v0.7.4: probe-based introspection — remote shares classify, gparted bug fixed, Storage pagination

Introspