup. Refuses to run once an admin already exists — that
+/// guards against a leaked WebUI being re-bootstrapped by an attacker
+/// who's seen the deployment URL. After bootstrap, the new session
+/// cookie is set so the operator goes straight to the dashboard.
+pub async fn api_setup(
+    State(state): State<AppState>,
+    Json(body): Json<SetupBody>,
+) -> Response {
+    if state.admin.is_configured() {
+        return (
+            StatusCode::CONFLICT,
+            Json(json!({ "error": "admin account already configured" })),
+        )
+            .into_response();
+    }
+    match state.admin.bootstrap(&body.username, &body.password) {
+        Ok(pub_) => {
+            let session = state.sessions.create(&pub_.username);
+            login_response(StatusCode::CREATED, &pub_, &session)
+        }
+        Err(openpxe_core::Error::Invalid(msg)) => {
+            (StatusCode::BAD_REQUEST, Json(json!({ "error": msg }))).into_response()
+        }
+        Err(e) => (
+            StatusCode::INTERNAL_SERVER_ERROR,
+            Json(json!({ "error": format!("{e}") })),
+        )
+            .into_response(),
+    }
+}
+
+#[derive(Debug, Deserialize)]
+pub struct LoginBody {
+    pub username: String,
+    pub password: String,
+}
+
+pub async fn api_login(State(state): State<AppState>, Json(body): Json<LoginBody>) -> Response {
+    // Brief, deliberately vague — "invalid credentials" rather than
+    // "no such user" / "wrong password". Same anti-enumeration posture
+    // as Sonarr/Radarr.
+    let pub_ = match state.admin.verify(&body.username, &body.password) {
+        Ok(Some(u)) => u,
+        Ok(None) => {
+            return (
+                StatusCode::UNAUTHORIZED,
+                Json(json!({ "error": "invalid username or password" })),
+            )
+                .into_response();
+        }
+        Err(e) => {
+            return (
+                StatusCode::INTERNAL_SERVER_ERROR,
+                Json(json!({ "error": format!("{e}") })),
+            )
+                .into_response();
+        }
+    };
+    let session = state.sessions.create(&pub_.username);
+    login_response(StatusCode::OK, &pub_, &session)
+}
+
+pub async fn api_logout(
+    State(state): State<AppState>,
+    headers: axum::http::HeaderMap,
+) -> Response {
+    if let Some(t) = parse_cookie(&headers) {
+        state.sessions.revoke(&t);
+    }
+    // Stomp the cookie unconditionally — even if the request didn't
+    // carry one, the browser shouldn't keep a stale value.
+    let mut resp = StatusCode::NO_CONTENT.into_response();
+    resp.headers_mut().insert(
+        header::SET_COOKIE,
+        HeaderValue::from_str(&cookie_attrs("", Some(0))).unwrap(),
+    );
+    resp
+}
+
+/// Status surface for the front-end shell. Returns four cases:
+///
+/// * `setup_required: true` — no admin yet; show first-run page.
+/// * `authenticated: false` — admin exists, no session; show login.
+/// * `authenticated: true` + `user` — let the dashboard load.
+pub async fn api_me(State(state): State<AppState>, headers: axum::http::HeaderMap) -> Response {
+    if !state.admin.is_configured() {
+        return (
+            StatusCode::OK,
+            Json(json!({
+                "setup_required": true,
+                "authenticated": false,
+            })),
+        )
+            .into_response();
+    }
+    let token = parse_cookie(&headers);
+    let username = token.as_deref().and_then(|t| state.sessions.touch(t));
+    match username {
+        Some(u) => (
+            StatusCode::OK,
+            Json(json!({
+                "setup_required": false,
+                "authenticated": true,
+                "user": state.admin.snapshot(),
+                "session_user": u,
+            })),
+        )
+            .into_response(),
+        None => (
+            StatusCode::OK,
+            Json(json!({
+                "setup_required": false,
+                "authenticated": false,
+            })),
+        )
+            .into_response(),
+    }
+}
+
+#[derive(Debug, Deserialize)]
+pub struct UpdateCredentialsBody {
+    pub current_password: String,
+    #[serde(default)]
+    pub new_username: Option<String>,
+    #[serde(default)]
+    pub new_password: Option<String>,
+}
+
+/// Rotate the admin's username and/or password. Auth middleware has
+/// already proved the caller owns a session; we additionally require
+/// the *current* password to prove "person at the keyboard right now".
+/// On success we issue a fresh session cookie keyed to the (possibly
+/// new) username and revoke every prior session so a stolen cookie
+/// from before the rotation stops working.
+pub async fn api_update_credentials(
+    State(state): State<AppState>,
+    Json(body): Json<UpdateCredentialsBody>,
+) -> Response {
+    if !state.admin.is_configured() {
+        return (
+            StatusCode::CONFLICT,
+            Json(json!({ "error": "no admin configured" })),
+        )
+            .into_response();
+    }
+    let result = state.admin.update_credentials(
+        &body.current_password,
+        body.new_username.as_deref(),
+        body.new_password.as_deref(),
+    );
+    match result {
+        Ok(pub_) => {
+            state.sessions.revoke_all();
+            let session = state.sessions.create(&pub_.username);
+            login_response(StatusCode::OK, &pub_, &session)
+        }
+        Err(openpxe_core::Error::Invalid(msg)) => {
+            (StatusCode::BAD_REQUEST, Json(json!({ "error": msg }))).into_response()
+        }
+        Err(e) => (
+            StatusCode::INTERNAL_SERVER_ERROR,
+            Json(json!({ "error": format!("{e}") })),
+        )
+            .into_response(),
+    }
+}
+
+#[derive(Debug, Serialize)]
+struct LoginPayload<'a> {
+    user: &'a AdminPublic,
+    authenticated: bool,
+}
+
+fn login_response(status: StatusCode, user: &AdminPublic, session: &str) -> Response {
+    let body = Json(LoginPayload {
+        user,
+        authenticated: true,
+    });
+    let mut resp = (status, body).into_response();
+    resp.headers_mut().insert(
+        header::SET_COOKIE,
+        HeaderValue::from_str(&cookie_attrs(session, None)).unwrap(),
+    );
+    resp
+}
+
+// ── Tests ─────────────────────────────────────────────────────────────────
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn session_create_touch_revoke() {
+        let s = SessionStore::default();
+        assert!(s.is_empty());
+        let t = s.create("admin");
+        assert_eq!(s.len(), 1);
+        assert_eq!(s.touch(&t).as_deref(), Some("admin"));
+        s.revoke(&t);
+        assert!(s.is_empty());
+        // Stale token doesn't error, just returns None.
+        assert!(s.touch(&t).is_none());
+    }
+
+    #[test]
+    fn session_revoke_all_clears() {
+        let s = SessionStore::default();
+        let _ = s.create("a");
+        let _ = s.create("b");
+        assert_eq!(s.len(), 2);
+        s.revoke_all();
+        assert!(s.is_empty());
+    }
+
+    #[test]
+    fn public_path_allowlist() {
+        // PXE + chrome paths bypass auth.
+        for p in [
+            "/", "/assets/app.js", "/boot.ipxe", "/boot/fake.ipxe",
+            "/iso/fake.iso", "/ipxe/snponly.efi", "/healthz", "/readyz",
+            "/metrics",
+        ] {
+            assert!(is_public_path(p), "expected {p} to be public");
+        }
+        // Auth surface itself is public.
+        for p in ["/api/setup", "/api/login", "/api/logout", "/api/me"] {
+            assert!(is_public_path(p), "expected {p} to be public");
+        }
+        // iPXE long-poll endpoints are public (no cookie available).
+        assert!(is_public_path("/api/queue/join"));
+        assert!(is_public_path("/api/queue/poll/abc"));
+        // Everything else under /api/* must auth.
+        for p in [
+            "/api/isos",
+            "/api/isos/x/category",
+            "/api/storage/disk",
+            "/api/branding/logo",
+            "/api/sso",
+            "/api/hosts",
+        ] {
+            assert!(!is_public_path(p), "expected {p} to require auth");
+        }
+    }
+
+    #[test]
+    fn cookie_parse_picks_session_value() {
+        let mut h = axum::http::HeaderMap::new();
+        h.insert(
+            header::COOKIE,
+            HeaderValue::from_str(&format!("foo=bar; {SESSION_COOKIE}=abc123; baz=qux"))
+                .unwrap(),
+        );
+        assert_eq!(parse_cookie(&h).as_deref(), Some("abc123"));
+        // Different name → None.
+        let mut h2 = axum::http::HeaderMap::new();
+        h2.insert(header::COOKIE, HeaderValue::from_str("foo=bar").unwrap());
+        assert!(parse_cookie(&h2).is_none());
+        // No cookie header at all → None.
+        assert!(parse_cookie(&axum::http::HeaderMap::new()).is_none());
+    }
+}

crates/http-api/src/ipxe_script.rs

@@ -23,8 +23,8 @@
 //! There is intentionally no UI path to upload a custom `.ipxe` script.
 
 use openpxe_core::{Settings, TimeoutAction};
-use openpxe_iso_store::{BootEntry, BootKind, IsoMeta};
 use openpxe_iso_store::introspect::DistroFamily;
+use openpxe_iso_store::{BootEntry, BootKind, IsoMeta};
 use std::fmt::Write as _;
 
 /// Top-level OpenPXE boot menu. Serialized identically for BIOS and UEFI
@@ -49,9 +49,15 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
     let _ = writeln!(s, "set cls ${{esc:string}}[2J");
     let _ = writeln!(s, ":menu");
     let _ = writeln!(s, "menu OpenPXE - network boot menu");
-    let _ = writeln!(s, "item --gap -- ------------------------- Default -------------------------");
+    let _ = writeln!(
+        s,
+        "item --gap -- ------------------------- Default -------------------------"
+    );
     let _ = writeln!(s, "item local            Boot from Local HDD");
-    let _ = writeln!(s, "item --gap -- ----------------------- Installers -----------------------");
+    let _ = writeln!(
+        s,
+        "item --gap -- ----------------------- Installers -----------------------"
+    );
     if has_family(isos, is_linux_family) {
         let _ = writeln!(s, "item linux            Linux Installers  >");
     } else {
@@ -64,9 +70,15 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
     } else {
         let _ = writeln!(s, "item --gap -- (Windows support disabled in Settings)");
     }
-    let _ = writeln!(s, "item --gap -- -------------------------- Tools --------------------------");
+    let _ = writeln!(
+        s,
+        "item --gap -- -------------------------- Tools --------------------------"
+    );
     let _ = writeln!(s, "item tools            Tools  >");
-    let _ = writeln!(s, "item --gap -- ---------------------- Queued Deployment ---------------------");
+    let _ = writeln!(
+        s,
+        "item --gap -- ---------------------- Queued Deployment ---------------------"
+    );
     let _ = writeln!(s, "item queue            Queued Deployment  (join queue)");
     let _ = writeln!(s, "item --gap");
     let _ = writeln!(s, "item --key x exit     Exit iPXE");
@@ -74,18 +86,39 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
     if matches!(settings.timeout_action, TimeoutAction::Stay) {
         let _ = writeln!(s, "choose --default {default_item} target || goto menu");
     } else {
-        let _ = writeln!(s, "choose --default {default_item} --timeout {timeout_ms} target || goto menu");
+        let _ = writeln!(
+            s,
+            "choose --default {default_item} --timeout {timeout_ms} target || goto menu"
+        );
     }
 
     // iPXE's `||` is strict about what follows. Each test uses `goto menu`
     // as the fallthrough target so the parser never sees a bare `||` with
     // trailing whitespace — some iPXE builds reject that.
-    let _ = writeln!(s, "iseq ${{target}} local   && chain {base}/boot/_local.ipxe        || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} linux   && chain {base}/boot/_linux_menu.ipxe   || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} windows && chain {base}/boot/_windows_menu.ipxe || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} tools   && chain {base}/boot/_tools_menu.ipxe   || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} queue   && chain {base}/boot/_queue.ipxe         || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} exit    && exit                                 || goto menu");
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} local   && chain {base}/boot/_local.ipxe        || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} linux   && chain {base}/boot/_linux_menu.ipxe   || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} windows && chain {base}/boot/_windows_menu.ipxe || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} tools   && chain {base}/boot/_tools_menu.ipxe   || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} queue   && chain {base}/boot/_queue.ipxe         || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} exit    && exit                                 || goto menu"
+    );
     let _ = writeln!(s, "goto menu");
     s
 }
@@ -95,27 +128,48 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
 #[must_use]
 pub fn render_family_menu(isos: &[IsoMeta], base_url: &str, is_windows: bool) -> String {
     let base = base_url.trim_end_matches('/');
-    let title = if is_windows { "Windows Installers" } else { "Linux Installers" };
+    let title = if is_windows {
+        "Windows Installers"
+    } else {
+        "Linux Installers"
+    };
     let label = if is_windows { "windows" } else { "linux" };
     let mut s = String::new();
     let _ = writeln!(s, "#!ipxe");
     let _ = writeln!(s, "set base-url {base}");
     let _ = writeln!(s, ":menu");
     let _ = writeln!(s, "menu OpenPXE - {title}");
-    let filter: fn(DistroFamily) -> bool =
-        if is_windows { is_windows_family } else { is_linux_family };
+    let filter: fn(DistroFamily) -> bool = if is_windows {
+        is_windows_family
+    } else {
+        is_linux_family
+    };
     let mut count = 0;
     for iso in isos {
-        if !filter(iso.introspection.family) { continue; }
+        if !filter(iso.introspection.family) {
+            continue;
+        }
+        // v0.4.4: ISOs the operator flipped to the Tools category move
+        // out of the OS installer submenus entirely — they only appear
+        // under Tools. Without this filter the operator would see the
+        // same ISO in both menus.
+        if matches!(iso.category, openpxe_iso_store::IsoCategory::Tools) {
+            continue;
+        }
         for entry in &iso.boot_entries {
             let size_label = fmt_size_mib(iso.size_bytes);
             let key = hotkey_for_index(count);
             // Visual hint: a leading `*` marks password-protected entries.
             // ASCII only — iPXE's menu console mangles non-ASCII on some
             // firmwares.
-            let lock = if iso.is_password_protected() { "*" } else { " " };
+            let lock = if iso.is_password_protected() {
+                "*"
+            } else {
+                " "
+            };
             let _ = writeln!(
-                s, "item {}{} {}[{:>6}] {}",
+                s,
+                "item {}{} {}[{:>6}] {}",
                 key,
                 entry.id,
                 lock,
@@ -131,8 +185,18 @@ pub fn render_family_menu(isos: &[IsoMeta], base_url: &str, is_windows: bool) ->
     let _ = writeln!(s, "item --gap");
     let _ = writeln!(s, "item --key b back   < Back to main menu");
     let _ = writeln!(s, "choose target || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} back && chain {base}/boot.ipxe || goto menu");
-    let _ = writeln!(s, "chain {base}/boot/${{target}}.ipxe || goto menu");
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} back && chain {base}/boot.ipxe || goto menu"
+    );
+    // Pass `?mac=${mac}` so the per-entry handler can record the booting
+    // client into the Host log. iPXE substitutes `${mac}` before
+    // the HTTP fetch; if the firmware can't resolve it the literal
+    // `${mac}` is sent and the server treats it as "unknown".
+    let _ = writeln!(
+        s,
+        "chain {base}/boot/${{target}}.ipxe?mac=${{mac}} || goto menu"
+    );
     s
 }
 
@@ -153,15 +217,52 @@ fn hotkey_for_index(i: usize) -> String {
     }
 }
 
-/// Tools submenu — Utilities, Shell, NIC Info, Reboot, Exit to firmware.
+/// Tools submenu — Utilities, Shell, NIC Info, Reboot, Exit to firmware,
+/// plus any ISOs the operator flipped to [`IsoCategory::Tools`] in the
+/// Storage tab. The category-Tools ISOs render first so frequently used
+/// recovery / hardware tools are reachable with a single number key
+/// before the built-in shortcuts.
 #[must_use]
-pub fn render_tools_menu(base_url: &str) -> String {
+pub fn render_tools_menu(isos: &[IsoMeta], base_url: &str) -> String {
     let base = base_url.trim_end_matches('/');
     let mut s = String::new();
     let _ = writeln!(s, "#!ipxe");
     let _ = writeln!(s, "set base-url {base}");
     let _ = writeln!(s, ":menu");
     let _ = writeln!(s, "menu OpenPXE - Tools");
+
+    // Operator-categorized tool ISOs (hotkeys 1..9), each chained the
+    // same way as a per-family menu pick — through the boot-entry id
+    // route, carrying `?mac=${mac}` for Host log attribution.
+    let mut count = 0;
+    for iso in isos {
+        if !matches!(iso.category, openpxe_iso_store::IsoCategory::Tools) {
+            continue;
+        }
+        for entry in &iso.boot_entries {
+            let size_label = fmt_size_mib(iso.size_bytes);
+            let key = hotkey_for_index(count);
+            let lock = if iso.is_password_protected() {
+                "*"
+            } else {
+                " "
+            };
+            let _ = writeln!(
+                s,
+                "item {}{} {}[{:>6}] {}",
+                key,
+                entry.id,
+                lock,
+                size_label,
+                escape_label(&entry.title),
+            );
+            count += 1;
+        }
+    }
+    if count > 0 {
+        let _ = writeln!(s, "item --gap");
+    }
+
     let _ = writeln!(s, "item --key u util     Utilities  (memtest, ...)");
     let _ = writeln!(s, "item --key s shell    OpenPXE Shell");
     let _ = writeln!(s, "item --key n nic      Network Card Info");
@@ -171,13 +272,36 @@ pub fn render_tools_menu(base_url: &str) -> String {
     let _ = writeln!(s, "item --gap");
     let _ = writeln!(s, "item --key b back     < Back to main menu");
     let _ = writeln!(s, "choose target || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} util     && chain {base}/boot/_util.ipxe  || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} shell    && chain {base}/boot/_shell.ipxe || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} nic      && chain {base}/boot/_nic.ipxe   || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} reboot   && reboot                        || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} firmware && exit 0                        || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} back     && chain {base}/boot.ipxe        || goto menu");
-    let _ = writeln!(s, "goto menu");
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} util     && chain {base}/boot/_util.ipxe  || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} shell    && chain {base}/boot/_shell.ipxe || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} nic      && chain {base}/boot/_nic.ipxe   || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} reboot   && reboot                        || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} firmware && exit 0                        || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} back     && chain {base}/boot.ipxe        || goto menu"
+    );
+    // Fall-through for category-Tools ISO ids — same as the family
+    // submenu, carrying `?mac=${mac}` for the boot log.
+    let _ = writeln!(
+        s,
+        "chain {base}/boot/${{target}}.ipxe?mac=${{mac}} || goto menu"
+    );
     s
 }
 
@@ -190,8 +314,15 @@ pub fn render_local_hdd(base_url: &str) -> String {
     let mut s = String::new();
     let _ = writeln!(s, "#!ipxe");
     let _ = writeln!(s, "# Boot from Local HDD - platform-sensitive");
-    let _ = writeln!(s, "iseq ${{platform}} pcbios && sanboot --no-describe --drive 0x80 || ");
-    let _ = writeln!(s, "# UEFI path: fall through to the firmware's next boot entry");
+    let _ = writeln!(
+        s,
+        "iseq ${{platform}} pcbios && sanboot --no-describe --drive 0x80 || goto uefi"
+    );
+    let _ = writeln!(s, ":uefi");
+    let _ = writeln!(
+        s,
+        "# UEFI path: fall through to the firmware's next boot entry"
+    );
     let _ = writeln!(s, "exit 0");
     let _ = writeln!(s, "# If the above exit returns, loop back to the main menu");
     let _ = writeln!(s, "chain {base}/boot.ipxe");
@@ -212,8 +343,14 @@ pub fn render_util(base_url: &str) -> String {
     let _ = writeln!(s, "item --gap");
     let _ = writeln!(s, "item back         < Back");
     let _ = writeln!(s, "choose target || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} memtest && chain {base}/ipxe/memtest.bin || ");
-    let _ = writeln!(s, "iseq ${{target}} back && chain {base}/boot/_tools_menu.ipxe || ");
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} memtest && chain {base}/ipxe/memtest.bin || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} back && chain {base}/boot/_tools_menu.ipxe || goto menu"
+    );
     let _ = writeln!(s, "goto menu");
     s
 }
@@ -260,7 +397,10 @@ pub fn render_queue_entry(base_url: &str) -> String {
     let base = base_url.trim_end_matches('/');
     let mut s = String::new();
     let _ = writeln!(s, "#!ipxe");
-    let _ = writeln!(s, "# Queued Deployment - join the queue and wait for operator");
+    let _ = writeln!(
+        s,
+        "# Queued Deployment - join the queue and wait for operator"
+    );
     let _ = writeln!(s, "echo Joining deployment queue...");
     // imgfetch writes the body to a file in iPXE's transient FS; we read
     // the queue entry id out of the Location-style header by asking the server
@@ -277,7 +417,11 @@ pub fn render_entry(entry: &BootEntry, settings: &Settings, base_url: &str) -> S
     let _ = writeln!(s, "#!ipxe");
     let _ = writeln!(s, "set base-url {base}");
     match &entry.kind {
-        BootKind::LinuxKernel { kernel_url, initrd_urls, args } => {
+        BootKind::LinuxKernel {
+            kernel_url,
+            initrd_urls,
+            args,
+        } => {
             let mut cmdline = args.cmdline.replace("${base-url}", base);
             if !settings.extra_kernel_args.trim().is_empty() {
                 cmdline.push(' ');
@@ -328,7 +472,12 @@ fn has_family(isos: &[IsoMeta], pred: fn(DistroFamily) -> bool) -> bool {
 }
 
 fn escape_label(s: &str) -> String {
-    s.chars().map(|c| match c { '\n' | '\r' => ' ', c => c }).collect()
+    s.chars()
+        .map(|c| match c {
+            '\n' | '\r' => ' ',
+            c => c,
+        })
+        .collect()
 }
 
 /// Render the password-prompt script for a protected boot entry.
@@ -362,12 +511,20 @@ pub fn render_password_prompt(entry_id: &str, iso_filename: &str, base_url: &str
     let _ = writeln!(s, "echo ==========================================");
     let _ = writeln!(s, "set password ");
     let _ = writeln!(s, "read --secret password");
-    let _ = writeln!(s, "iseq ${{password}} \"\" && chain {base}/boot.ipxe || goto submit");
-    let _ = writeln!(s, ":submit");
-    let _ = writeln!(s, "echo Verifying...");
     let _ = writeln!(
         s,
-        "chain {base}/boot/{entry_id}.ipxe?token=${{password:uristring}} || chain {base}/boot.ipxe"
+        "iseq ${{password}} \"\" && chain {base}/boot.ipxe || goto submit"
+    );
+    let _ = writeln!(s, ":submit");
+    let _ = writeln!(s, "echo Verifying...");
+    // Carry `mac=${mac}` alongside the token so a successful unlock
+    // records the actual client MAC into the Host log. On
+    // older iPXE that can't resolve `${mac}` the server just stores it
+    // as "unknown" rather than refusing to boot.
+    let _ = writeln!(
+        s,
+        "chain {base}/boot/{entry_id}.ipxe?token=${{password:uristring}}&mac=${{mac}} \
+         || chain {base}/boot.ipxe"
     );
     s
 }
@@ -384,7 +541,10 @@ pub fn render_password_failed(entry_id: &str, base_url: &str) -> String {
     let _ = writeln!(s, "echo");
     let _ = writeln!(s, "echo Wrong password.");
     let _ = writeln!(s, "sleep 2");
-    let _ = writeln!(s, "chain {base}/boot/{entry_id}.ipxe || chain {base}/boot.ipxe");
+    let _ = writeln!(
+        s,
+        "chain {base}/boot/{entry_id}.ipxe || chain {base}/boot.ipxe"
+    );
     s
 }
 
@@ -414,4 +574,27 @@ mod password_tests {
         // Re-target the entry so the prompt flow runs again.
         assert!(s.contains("chain http://10.0.0.5/boot/alpha-linux.ipxe"));
     }
+
+    #[test]
+    fn generated_scripts_do_not_emit_bare_or_trailing_fallbacks() {
+        let settings = Settings::default();
+        let scripts = [
+            render_menu(&[], &settings, "http://10.0.0.5"),
+            render_tools_menu(&[], "http://10.0.0.5"),
+            render_local_hdd("http://10.0.0.5"),
+            render_util("http://10.0.0.5"),
+            render_shell("http://10.0.0.5"),
+            render_nic_info("http://10.0.0.5"),
+            render_queue_entry("http://10.0.0.5"),
+            render_password_failed("alpha-linux", "http://10.0.0.5"),
+        ];
+        for script in scripts {
+            for line in script.lines() {
+                assert!(
+                    !line.trim_end().ends_with("||"),
+                    "bare iPXE fallback operator in line: {line}\nscript:\n{script}"
+                );
+            }
+        }
+    }
 }

crates/http-api/src/iso_fs.rs

@@ -31,7 +31,9 @@ pub fn lookup(iso_path: &Path, in_iso_path: &str) -> Option<FileLocation> {
         .split('/')
         .filter(|c| !c.is_empty())
         .collect();
-    if components.is_empty() { return None; }
+    if components.is_empty() {
+        return None;
+    }
     walk(&mut f, root.offset, root.length, &components)
 }
 
@@ -40,11 +42,16 @@ fn read_root_directory(f: &mut std::fs::File) -> Option<FileLocation> {
     let mut pvd = [0u8; 2048];
     f.seek(SeekFrom::Start(16 * SECTOR)).ok()?;
     f.read_exact(&mut pvd).ok()?;
-    if pvd[0] != 0x01 || &pvd[1..6] != b"CD001" { return None; }
+    if pvd[0] != 0x01 || &pvd[1..6] != b"CD001" {
+        return None;
+    }
     // Root directory record is at offset 156, length 34.
     let rec = &pvd[156..156 + 34];
     let (offset, length) = parse_dir_record_ext(rec)?;
-    Some(FileLocation { offset: offset * SECTOR, length })
+    Some(FileLocation {
+        offset: offset * SECTOR,
+        length,
+    })
 }
 
 /// Walk components down the directory tree starting at `dir_offset`.
@@ -66,21 +73,29 @@ fn walk(
         if len == 0 {
             // Padding to sector boundary.
             let next = (i / SECTOR as usize + 1) * SECTOR as usize;
-            if next <= i { break; }
+            if next <= i {
+                break;
+            }
             i = next;
             continue;
         }
-        if i + len > dir.len() { break; }
+        if i + len > dir.len() {
+            break;
+        }
         let rec = &dir[i..i + len];
         let name = dir_record_name(rec);
         let is_dir = (rec.get(25).copied().unwrap_or(0) & 0x02) != 0;
         // Skip "." (0x00) and ".." (0x01) pseudo-entries.
-        let is_pseudo = matches!(rec.get(32).copied(), Some(1)) && rec.get(33).copied() == Some(0x00)
+        let is_pseudo = matches!(rec.get(32).copied(), Some(1))
+            && rec.get(33).copied() == Some(0x00)
             || matches!(rec.get(32).copied(), Some(1)) && rec.get(33).copied() == Some(0x01);
         if !is_pseudo && name.eq_ignore_ascii_case(target) {
             let (child_off, child_len) = parse_dir_record_ext(rec)?;
             if rest.is_empty() && !is_dir {
-                return Some(FileLocation { offset: child_off * SECTOR, length: child_len });
+                return Some(FileLocation {
+                    offset: child_off * SECTOR,
+                    length: child_len,
+                });
             } else if !rest.is_empty() && is_dir {
                 return walk(f, child_off * SECTOR, child_len, rest);
             }
@@ -94,7 +109,9 @@ fn walk(
 /// Layout per ISO9660: bytes 2..10 extent LBA (LE+BE duplicate), 10..18
 /// data length (LE+BE duplicate). We trust the little-endian copy.
 fn parse_dir_record_ext(rec: &[u8]) -> Option<(u64, u64)> {
-    if rec.len() < 34 { return None; }
+    if rec.len() < 34 {
+        return None;
+    }
     let lba = u32::from_le_bytes(rec[2..6].try_into().ok()?) as u64;
     let len = u32::from_le_bytes(rec[10..14].try_into().ok()?) as u64;
     Some((lba, len))
@@ -104,9 +121,15 @@ fn parse_dir_record_ext(rec: &[u8]) -> Option<(u64, u64)> {
 /// `;1` version suffix.
 fn dir_record_name(rec: &[u8]) -> String {
     let name_len = *rec.get(32).unwrap_or(&0) as usize;
-    if name_len == 0 || rec.len() < 33 + name_len { return String::new(); }
+    if name_len == 0 || rec.len() < 33 + name_len {
+        return String::new();
+    }
     let raw = &rec[33..33 + name_len];
     let s = String::from_utf8_lossy(raw).to_string();
     // Strip `;N` version suffix.
-    if let Some(i) = s.rfind(';') { s[..i].to_string() } else { s }
+    if let Some(i) = s.rfind(';') {
+        s[..i].to_string()
+    } else {
+        s
+    }
 }

crates/http-api/src/lib.rs

@@ -14,11 +14,13 @@
 #![forbid(unsafe_code)]
 
 pub mod app;
+pub mod auth;
 pub mod ipxe_script;
 pub mod iso_fs;
 pub mod log_stream;
 pub mod state;
 pub mod terminal;
+pub mod uploads;
 
 pub use app::build_router;
 pub use state::AppState;

crates/http-api/src/log_stream.rs

@@ -36,9 +36,11 @@ pub async fn stream(
     let rx = state.log_bus.subscribe();
     let live = BroadcastStream::new(rx).map(|res| match res {
         Ok(line) => Ok(Event::default().data(line_json(&line))),
-        Err(tokio_stream::wrappers::errors::BroadcastStreamRecvError::Lagged(n)) => Ok(Event::default()
+        Err(tokio_stream::wrappers::errors::BroadcastStreamRecvError::Lagged(n)) => {
+            Ok(Event::default()
                 .event("lagged")
-            .data(json!({ "skipped": n }).to_string())),
+                .data(json!({ "skipped": n }).to_string()))
+        }
     });
 
     Sse::new(recent_stream.chain(live))
@@ -55,9 +57,11 @@ pub async fn recent(State(state): State<AppState>) -> Json<serde_json::Value> {
 /// keep streaming new lines as they arrive).
 pub async fn clear(State(state): State<AppState>) -> Json<serde_json::Value> {
     state.log_bus.clear();
-    state
-        .log_bus
-        .push("info", "openpxe::terminal", "log buffer cleared by operator");
+    state.log_bus.push(
+        "info",
+        "openpxe::terminal",
+        "log buffer cleared by operator",
+    );
     Json(json!({ "ok": true }))
 }
 

crates/http-api/src/state.rs

@@ -1,4 +1,9 @@
-use openpxe_core::{ClientRegistry, DeploymentQueue, HostBindings, LogBus, Metrics, SettingsStore};
+use crate::uploads::UploadSessions;
+use crate::auth::SessionStore;
+use openpxe_core::{
+    AdminStore, BootLog, BrandingStore, ClientRegistry, DeploymentQueue, HostBindings, LogBus,
+    Metrics, SettingsStore, SsoStore,
+};
 use openpxe_iso_store::{IsoStore, NfsManager, SmbManager};
 use std::sync::Arc;
 use time::OffsetDateTime;
@@ -13,6 +18,25 @@ pub struct AppState {
     /// these MACs requests `/boot.ipxe`, we chain straight to the
     /// configured target instead of rendering the menu.
     pub hosts: HostBindings,
+    /// Persistent boot-event log surfaced under the Hosts tab. Records
+    /// every `/boot/<entry>.ipxe` chain that goes on to serve a script
+    /// (i.e. an image actually starting to install on a machine).
+    pub boot_log: BootLog,
+    /// Operator-controlled UI overrides (custom logo). When the
+    /// operator hasn't uploaded anything, the WebUI serves the bundled
+    /// rainbow-horizon mark.
+    pub branding: BrandingStore,
+    /// Forms-auth admin record + first-run bootstrap state. When
+    /// `admin.is_configured() == false`, the auth middleware passes
+    /// every request through and `/api/me` reports `setup_required`.
+    pub admin: AdminStore,
+    /// In-memory session table for active operator logins. Cleared on
+    /// process restart (sessions are tied to UI state, not persisted —
+    /// matches Sonarr/Radarr behaviour).
+    pub sessions: SessionStore,
+    /// SAML SSO configuration. v0.4.5 stores it; the actual SSO login
+    /// flow ships in a later release.
+    pub sso: SsoStore,
     /// Lock-free metrics counters surfaced at `/metrics` in Prometheus
     /// text format. Cheap to clone (handles to atomics).
     pub metrics: Metrics,
@@ -25,6 +49,10 @@ pub struct AppState {
     /// available in the runtime image. Surfaces errors per-mount rather
     /// than failing the global state.
     pub nfs: NfsManager,
+    /// Browser chunked upload state. Multipart uploads still go straight
+    /// through `IsoStore`, but the UI uses sessions so large ISO transfers
+    /// can show deterministic progress and leave visible partial files.
+    pub uploads: UploadSessions,
     /// Live log bus consumed by the Terminal tab via SSE. Operator-issued
     /// terminal commands also push synthetic lines onto it so the tail
     /// shows them inline.

crates/http-api/src/terminal.rs

@@ -31,12 +31,17 @@ pub async fn run_command(
 ) -> impl IntoResponse {
     let line = req.command.trim();
     if line.is_empty() {
-        return (StatusCode::OK, Json(json!({ "output": HELP_TEXT, "ok": true })));
+        return (
+            StatusCode::OK,
+            Json(json!({ "output": HELP_TEXT, "ok": true })),
+        );
     }
 
     // Echo the typed command into the live log so the Terminal tab shows
     // operator activity in-band with server-emitted log lines.
-    state.log_bus.push("info", "openpxe::terminal", format!("> {line}"));
+    state
+        .log_bus
+        .push("info", "openpxe::terminal", format!("> {line}"));
 
     let argv = shell_split(line);
     if argv.is_empty() {
@@ -55,7 +60,11 @@ pub async fn run_command(
     // so reading the live tail tells the same story as scrolling the
     // terminal pane.
     let mirror = if output.len() > 1024 {
-        format!("{}\n... ({} bytes truncated)", &output[..1024], output.len() - 1024)
+        format!(
+            "{}\n... ({} bytes truncated)",
+            &output[..1024],
+            output.len() - 1024
+        )
     } else {
         output.clone()
     };
@@ -78,7 +87,7 @@ async fn dispatch(state: &AppState, argv: &[String]) -> Result<String, String> {
         "status" => Ok(status_text(state)),
         "isos" | "images" => Ok(isos_text(state)),
         "clients" => Ok(clients_text(state)),
-        "queue" => gate_command(state, tail).await,
+        "queue" => queue_command(state, tail).await,
         "nfs" => nfs_command(state, tail).await,
         "smb" => smb_command(state, tail).await,
         "log" => log_command(state, tail),
@@ -96,7 +105,7 @@ async fn dispatch(state: &AppState, argv: &[String]) -> Result<String, String> {
 fn status_text(s: &AppState) -> String {
     let isos = s.iso_store.list();
     let clients = s.clients.list();
-    let gates = s.queue.list();
+    let queue_entries = s.queue.list();
     let smb = s.smb.as_ref().map(|m| m.snapshot());
     let nfs = s.nfs.list();
     let nfs_active = nfs.iter().filter(|m| m.mounted).count();
@@ -112,13 +121,23 @@ fn status_text(s: &AppState) -> String {
          nfs mounts:   {n_total} configured ({n_active} active)\n",
         ver = env!("CARGO_PKG_VERSION"),
         base = s.public_base_url,
-        nic = if s.nic_name.is_empty() { "?" } else { s.nic_name.as_str() },
+        nic = if s.nic_name.is_empty() {
+            "?"
+        } else {
+            s.nic_name.as_str()
+        },
         up = uptime_string(s),
         n_isos = isos.len(),
-        n_local = isos.iter().filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Local)).count(),
-        n_nfs = isos.iter().filter(|i| !matches!(i.source, openpxe_iso_store::IsoSource::Local)).count(),
+        n_local = isos
+            .iter()
+            .filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Local))
+            .count(),
+        n_nfs = isos
+            .iter()
+            .filter(|i| !matches!(i.source, openpxe_iso_store::IsoSource::Local))
+            .count(),
         n_clients = clients.len(),
-        n_entries = gates.len(),
+        n_entries = queue_entries.len(),
         smb = smb.map_or_else(|| "(disabled)".into(), |s| format!("{s:?}")),
         n_total = nfs.len(),
         n_active = nfs_active,
@@ -159,11 +178,7 @@ fn clients_text(s: &AppState) -> String {
         return "(no clients yet)".into();
     }
     let mut out = String::new();
-    let _ = writeln!(
-        out,
-        "{:<19} {:<16} {:<8} LAST SEEN",
-        "MAC", "IP", "EVENTS"
-    );
+    let _ = writeln!(out, "{:<19} {:<16} {:<8} LAST SEEN", "MAC", "IP", "EVENTS");
     for c in clients {
         let ip = c.last_ip.map_or_else(|| "-".into(), |i| i.to_string());
         let _ = writeln!(
@@ -180,35 +195,35 @@ fn clients_text(s: &AppState) -> String {
     out
 }
 
-// ── gate ───────────────────────────────────────────────────────────────
+// ── queue ──────────────────────────────────────────────────────────────
 
-// `async` for symmetry with the other dispatch helpers — gate operations
+// `async` for symmetry with the other dispatch helpers — queue operations
 // are sync today but might grow to await on a database in a future phase.
 #[allow(clippy::unused_async)]
-async fn gate_command(s: &AppState, args: &[String]) -> Result<String, String> {
+async fn queue_command(s: &AppState, args: &[String]) -> Result<String, String> {
     match args.first().map(String::as_str) {
         None | Some("list") => {
-            let gs = s.queue.list();
-            if gs.is_empty() {
-                return Ok("(no gates)".into());
+            let entries = s.queue.list();
+            if entries.is_empty() {
+                return Ok("(queue empty)".into());
             }
             let mut out = String::new();
-            for g in gs {
+            for entry in entries {
                 let _ = writeln!(
                     out,
                     "#{:<3} {:<19} {:<16} target={}",
-                    g.position,
-                    g.mac,
-                    g.id,
-                    g.assigned_target.unwrap_or_else(|| "-".into())
+                    entry.position,
+                    entry.mac,
+                    entry.id,
+                    entry.assigned_target.unwrap_or_else(|| "-".into())
                 );
             }
             Ok(out)
         }
         Some("assign-all") => {
-            let target = args.get(1).ok_or_else(|| {
-                "usage: gate assign-all <iso_boot_entry_id>".to_string()
-            })?;
+            let target = args
+                .get(1)
+                .ok_or_else(|| "usage: queue assign-all <iso_boot_entry_id>".to_string())?;
             let found = s
                 .iso_store
                 .list()
@@ -219,30 +234,32 @@ async fn gate_command(s: &AppState, args: &[String]) -> Result<String, String> {
             }
             let ids: Vec<_> = s.queue.list().into_iter().map(|g| g.id).collect();
             let n = s.queue.assign(&ids, target);
-            Ok(format!("assigned {n} gates -> {target}"))
+            Ok(format!("assigned {n} queue entries -> {target}"))
         }
         Some("assign") => {
             let entry_id = args
                 .get(1)
-                .ok_or_else(|| "usage: gate assign <entry_id> <iso_boot_entry_id>".to_string())?;
+                .ok_or_else(|| "usage: queue assign <entry_id> <iso_boot_entry_id>".to_string())?;
             let target = args
                 .get(2)
-                .ok_or_else(|| "usage: gate assign <entry_id> <iso_boot_entry_id>".to_string())?;
+                .ok_or_else(|| "usage: queue assign <entry_id> <iso_boot_entry_id>".to_string())?;
             let n = s.queue.assign(std::slice::from_ref(entry_id), target);
             if n == 0 {
-                return Err(format!("no such gate: {entry_id}"));
+                return Err(format!("no such queue entry: {entry_id}"));
             }
-            Ok(format!("assigned 1 gate -> {target}"))
+            Ok(format!("assigned 1 queue entry -> {target}"))
         }
         Some("release") => {
-            let entry_id = args.get(1).ok_or_else(|| "usage: gate release <entry_id>".to_string())?;
+            let entry_id = args
+                .get(1)
+                .ok_or_else(|| "usage: queue release <entry_id>".to_string())?;
             match s.queue.release(entry_id) {
                 Some(_) => Ok(format!("released {entry_id}")),
-                None => Err(format!("no such gate: {entry_id}")),
+                None => Err(format!("no such queue entry: {entry_id}")),
             }
         }
         Some(other) => Err(format!(
-            "unknown gate subcommand: {other}\ntry: gate [list|assign-all|assign|release]"
+            "unknown queue subcommand: {other}\ntry: queue [list|assign-all|assign|release]"
         )),
     }
 }
@@ -294,7 +311,9 @@ async fn nfs_command(s: &AppState, args: &[String]) -> Result<String, String> {
             let version = match args.get(2).map(String::as_str) {
                 Some("v3") => openpxe_iso_store::NfsVersion::V3,
                 Some("v41") | None => openpxe_iso_store::NfsVersion::V41,
-                Some(other) => return Err(format!("unknown nfs version: {other} (expect v3 or v41)")),
+                Some(other) => {
+                    return Err(format!("unknown nfs version: {other} (expect v3 or v41)"))
+                }
             };
             let read_only = !matches!(args.get(3).map(String::as_str), Some("rw"));
             let req = openpxe_iso_store::NfsAddRequest {
@@ -309,14 +328,18 @@ async fn nfs_command(s: &AppState, args: &[String]) -> Result<String, String> {
             }
         }
         Some("unmount") => {
-            let id = args.get(1).ok_or_else(|| "usage: nfs unmount <id>".to_string())?;
+            let id = args
+                .get(1)
+                .ok_or_else(|| "usage: nfs unmount <id>".to_string())?;
             match s.nfs.remove(id).await {
                 Ok(()) => Ok(format!("unmounted {id}")),
                 Err(e) => Err(format!("unmount failed: {e}")),
             }
         }
         Some("scan") => {
-            let id = args.get(1).ok_or_else(|| "usage: nfs scan <id>".to_string())?;
+            let id = args
+                .get(1)
+                .ok_or_else(|| "usage: nfs scan <id>".to_string())?;
             match s.nfs.rescan(id).await {
                 Ok(n) => Ok(format!("re-scanned {id}: {n} isos")),
                 Err(e) => Err(format!("scan failed: {e}")),
@@ -368,10 +391,7 @@ fn log_command(s: &AppState, args: &[String]) -> Result<String, String> {
             Ok("log buffer cleared".into())
         }
         Some("tail") => {
-            let n: usize = args
-                .get(1)
-                .and_then(|v| v.parse().ok())
-                .unwrap_or(20);
+            let n: usize = args.get(1).and_then(|v| v.parse().ok()).unwrap_or(20);
             let lines = s.log_bus.recent();
             let start = lines.len().saturating_sub(n);
             let mut out = String::new();
@@ -462,10 +482,10 @@ OpenPXE terminal — available commands:
 
   isos                              list registered ISOs
   clients                           list PXE clients seen this session
-  gate list                         list gated-deployment queue
-  gate assign <entry_id> <target>    assign one gate to a boot entry
-  gate assign-all <target>          assign every waiting gate
-  gate release <entry_id>            release one gate
+  queue list                        list queued clients
+  queue assign <entry_id> <target>   assign one queued client to a boot entry
+  queue assign-all <target>         assign every waiting client
+  queue release <entry_id>           release one queued client
 
   nfs list                          list NFS mounts
   nfs mount <s>:<e> [v3|v41] [ro|rw]  add and mount an NFS share
@@ -521,4 +541,10 @@ mod tests {
         assert_eq!(truncate("hi", 10), "hi");
         assert_eq!(truncate("longerthanfive", 5), "long…");
     }
+
+    #[test]
+    fn help_uses_queue_language() {
+        assert!(HELP_TEXT.contains("queue list"));
+        assert!(HELP_TEXT.contains("queued clients"));
+    }
 }

crates/http-api/src/uploads.rs

@@ -0,0 +1,180 @@
+//! Chunked upload sessions for browser-driven ISO uploads.
+//!
+//! The legacy multipart endpoint still exists for simple API clients, but
+//! browsers get a better failure mode with raw chunks: progress advances after
+//! each acknowledged write, partial files appear in the ISO directory
+//! immediately, and reverse proxies are less likely to buffer an entire DVD
+//! image before OpenPXE sees byte one.
+
+use bytes::Bytes;
+use openpxe_core::{Error, Result};
+use openpxe_iso_store::{IsoMeta, IsoStore, UploadHandle};
+use serde::Serialize;
+use std::collections::HashMap;
+use std::sync::Arc;
+use tokio::sync::Mutex;
+use uuid::Uuid;
+
+const DEFAULT_CHUNK_SIZE: u64 = 8 * 1024 * 1024;
+
+#[derive(Clone, Default)]
+pub struct UploadSessions {
+    inner: Arc<Mutex<HashMap<String, Arc<Mutex<UploadSession>>>>>,
+}
+
+struct UploadSession {
+    filename: String,
+    expected_size: Option<u64>,
+    offset: u64,
+    handle: Option<UploadHandle>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct UploadStarted {
+    pub upload_id: String,
+    pub iso_id: String,
+    pub filename: String,
+    pub offset: u64,
+    pub chunk_size: u64,
+}
+
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum UploadAppend {
+    Progress { offset: u64 },
+    Complete { offset: u64, iso: Box<IsoMeta> },
+}
+
+impl UploadSessions {
+    pub async fn begin(
+        &self,
+        store: &IsoStore,
+        filename: &str,
+        expected_size: Option<u64>,
+    ) -> Result<UploadStarted> {
+        if !filename.to_ascii_lowercase().ends_with(".iso") {
+            return Err(Error::Invalid("only .iso uploads accepted".to_string()));
+        }
+
+        let handle = store.begin_upload(filename).await?;
+        let iso_id = handle.id.clone();
+        let upload_id = Uuid::new_v4().to_string();
+        let session = UploadSession {
+            filename: filename.to_string(),
+            expected_size,
+            offset: 0,
+            handle: Some(handle),
+        };
+
+        self.inner
+            .lock()
+            .await
+            .insert(upload_id.clone(), Arc::new(Mutex::new(session)));
+
+        Ok(UploadStarted {
+            upload_id,
+            iso_id,
+            filename: filename.to_string(),
+            offset: 0,
+            chunk_size: DEFAULT_CHUNK_SIZE,
+        })
+    }
+
+    pub async fn append(
+        &self,
+        store: &IsoStore,
+        upload_id: &str,
+        offset: u64,
+        chunk: Bytes,
+        complete: bool,
+    ) -> Result<UploadAppend> {
+        let Some(session_lock) = self.inner.lock().await.get(upload_id).cloned() else {
+            return Err(Error::Invalid(format!("no such upload '{upload_id}'")));
+        };
+
+        let mut session = session_lock.lock().await;
+        if session.offset != offset {
+            return Err(Error::Invalid(format!(
+                "expected offset {}, got {offset}",
+                session.offset
+            )));
+        }
+
+        let new_offset = session
+            .offset
+            .checked_add(chunk.len() as u64)
+            .ok_or_else(|| Error::Invalid("upload offset overflow".to_string()))?;
+
+        if let Some(expected) = session.expected_size {
+            if new_offset > expected {
+                return Err(Error::Invalid(format!(
+                    "chunk exceeds declared upload size {expected}"
+                )));
+            }
+        }
+
+        let Some(handle) = session.handle.as_mut() else {
+            return Err(Error::Invalid("upload already completed".to_string()));
+        };
+        if let Err(e) = handle.write_chunk(&chunk).await {
+            let handle = session.handle.take();
+            drop(session);
+            self.inner.lock().await.remove(upload_id);
+            if let Some(handle) = handle {
+                let _ = handle.abort().await;
+            }
+            return Err(e);
+        }
+
+        session.offset = new_offset;
+        if !complete {
+            return Ok(UploadAppend::Progress { offset: new_offset });
+        }
+
+        if let Some(expected) = session.expected_size {
+            if new_offset != expected {
+                return Err(Error::Invalid(format!(
+                    "final chunk ended at {new_offset}, expected {expected}"
+                )));
+            }
+        }
+
+        let Some(handle) = session.handle.take() else {
+            return Err(Error::Invalid("upload already completed".to_string()));
+        };
+        let filename = session.filename.clone();
+        drop(session);
+
+        tracing::info!(
+            target: "openpxe::http::upload",
+            upload_id,
+            filename = %filename,
+            received_bytes = new_offset,
+            "chunked upload body complete; introspecting"
+        );
+
+        let meta = match handle.finish(store).await {
+            Ok(meta) => meta,
+            Err(e) => {
+                self.inner.lock().await.remove(upload_id);
+                return Err(e);
+            }
+        };
+        self.inner.lock().await.remove(upload_id);
+        Ok(UploadAppend::Complete {
+            offset: new_offset,
+            iso: Box::new(meta),
+        })
+    }
+
+    pub async fn abort(&self, upload_id: &str) -> Result<()> {
+        let Some(session_lock) = self.inner.lock().await.remove(upload_id) else {
+            return Err(Error::Invalid(format!("no such upload '{upload_id}'")));
+        };
+        let mut session = session_lock.lock().await;
+        if let Some(handle) = session.handle.take() {
+            handle.abort().await?;
+        }
+        Ok(())
+    }
+}

crates/ipxe-assets/src/lib.rs

@@ -51,7 +51,9 @@ pub fn asset_slice(name: &str) -> Option<std::borrow::Cow<'static, [u8]>> {
 /// Enumerate embedded asset filenames. Useful for startup logging so the
 /// operator can immediately tell which architectures will work.
 pub fn list_assets() -> Vec<String> {
-    IpxeAssets::iter().map(std::borrow::Cow::into_owned).collect()
+    IpxeAssets::iter()
+        .map(std::borrow::Cow::into_owned)
+        .collect()
 }
 
 /// Log at startup which iPXE binaries are present and which are missing.

crates/iso-store/src/introspect.rs

@@ -78,7 +78,9 @@ pub fn introspect(path: &Path) -> IntrospectionReport {
     let mut haystack = Vec::with_capacity(scan_bytes.min(32 * 1024 * 1024));
     while read_total < scan_bytes {
         let n = f.read(&mut buf).unwrap_or(0);
-        if n == 0 { break; }
+        if n == 0 {
+            break;
+        }
         haystack.extend_from_slice(&buf[..n]);
         read_total += n;
     }
@@ -107,8 +109,11 @@ fn family_from_label(label: &str) -> DistroFamily {
     let l = label.to_ascii_lowercase();
     if l.contains("ubuntu") || l.contains("debian") || l.contains("mint") {
         DistroFamily::DebianUbuntu
-    } else if l.contains("rhel") || l.contains("centos") || l.contains("fedora")
-        || l.contains("rocky") || l.contains("alma")
+    } else if l.contains("rhel")
+        || l.contains("centos")
+        || l.contains("fedora")
+        || l.contains("rocky")
+        || l.contains("alma")
     {
         DistroFamily::RhelFedora
     } else if l.contains("suse") || l.contains("opensuse") {
@@ -127,17 +132,30 @@ fn family_from_label(label: &str) -> DistroFamily {
 fn guess_kernel_initrd(family: DistroFamily) -> (Option<&'static str>, Vec<&'static str>) {
     match family {
         DistroFamily::DebianUbuntu => (Some("/casper/vmlinuz"), vec!["/casper/initrd"]),
-        DistroFamily::RhelFedora => (Some("/images/pxeboot/vmlinuz"), vec!["/images/pxeboot/initrd.img"]),
-        DistroFamily::OpenSuse => (Some("/boot/x86_64/loader/linux"), vec!["/boot/x86_64/loader/initrd"]),
-        DistroFamily::Arch => (Some("/arch/boot/x86_64/vmlinuz-linux"), vec!["/arch/boot/x86_64/initramfs-linux.img"]),
+        DistroFamily::RhelFedora => (
+            Some("/images/pxeboot/vmlinuz"),
+            vec!["/images/pxeboot/initrd.img"],
+        ),
+        DistroFamily::OpenSuse => (
+            Some("/boot/x86_64/loader/linux"),
+            vec!["/boot/x86_64/loader/initrd"],
+        ),
+        DistroFamily::Arch => (
+            Some("/arch/boot/x86_64/vmlinuz-linux"),
+            vec!["/arch/boot/x86_64/initramfs-linux.img"],
+        ),
         DistroFamily::Alpine => (Some("/boot/vmlinuz-lts"), vec!["/boot/initramfs-lts"]),
         DistroFamily::WindowsPe | DistroFamily::Unknown => (None, Vec::new()),
     }
 }
 
 fn contains_ascii(haystack: &[u8], needle: &[u8]) -> bool {
-    if needle.is_empty() || haystack.len() < needle.len() { return false; }
-    haystack.windows(needle.len()).any(|w| w.eq_ignore_ascii_case(needle))
+    if needle.is_empty() || haystack.len() < needle.len() {
+        return false;
+    }
+    haystack
+        .windows(needle.len())
+        .any(|w| w.eq_ignore_ascii_case(needle))
 }
 
 #[cfg(test)]
@@ -146,9 +164,18 @@ mod tests {
 
     #[test]
     fn label_matching() {
-        assert_eq!(family_from_label("Ubuntu 24.04"), DistroFamily::DebianUbuntu);
-        assert_eq!(family_from_label("Rocky-9-x86_64-dvd"), DistroFamily::RhelFedora);
-        assert_eq!(family_from_label("openSUSE-Leap-15.6"), DistroFamily::OpenSuse);
+        assert_eq!(
+            family_from_label("Ubuntu 24.04"),
+            DistroFamily::DebianUbuntu
+        );
+        assert_eq!(
+            family_from_label("Rocky-9-x86_64-dvd"),
+            DistroFamily::RhelFedora
+        );
+        assert_eq!(
+            family_from_label("openSUSE-Leap-15.6"),
+            DistroFamily::OpenSuse
+        );
         assert_eq!(family_from_label("ARCH_202604"), DistroFamily::Arch);
         assert_eq!(family_from_label("weird-custom"), DistroFamily::Unknown);
     }

crates/iso-store/src/lib.rs

@@ -27,5 +27,8 @@ pub use entry::{BootEntry, BootKind, KernelArgs};
 pub use introspect::{DistroFamily, IntrospectionReport};
 pub use nfs::{NfsAddRequest, NfsManager, NfsMount, NfsVersion};
 pub use smb::{extract_windows_iso, SmbManager, SmbState};
-pub use store::{generate_boot_entries_for, slugify_str, IsoMeta, IsoSource, IsoStore, UploadHandle};
+pub use store::{
+    generate_boot_entries_for, slugify_str, IsoCategory, IsoMeta, IsoSource, IsoStore,
+    UploadHandle,
+};
 pub use windows::{WimPatcher, WinPatchState};

crates/iso-store/src/nfs.rs

@@ -36,8 +36,8 @@
 
 use crate::introspect::{introspect, IntrospectionReport};
 use crate::store::{generate_boot_entries_for, slugify_str, IsoSource, IsoStore};
-use parking_lot::Mutex;
 use openpxe_core::{Error, Result};
+use parking_lot::Mutex;
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
 use std::path::{Path, PathBuf};
@@ -403,14 +403,8 @@ impl NfsManager {
                 mount_id: m.id.clone(),
                 relative_path: filename.clone(),
             };
-            self.iso_store.register_external(
-                id,
-                filename,
-                size,
-                report,
-                boot_entries,
-                source,
-            );
+            self.iso_store
+                .register_external(id, filename, size, report, boot_entries, source);
             count += 1;
         }
         Ok(count)

crates/iso-store/src/smb.rs

@@ -25,11 +25,11 @@
 //!     Samba), we return `SmbState::SmbdMissing` and the UI surfaces the
 //!     gap. No panics, no retries, no silent failure.
 
+use parking_lot::Mutex;
 use serde::{Deserialize, Serialize};
 use std::path::{Path, PathBuf};
 use std::process::{Child, Command, Stdio};
 use std::sync::Arc;
-use parking_lot::Mutex;
 
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(rename_all = "snake_case", tag = "state")]
@@ -72,7 +72,9 @@ impl SmbManager {
     /// ISO under `smb_dir/<slug>/` becomes a share named `<slug>`. Returns
     /// the sorted list.
     pub fn discover_shares(&self) -> Vec<String> {
-        let Ok(rd) = std::fs::read_dir(&self.smb_dir) else { return vec![]; };
+        let Ok(rd) = std::fs::read_dir(&self.smb_dir) else {
+            return vec![];
+        };
         let mut out: Vec<String> = rd
             .flatten()
             .filter(|e| e.path().is_dir())
@@ -130,7 +132,9 @@ impl SmbManager {
         let shares = match self.write_conf() {
             Ok(v) => v,
             Err(e) => {
-                let s = SmbState::Failed { reason: format!("write smb.conf: {e}") };
+                let s = SmbState::Failed {
+                    reason: format!("write smb.conf: {e}"),
+                };
                 *self.state.lock() = s.clone();
                 return s;
             }
@@ -139,7 +143,8 @@ impl SmbManager {
             .args([
                 "--foreground",
                 "--no-process-group",
-                "--configfile", self.conf_path.to_str().unwrap_or(""),
+                "--configfile",
+                self.conf_path.to_str().unwrap_or(""),
                 "--log-stdout",
             ])
             .stdin(Stdio::null())
@@ -156,7 +161,9 @@ impl SmbManager {
                 s
             }
             Err(e) => {
-                let s = SmbState::Failed { reason: format!("spawn smbd: {e}") };
+                let s = SmbState::Failed {
+                    reason: format!("spawn smbd: {e}"),
+                };
                 *self.state.lock() = s.clone();
                 s
             }
@@ -168,11 +175,15 @@ impl SmbManager {
     #[allow(unsafe_code)]
     pub fn reconcile(&self) -> SmbState {
         let mut g = self.child.lock();
-        if g.is_none() { return self.state.lock().clone(); }
+        if g.is_none() {
+            return self.state.lock().clone();
+        }
         let shares = match self.write_conf() {
             Ok(v) => v,
             Err(e) => {
-                let s = SmbState::Failed { reason: format!("write smb.conf: {e}") };
+                let s = SmbState::Failed {
+                    reason: format!("write smb.conf: {e}"),
+                };
                 *self.state.lock() = s.clone();
                 return s;
             }
@@ -191,8 +202,13 @@ impl SmbManager {
             // covers this is `nix`, which pulls ~40 transitive deps for a
             // single signal send. One documented unsafe call is the better
             // tradeoff for a container-first project.
-            unsafe { libc::kill(pid, libc::SIGHUP); }
-            let s = SmbState::Running { pid: pid as u32, shares };
+            unsafe {
+                libc::kill(pid, libc::SIGHUP);
+            }
+            let s = SmbState::Running {
+                pid: pid as u32,
+                shares,
+            };
             *self.state.lock() = s.clone();
             s
         } else {
@@ -212,15 +228,19 @@ impl SmbManager {
 }
 
 fn smbd_present() -> bool {
-    let Ok(paths) = std::env::var("PATH") else { return false; };
+    let Ok(paths) = std::env::var("PATH") else {
+        return false;
+    };
     for dir in std::env::split_paths(&paths) {
-        if dir.join("smbd").is_file() { return true; }
+        if dir.join("smbd").is_file() {
+            return true;
+        }
     }
     false
 }
 
 const SMB_CONF_GLOBAL: &str = r"[global]
-workgroup = PXEFORGE
+workgroup = OPENPXE
 server min protocol = SMB2
 smb ports = 445
 log level = 1
@@ -235,6 +255,15 @@ lock directory = /tmp
 state directory = /tmp
 cache directory = /tmp
 pid directory = /tmp
+# WinPE reconnect hardening. Windows Setup can reboot mid-install and
+# reconnect from the same IP; stale sessions/oplocks otherwise cause
+# intermittent `net use` failures on the second stage.
+reset on zero vc = yes
+oplocks = no
+kernel oplocks = no
+level2 oplocks = no
+strict locking = no
+deadtime = 1
 ";
 
 /// Extract a Windows ISO at `iso_path` into `smb_dir/<slug>/`. Uses
@@ -245,7 +274,11 @@ pid directory = /tmp
 /// Idempotent: if the target dir already contains `sources/boot.wim`, we
 /// skip extraction. Callers who want a forced re-extract should remove the
 /// dir first.
-pub fn extract_windows_iso(iso_path: &Path, smb_dir: &Path, slug: &str) -> std::io::Result<PathBuf> {
+pub fn extract_windows_iso(
+    iso_path: &Path,
+    smb_dir: &Path,
+    slug: &str,
+) -> std::io::Result<PathBuf> {
     let target = smb_dir.join(slug);
     if target.join("sources").join("boot.wim").is_file() {
         tracing::debug!(target: "openpxe::smb", slug, "ISO already extracted, skipping");
@@ -263,7 +296,9 @@ pub fn extract_windows_iso(iso_path: &Path, smb_dir: &Path, slug: &str) -> std::
             .stdout(Stdio::null())
             .stderr(Stdio::piped())
             .output()?;
-        if out.status.success() { return Ok(target); }
+        if out.status.success() {
+            return Ok(target);
+        }
         tracing::warn!(
             target: "openpxe::smb",
             stderr=%String::from_utf8_lossy(&out.stderr),
@@ -278,7 +313,9 @@ pub fn extract_windows_iso(iso_path: &Path, smb_dir: &Path, slug: &str) -> std::
             .args(["-C"])
             .arg(&target)
             .output()?;
-        if out.status.success() { return Ok(target); }
+        if out.status.success() {
+            return Ok(target);
+        }
         return Err(std::io::Error::other(format!(
             "bsdtar failed: {}",
             String::from_utf8_lossy(&out.stderr)
@@ -294,7 +331,9 @@ fn which(cmd: &str) -> Option<PathBuf> {
     let paths = std::env::var_os("PATH")?;
     for dir in std::env::split_paths(&paths) {
         let p = dir.join(cmd);
-        if p.is_file() { return Some(p); }
+        if p.is_file() {
+            return Some(p);
+        }
     }
     None
 }
@@ -320,7 +359,9 @@ mod tests {
         let m = SmbManager::new(dir.path().into());
         let st = m.start();
         // Restore PATH before asserting so any subsequent failure is legible.
-        if let Some(p) = saved { std::env::set_var("PATH", p); }
+        if let Some(p) = saved {
+            std::env::set_var("PATH", p);
+        }
         assert_eq!(st, SmbState::SmbdMissing);
     }
 
@@ -347,5 +388,27 @@ mod tests {
         assert!(conf.contains("guest ok = yes"));
         assert!(conf.contains("read only = yes"));
         assert!(conf.contains("server min protocol = SMB2"));
+        assert!(conf.contains("workgroup = OPENPXE"));
+    }
+
+    #[test]
+    fn write_conf_includes_winpe_reconnect_tuning() {
+        let dir = tempdir().unwrap();
+        let m = SmbManager::new(dir.path().into());
+        m.write_conf().unwrap();
+        let conf = std::fs::read_to_string(dir.path().join("smb.conf")).unwrap();
+        for expected in [
+            "reset on zero vc = yes",
+            "oplocks = no",
+            "kernel oplocks = no",
+            "level2 oplocks = no",
+            "strict locking = no",
+            "deadtime = 1",
+        ] {
+            assert!(
+                conf.contains(expected),
+                "missing Windows reconnect Samba option {expected} in:\n{conf}"
+            );
+        }
     }
 }

crates/iso-store/src/store.rs

@@ -3,8 +3,8 @@
 use crate::entry::{BootEntry, BootKind, KernelArgs};
 use crate::introspect::{introspect, DistroFamily, IntrospectionReport};
 use bytes::Bytes;
-use parking_lot::RwLock;
 use openpxe_core::{Error, Result};
+use parking_lot::RwLock;
 use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
 use std::collections::HashMap;
@@ -31,6 +31,30 @@ pub enum IsoSource {
     },
 }
 
+/// Where the ISO lands in the PXE menu hierarchy.
+///
+/// Auto-detected family (Debian, Windows, …) still drives BIOS/UEFI
+/// behaviour and per-entry boot args, but the *menu placement* is
+/// operator-controlled — an operator who's uploaded a TinyCore live ISO
+/// to use as a recovery shim, or a SystemRescue image, can flip its
+/// category to `Tools` so it lands next to memtest/shell instead of
+/// under Linux Installers.
+///
+/// Old `meta.json` files without this field deserialize as `Os`, which
+/// matches v0.4.1 behaviour (everything goes under OS Installers).
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum IsoCategory {
+    /// "OS Installer" — routed via the auto-detected family into the
+    /// Linux / Windows installer submenus.
+    #[default]
+    Os,
+    /// "Tool" — surfaced under the Tools menu next to memtest, shell,
+    /// NIC info, etc. Family detection still decides BIOS/UEFI vs
+    /// wimboot vs sanboot at boot time.
+    Tools,
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct IsoMeta {
     /// Stable slug used in URLs (derived from the uploaded filename).
@@ -56,6 +80,10 @@ pub struct IsoMeta {
     /// the common no-password case.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub password_hash: Option<String>,
+    /// Where the ISO sits in the PXE menu hierarchy — operator-controlled,
+    /// not driven by family detection. Defaults to [`IsoCategory::Os`].
+    #[serde(default)]
+    pub category: IsoCategory,
 }
 
 impl IsoMeta {
@@ -114,6 +142,7 @@ impl UploadHandle {
             boot_entries,
             source: IsoSource::Local,
             password_hash: None,
+            category: IsoCategory::default(),
         };
         store.persist_meta(&meta).await?;
         store.insert(meta.clone());
@@ -170,7 +199,9 @@ impl IsoStore {
         let mut entries = tokio::fs::read_dir(self.iso_dir.as_path()).await?;
         while let Some(e) = entries.next_entry().await? {
             let p = e.path();
-            if p.extension().and_then(|s| s.to_str()) != Some("json") { continue; }
+            if p.extension().and_then(|s| s.to_str()) != Some("json") {
+                continue;
+            }
             if !p
                 .file_name()
                 .and_then(|s| s.to_str())
@@ -214,6 +245,9 @@ impl IsoStore {
             return Err(Error::Invalid(format!("iso '{id}' already exists")));
         }
         let partial_path = self.iso_dir.join(format!("{id}.partial"));
+        if partial_path.exists() {
+            return Err(Error::Invalid(format!("iso '{id}' is already uploading")));
+        }
         let file = tokio::fs::File::create(&partial_path).await?;
         Ok(UploadHandle {
             id,
@@ -276,7 +310,10 @@ impl IsoStore {
     /// share or unmount the NFS share entirely.
     pub async fn delete(&self, id: &str) -> Result<()> {
         let meta = self.get(id);
-        let is_local = matches!(meta.as_ref().map(|m| &m.source), Some(IsoSource::Local) | None);
+        let is_local = matches!(
+            meta.as_ref().map(|m| &m.source),
+            Some(IsoSource::Local) | None
+        );
         if is_local {
             let iso = self.iso_path(id);
             let meta_path = self.meta_path(id);
@@ -310,6 +347,7 @@ impl IsoStore {
             boot_entries,
             source,
             password_hash: None,
+            category: IsoCategory::default(),
         };
         self.inner.write().isos.insert(id, meta);
     }
@@ -319,9 +357,9 @@ impl IsoStore {
     /// to clean out stale entries.
     pub fn drop_external_source(&self, mount_id: &str) {
         let mut g = self.inner.write();
-        g.isos.retain(|_, m| {
-            !matches!(&m.source, IsoSource::Nfs { mount_id: mid, .. } if mid == mount_id)
-        });
+        g.isos.retain(
+            |_, m| !matches!(&m.source, IsoSource::Nfs { mount_id: mid, .. } if mid == mount_id),
+        );
     }
 
     /// Set or clear an ISO's boot password.
@@ -369,9 +407,50 @@ impl IsoStore {
         Ok(())
     }
 
+    /// Flip an ISO's menu category. Persists to `meta.json` for local
+    /// ISOs; NFS-sourced ISOs keep the change in memory only (the next
+    /// re-scan would overwrite it anyway).
+    pub async fn set_category(&self, id: &str, category: IsoCategory) -> Result<IsoMeta> {
+        let updated = {
+            let mut g = self.inner.write();
+            let m = g
+                .isos
+                .get_mut(id)
+                .ok_or_else(|| Error::Invalid(format!("no such iso '{id}'")))?;
+            m.category = category;
+            m.clone()
+        };
+        if matches!(updated.source, IsoSource::Local) {
+            self.persist_meta(&updated).await?;
+        }
+        Ok(updated)
+    }
+
+    /// Absolute path to the directory holding local ISO uploads. Used
+    /// by the HTTP layer for the disk-space endpoint — the volume that
+    /// hosts this directory is what runs out of room first.
+    #[must_use]
+    pub fn iso_dir(&self) -> PathBuf {
+        self.iso_dir.as_path().to_path_buf()
+    }
+
+    /// `(total_bytes, available_bytes)` for the filesystem hosting the
+    /// ISO directory. Returns `None` if `statvfs` fails (read-only
+    /// filesystem with no quota, mount disappeared, …) — callers
+    /// should treat that as "unknown" rather than zero.
+    ///
+    /// Lives here rather than the HTTP crate because `http-api`'s
+    /// `#![forbid(unsafe_code)]` rules out the libc FFI directly, and
+    /// because this is naturally an `IsoStore` question — the volume
+    /// of interest is whatever's hosting the iso dir.
+    #[must_use]
+    pub fn disk_usage(&self) -> Option<(u64, u64)> {
+        disk_usage_for(self.iso_dir.as_path())
+    }
+
     /// Verify a candidate password against the stored bcrypt hash.
     /// Returns:
-    /// - `Ok(true)`   — match (or the ISO has no password set; gate is open)
+    /// - `Ok(true)`   — match (or the ISO has no password set; boot is open)
     /// - `Ok(false)`  — mismatch
     /// - `Err(_)`     — id not found, or bcrypt error
     pub fn verify_password(&self, id: &str, candidate: &str) -> Result<bool> {
@@ -385,6 +464,33 @@ impl IsoStore {
     }
 }
 
+/// Resolve `(total, available)` bytes for the filesystem hosting `path`.
+/// Returns `None` if `statvfs` fails.
+#[allow(unsafe_code)]
+fn disk_usage_for(path: &std::path::Path) -> Option<(u64, u64)> {
+    use std::ffi::CString;
+    use std::os::unix::ffi::OsStrExt;
+    let c = CString::new(path.as_os_str().as_bytes()).ok()?;
+    // SAFETY: `statvfs` is repr(C); a zeroed value is a valid initial
+    // state per POSIX. The FFI call writes every field we then read.
+    let mut stat: libc::statvfs = unsafe { std::mem::zeroed() };
+    // SAFETY: `c` is a NUL-terminated C string pointing into a stack
+    // CString that outlives this call; `&mut stat` is a unique aligned
+    // pointer to a stack-local `statvfs`. The kernel writes through
+    // it but does not retain the pointer past return.
+    let rc = unsafe { libc::statvfs(c.as_ptr(), &raw mut stat) };
+    if rc != 0 {
+        return None;
+    }
+    // Use f_frsize (fundamental block size). f_bsize is "preferred I/O
+    // block" and doesn't always match the unit f_blocks is denominated
+    // in — on some BSDs it would over-report by a factor of 8.
+    let frsize = stat.f_frsize as u64;
+    let total = stat.f_blocks as u64 * frsize;
+    let avail = stat.f_bavail as u64 * frsize;
+    Some((total, avail))
+}
+
 fn slugify(filename: &str) -> String {
     let stem = Path::new(filename)
         .file_stem()
@@ -427,7 +533,10 @@ pub fn generate_boot_entries_for(
 /// Build `BootEntry`s from the introspection report. URLs are relative —
 /// the HTTP layer rewrites them with the public base URL per request.
 fn generate_boot_entries(id: &str, filename: &str, r: &IntrospectionReport) -> Vec<BootEntry> {
-    let title = r.volume_label.clone().unwrap_or_else(|| filename.to_string());
+    let title = r
+        .volume_label
+        .clone()
+        .unwrap_or_else(|| filename.to_string());
     match r.family {
         DistroFamily::WindowsPe if r.has_boot_wim => {
             // Standard wimboot chain. Paths are in-ISO; the HTTP layer maps
@@ -451,12 +560,22 @@ fn generate_boot_entries(id: &str, filename: &str, r: &IntrospectionReport) -> V
         fam if r.kernel_path.is_some() => {
             let base = format!("iso/{id}");
             let kernel_url = format!("{base}{}", r.kernel_path.as_deref().unwrap_or(""));
-            let initrd_urls = r.initrd_paths.iter().map(|p| format!("{base}{p}")).collect();
-            let args = KernelArgs { cmdline: linux_cmdline(fam, id) };
+            let initrd_urls = r
+                .initrd_paths
+                .iter()
+                .map(|p| format!("{base}{p}"))
+                .collect();
+            let args = KernelArgs {
+                cmdline: linux_cmdline(fam, id),
+            };
             vec![BootEntry {
                 id: format!("{id}-linux"),
                 title,
-                kind: BootKind::LinuxKernel { kernel_url, initrd_urls, args },
+                kind: BootKind::LinuxKernel {
+                    kernel_url,
+                    initrd_urls,
+                    args,
+                },
             }]
         }
         _ => {
@@ -465,7 +584,9 @@ fn generate_boot_entries(id: &str, filename: &str, r: &IntrospectionReport) -> V
             vec![BootEntry {
                 id: format!("{id}-sanboot"),
                 title: format!("{title} (SAN boot — may fail for >1GiB ISOs)"),
-                kind: BootKind::SanBootIso { iso_url: format!("iso/{id}.iso") },
+                kind: BootKind::SanBootIso {
+                    iso_url: format!("iso/{id}.iso"),
+                },
             }]
         }
     }
@@ -475,8 +596,17 @@ fn linux_cmdline(family: DistroFamily, id: &str) -> String {
     // The HTTP layer resolves `${base-url}` at render time.
     let iso_url = format!("${{base-url}}/iso/{id}.iso");
     match family {
+        // VMware-UEFI fix (v0.4.5, matching Bootimus v0.1.67's Casper
+        // patch): drop `netboot=url url=… ---` in favour of the
+        // canonical Casper option `iso-url=` and add `ds=nocloud` so
+        // cloud-init / subiquity (live-server) doesn't stall waiting on
+        // a metadata datasource that doesn't exist in PXE. Without
+        // `ds=nocloud`, Ubuntu live-server / Mint / Pop!_OS / elementary
+        // ISOs would boot fine on bare-metal UEFI but hang at "cloud-init
+        // running" on VMware-UEFI guests because the vmxnet3 driver's
+        // late-init upsets cloud-init's network probe.
         DistroFamily::DebianUbuntu => format!(
-            "boot=casper netboot=url url={iso_url} ip=dhcp ---"
+            "boot=casper initrd=initrd ds=nocloud ip=dhcp iso-url={iso_url}"
         ),
         DistroFamily::RhelFedora => format!(
             "inst.repo={iso_url} inst.stage2={iso_url} ip=dhcp"
@@ -511,6 +641,23 @@ mod tests {
         assert_eq!(slugify("/etc/passwd"), "passwd");
     }
 
+    #[test]
+    fn casper_cmdline_vmware_uefi_safe() {
+        // v0.4.5 regression guard: the Debian/Ubuntu cmdline must use
+        // the canonical Casper `iso-url=` option and include
+        // `ds=nocloud` so VMware-UEFI guests don't hang at "cloud-init
+        // running" waiting on a metadata datasource that PXE can't
+        // provide. The legacy `netboot=url url=… ---` form is gone for
+        // good.
+        let s = linux_cmdline(DistroFamily::DebianUbuntu, "ubuntu-24-04");
+        assert!(s.contains("boot=casper"), "{s}");
+        assert!(s.contains("iso-url=${base-url}/iso/ubuntu-24-04.iso"), "{s}");
+        assert!(s.contains("ds=nocloud"), "{s}");
+        assert!(s.contains("ip=dhcp"), "{s}");
+        assert!(!s.contains("netboot=url"), "legacy option leaked: {s}");
+        assert!(!s.contains(" --- "), "stray ---: {s}");
+    }
+
     fn fake_meta(id: &str) -> IsoMeta {
         IsoMeta {
             id: id.into(),
@@ -528,6 +675,7 @@ mod tests {
             boot_entries: vec![],
             source: IsoSource::Local,
             password_hash: None,
+            category: IsoCategory::default(),
         }
     }
 
@@ -536,7 +684,11 @@ mod tests {
         let dir = tempdir().unwrap();
         let store = IsoStore::new(dir.path().to_path_buf());
         store.ensure_dirs().await.unwrap();
-        store.inner.write().isos.insert("alpha".into(), fake_meta("alpha"));
+        store
+            .inner
+            .write()
+            .isos
+            .insert("alpha".into(), fake_meta("alpha"));
 
         // No password set — verify_password returns Ok(true) for any input.
         assert!(store.verify_password("alpha", "anything").unwrap());
@@ -570,6 +722,19 @@ mod tests {
         assert!(matches!(r, Err(Error::Invalid(_))));
     }
 
+    #[tokio::test]
+    async fn begin_upload_rejects_existing_partial_file() {
+        let dir = tempdir().unwrap();
+        let store = IsoStore::new(dir.path().to_path_buf());
+        store.ensure_dirs().await.unwrap();
+        tokio::fs::write(dir.path().join("ubuntu.partial"), b"in-flight")
+            .await
+            .unwrap();
+
+        let r = store.begin_upload("ubuntu.iso").await;
+        assert!(matches!(r, Err(Error::Invalid(_))));
+    }
+
     #[tokio::test]
     async fn password_persists_via_meta_json_for_local_isos() {
         // Hash makes it onto disk so it survives a restart.

crates/iso-store/src/windows.rs

@@ -54,7 +54,10 @@ pub struct WimPatcher {
 impl WimPatcher {
     #[must_use]
     pub fn new(smb_host: String, smb_share: String) -> Self {
-        Self { smb_host, smb_share }
+        Self {
+            smb_host,
+            smb_share,
+        }
     }
 
     /// Apply WinPE patches to `boot.wim` inside `extracted_iso_dir`. Returns
@@ -72,31 +75,40 @@ impl WimPatcher {
 
         let work = match tempfile::tempdir() {
             Ok(d) => d,
-            Err(e) => return WinPatchState::Failed { reason: format!("tempdir: {e}") },
+            Err(e) => {
+                return WinPatchState::Failed {
+                    reason: format!("tempdir: {e}"),
+                }
+            }
         };
 
         // Stage the two files we want present at /Windows/System32/.
         let staging = work.path().join("stage/Windows/System32");
         if let Err(e) = std::fs::create_dir_all(&staging) {
-            return WinPatchState::Failed { reason: format!("staging mkdir: {e}") };
+            return WinPatchState::Failed {
+                reason: format!("staging mkdir: {e}"),
+            };
         }
         if let Err(e) = std::fs::write(staging.join("winpeshl.ini"), WINPESHL_INI) {
-            return WinPatchState::Failed { reason: format!("write winpeshl.ini: {e}") };
+            return WinPatchState::Failed {
+                reason: format!("write winpeshl.ini: {e}"),
+            };
         }
         let startnet = render_startnet(&self.smb_host, &self.smb_share);
         if let Err(e) = std::fs::write(staging.join("startnet.cmd"), startnet) {
-            return WinPatchState::Failed { reason: format!("write startnet.cmd: {e}") };
+            return WinPatchState::Failed {
+                reason: format!("write startnet.cmd: {e}"),
+            };
         }
 
         // Build a wimlib update command file:
         //   add <stage>/Windows/System32 /Windows/System32
         let update_file = work.path().join("update.cmd");
-        let update_cmd = format!(
-            "add \"{}\" \"/Windows/System32\"\n",
-            staging.display()
-        );
+        let update_cmd = format!("add \"{}\" \"/Windows/System32\"\n", staging.display());
         if let Err(e) = std::fs::write(&update_file, update_cmd) {
-            return WinPatchState::Failed { reason: format!("write update.cmd: {e}") };
+            return WinPatchState::Failed {
+                reason: format!("write update.cmd: {e}"),
+            };
         }
 
         // Run wimlib-imagex update against image index 2 (WinPE).
@@ -120,7 +132,9 @@ impl WimPatcher {
                     String::from_utf8_lossy(&o.stderr)
                 ),
             },
-            Err(e) => WinPatchState::Failed { reason: format!("spawn wimlib-imagex: {e}") },
+            Err(e) => WinPatchState::Failed {
+                reason: format!("spawn wimlib-imagex: {e}"),
+            },
         }
     }
 }
@@ -133,7 +147,9 @@ fn which(cmd: &str) -> Option<PathBuf> {
     let paths = std::env::var_os("PATH")?;
     for dir in std::env::split_paths(&paths) {
         let p = dir.join(cmd);
-        if p.is_file() { return Some(p); }
+        if p.is_file() {
+            return Some(p);
+        }
     }
     None
 }
@@ -174,7 +190,11 @@ fn render_startnet(host: &str, share: &str) -> String {
     )
     .unwrap();
     s.push_str(":havenet\r\n");
-    writeln!(s, "echo Mapping install media from \\\\{host}\\{share}...\r").unwrap();
+    writeln!(
+        s,
+        "echo Mapping install media from \\\\{host}\\{share}...\r"
+    )
+    .unwrap();
     writeln!(
         s,
         ":mapshare\r\nnet use Z: \\\\{host}\\{share} /user:guest \"\" /persistent:no && goto mapped\r\n\
@@ -205,6 +225,23 @@ mod tests {
         assert!(s.contains("setup.exe"));
     }
 
+    #[test]
+    fn startnet_primes_workstation_and_surfaces_mapping_errors() {
+        let s = render_startnet("10.0.0.5", "win11");
+        assert!(
+            s.contains("net start Workstation"),
+            "WinPE should explicitly start the SMB client before net use:\n{s}"
+        );
+        let net_use_line = s
+            .lines()
+            .find(|line| line.contains("net use Z:"))
+            .expect("net use line");
+        assert!(
+            !net_use_line.contains(">nul"),
+            "net use errors must remain visible in WinPE console: {net_use_line}"
+        );
+    }
+
     #[test]
     fn patcher_reports_wimlib_missing_gracefully() {
         // We don't assume wimlib is present in CI; this checks the missing

crates/openpxe/src/main.rs

@@ -4,16 +4,16 @@
 
 use clap::{Parser, Subcommand};
 use openpxe_core::{
-    ClientRegistry, Config, DhcpMode, DeploymentQueue, HostBindings, LogBus, LogBusLayer, Metrics,
+    ClientRegistry, Config, DeploymentQueue, DhcpMode, HostBindings, LogBus, LogBusLayer, Metrics,
     SettingsStore,
 };
 use openpxe_dhcp_proxy::DhcpProxyServer;
 use openpxe_http_api::{build_router, AppState};
 use openpxe_iso_store::{IsoStore, NfsManager, SmbManager};
-use std::sync::Arc;
 use openpxe_tftp::TftpServer;
 use std::net::{Ipv4Addr, SocketAddr};
 use std::path::PathBuf;
+use std::sync::Arc;
 use tokio::io::AsyncReadExt;
 
 #[derive(Debug, Parser)]
@@ -39,7 +39,7 @@ enum Command {
     ///   docker run --rm \
     ///     -v /my/isos:/seed:ro \
     ///     -v openpxe-data:/var/lib/openpxe/isos \
-    ///     openpxe:0.1.0 seed --from /seed
+    ///     openpxe:0.4.1 seed --from /seed
     Seed {
         /// Source directory containing one or more `.iso` files.
         #[arg(long)]
@@ -100,9 +100,14 @@ async fn main() -> anyhow::Result<()> {
     let iso_store = IsoStore::new(config.paths.iso_dir.clone());
     iso_store.load_from_disk().await?;
     let clients = ClientRegistry::new();
-    let gates = DeploymentQueue::new();
+    let queue = DeploymentQueue::new();
     let settings = SettingsStore::load_or_default(&config.paths.work_dir);
     let hosts = HostBindings::load_or_default(&config.paths.work_dir);
+    let boot_log = openpxe_core::BootLog::load_or_default(&config.paths.work_dir);
+    let branding = openpxe_core::BrandingStore::load_or_default(&config.paths.work_dir);
+    let admin = openpxe_core::AdminStore::load_or_default(&config.paths.work_dir);
+    let sso = openpxe_core::SsoStore::load_or_default(&config.paths.work_dir);
+    let sessions = openpxe_http_api::auth::SessionStore::default();
     let metrics = Metrics::new();
 
     // Build the SMB manager unconditionally — it starts/stops on the
@@ -138,11 +143,17 @@ async fn main() -> anyhow::Result<()> {
         iso_store: iso_store.clone(),
         clients: clients.clone(),
         settings: settings.clone(),
-        queue: gates.clone(),
+        queue: queue.clone(),
         hosts: hosts.clone(),
+        boot_log: boot_log.clone(),
+        branding: branding.clone(),
+        admin: admin.clone(),
+        sessions: sessions.clone(),
+        sso: sso.clone(),
         metrics: metrics.clone(),
         smb: Some(smb.clone()),
         nfs: nfs.clone(),
+        uploads: openpxe_http_api::uploads::UploadSessions::default(),
         log_bus: log_bus.clone(),
         started_at: time::OffsetDateTime::now_utc(),
         public_base_url: public_base_url.clone(),
@@ -156,7 +167,15 @@ async fn main() -> anyhow::Result<()> {
     let http_task = tokio::spawn(async move {
         let listener = tokio::net::TcpListener::bind(http_addr).await?;
         tracing::info!(target: "openpxe::http", "HTTP listening on {http_addr}");
-        axum::serve(listener, router).await?;
+        // `into_make_service_with_connect_info` is required so per-request
+        // `ConnectInfo<SocketAddr>` extractors can resolve the peer IP —
+        // used by `/boot/<entry>.ipxe` to record the booting client's
+        // address into the Host log. Without this the extractor 500s.
+        axum::serve(
+            listener,
+            router.into_make_service_with_connect_info::<std::net::SocketAddr>(),
+        )
+        .await?;
         Ok::<_, anyhow::Error>(())
     });
 
@@ -210,7 +229,11 @@ async fn run_command(cmd: Command, config: Config) -> anyhow::Result<()> {
 /// Reuses `IsoStore::begin_upload` / `finish` so the resulting meta on disk
 /// is identical to a web upload — same slug rules, same introspection, same
 /// sha256.
-async fn seed_from_dir(src: &std::path::Path, config: &Config, dry_run: bool) -> anyhow::Result<()> {
+async fn seed_from_dir(
+    src: &std::path::Path,
+    config: &Config,
+    dry_run: bool,
+) -> anyhow::Result<()> {
     let store = IsoStore::new(config.paths.iso_dir.clone());
     store.load_from_disk().await?;
     let mut entries = tokio::fs::read_dir(src).await?;
@@ -218,7 +241,12 @@ async fn seed_from_dir(src: &std::path::Path, config: &Config, dry_run: bool) ->
     let mut skipped = 0u32;
     while let Some(entry) = entries.next_entry().await? {
         let p = entry.path();
-        if p.extension().and_then(|e| e.to_str()).map(str::to_ascii_lowercase).as_deref() != Some("iso") {
+        if p.extension()
+            .and_then(|e| e.to_str())
+            .map(str::to_ascii_lowercase)
+            .as_deref()
+            != Some("iso")
+        {
             continue;
         }
         let filename = p
@@ -226,8 +254,14 @@ async fn seed_from_dir(src: &std::path::Path, config: &Config, dry_run: bool) ->
             .and_then(|s| s.to_str())
             .ok_or_else(|| anyhow::anyhow!("non-utf8 filename: {}", p.display()))?
             .to_string();
-        println!("  {} ({} bytes)", filename, tokio::fs::metadata(&p).await?.len());
-        if dry_run { continue; }
+        println!(
+            "  {} ({} bytes)",
+            filename,
+            tokio::fs::metadata(&p).await?.len()
+        );
+        if dry_run {
+            continue;
+        }
 
         let mut handle = match store.begin_upload(&filename).await {
             Ok(h) => h,
@@ -242,15 +276,23 @@ async fn seed_from_dir(src: &std::path::Path, config: &Config, dry_run: bool) ->
         let mut buf = vec![0u8; 1024 * 1024];
         loop {
             let n = file.read(&mut buf).await?;
-            if n == 0 { break; }
+            if n == 0 {
+                break;
+            }
             let chunk: bytes::Bytes = buf[..n].to_vec().into();
             handle.write_chunk(&chunk).await?;
         }
         let meta = handle.finish(&store).await?;
-        println!("    -> id={} family={:?}", meta.id, meta.introspection.family);
+        println!(
+            "    -> id={} family={:?}",
+            meta.id, meta.introspection.family
+        );
         imported += 1;
     }
-    println!("\nimported={imported}  skipped={skipped}  {}", if dry_run { "(dry run)" } else { "" });
+    println!(
+        "\nimported={imported}  skipped={skipped}  {}",
+        if dry_run { "(dry run)" } else { "" }
+    );
     Ok(())
 }
 
@@ -294,9 +336,8 @@ fn hostname() -> std::io::Result<String> {
     if let Ok(h) = std::fs::read_to_string("/proc/sys/kernel/hostname") {
         return Ok(h.trim().to_string());
     }
-    std::env::var("HOSTNAME").map_err(|_| std::io::Error::new(
-        std::io::ErrorKind::NotFound, "no hostname",
-    ))
+    std::env::var("HOSTNAME")
+        .map_err(|_| std::io::Error::new(std::io::ErrorKind::NotFound, "no hostname"))
 }
 
 fn init_tracing(bus: Arc<LogBus>) {
@@ -328,7 +369,10 @@ fn detect_network_info(our_ip: Ipv4Addr) -> NetworkInfo {
 
     // `ip -o -f inet addr show` lists every interface with its
     // `inet a.b.c.d/mask`. We match the line that mentions our IP.
-    if let Ok(out) = Command::new("ip").args(["-o", "-f", "inet", "addr", "show"]).output() {
+    if let Ok(out) = Command::new("ip")
+        .args(["-o", "-f", "inet", "addr", "show"])
+        .output()
+    {
         if let Ok(text) = String::from_utf8(out.stdout) {
             for line in text.lines() {
                 if !line.contains(&our_ip.to_string()) {
@@ -353,7 +397,10 @@ fn detect_network_info(our_ip: Ipv4Addr) -> NetworkInfo {
     }
 
     // `ip route show default` -> "default via 10.0.0.1 dev enp1s0 ..."
-    if let Ok(out) = Command::new("ip").args(["route", "show", "default"]).output() {
+    if let Ok(out) = Command::new("ip")
+        .args(["route", "show", "default"])
+        .output()
+    {
         if let Ok(text) = String::from_utf8(out.stdout) {
             if let Some(line) = text.lines().next() {
                 let mut parts = line.split_whitespace();
@@ -374,7 +421,11 @@ fn detect_network_info(our_ip: Ipv4Addr) -> NetworkInfo {
 
 fn prefix_to_dotted(prefix: u8) -> String {
     let prefix = prefix.min(32);
-    let mask: u32 = if prefix == 0 { 0 } else { u32::MAX << (32 - prefix) };
+    let mask: u32 = if prefix == 0 {
+        0
+    } else {
+        u32::MAX << (32 - prefix)
+    };
     format!(
         "{}.{}.{}.{}",
         (mask >> 24) & 0xff,

crates/tftp/src/server.rs

@@ -45,7 +45,12 @@ impl TftpServer {
         clients: Arc<ClientRegistry>,
         metrics: openpxe_core::Metrics,
     ) -> Self {
-        Self { bind, port, clients, metrics }
+        Self {
+            bind,
+            port,
+            clients,
+            metrics,
+        }
     }
 
     pub async fn run(self) -> anyhow::Result<()> {
@@ -86,7 +91,9 @@ async fn handle_rrq(
     let Some(req) = parse_rrq(&packet) else {
         return Ok(());
     };
-    let Request { filename, options, .. } = req;
+    let Request {
+        filename, options, ..
+    } = req;
 
     // Per-transfer ephemeral socket.
     let sock = bind_udp(bind_ip, 0)?;
@@ -98,7 +105,9 @@ async fn handle_rrq(
             &peer.ip().to_string(),
             Some(peer.ip()),
             None,
-            ClientEvent::TftpRead { file: filename.clone() },
+            ClientEvent::TftpRead {
+                file: filename.clone(),
+            },
         );
         return Ok(());
     };
@@ -112,7 +121,9 @@ async fn handle_rrq(
         &peer.ip().to_string(),
         Some(peer.ip()),
         None,
-        ClientEvent::TftpRead { file: filename.clone() },
+        ClientEvent::TftpRead {
+            file: filename.clone(),
+        },
     );
 
     // Negotiate options.
@@ -173,7 +184,9 @@ async fn handle_rrq(
 
         // Send one window worth of DATA.
         for _ in 0..window {
-            if offset >= total { break; }
+            if offset >= total {
+                break;
+            }
             let end = (offset + blksize).min(total);
             let chunk = &file_bytes[offset..end];
             let pkt = encode_data(block_no, chunk);
@@ -255,20 +268,30 @@ struct Request {
 }
 
 fn parse_rrq(pkt: &[u8]) -> Option<Request> {
-    if pkt.len() < 4 { return None; }
+    if pkt.len() < 4 {
+        return None;
+    }
     let op = u16::from_be_bytes([pkt[0], pkt[1]]);
-    if op != OP_RRQ { return None; }
+    if op != OP_RRQ {
+        return None;
+    }
     let mut rest = &pkt[2..];
     let filename = read_cstr(&mut rest)?;
     let mode = read_cstr(&mut rest)?;
     let mut options = Vec::new();
     while !rest.is_empty() {
         let Some(k) = read_cstr(&mut rest) else { break };
-        if k.is_empty() { break; }
+        if k.is_empty() {
+            break;
+        }
         let v = read_cstr(&mut rest).unwrap_or_default();
         options.push((k.to_ascii_lowercase(), v));
     }
-    Some(Request { filename, mode, options })
+    Some(Request {
+        filename,
+        mode,
+        options,
+    })
 }
 
 fn read_cstr(buf: &mut &[u8]) -> Option<String> {
@@ -316,8 +339,12 @@ async fn recv_ack(sock: &UdpSocket, peer: SocketAddr) -> anyhow::Result<u16> {
     let mut buf = [0u8; 32];
     loop {
         let (n, from) = sock.recv_from(&mut buf).await?;
-        if from.ip() != peer.ip() { continue; }
-        if n < 4 { continue; }
+        if from.ip() != peer.ip() {
+            continue;
+        }
+        if n < 4 {
+            continue;
+        }
         let op = u16::from_be_bytes([buf[0], buf[1]]);
         match op {
             OP_ACK => return Ok(u16::from_be_bytes([buf[2], buf[3]])),
@@ -344,14 +371,19 @@ async fn wait_for_ack(
             Ok(Ok(_)) => {}
             Ok(Err(_)) | Err(_) => {
                 tries += 1;
-                if tries > 5 { return Ok(false); }
+                if tries > 5 {
+                    return Ok(false);
+                }
             }
         }
     }
 }
 
 fn bind_udp(bind: IpAddr, port: u16) -> anyhow::Result<UdpSocket> {
-    let domain = match bind { IpAddr::V4(_) => Domain::IPV4, IpAddr::V6(_) => Domain::IPV6 };
+    let domain = match bind {
+        IpAddr::V4(_) => Domain::IPV4,
+        IpAddr::V6(_) => Domain::IPV6,
+    };
     let sock = Socket::new(domain, Type::DGRAM, Some(Protocol::UDP))?;
     sock.set_reuse_address(true)?;
     sock.set_nonblocking(true)?;
@@ -382,7 +414,9 @@ pub fn plan_window(
     let mut o = offset;
     let mut b = starting_block;
     for _ in 0..window {
-        if o >= total { break; }
+        if o >= total {
+            break;
+        }
         let end = (o + blksize).min(total);
         out.push((b, end - o));
         o = end;

crates/webui/src/app.css

@@ -8,23 +8,26 @@
  * CSS lands). */
 
 :root {
-  /* Dark palette (default). */
-  --bg:           #0b1018;
-  --bg-panel:    #121826;
-  --bg-panel-2:  #1a2334;
-  --bg-elev:     #223047;
-  --fg:           #e4e8ef;
-  --fg-dim:      #8a94a7;
-  --fg-dimmer:   #5a6379;
-  --accent:       #00d4b4;   /* Netbox-ish teal */
+  /* Jet-black dark palette (default). Modelled on Netbox Labs's
+     near-black product chrome, with surfaces stepping subtly upward
+     rather than the previous blue-tinted ramp, so the UI reads as a
+     genuine "dark" rather than "dim navy". */
+  --bg:           #030303;
+  --bg-panel:    #0a0a0a;
+  --bg-panel-2:  #141414;
+  --bg-elev:     #1c1c1c;
+  --fg:           #e8eaed;
+  --fg-dim:      #9aa0a6;
+  --fg-dimmer:   #6b7077;
+  --accent:       #00d4b4;   /* Netbox-ish teal — kept for brand */
   --accent-dim:  #07a38c;
   --warn:         #ffb347;
   --err:          #ef6e6e;
   --ok:           #4ade80;
-  --border:       #223047;
-  --border-soft: #172033;
-  --terminal-bg: #06090e;
-  --shadow-card: 0 1px 0 rgba(255,255,255,0.02), 0 8px 24px rgba(0,0,0,0.25);
+  --border:       #1f1f1f;
+  --border-soft: #141414;
+  --terminal-bg: #050505;
+  --shadow-card: 0 1px 0 rgba(255,255,255,0.02), 0 8px 24px rgba(0,0,0,0.55);
   --radius:      6px;
   --radius-lg:  10px;
   --sidebar-w:  240px;
@@ -38,7 +41,7 @@
      consistency. Designed against Netbox Labs's reference screenshot:
      near-white surfaces, soft grey dividers, dark text. */
   --bg:           #f6f8fb;
-  --bg-panel:    #ffffff;
+  --bg-panel:    #fbfcfe;
   --bg-panel-2:  #f0f3f8;
   --bg-elev:     #e6ebf2;
   --fg:           #1c2330;
@@ -51,7 +54,11 @@
   --ok:           #1f9b54;
   --border:       #d8dde6;
   --border-soft: #e7eaf0;
-  --terminal-bg: #0d1219; /* terminal stays dark even in light mode */
+  /* Light-mode terminal: the pane background and chrome track the rest
+     of the light theme. Per-level text colours below recolour-on-light
+     so log lines stay readable on a pale background — previously the
+     terminal was locked to dark and looked like a stuck panel. */
+  --terminal-bg: #ffffff;
   --shadow-card: 0 1px 0 rgba(0,0,0,0.02), 0 6px 18px rgba(20,28,52,0.06);
 }
 
@@ -84,14 +91,23 @@ code, kbd { font-family: var(--mono); font-size: 12.5px;
   border-right: 1px solid var(--border);
   display: flex; flex-direction: column;
 }
+/* The brand block sits flush with the topbar so the sidebar+topbar reads
+   as one continuous bar across the top of the app, rather than a chunky
+   2-line logo block plus a separate (smaller-typeface) page title. The
+   height/border-bottom match the topbar exactly so the divider runs
+   straight across without a step. */
 .sidebar .brand {
   display: flex; align-items: center; gap: 12px;
-  padding: 14px 18px;
+  padding: 0 18px;
+  height: var(--topbar-h);
   border-bottom: 1px solid var(--border);
 }
-.sidebar .brand img { width: 40px; height: auto; }
-.sidebar .brand strong { font-size: 16px; letter-spacing: 0.4px; }
-.sidebar .brand .sub { color: var(--fg-dim); font-size: 11px; }
+.sidebar .brand img { width: 26px; height: 26px; flex: none; }
+.sidebar .brand strong {
+  font-size: 15px; font-weight: 600;
+  letter-spacing: 0.2px;
+  color: var(--fg);
+}
 .sidebar nav { padding: 10px 0; flex: 1; overflow-y: auto; }
 .sidebar nav a {
   display: flex; align-items: center; gap: 10px;
@@ -113,10 +129,40 @@ code, kbd { font-family: var(--mono); font-size: 12.5px;
 }
 .sidebar nav a.active .count { background: var(--accent); color: #002923; }
 .sidebar .footer {
-  padding: 10px 18px; border-top: 1px solid var(--border);
+  padding: 12px 18px; border-top: 1px solid var(--border);
   color: var(--fg-dimmer); font-size: 11px;
+  display: flex; flex-direction: column; gap: 4px;
+}
+.sidebar .footer code { background: transparent; color: var(--fg-dim); padding: 0;
+  font-size: 11px; word-break: break-all; }
+.sidebar .footer .status-row {
+  display: flex; align-items: center; gap: 8px;
+  margin-bottom: 4px;
+}
+.sidebar .footer .status-row .dot {
+  width: 8px; height: 8px; border-radius: 50%; display: inline-block;
+  background: var(--fg-dimmer); flex: none;
+}
+.sidebar .footer .status-row .dot.ok   { background: var(--ok);
+  box-shadow: 0 0 6px color-mix(in srgb, var(--ok) 60%, transparent); }
+.sidebar .footer .status-row .dot.err  { background: var(--err); }
+.sidebar .footer .status-row .dot.warn { background: var(--warn); }
+.sidebar .footer .status-label { color: var(--fg-dim); }
+.sidebar .footer .status-value { color: var(--fg); font-weight: 600; }
+.sidebar .footer .status-value.ok   { color: var(--ok); }
+.sidebar .footer .status-value.err  { color: var(--err); }
+.sidebar .footer .status-value.warn { color: var(--warn); }
+.sidebar .footer .footer-sub { color: var(--fg-dimmer); margin-top: 2px; }
+/* Persistent backend identity. Sits below the advertised URL so even
+   when an operator has uploaded their own logo, "what is this" stays
+   answerable from the bottom-left of every page. */
+.sidebar .footer .footer-version {
+  margin-top: 8px; padding-top: 8px;
+  border-top: 1px dashed var(--border-soft);
+  color: var(--fg-dim);
+  font-variant-numeric: tabular-nums;
+  letter-spacing: 0.2px;
 }
-.sidebar .footer code { background: transparent; color: var(--fg-dim); padding: 0; }
 
 /* ── Top bar ───────────────────────────────────────────────────────── */
 
@@ -230,7 +276,7 @@ button, .btn {
   cursor: pointer;
   transition: background 0.12s ease;
 }
-button:hover, .btn:hover { background: var(--accent-dim); color: #fff; }
+button:hover, .btn:hover { background: var(--accent-dim); color: #f4fffd; }
 button.ghost { background: transparent; color: var(--fg); border: 1px solid var(--border); }
 button.ghost:hover { background: var(--bg-panel-2); color: var(--fg); }
 button.danger { background: transparent; color: var(--err); border: 1px solid color-mix(in srgb, var(--err) 35%, transparent); }
@@ -281,8 +327,7 @@ label.check input { accent-color: var(--accent); }
 
 /* ── Imaging progress widget ───────────────────────────────────────
    Animated brand mark paired with a horizontal progress bar; surfaces
-   on Dashboard and the Queue tab. Renamed from `.forge-progress` in
-   v0.3.0 — the anvil-themed naming is gone with the rebrand. */
+   on Dashboard and the Queue tab. */
 .queue-progress {
   display: flex; align-items: center; gap: 16px;
   padding: 16px;
@@ -380,7 +425,7 @@ tr.unbootable td:first-child { border-left: 3px solid var(--warn); }
 .form-row { display: grid; grid-template-columns: repeat(4, 1fr); gap: 10px 14px; }
 @media (max-width: 900px) { .form-row { grid-template-columns: 1fr; } }
 
-/* ── Gate queue "horse race" visual ──────────────────────────────── */
+/* ── Queued deployment visual ────────────────────────────────────── */
 .queue-track {
   display: grid; gap: 6px;
   padding: 10px 0;
@@ -414,52 +459,204 @@ tr.unbootable td:first-child { border-left: 3px solid var(--warn); }
   min-height: 480px;
   box-shadow: var(--shadow-card);
 }
+/* Terminal pane colours follow the active theme. Hard-coded hexes
+   (#050505, #181818, #cfd6e2 etc.) were leaving the light-mode pane
+   looking dark; we keep palette-aware vars instead so the toggle works. */
 .terminal .pane {
   flex: 1; overflow: auto;
   padding: 10px 14px;
   font-family: var(--mono); font-size: 12.5px; line-height: 1.5;
-  color: #cfd6e2;
+  color: var(--fg);
   white-space: pre-wrap; word-break: break-word;
 }
 .terminal .pane .lvl-error { color: var(--err); }
 .terminal .pane .lvl-warn  { color: var(--warn); }
-.terminal .pane .lvl-info  { color: #cfd6e2; }
-.terminal .pane .lvl-debug { color: #8b94a8; }
-.terminal .pane .lvl-trace { color: #5a6379; }
-.terminal .pane .ts        { color: #5a6379; }
-.terminal .pane .tg        { color: #7cd3ff; }
+.terminal .pane .lvl-info  { color: var(--fg); }
+.terminal .pane .lvl-debug { color: var(--fg-dim); }
+.terminal .pane .lvl-trace { color: var(--fg-dimmer); }
+.terminal .pane .ts        { color: var(--fg-dimmer); }
+.terminal .pane .tg        { color: var(--accent); }
 .terminal .pane .echo      { color: var(--accent); }
 .terminal .input-row {
   display: flex; align-items: center; gap: 8px;
   padding: 8px 14px;
-  background: #0a0e15;
-  border-top: 1px solid #1d2330;
+  background: var(--bg-panel-2);
+  border-top: 1px solid var(--border);
 }
 .terminal .input-row .prompt { color: var(--accent); font-family: var(--mono); }
 .terminal .input-row input {
-  flex: 1; background: transparent; border: 0; color: #e4e8ef;
+  flex: 1; background: transparent; border: 0; color: var(--fg);
   font: inherit; font-family: var(--mono); font-size: 13px;
   outline: none; padding: 4px 0;
 }
 .terminal .toolbar {
   display: flex; gap: 8px; align-items: center;
   padding: 8px 14px;
-  background: #0a0e15;
-  border-bottom: 1px solid #1d2330;
-  font-size: 12px; color: #8a94a7;
+  background: var(--bg-panel-2);
+  border-bottom: 1px solid var(--border);
+  font-size: 12px; color: var(--fg-dim);
 }
 .terminal .toolbar .right { margin-left: auto; display: flex; gap: 6px; }
 .terminal .toolbar button {
   padding: 3px 9px; font-size: 11px;
-  background: transparent; color: #8a94a7; border: 1px solid #1d2330;
+  background: transparent; color: var(--fg-dim); border: 1px solid var(--border);
   font-weight: 500;
 }
-.terminal .toolbar button:hover { color: #e4e8ef; background: #1d2330; }
+.terminal .toolbar button:hover { color: var(--fg); background: var(--bg-elev); }
+
+/* ── Auth screen (first-run setup + login) ───────────────────────
+   Used when /api/me reports setup_required or !authenticated. The
+   regular .shell is hidden; this overlay takes the full viewport so
+   the operator never sees half-loaded dashboard chrome while the auth
+   state is unknown. Same palette as the rest of the UI — borrows the
+   Sonarr/Radarr layout (centered narrow card on the page background).
+*/
+.auth-screen {
+  position: fixed; inset: 0;
+  display: flex; align-items: center; justify-content: center;
+  background: var(--bg);
+  padding: 24px;
+  z-index: 100;
+}
+.auth-card {
+  width: 100%; max-width: 380px;
+  background: var(--bg-panel);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-lg);
+  box-shadow: var(--shadow-card);
+  padding: 28px 28px 22px;
+}
+.auth-card .brand-row {
+  display: flex; align-items: center; gap: 12px;
+  margin-bottom: 18px;
+}
+.auth-card .brand-row img { width: 32px; height: 32px; flex: none; }
+.auth-card .brand-row .name { font-size: 17px; font-weight: 600; letter-spacing: 0.2px; color: var(--fg); }
+.auth-card h2 {
+  margin: 0 0 6px; font-size: 16px; font-weight: 600; color: var(--fg);
+}
+.auth-card .lede {
+  color: var(--fg-dim); font-size: 13px; margin: 0 0 18px;
+  line-height: 1.5;
+}
+.auth-card .field { margin-bottom: 12px; }
+.auth-card input[type="text"],
+.auth-card input[type="password"] {
+  width: 100%; background: var(--bg); color: var(--fg);
+  border: 1px solid var(--border); border-radius: var(--radius);
+  padding: 9px 11px; font: inherit; font-size: 13.5px;
+}
+.auth-card input:focus { outline: none; border-color: var(--accent); }
+.auth-card .submit { width: 100%; padding: 9px 12px; margin-top: 6px; }
+.auth-card .auth-err {
+  margin-top: 12px; color: var(--err); font-size: 12.5px;
+}
+.auth-card .auth-foot {
+  margin-top: 14px; padding-top: 12px;
+  border-top: 1px solid var(--border-soft);
+  color: var(--fg-dimmer); font-size: 11.5px; text-align: center;
+}
+.auth-card .sso-btn {
+  width: 100%; margin-top: 10px;
+  background: transparent; color: var(--fg);
+  border: 1px solid var(--border);
+  padding: 9px 12px;
+}
+.auth-card .sso-btn:hover {
+  background: var(--bg-panel-2); border-color: var(--accent); color: var(--fg);
+}
+.auth-card .sso-btn .meta { color: var(--fg-dim); font-size: 11px; margin-top: 2px; }
+
+/* ── Logout chip (sidebar footer) ────────────────────────────── */
+.sidebar .footer .logout-row {
+  margin-top: 8px; display: flex; align-items: center; justify-content: space-between;
+  gap: 8px;
+}
+.sidebar .footer .logout-row .who {
+  color: var(--fg); font-weight: 600; font-size: 11.5px;
+  overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
+}
+.sidebar .footer .logout-btn {
+  background: transparent; color: var(--fg-dim);
+  border: 1px solid var(--border); border-radius: var(--radius);
+  padding: 2px 8px; font: inherit; font-size: 11px; font-weight: 500;
+  cursor: pointer;
+}
+.sidebar .footer .logout-btn:hover { color: var(--fg); background: var(--bg-panel-2); border-color: var(--accent); }
 
 /* ── About card ─────────────────────────────────────────────────── */
 .about-hero { padding: 20px 24px; }
 .about-hero h2 { font-size: 22px; margin: 0 0 8px; color: var(--fg); }
-.about-hero .lead { color: var(--fg-dim); font-size: 14px; max-width: 60ch; }
+/* Span the full main column rather than capping at 60ch — the page is
+   read at typical desktop widths and the cap was leaving the right two
+   thirds of the panel awkwardly empty. */
+.about-hero .lead { color: var(--fg-dim); font-size: 14px; max-width: none; }
 .about-hero .who { margin-top: 18px; font-size: 13px; }
 .about-hero .who span { color: var(--fg-dim); }
 .about-hero .who strong { color: var(--accent); }
+.about-hero a { color: var(--accent); }
+
+/* ── API reference (Settings → bottom) ─────────────────────────── */
+.api-ref { display: grid; gap: 18px; padding: 16px; }
+.api-ref .group h3 {
+  margin: 0 0 8px; font-size: 13px; color: var(--fg-dim);
+  text-transform: uppercase; letter-spacing: 0.8px;
+}
+.api-ref .ep {
+  display: grid; grid-template-columns: 64px minmax(200px, 1fr) 2fr;
+  gap: 12px; align-items: baseline;
+  padding: 6px 0; border-top: 1px solid var(--border-soft);
+  font-size: 13px;
+}
+.api-ref .ep:first-child { border-top: 0; }
+.api-ref .ep .method {
+  font-family: var(--mono); font-weight: 600; font-size: 11px;
+  padding: 2px 6px; border-radius: 4px;
+  text-align: center; letter-spacing: 0.6px;
+}
+.api-ref .ep .method.get    { background: color-mix(in srgb, var(--ok) 22%, transparent);     color: var(--ok); }
+.api-ref .ep .method.post   { background: color-mix(in srgb, var(--accent) 22%, transparent); color: var(--accent); }
+.api-ref .ep .method.put    { background: color-mix(in srgb, var(--warn) 22%, transparent);   color: var(--warn); }
+.api-ref .ep .method.delete { background: color-mix(in srgb, var(--err) 22%, transparent);    color: var(--err); }
+.api-ref .ep .path { font-family: var(--mono); color: var(--fg); word-break: break-all; }
+.api-ref .ep .desc { color: var(--fg-dim); }
+@media (max-width: 900px) {
+  .api-ref .ep { grid-template-columns: 1fr; gap: 4px; }
+  .api-ref .ep .method { justify-self: start; }
+}
+
+/* ── Disk space card ───────────────────────────────────────────── */
+.diskbar {
+  height: 10px; border-radius: 5px;
+  background: var(--bg-elev);
+  overflow: hidden; margin-top: 8px;
+}
+.diskbar .fill {
+  height: 100%;
+  background: linear-gradient(90deg, var(--accent-dim), var(--accent));
+  transition: width 0.4s ease;
+}
+.diskbar.warn .fill { background: var(--warn); }
+.diskbar.full .fill { background: var(--err); }
+.disk-meta { display: flex; gap: 14px; font-size: 12px; color: var(--fg-dim); margin-top: 8px; flex-wrap: wrap; }
+.disk-meta strong { color: var(--fg); font-weight: 600; font-variant-numeric: tabular-nums; }
+
+/* ── Logo upload (Settings) ────────────────────────────────────── */
+.logo-preview {
+  display: flex; align-items: center; gap: 14px;
+  padding: 12px;
+  background: var(--bg-panel-2);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+}
+.logo-preview .swatch {
+  width: 56px; height: 56px;
+  display: flex; align-items: center; justify-content: center;
+  background: var(--bg); border: 1px solid var(--border);
+  border-radius: var(--radius);
+  flex: none;
+}
+.logo-preview .swatch img { max-width: 48px; max-height: 48px; }
+.logo-preview .info { flex: 1; min-width: 0; }
+.logo-preview .info .name { color: var(--fg); font-weight: 600; }
+.logo-preview .info .meta { color: var(--fg-dim); font-size: 12px; margin-top: 2px; }

crates/webui/src/app.js

@@ -63,16 +63,37 @@
   };
 
   // ── network helpers ──────────────────────────────────────────────
+  // All three helpers funnel through a 401 detector. When the server
+  // says "auth required" mid-session — most commonly because the
+  // operator's session expired while the tab was idle — we transparently
+  // swap the SPA out for the login screen rather than letting the UI
+  // throw a generic error.
+  function maybeAuthBounce(r) {
+    if (r && r.status === 401) {
+      // Render the login screen without reloading; any in-flight
+      // promises still return their values to the original caller.
+      showAuthScreen('login');
+    }
+    return r;
+  }
   async function getJSON(url) {
-    const r = await fetch(url);
+    const r = maybeAuthBounce(await fetch(url));
     if (!r.ok) throw new Error(url + ': ' + r.status);
     return r.json();
   }
   async function putJSON(url, body) {
-    return fetch(url, {method:'PUT', headers:{'Content-Type':'application/json'}, body: JSON.stringify(body)});
+    return maybeAuthBounce(await fetch(url, {
+      method:'PUT',
+      headers:{'Content-Type':'application/json'},
+      body: JSON.stringify(body),
+    }));
   }
   async function postJSON(url, body) {
-    return fetch(url, {method:'POST', headers:{'Content-Type':'application/json'}, body: JSON.stringify(body)});
+    return maybeAuthBounce(await fetch(url, {
+      method:'POST',
+      headers:{'Content-Type':'application/json'},
+      body: JSON.stringify(body),
+    }));
   }
 
   // Animated brand-mark + progress bar widget. Built once here and inlined
@@ -246,7 +267,7 @@
       return el('div', {class:'grid'}, [networkCard]);
     },
 
-    gate: async () => {
+    queue: async () => {
       const [{ entries = [] }, isos] = await Promise.all([
         getJSON('/api/queue'), getJSON('/api/isos'),
       ]);
@@ -267,7 +288,7 @@
         if (!j.ok) { msg.textContent = 'Assign failed: ' + (j.error || 'unknown'); msg.className='msg err'; return; }
         msg.textContent = 'Launched ' + j.assigned + ' client' + (j.assigned===1?'':'s') + ' → ' + j.target;
         msg.className = 'msg ok';
-        render('gate');
+        render('queue');
       };
 
       const track = entries.length
@@ -284,22 +305,22 @@
                 : el('span', {class:'tag accent'}, 'waiting')),
               el('button', {class:'ghost', onclick: async () => {
                 await fetch('/api/queue/' + encodeURIComponent(g.id), {method:'DELETE'});
-                render('gate');
+                render('queue');
               }}, 'Release'),
             ]))
           )
         : el('div', {class:'empty'},
-            'No clients at the gate. Boot a client and choose "Queued Deployment" in the PXE menu.');
+            'No clients queued. Boot a client and choose "Queued Deployment" in the PXE menu.');
 
       const imaging = entries.filter(g => g.assigned_target).length;
 
       return el('div', {class:'grid'}, [
         el('div', {class:'card'}, [
-          el('header', {}, el('h2', {}, 'Forge')),
+          el('header', {}, el('h2', {}, 'Status')),
           queueProgressWidget(imaging, entries.length),
         ]),
         el('div', {class:'card'}, [
-          el('header', {}, el('h2', {}, 'Launch an image across the gate')),
+          el('header', {}, el('h2', {}, 'Launch image for queued clients')),
           el('div', {class:'body'}, [
             el('label', {class:'field'}, [
               el('span', {class:'name'}, 'Target image'),
@@ -312,7 +333,7 @@
         ]),
         el('div', {class:'card'}, [
           el('header', {}, [
-            el('h2', {}, 'Gate positions'),
+            el('h2', {}, 'Queue positions'),
             el('span', {class:'sub'}, entries.length + ' waiting'),
           ]),
           el('div', {class:'body'}, track),
@@ -321,8 +342,11 @@
     },
 
     storage: async () => {
-      const [isos, settings, nfsRes] = await Promise.all([
+      const [isos, settings, nfsRes, disk] = await Promise.all([
         getJSON('/api/isos'), getJSON('/api/settings'), getJSON('/api/nfs'),
+        getJSON('/api/storage/disk').catch(() => ({
+          total_bytes: 0, available_bytes: 0, used_bytes: 0, path: '?',
+        })),
       ]);
       const mounts = nfsRes.mounts || [];
 
@@ -346,29 +370,84 @@
       });
       file.onchange = () => { if (file.files[0]) upload(file.files[0]); };
 
-      function upload(f) {
-        upMsg.textContent = 'Uploading ' + f.name + ' (' + fmtBytes(f.size) + ')…';
-        upMsg.className = 'msg';
+      // Chunked upload telemetry. The old browser path posted one huge
+      // multipart body, which left operators staring at 0% when a reverse
+      // proxy buffered or rejected the request before OpenPXE saw it. This
+      // path writes small raw chunks; each acknowledged chunk advances the
+      // bar and leaves a visible .partial file in the ISO directory.
+      async function upload(f) {
+        const started = Date.now();
+        const bar = $('#bar');
+        const setStatus = (text, cls) => { upMsg.textContent = text; upMsg.className = 'msg ' + (cls || ''); };
+        const update = (loaded, total, phase) => {
+          const pct = total > 0 ? Math.min(100, (loaded / total) * 100) : 100;
+          bar.style.width = pct.toFixed(1) + '%';
+          const elapsed = Math.max(0.001, (Date.now() - started) / 1000);
+          const rate = loaded > 0 ? loaded / elapsed : 0;
+          const remain = rate > 0 ? (total - loaded) / rate : 0;
+          setStatus(
+            phase + ' ' + f.name + ' - ' +
+            fmtBytes(loaded) + ' of ' + fmtBytes(total) +
+            ' (' + pct.toFixed(1) + '%, ' + fmtBytes(rate) + '/s' +
+            (remain > 0 ? ', ' + Math.ceil(remain) + 's left' : '') + ')');
+        };
+        const failText = async (r) => {
+          const text = (await r.text()).slice(0, 240);
+          let hint = '';
+          if (r.status === 413)      hint = ' - body too large. A proxy likely rejected this chunk.';
+          else if (r.status === 502) hint = ' - bad gateway. Proxy lost the upstream mid-stream.';
+          else if (r.status === 504) hint = ' - gateway timeout. Try the LAN IP directly.';
+          else if (r.status === 409) hint = ' - name conflict or offset mismatch. Remove the old ISO and retry.';
+          return 'HTTP ' + r.status + ' ' + text + hint;
+        };
+
+        let uploadId = null;
+        setStatus('Preparing upload for ' + f.name + ' (' + fmtBytes(f.size) + ')');
         prog.classList.add('active');
-        const fd = new FormData(); fd.append('file', f);
-        const xhr = new XMLHttpRequest();
-        xhr.upload.onprogress = e => {
-          if (e.lengthComputable) $('#bar').style.width = (e.loaded/e.total*100).toFixed(1) + '%';
-        };
-        xhr.onload = () => {
-          prog.classList.remove('active');
-          $('#bar').style.width = '0';
-          if (xhr.status >= 200 && xhr.status < 300) {
-            upMsg.textContent = 'Uploaded & analyzed.'; upMsg.className = 'msg ok';
+        bar.style.width = '1%';
+
+        try {
+          const begin = await postJSON('/api/uploads', {
+            filename: f.name,
+            size_bytes: f.size,
+          });
+          if (!begin.ok) throw new Error(await failText(begin));
+          const session = await begin.json();
+          uploadId = session.upload_id;
+          const chunkSize = Math.max(1024 * 1024, Number(session.chunk_size || 8 * 1024 * 1024));
+
+          let offset = Number(session.offset || 0);
+          let finished = null;
+          do {
+            const end = Math.min(offset + chunkSize, f.size);
+            const complete = end >= f.size;
+            const r = await fetch('/api/uploads/' + encodeURIComponent(uploadId), {
+              method: 'PUT',
+              headers: {
+                'x-openpxe-upload-offset': String(offset),
+                'x-openpxe-upload-complete': complete ? 'true' : 'false',
+              },
+              body: f.slice(offset, end),
+            });
+            if (!r.ok) throw new Error(await failText(r));
+            const j = await r.json();
+            offset = Number(j.offset || end);
+            update(offset, f.size, complete ? 'Analyzing' : 'Uploading');
+            if (j.complete) finished = j.iso || true;
+          } while (!finished);
+
+          setStatus('Uploaded and analyzed: ' + f.name + ' (' + fmtBytes(f.size) + ')', 'ok');
           render('storage');
-          } else {
-            upMsg.textContent = 'Upload failed: ' + xhr.status + ' ' + xhr.responseText;
-            upMsg.className = 'msg err';
+        } catch (err) {
+          if (uploadId) {
+            try { await fetch('/api/uploads/' + encodeURIComponent(uploadId), {method: 'DELETE'}); }
+            catch {}
+          }
+          setStatus('Upload failed: ' + (err && err.message ? err.message : String(err)), 'err');
+        } finally {
+          prog.classList.remove('active');
+          if (!upMsg.className.includes('ok')) bar.style.width = '0';
         }
-        };
-        xhr.onerror = () => { upMsg.textContent = 'Network error.'; upMsg.className = 'msg err'; };
-        xhr.open('POST', '/api/isos');
-        xhr.send(fd);
       }
 
       // ── ISO table (mixed local + NFS) ──
@@ -456,6 +535,30 @@
         const editorRow = el('tr', {style:'display:none'}, editorCells);
         refreshFieldVisibility();
 
+        // Type cell becomes an OS/Tools <select>. Default is OS (everything
+        // routes through the family-detected installer submenu); switching
+        // to Tools moves the ISO into the Tools submenu next to memtest.
+        // The detected family stays visible as a small subtitle below the
+        // selector so the operator hasn't lost that information.
+        const catSel = el('select', {
+          style: 'min-width:96px;background:var(--bg);color:var(--fg);' +
+                 'border:1px solid var(--border);border-radius:var(--radius);' +
+                 'padding:4px 8px;font:inherit;font-size:12px'
+        }, [
+          el('option', {value: 'os'},    'OS'),
+          el('option', {value: 'tools'}, 'Tools'),
+        ]);
+        catSel.value = (i.category || 'os');
+        catSel.onchange = async () => {
+          const r = await putJSON('/api/isos/' + encodeURIComponent(i.id) + '/category',
+            { category: catSel.value });
+          if (!r.ok) {
+            const t = await r.text();
+            alert('Category change failed: ' + t);
+          }
+          render('storage');
+        };
+
         const tr = el('tr', b.ok ? {} : {class: 'unbootable'}, [
           el('td', {}, [
             el('div', {style:'display:flex;align-items:center;gap:8px'}, [
@@ -468,7 +571,11 @@
             !b.ok ? el('div', {class:'row-warn'}, '⚠ ' + b.reason)
                   : (b.warn ? el('div', {class:'row-warn'}, '⚠ ' + b.warn) : null),
           ]),
-          el('td', {}, el('span', {class:'tag'}, familyLabel(i.introspection.family))),
+          el('td', {}, [
+            catSel,
+            el('div', {style:'color:var(--fg-dim);font-size:11px;margin-top:4px'},
+              familyLabel(i.introspection.family)),
+          ]),
           el('td', {class:'num'}, fmtBytes(i.size_bytes)),
           el('td', {},
             el('span', {class:'src-badge' + (isNfs ? ' nfs' : '')},
@@ -554,7 +661,48 @@
         el('span'),
       ])) : [el('div', {class:'empty'}, 'No NFS shares mounted.')];
 
+      // Disk-space card. Free + used + total for the volume hosting the
+      // ISO directory, with a coloured bar. Warns at 80% and goes red at
+      // 95% so the operator sees the runway shrinking before uploads
+      // start failing with ENOSPC.
+      const total = Number(disk.total_bytes || 0);
+      const avail = Number(disk.available_bytes || 0);
+      const used  = Number(disk.used_bytes  || 0);
+      const pctUsed = total > 0 ? (used / total) * 100 : 0;
+      let barClass = 'diskbar';
+      if (pctUsed >= 95)      barClass += ' full';
+      else if (pctUsed >= 80) barClass += ' warn';
+      const diskCard = el('div', {class:'card'}, [
+        el('header', {}, [
+          el('h2', {}, 'Disk space'),
+          el('span', {class:'sub'},
+            total > 0
+              ? (pctUsed.toFixed(1) + '% used')
+              : 'unavailable'),
+        ]),
+        el('div', {class:'body'}, [
+          el('div', {style:'color:var(--fg-dim);font-size:12px;word-break:break-all'},
+            disk.path ? ('Volume: ' + disk.path) : 'Volume path unknown'),
+          el('div', {class: barClass},
+            el('div', {class:'fill',
+              style:'width:' + Math.min(100, pctUsed).toFixed(1) + '%'})),
+          el('div', {class:'disk-meta'}, [
+            el('span', {}, ['Used ',  el('strong', {}, fmtBytes(used))]),
+            el('span', {}, ['Free ',  el('strong', {}, fmtBytes(avail))]),
+            el('span', {}, ['Total ', el('strong', {}, fmtBytes(total))]),
+          ]),
+          pctUsed >= 95
+            ? el('p', {class:'msg err', style:'margin-top:10px'},
+                '⚠ Less than 5% free. Remove old ISOs or grow the volume before uploading more.')
+            : (pctUsed >= 80
+                ? el('p', {class:'msg', style:'color:var(--warn);margin-top:10px'},
+                    'Volume is getting full. Consider pruning old ISOs.')
+                : null),
+        ]),
+      ]);
+
       return el('div', {class:'grid'}, [
+        diskCard,
         el('div', {class:'card'}, [
           el('header', {}, el('h2', {}, 'Upload ISO')),
           el('div', {class:'body'}, [drop, file, prog, upMsg]),
@@ -602,9 +750,11 @@
     },
 
     hosts: async () => {
-      const [{ hosts = [] }, isos] = await Promise.all([
+      const [{ hosts = [] }, isos, bootLogRes] = await Promise.all([
         getJSON('/api/hosts'), getJSON('/api/isos'),
+        getJSON('/api/boot-log').catch(() => ({ events: [] })),
       ]);
+      const bootEvents = bootLogRes.events || [];
       const targets = isos.flatMap(i => i.boot_entries.map(e => ({
         id: e.id, title: e.title + '  — ' + familyLabel(i.introspection.family),
       })));
@@ -680,8 +830,7 @@
             upsertBtn, msg,
             el('p', {class:'msg', style:'margin-top:14px'},
               'When a client with a bound MAC requests boot.ipxe, OpenPXE ' +
-              'short-circuits past the interactive menu and chains directly. ' +
-              'Inspired by Tinkerbell smee\'s MAC-prepended URL pattern.'),
+              'short-circuits past the interactive menu and chains directly.'),
           ]),
         ]),
         el('div', {class:'card'}, [
@@ -691,6 +840,37 @@
           ]),
           table,
         ]),
+        el('div', {class:'card'}, [
+          el('header', {}, [
+            el('h2', {}, 'Host log'),
+            el('span', {class:'sub'},
+              bootEvents.length + ' event' + (bootEvents.length === 1 ? '' : 's')),
+          ]),
+          bootEvents.length
+            ? el('table', {}, [
+                el('thead', {}, el('tr', {}, [
+                  el('th', {}, 'Time'),
+                  el('th', {}, 'MAC'),
+                  el('th', {}, 'IP'),
+                  el('th', {}, 'Image'),
+                ])),
+                el('tbody', {},
+                  bootEvents.map(e => el('tr', {}, [
+                    el('td', {}, fmtAgo(e.timestamp)),
+                    el('td', {class:'mono'}, e.mac || el('span', {class:'tag'}, '(unknown)')),
+                    el('td', {class:'mono'}, e.ip ? String(e.ip) : '—'),
+                    el('td', {}, [
+                      el('span', {style:'font-weight:600'}, e.target_title || e.target_id),
+                      el('div', {class:'meta',
+                        style:'color:var(--fg-dim);font-size:11.5px;margin-top:2px'},
+                        e.target_id),
+                    ]),
+                  ]))),
+              ])
+            : el('div', {class:'empty'},
+                'No boot events yet. When a PXE client chains a boot entry, ' +
+                'it lands here with the MAC, IP, and image it received.'),
+        ]),
       ]);
     },
 
@@ -821,6 +1001,299 @@
       return term;
     },
 
+    settings: async () => {
+      const [status, docs, me, sso] = await Promise.all([
+        getJSON('/api/status'),
+        getJSON('/api/docs').catch(() => ({ groups: [] })),
+        getJSON('/api/me').catch(() => ({})),
+        getJSON('/api/sso').catch(() => ({
+          enabled:false, idp_name:'', metadata:'', metadata_url:'',
+        })),
+      ]);
+      const hasLogo = !!status.custom_logo;
+
+      // ── Account card (Forms admin credentials, v0.4.5).
+      // Sonarr/Radarr-style: the admin enters their current password
+      // before changing username or password. On success the server
+      // revokes every other session, so a forgotten browser tab can't
+      // keep operating with stale credentials.
+      const currentPw = el('input', {type:'password', autocomplete:'current-password'});
+      const newUser   = el('input', {type:'text', autocomplete:'username',
+        placeholder: (me.user && me.user.username) || 'admin'});
+      const newPw     = el('input', {type:'password', autocomplete:'new-password',
+        placeholder: 'leave blank to keep current'});
+      const newPwConfirm = el('input', {type:'password', autocomplete:'new-password',
+        placeholder: 'confirm new password'});
+      const accountMsg = el('div', {class:'msg', style:'margin-top:8px'});
+      const accountSave = el('button', {onclick: async () => {
+        accountMsg.textContent = ''; accountMsg.className = 'msg';
+        if (!currentPw.value) {
+          accountMsg.textContent = 'Current password is required.';
+          accountMsg.className = 'msg err';
+          return;
+        }
+        if (newPw.value && newPw.value !== newPwConfirm.value) {
+          accountMsg.textContent = 'New password and confirmation do not match.';
+          accountMsg.className = 'msg err';
+          return;
+        }
+        if (!newUser.value && !newPw.value) {
+          accountMsg.textContent = 'Nothing to change. Fill in a new username or password.';
+          accountMsg.className = 'msg err';
+          return;
+        }
+        const body = { current_password: currentPw.value };
+        if (newUser.value) body.new_username = newUser.value;
+        if (newPw.value)   body.new_password = newPw.value;
+        const r = await putJSON('/api/me/credentials', body);
+        // Clear the typed plaintext immediately — minimises DOM dwell time.
+        currentPw.value = ''; newPw.value = ''; newPwConfirm.value = '';
+        if (r.ok) {
+          accountMsg.textContent = 'Credentials updated. Other sessions were signed out.';
+          accountMsg.className = 'msg ok';
+          // Refresh the settings view to pick up the new "logged in as" display.
+          setTimeout(() => render('settings'), 600);
+        } else {
+          const j = await r.json().catch(() => ({}));
+          accountMsg.textContent = j.error || ('Update failed: HTTP ' + r.status);
+          accountMsg.className = 'msg err';
+        }
+      }}, 'Update credentials');
+      const accountCard = el('div', {class:'card'}, [
+        el('header', {}, [
+          el('h2', {}, 'Administrator account'),
+          el('span', {class:'sub'},
+            (me && me.user && me.user.username)
+              ? ('signed in as ' + me.user.username)
+              : 'signed in'),
+        ]),
+        el('div', {class:'body'}, [
+          el('p', {class:'msg', style:'margin-bottom:14px'},
+            'Rotate the administrator login. Your current password is required ' +
+            'to make any change; on success every other browser session is ' +
+            'signed out so a stale cookie can\'t keep operating.'),
+          el('div', {class:'form-row'}, [
+            el('label', {class:'field'}, [
+              el('span', {class:'name'}, 'Current password'),
+              currentPw,
+            ]),
+            el('label', {class:'field'}, [
+              el('span', {class:'name'}, 'New username (optional)'),
+              newUser,
+            ]),
+            el('label', {class:'field'}, [
+              el('span', {class:'name'}, 'New password (optional)'),
+              newPw,
+            ]),
+            el('label', {class:'field'}, [
+              el('span', {class:'name'}, 'Confirm new password'),
+              newPwConfirm,
+            ]),
+          ]),
+          accountSave, accountMsg,
+        ]),
+      ]);
+
+      // ── SSO card (FleetDM-shaped, storage-only for v0.4.5).
+      // Operators paste either a metadata URL or the raw XML; tabs
+      // switch the visible field. Saving validates server-side. The
+      // actual SAML login flow ships in a later release — we surface
+      // a yellow "config saved, runtime pending" line when usable.
+      const ssoEnabled = el('input', {type:'checkbox'});
+      ssoEnabled.checked = !!sso.enabled;
+      const ssoName = el('input', {type:'text', placeholder:'e.g. Okta, Azure AD',
+        value: sso.idp_name || ''});
+      const ssoUrl = el('input', {type:'text', placeholder:'https://idp.example.com/metadata',
+        value: sso.metadata_url || ''});
+      const ssoXml = el('textarea', {rows:'6',
+        placeholder:'<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"…',
+        style:'width:100%;font-family:var(--mono);font-size:12px;background:var(--bg);' +
+              'color:var(--fg);border:1px solid var(--border);border-radius:var(--radius);' +
+              'padding:8px 10px;resize:vertical'},
+        sso.metadata || '');
+      const ssoMode = el('select', {style:'min-width:160px;background:var(--bg);color:var(--fg);' +
+        'border:1px solid var(--border);border-radius:var(--radius);padding:6px 8px;font:inherit'}, [
+        el('option', {value:'url'}, 'Metadata URL'),
+        el('option', {value:'xml'}, 'Metadata XML'),
+      ]);
+      ssoMode.value = sso.metadata && !sso.metadata_url ? 'xml' : 'url';
+      const urlWrap = el('label', {class:'field'}, [
+        el('span', {class:'name'}, 'IdP metadata URL'),
+        ssoUrl,
+        el('span', {class:'hint'},
+          'OpenPXE will fetch this URL once SSO sign-in lands; v0.4.5 just stores it.'),
+      ]);
+      const xmlWrap = el('label', {class:'field'}, [
+        el('span', {class:'name'}, 'IdP metadata XML'),
+        ssoXml,
+        el('span', {class:'hint'},
+          'Paste the raw <EntityDescriptor>…</EntityDescriptor> document from your IdP.'),
+      ]);
+      const refreshSsoFields = () => {
+        if (ssoMode.value === 'url') {
+          urlWrap.style.display = ''; xmlWrap.style.display = 'none';
+        } else {
+          urlWrap.style.display = 'none'; xmlWrap.style.display = '';
+        }
+      };
+      ssoMode.onchange = refreshSsoFields;
+      refreshSsoFields();
+      const ssoMsg = el('div', {class:'msg', style:'margin-top:8px'});
+      const ssoSave = el('button', {onclick: async () => {
+        ssoMsg.textContent = ''; ssoMsg.className = 'msg';
+        const payload = {
+          enabled: ssoEnabled.checked,
+          idp_name: ssoName.value,
+          metadata:     ssoMode.value === 'xml' ? ssoXml.value : '',
+          metadata_url: ssoMode.value === 'url' ? ssoUrl.value : '',
+        };
+        const r = await putJSON('/api/sso', payload);
+        if (r.ok) {
+          ssoMsg.textContent = ssoEnabled.checked
+            ? 'SSO configuration saved. Runtime sign-in flow ships in a future release.'
+            : 'SSO configuration saved (disabled).';
+          ssoMsg.className = 'msg ok';
+        } else {
+          const t = await r.text();
+          ssoMsg.textContent = 'Save failed: ' + t;
+          ssoMsg.className = 'msg err';
+        }
+      }}, 'Save SSO settings');
+      const ssoCard = el('div', {class:'card'}, [
+        el('header', {}, [
+          el('h2', {}, 'Single sign-on (SAML)'),
+          el('span', {class:'sub'},
+            sso.enabled
+              ? (sso.metadata_url || sso.metadata
+                  ? 'configured · runtime pending'
+                  : 'enabled but missing source')
+              : 'disabled'),
+        ]),
+        el('div', {class:'body'}, [
+          el('p', {class:'msg', style:'margin-bottom:14px'},
+            'Configure your SAML IdP today; OpenPXE persists the metadata so ' +
+            'when SSO sign-in lights up in a future release, no operator ' +
+            're-entry is needed. The local administrator account above is ' +
+            'always available as a fallback owner regardless of SSO state.'),
+          el('label', {class:'check', style:'margin-bottom:14px;max-width:280px'}, [
+            ssoEnabled,
+            el('span', {}, 'Enable single sign-on'),
+          ]),
+          el('div', {class:'form-row'}, [
+            el('label', {class:'field'}, [
+              el('span', {class:'name'}, 'IdP display name'),
+              ssoName,
+              el('span', {class:'hint'}, '"Sign in with X" label on the login screen.'),
+            ]),
+            el('label', {class:'field'}, [
+              el('span', {class:'name'}, 'Metadata source'),
+              ssoMode,
+            ]),
+          ]),
+          urlWrap,
+          xmlWrap,
+          ssoSave, ssoMsg,
+        ]),
+      ]);
+
+      // ── Custom logo upload.
+      // Single-file drop-zone; PNG/SVG/JPEG/WebP/GIF up to 2 MB.
+      // Persisted as <work_dir>/branding/logo.<ext> and served from
+      // /assets/logo.svg in preference to the bundled mark.
+      const logoFile = el('input', {
+        type:'file',
+        accept:'image/svg+xml,image/png,image/jpeg,image/webp,image/gif',
+        style:'display:none', id:'logo-file',
+      });
+      const logoMsg = el('div', {class:'msg', style:'margin-top:10px'});
+      const logoBust = '?v=' + Date.now(); // bust the browser cache after upload
+      logoFile.onchange = async () => {
+        if (!logoFile.files[0]) return;
+        const f = logoFile.files[0];
+        const fd = new FormData(); fd.append('file', f, f.name);
+        logoMsg.textContent = 'Uploading ' + f.name + ' (' + fmtBytes(f.size) + ')…';
+        logoMsg.className = 'msg';
+        const r = await fetch('/api/branding/logo', {method:'POST', body: fd});
+        if (r.ok) {
+          logoMsg.textContent = 'Custom logo installed. Reloading…';
+          logoMsg.className = 'msg ok';
+          setTimeout(() => location.reload(), 600);
+        } else {
+          const t = await r.text();
+          logoMsg.textContent = 'Upload failed: ' + t;
+          logoMsg.className = 'msg err';
+        }
+      };
+      const logoCard = el('div', {class:'card'}, [
+        el('header', {}, el('h2', {}, 'Branding')),
+        el('div', {class:'body'}, [
+          el('p', {class:'msg', style:'margin-bottom:14px'},
+            'Override the top-left brand mark with your own logo. Up to 2 MB; ' +
+            'PNG, SVG, JPEG, WebP, or GIF. The original OpenPXE version is ' +
+            'always shown in the bottom-left for support purposes.'),
+          el('div', {class:'logo-preview'}, [
+            el('div', {class:'swatch'},
+              el('img', {src: '/assets/logo.svg' + logoBust, alt:'current logo'})),
+            el('div', {class:'info'}, [
+              el('div', {class:'name'}, hasLogo ? 'Custom logo (uploaded)' : 'Default OpenPXE mark'),
+              el('div', {class:'meta'},
+                hasLogo
+                  ? 'Operator-uploaded; served from <work_dir>/branding/.'
+                  : 'Bundled rainbow-horizon mark. Upload an image to override.'),
+            ]),
+            el('div', {style:'display:flex;gap:8px;flex-wrap:wrap'}, [
+              el('button', {onclick: () => logoFile.click()},
+                hasLogo ? 'Replace logo' : 'Upload logo'),
+              hasLogo
+                ? el('button', {class:'danger', onclick: async () => {
+                    if (!confirm('Remove custom logo and revert to the OpenPXE mark?')) return;
+                    const r = await fetch('/api/branding/logo', {method:'DELETE'});
+                    if (r.ok || r.status === 204) {
+                      logoMsg.textContent = 'Reverted to default mark. Reloading…';
+                      logoMsg.className = 'msg ok';
+                      setTimeout(() => location.reload(), 500);
+                    } else {
+                      const t = await r.text();
+                      logoMsg.textContent = 'Clear failed: ' + t;
+                      logoMsg.className = 'msg err';
+                    }
+                  }}, 'Remove')
+                : null,
+            ]),
+          ]),
+          logoFile, logoMsg,
+        ]),
+      ]);
+
+      // ── API reference (always at the bottom of Settings).
+      // Sourced from /api/docs so the hand-curated list stays the
+      // single source of truth and the UI doesn't need its own copy
+      // baked into the JS bundle.
+      const groups = docs.groups || [];
+      const apiCard = el('div', {class:'card'}, [
+        el('header', {}, [
+          el('h2', {}, 'API reference'),
+          el('span', {class:'sub'},
+            groups.reduce((n, g) => n + (g.endpoints || []).length, 0) + ' endpoints'),
+        ]),
+        el('div', {class:'api-ref'},
+          groups.length
+            ? groups.map(g => el('div', {class:'group'}, [
+                el('h3', {}, g.name),
+                ...(g.endpoints || []).map(ep => el('div', {class:'ep'}, [
+                  el('span', {class:'method ' + (ep.method || 'get').toLowerCase()},
+                    ep.method || 'GET'),
+                  el('span', {class:'path'}, ep.path || '?'),
+                  el('span', {class:'desc'}, ep.summary || ''),
+                ])),
+              ]))
+            : el('div', {class:'empty'},
+                'No API documentation returned by /api/docs.')),
+      ]);
+
+      return el('div', {class:'grid'}, [accountCard, ssoCard, logoCard, apiCard]);
+    },
+
     about: async () => {
       const status = await getJSON('/api/status');
       return el('div', {class:'card'}, [
@@ -833,7 +1306,10 @@
           el('div', {class:'who'}, [
             el('span', {}, 'Developer: '), el('strong', {}, 'Miles Ward'), el('br'),
             el('span', {}, 'Version: '), el('strong', {}, status.version || '?'), el('br'),
-            el('span', {}, 'Base URL: '), el('strong', {}, status.public_base_url),
+            el('span', {}, 'Base URL: '), el('strong', {}, status.public_base_url), el('br'),
+            el('span', {}, 'Docs: '),
+            el('a', {href:'https://openpxe.com/', target:'_blank', rel:'noopener noreferrer'},
+              'https://openpxe.com/'),
           ]),
           el('p', {class:'msg', style:'margin-top:18px'},
             'iPXE is an internal implementation detail. Everything the firmware ' +
@@ -854,10 +1330,11 @@
   const viewTitles = {
     dashboard: 'Dashboard',
     network: 'Network',
-    gate: 'Queue',
+    queue: 'Queue',
     storage: 'Storage',
     hosts: 'Hosts',
     terminal: 'Terminal',
+    settings: 'Settings',
     about: 'About',
   };
 
@@ -915,6 +1392,24 @@
     }
   }
 
+  // Set the sidebar footer "Service status:" line. The chip itself moved
+  // off the topbar in v0.4.x: operators wanted readiness, advertised
+  // URL, and the boot IP grouped together as the bottom-left summary.
+  function setReady(state) {
+    const dot = $('[data-bind=ready_dot]');
+    const lbl = $('[data-bind=ready_label]');
+    if (!dot || !lbl) return;
+    const map = {
+      ready:       { cls: 'ok',  text: 'Ready' },
+      notready:    { cls: 'err', text: 'Not ready' },
+      unreachable: { cls: 'err', text: 'Unreachable' },
+    };
+    const m = map[state] || { cls: 'warn', text: 'Checking…' };
+    dot.className = 'dot ' + m.cls;
+    lbl.className = 'status-value ' + m.cls;
+    lbl.textContent = m.text;
+  }
+
   async function refreshChips() {
     try {
       const s = await getJSON('/api/status');
@@ -924,14 +1419,9 @@
       $$('[data-bind=client_count],[data-bind=client_count2]').forEach(n => n.textContent = String(s.client_count));
       $$('[data-bind=queue_count],[data-bind=queue_count2]').forEach(n => n.textContent = String(s.queue_count));
       $$('[data-bind=host_count]').forEach(n => n.textContent = String(s.host_bindings || 0));
-      const chip = $('[data-bind=ready_chip]');
-      if (chip) {
-        if (r.ok) { chip.textContent = '● ready'; chip.className = 'chip ready'; }
-        else      { chip.textContent = '● not ready'; chip.className = 'chip notready'; }
-      }
+      setReady(r.ok ? 'ready' : 'notready');
     } catch {
-      const chip = $('[data-bind=ready_chip]');
-      if (chip) { chip.textContent = '● unreachable'; chip.className = 'chip notready'; }
+      setReady('unreachable');
     }
   }
 
@@ -940,7 +1430,245 @@
     if (a) { e.preventDefault(); render(a.dataset.view); }
   });
 
+  // ── Auth bootstrap (v0.4.5) ──────────────────────────────────────
+  // Before painting the dashboard, ask /api/me whether the operator
+  // needs to bootstrap an admin (`setup_required`), sign in
+  // (`!authenticated`), or just load the dashboard. The auth screen
+  // takes over the viewport completely — no half-rendered chrome
+  // bleeding through. Sonarr/Radarr-style.
+  let chipsInterval = null;
+  let authScreenEl = null;
+  let ssoConfig = null;
+
+  function teardownAuthScreen() {
+    if (authScreenEl && authScreenEl.parentNode) {
+      authScreenEl.parentNode.removeChild(authScreenEl);
+    }
+    authScreenEl = null;
+    document.querySelector('.shell').style.display = '';
+  }
+
+  function buildLoginCard() {
+    const usernameInput = el('input', {type:'text', name:'username', autocomplete:'username', autofocus:'autofocus', spellcheck:'false'});
+    const passwordInput = el('input', {type:'password', name:'password', autocomplete:'current-password'});
+    const err = el('div', {class:'auth-err', style:'display:none'});
+    const submit = el('button', {class:'submit', type:'submit'}, 'Sign in');
+
+    const ssoButton = ssoConfig && ssoConfig.enabled && (ssoConfig.metadata_url || ssoConfig.metadata)
+      ? el('button', {type:'button', class:'sso-btn', onclick: () => {
+          // SSO login flow lands in a later release — for now we
+          // surface a friendly note so the operator knows the config
+          // landed but the runtime hookup is pending.
+          err.textContent = 'SSO sign-in is configured but the runtime flow ships in a future release. Sign in with the local admin for now.';
+          err.style.display = '';
+        }}, [
+          el('div', {}, 'Sign in with ' + (ssoConfig.idp_name || 'SSO')),
+          el('div', {class:'meta'}, 'configured · runtime flow pending'),
+        ])
+      : null;
+
+    const form = el('form', {class:'auth-form', onsubmit: async (e) => {
+      e.preventDefault();
+      err.style.display = 'none';
+      submit.disabled = true;
+      submit.textContent = 'Signing in…';
+      try {
+        const r = await fetch('/api/login', {
+          method:'POST',
+          headers:{'Content-Type':'application/json'},
+          body: JSON.stringify({username: usernameInput.value, password: passwordInput.value}),
+        });
+        if (r.ok) {
+          passwordInput.value = '';
+          teardownAuthScreen();
+          await startDashboard();
+          return;
+        }
+        const j = await r.json().catch(() => ({}));
+        err.textContent = j.error || ('Sign-in failed: HTTP ' + r.status);
+        err.style.display = '';
+      } catch (ex) {
+        err.textContent = 'Network error: ' + (ex && ex.message ? ex.message : ex);
+        err.style.display = '';
+      } finally {
+        submit.disabled = false;
+        submit.textContent = 'Sign in';
+      }
+    }}, [
+      el('div', {class:'brand-row'}, [
+        el('img', {src:'/assets/logo.svg', alt:''}),
+        el('div', {class:'name'}, 'OpenPXE'),
+      ]),
+      el('h2', {}, 'Sign in'),
+      el('p', {class:'lede'}, 'Enter your administrator credentials. Forgot them? SSH to the host and remove work_dir/auth.json — the next launch will re-prompt for setup.'),
+      el('label', {class:'field'}, [
+        el('div', {style:'color:var(--fg-dim);font-size:12px;margin-bottom:4px'}, 'Username'),
+        usernameInput,
+      ]),
+      el('label', {class:'field'}, [
+        el('div', {style:'color:var(--fg-dim);font-size:12px;margin-bottom:4px'}, 'Password'),
+        passwordInput,
+      ]),
+      submit,
+      ssoButton,
+      err,
+      el('div', {class:'auth-foot'}, 'OpenPXE · ' + (window.location.host || '')),
+    ]);
+    return form;
+  }
+
+  function buildSetupCard() {
+    const usernameInput = el('input', {type:'text', name:'username', autocomplete:'username', autofocus:'autofocus', spellcheck:'false'});
+    const passwordInput = el('input', {type:'password', name:'password', autocomplete:'new-password'});
+    const confirmInput  = el('input', {type:'password', name:'confirm', autocomplete:'new-password'});
+    const err = el('div', {class:'auth-err', style:'display:none'});
+    const submit = el('button', {class:'submit', type:'submit'}, 'Create administrator');
+
+    const form = el('form', {class:'auth-form', onsubmit: async (e) => {
+      e.preventDefault();
+      err.style.display = 'none';
+      if (passwordInput.value !== confirmInput.value) {
+        err.textContent = 'Passwords do not match.';
+        err.style.display = '';
+        return;
+      }
+      if (passwordInput.value.length < 8) {
+        err.textContent = 'Password must be at least 8 characters.';
+        err.style.display = '';
+        return;
+      }
+      submit.disabled = true;
+      submit.textContent = 'Creating…';
+      try {
+        const r = await fetch('/api/setup', {
+          method:'POST',
+          headers:{'Content-Type':'application/json'},
+          body: JSON.stringify({username: usernameInput.value, password: passwordInput.value}),
+        });
+        if (r.ok) {
+          passwordInput.value = '';
+          confirmInput.value = '';
+          teardownAuthScreen();
+          await startDashboard();
+          return;
+        }
+        const j = await r.json().catch(() => ({}));
+        err.textContent = j.error || ('Setup failed: HTTP ' + r.status);
+        err.style.display = '';
+      } catch (ex) {
+        err.textContent = 'Network error: ' + (ex && ex.message ? ex.message : ex);
+        err.style.display = '';
+      } finally {
+        submit.disabled = false;
+        submit.textContent = 'Create administrator';
+      }
+    }}, [
+      el('div', {class:'brand-row'}, [
+        el('img', {src:'/assets/logo.svg', alt:''}),
+        el('div', {class:'name'}, 'OpenPXE'),
+      ]),
+      el('h2', {}, 'First-run setup'),
+      el('p', {class:'lede'}, 'Welcome. Create the administrator account that will own this OpenPXE deployment. Additional users come in through SSO later.'),
+      el('label', {class:'field'}, [
+        el('div', {style:'color:var(--fg-dim);font-size:12px;margin-bottom:4px'}, 'Username'),
+        usernameInput,
+      ]),
+      el('label', {class:'field'}, [
+        el('div', {style:'color:var(--fg-dim);font-size:12px;margin-bottom:4px'}, 'Password (≥8 chars)'),
+        passwordInput,
+      ]),
+      el('label', {class:'field'}, [
+        el('div', {style:'color:var(--fg-dim);font-size:12px;margin-bottom:4px'}, 'Confirm password'),
+        confirmInput,
+      ]),
+      submit,
+      err,
+      el('div', {class:'auth-foot'}, 'OpenPXE · ' + (window.location.host || '')),
+    ]);
+    return form;
+  }
+
+  function showAuthScreen(mode) {
+    // Tear down any previous screen + the dashboard chrome.
+    if (authScreenEl && authScreenEl.parentNode) {
+      authScreenEl.parentNode.removeChild(authScreenEl);
+    }
+    const shell = document.querySelector('.shell');
+    if (shell) shell.style.display = 'none';
+    if (chipsInterval) { clearInterval(chipsInterval); chipsInterval = null; }
+
+    const card = (mode === 'setup' ? buildSetupCard() : buildLoginCard());
+    authScreenEl = el('div', {class:'auth-screen'},
+      el('div', {class:'auth-card'}, card));
+    document.body.appendChild(authScreenEl);
+    // Focus the first visible input (autofocus on dynamically created
+    // inputs doesn't fire in all browsers).
+    setTimeout(() => {
+      const inp = authScreenEl.querySelector('input[type="text"], input[type="password"]');
+      if (inp) inp.focus();
+    }, 30);
+  }
+
+  async function startDashboard() {
+    // Light up the sidebar's "signed in as X / Sign out" row. It was
+    // hidden in index.html because we don't know the identity until
+    // /api/me resolves.
+    try {
+      const me = await fetch('/api/me').then(r => r.ok ? r.json() : null);
+      const row = $('[data-bind=logout_row]');
+      const who = $('[data-bind=signed_in_as]');
+      const btn = $('[data-bind=logout_btn]');
+      if (row && me && me.authenticated && me.user) {
+        who.textContent = me.user.username;
+        who.title = 'Signed in as ' + me.user.username;
+        row.style.display = '';
+        if (btn && !btn._wired) {
+          btn._wired = true;
+          btn.addEventListener('click', async () => {
+            await fetch('/api/logout', {method:'POST'}).catch(() => {});
+            showAuthScreen('login');
+          });
+        }
+      }
+    } catch (e) { /* surfaces elsewhere */ }
     render('dashboard');
-  refreshChips();
-  setInterval(refreshChips, 3000);
+    await refreshChips();
+    if (!chipsInterval) chipsInterval = setInterval(refreshChips, 3000);
+  }
+
+  async function bootstrap() {
+    let me;
+    try {
+      me = await fetch('/api/me').then(r => r.json());
+    } catch (e) {
+      // /api/me is unauthenticated in every state — if we can't reach
+      // it the server is genuinely down, not an auth problem.
+      document.body.appendChild(el('div', {class:'auth-screen'},
+        el('div', {class:'auth-card'}, [
+          el('div', {class:'brand-row'}, [
+            el('img', {src:'/assets/logo.svg', alt:''}),
+            el('div', {class:'name'}, 'OpenPXE'),
+          ]),
+          el('h2', {}, 'Connection error'),
+          el('p', {class:'lede'}, 'Could not reach the OpenPXE server. Refresh once it is back up.'),
+        ])));
+      return;
+    }
+    // Preload the SSO config so the login card can offer the operator
+    // an "Sign in with X" button when configured. Failure is harmless.
+    try { ssoConfig = await fetch('/api/sso').then(r => r.ok ? r.json() : null); }
+    catch { ssoConfig = null; }
+
+    if (me.setup_required) {
+      showAuthScreen('setup');
+      return;
+    }
+    if (!me.authenticated) {
+      showAuthScreen('login');
+      return;
+    }
+    await startDashboard();
+  }
+
+  bootstrap();
 })();

crates/webui/src/index.html

@@ -26,11 +26,8 @@
 <div class="shell">
   <aside class="sidebar">
     <div class="brand">
-      <img src="/assets/logo.svg" alt="" />
-      <div>
+      <img src="/assets/logo.svg" alt="OpenPXE" />
       <strong>OpenPXE</strong>
-        <div class="sub">v<span data-bind="version">0.3.1</span></div>
-      </div>
     </div>
     <nav>
       <a data-view="dashboard" class="active">Dashboard</a>
@@ -48,18 +45,35 @@
         <span class="count" data-bind="host_count">0</span>
       </a>
       <a data-view="terminal">Terminal</a>
+      <a data-view="settings">Settings</a>
       <a data-view="about">About</a>
     </nav>
     <div class="footer">
-      Advertised to clients<br/>
+      <div class="status-row">
+        <span class="dot" data-bind="ready_dot" title="Server readiness"></span>
+        <span class="status-label">Service status:</span>
+        <span class="status-value" data-bind="ready_label">checking…</span>
+      </div>
+      <div class="footer-sub">Advertised to clients</div>
       <code>{{BASE_URL}}</code>
+      <!-- The brand badge at the top can be overridden by operator-uploaded
+           logos; keep "OpenPXE v…" pinned in the footer so the backend
+           identity is always visible regardless of branding. -->
+      <div class="footer-version">OpenPXE&nbsp;v<span data-bind="version">0.4.5</span></div>
+      <!-- v0.4.5: signed-in identity + one-click sign-out. The button
+           is populated by app.js after /api/me reports an authenticated
+           session — pre-auth states swap the whole shell for the
+           login/setup card so this row never gets shown there. -->
+      <div class="logout-row" data-bind="logout_row" style="display:none">
+        <span class="who" data-bind="signed_in_as" title=""></span>
+        <button type="button" class="logout-btn" data-bind="logout_btn">Sign out</button>
+      </div>
     </div>
   </aside>
 
   <header class="topbar">
     <h1 data-bind="view_title">Dashboard</h1>
     <div class="spacer"></div>
-    <span class="chip" data-bind="ready_chip" title="Server readiness">checking…</span>
     <span class="chip"><strong data-bind="iso_count2">0</strong>&nbsp;images</span>
     <span class="chip"><strong data-bind="client_count2">0</strong>&nbsp;clients</span>
     <span class="chip"><strong data-bind="queue_count2">0</strong>&nbsp;in queue</span>

crates/webui/src/lib.rs

@@ -15,19 +15,27 @@ pub fn index_html(base_url: &str) -> String {
 }
 
 #[must_use]
-pub fn app_js() -> &'static str { APP_JS }
+pub fn app_js() -> &'static str {
+    APP_JS
+}
 
 #[must_use]
-pub fn app_css() -> &'static str { APP_CSS }
+pub fn app_css() -> &'static str {
+    APP_CSS
+}
 
 #[must_use]
-pub fn logo_svg() -> &'static str { LOGO_SVG }
+pub fn logo_svg() -> &'static str {
+    LOGO_SVG
+}
 
 /// Larger, faster-cycling rainbow disc — used for the page-load
 /// transition and the imaging-progress widget on Dashboard / Queue.
 /// Pure SVG + SMIL, no JS, no GIF.
 #[must_use]
-pub fn loader_svg() -> &'static str { LOADER_SVG }
+pub fn loader_svg() -> &'static str {
+    LOADER_SVG
+}
 
 const INDEX_HTML: &str = include_str!("index.html");
 const APP_CSS: &str = include_str!("app.css");

deploy/docker/Dockerfile

@@ -14,7 +14,7 @@
 # Debian slim at ~75 MB + binary ~25 MB is fine for a PXE server that
 # spends most of its life idle.
 
-ARG RUST_VERSION=1.82
+ARG RUST_VERSION=1.95
 
 ########## fetch iPXE binaries ##########
 FROM debian:12-slim AS fetch
@@ -28,23 +28,44 @@ RUN mkdir -p assets/ipxe && bash scripts/fetch-ipxe.sh
 FROM rust:${RUST_VERSION}-bookworm AS build
 WORKDIR /src
 
+# v0.4.5: build a fully static musl binary (matches Bootimus v0.1.70's
+# move). The resulting `/openpxe` has no glibc dependency at all, which:
+#   - Lets the runtime stage be any Linux distro (we still ship Debian
+#     slim for the `samba` / `wimtools` / `nfs-common` shellouts, but a
+#     scratch/distroless variant becomes a one-line swap).
+#   - Cuts a class of "GLIBC_2.39 not found" surprises when running on
+#     older RHEL/Rocky hosts that don't match Debian 12's libc version.
+#   - Sidesteps cross-compilation snags (the binary is its own world).
+#
+# x86_64-unknown-linux-musl is fully static by default (no extra
+# RUSTFLAGS needed). musl-tools provides the linker.
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends musl-tools \
+ && rm -rf /var/lib/apt/lists/* \
+ && rustup target add x86_64-unknown-linux-musl
+
 # Copy the whole workspace in one go. We used to do a two-pass "cache-prime
 # with stubs, then real build" dance for dep-compile reuse; that turned out
 # to silently serve stale stub binaries when cargo's fingerprint didn't
 # notice the source swap. A single build is ~1.5 min longer on cold cache
 # but guarantees the binary reflects the sources we copied.
-COPY Cargo.toml rust-toolchain.toml ./
+# Do not copy rust-toolchain.toml into the image. The local workspace pins
+# developer tooling, but inside Docker we intentionally use the Rust version
+# selected by the base image. Copying rust-toolchain.toml with
+# `channel = "stable"` makes rustup download a second full toolchain during
+# `cargo build`, which is slow and can exhaust small Colima/CI disks.
+COPY Cargo.toml Cargo.lock ./
 COPY crates/ crates/
 COPY --from=fetch /src/assets/ipxe /src/assets/ipxe
 
-# Cache cargo registry + target across builds. The `--no-edit` touch is
+# Cache cargo registry + target across builds. The mtime touch is
 # belt-and-suspenders: cargo occasionally misses mtime-only changes on
 # networked FS; this forces a fingerprint check.
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
     --mount=type=cache,target=/src/target,sharing=locked \
     find crates -name '*.rs' -exec touch {} + && \
-    cargo build --release --bin openpxe && \
-    cp target/release/openpxe /openpxe && \
+    cargo build --release --target x86_64-unknown-linux-musl --bin openpxe && \
+    cp target/x86_64-unknown-linux-musl/release/openpxe /openpxe && \
     ls -l /openpxe
 
 ########## runtime ##########
@@ -57,22 +78,28 @@ RUN apt-get update \
  && useradd --system --uid 10001 --home-dir /var/lib/openpxe --shell /usr/sbin/nologin openpxe \
  && mkdir -p /var/lib/openpxe/isos /var/lib/openpxe/work /var/lib/openpxe/smb \
  && chown -R openpxe:openpxe /var/lib/openpxe
-# Runtime deps explained:
-#   wimtools  - provides `wimlib-imagex`, used to inject startnet.cmd into boot.wim.
-#   samba     - `smbd` serves extracted Windows install media on :445 for WinPE
-#               to `net use`. Guest read-only, scoped to /var/lib/openpxe/smb.
-#   nfs-common - provides `mount.nfs` / `mount.nfs4` for the Storage tab's
-#               NFS share manager. Mount also requires the container to run
-#               with CAP_SYS_ADMIN — without it, mount(2) returns EPERM and
-#               the manager surfaces a clear error in the UI instead of
-#               failing silently.
-#   iproute2  - `ip addr` / `ip route` for the auto-detected Network tab
-#               fields (NIC name, subnet mask, default gateway). Tiny,
-#               always available; we don't pull in netlink crates for
-#               this one-shot startup probe.
-#   gosu      - drops privileges cleanly from root after the entrypoint fixes
-#               bind-mount ownership (common OpenShift/Docker UX issue).
-# Windows-specific tools only activate when the WebUI toggle is on.
+# v0.4.5: the openpxe binary itself is now built against musl and is
+# fully static — no glibc dependency. The runtime stage still ships
+# Debian slim because OpenPXE shells out to the four packages below for
+# functionality we deliberately don't reimplement in-process:
+#   wimtools   - `wimlib-imagex`, used to inject startnet.cmd into boot.wim.
+#   samba      - `smbd` serves extracted Windows install media on :445 so
+#                WinPE can `net use`. Guest read-only, scoped to
+#                /var/lib/openpxe/smb.
+#   nfs-common - `mount.nfs` / `mount.nfs4` for the Storage tab's NFS
+#                share manager. Mount requires CAP_SYS_ADMIN; without it
+#                mount(2) returns EPERM and the manager surfaces a clear
+#                error in the UI.
+#   iproute2   - `ip addr` / `ip route` for the auto-detected Network
+#                tab fields (NIC name, subnet mask, default gateway).
+#                Tiny, always available; we don't pull in netlink crates
+#                for this one-shot startup probe.
+#   gosu       - drops privileges cleanly from root after the entrypoint
+#                fixes bind-mount ownership (common OpenShift/Docker UX
+#                issue).
+# A future "openpxe-static" variant could drop everything except the
+# binary onto distroless once we move the Windows + NFS legs to
+# in-process Rust crates.
 
 COPY --from=build /openpxe /usr/local/bin/openpxe
 COPY deploy/docker/entrypoint.sh /usr/local/bin/entrypoint.sh

deploy/openshift/30-deployment.yaml

@@ -34,7 +34,7 @@ spec:
         fsGroup: 10001
       containers:
         - name: openpxe
-          image: ghcr.io/casperadmin/openpxe:0.1.0
+          image: gitea.milesward.dev/mward4/openpxe:0.4.1
           imagePullPolicy: IfNotPresent
           ports:
             - name: dhcp

deploy/unraid/README.md

@@ -6,7 +6,7 @@ boot from OpenPXE". Pick the one that matches what you have.
 ## Path A — build on Unraid, push to Gitea registry, pull by tag
 
 Recommended once you've done it once. Image is published to
-`gitea.milesward.dev/mward4/openpxe:0.1.0` (or your equivalent) and
+`gitea.milesward.dev/mward4/openpxe:0.4.1` (or your equivalent) and
 every Unraid template / docker-compose just references the tag.
 
 Pre-flight:
@@ -40,14 +40,14 @@ What it does:
 3. `docker build` against `deploy/docker/Dockerfile`.
 4. `docker login gitea.milesward.dev:3000` using a temp `DOCKER_CONFIG`
    so the credential never lands in your real `~/.docker/config.json`.
-5. `docker push` both `:0.1.0` and `:latest`.
+5. `docker push` both `:0.4.1` and `:latest`.
 6. Logout, scrub the temp config, delete the workspace.
 
 After it finishes, in Unraid → Docker → Add Container, set:
 
 | Field      | Value                                           |
 |------------|-------------------------------------------------|
-| Repository | `gitea.milesward.dev/mward4/openpxe:0.1.0`     |
+| Repository | `gitea.milesward.dev/mward4/openpxe:0.4.1`     |
 | Network    | `host`                                          |
 | Extra args | `--cap-add=NET_BIND_SERVICE`                    |
 
@@ -88,14 +88,14 @@ then:
 
 ```bash
 # On the build host
-docker save openpxe:0.1.0 | gzip > openpxe-0.1.0.tar.gz
+docker save openpxe:0.4.1 | gzip > openpxe-0.4.1.tar.gz
 
 # Transfer (rsync / scp / SMB / ZFS-replicate / sneakernet)
-scp openpxe-0.1.0.tar.gz root@unraid:/tmp/
+scp openpxe-0.4.1.tar.gz root@unraid:/tmp/
 
 # On Unraid
-gunzip -c /tmp/openpxe-0.1.0.tar.gz | docker load
-docker tag openpxe:0.1.0 gitea.milesward.dev/mward4/openpxe:0.1.0
+gunzip -c /tmp/openpxe-0.4.1.tar.gz | docker load
+docker tag openpxe:0.4.1 gitea.milesward.dev/mward4/openpxe:0.4.1
 ```
 
 If you want it pullable by tag from other Unraid templates, push to

deploy/unraid/openpxe.xml

@@ -34,8 +34,8 @@
     Air-gapped network PXE boot server. Container-native Rust
     implementation — DHCP proxy + TFTP + iPXE chainload + HTTP ISO
     streaming, all in one process. Web UI for ISO upload, NFS share
-    mounting, and Queued Deployment ("horse-race" simultaneous launch
-    of one ISO across many waiting clients).
+    mounting, and Queued Deployment for coordinated launch of one ISO
+    across many waiting clients.
 
     NEVER touches the client OS trust store: no test-signed drivers,
     no testsigning toggle, no httpdisk.sys. Windows boot uses vanilla

docs/NEXT_PHASE.md

@@ -1,7 +1,7 @@
 # Phase 6 — recommendations
 
-The v0.2.0 cut leaves OpenPXE in a state where the entire protocol stack
-and operator UI are exercised by 66 automated tests, the container is
+The v0.4.1 cut leaves OpenPXE in a state where the entire protocol stack
+and operator UI are exercised by the automated test suite, the container is
 multi-arch buildable, and the image ships at ~97 MB. What's left before
 this looks and feels like a 1.0 product is mostly **real-hardware
 validation** plus a small batch of features that can only sensibly be

docs/architecture.md

@@ -265,10 +265,9 @@ tab is one click from the brand bar.
 - Persisted to `<work_dir>/hosts.json`. Like `SettingsStore`, in-memory
   is authoritative — disk corruption falls back to empty rather than
   failing startup.
-- Inspired by Tinkerbell `smee`'s MAC-prepended URL pattern. The DHCP
-  reply now embeds `?mac=${mac}` in the boot.ipxe URL; iPXE substitutes
-  the literal MAC client-side, so the HTTP layer can short-circuit
-  past the menu when a binding exists.
+- The DHCP reply embeds `?mac=${mac}` in the boot.ipxe URL; iPXE
+  substitutes the literal MAC client-side, so the HTTP layer can
+  short-circuit past the menu when a binding exists.
 - `/api/hosts` GET / POST / DELETE drives the **Hosts** tab.
 
 **Prometheus metrics** (`crates/core/src/metrics.rs`):
@@ -288,18 +287,17 @@ warning-free. Replaced `format!()`-into-`String` with
 `Reverse`, fixed `map_or(false, …)` → `is_some_and`, and a handful of
 other idiom fixes.
 
-**UI overhaul** for the v0.2.0 pre-beta milestone:
+**UI overhaul** for the pre-beta milestone:
 - Light + dark themes via `:root[data-theme=light]` token swap.
   Toggled by a top-right button or the `T` key. Persisted in
   localStorage; pre-paint inline script avoids dark→light flash.
-- New SVG logos: a refined anvil (`logo.svg`) and a SMIL-animated
-  `anvil-forge.svg` (rising sparks + pulsing underglow). Pure SVG —
-  no GIFs, no CSS keyframes for the sparks.
-- "Forge progress" widget on the Dashboard and Queue: animated
-  anvil paired with a `linear-gradient(warn → accent)` progress bar
+- New SVG logos: a refined OpenPXE mark (`logo.svg`) and a compact
+  SMIL-animated loader (`loader.svg`). Pure SVG, embedded in the binary.
+- Deployment progress widget on the Dashboard and Queue: animated
+  OpenPXE mark paired with a `linear-gradient(warn → accent)` progress bar
   with a moving sheen. Goes idle (greyscale, no sheen) at zero
   imaging load.
-- Loader replaced "Loading…" text with the same anvil.
+- Loader replaced "Loading..." text with the same OpenPXE mark.
 - Sidebar gains a **Hosts** tab.
 
 **Windows boot validation**:
@@ -317,7 +315,8 @@ other idiom fixes.
   fixes: explicit `net start Workstation` before `net use`, surfaces
   errors instead of blind retries.
 
-**Test count**: 66 → up from 56 in v0.1.0.
+**Test posture**: protocol, HTTP, ISO-store, Windows script, queue, metrics,
+and UI-offline checks all run in the workspace test suite.
 
 ## What's deferred to Phase 6
 

runbooks/linux-network-boot.md

@@ -115,7 +115,7 @@ Two options. Pick one.
 
 Big ISOs stream — there is no 2 GB limit, but expect upload to be
 throttled by your browser ↔ host link. The UI shows a progress bar; the
-animated anvil on the Dashboard tab fires up while imaging is in
+animated OpenPXE mark on the Dashboard tab fires up while imaging is in
 flight.
 
 ### 2b. Bulk seed from a directory (recommended for fresh deploys / CI)
@@ -290,7 +290,7 @@ INFO openpxe::http: GET /iso/ubuntu-…/casper/initrd  Range=bytes=0- 200 OK 75
 ```
 
 The **Terminal** tab in the web UI shows the same thing live, plus a
-short whitelisted command palette (`status`, `clients`, `gate`,
+short whitelisted command palette (`status`, `clients`, `queue`,
 `hosts`, `log`).
 
 ### 5d. Internet-side ISO sources
@@ -347,19 +347,19 @@ default for production hardware.
 ## 7. Re-imaging — the “Queued Deployment” flow
 
 Different scenario: you have **a rack of 30 servers** to image
-identically, all at once. Don’t bind 30 MACs by hand. Use the gate.
+identically, all at once. Don’t bind 30 MACs by hand. Use the queue.
 
 1. **Don’t** create host bindings.
 2. PXE-boot every machine. They land on the menu.
 3. On each: select **Queued Deployment**. They get position #1, #2,
    …, #30 and start long-polling.
-4. In the UI: **Forge Gate** tab shows all 30 lined up. Pick the
+4. In the UI: **Queue** tab shows all 30 lined up. Pick the
    ISO, click **Assign to all waiting**.
 5. Every client’s open long-poll wakes up at the same instant and
    chains the same boot script. They all start imaging
-   simultaneously — the “horse race gate” opens.
+   simultaneously.
 
-The animated anvil widget on the Dashboard runs while any client is
+The animated OpenPXE progress widget on the Dashboard runs while any client is
 still in the kernel-fetch phase.
 
 ---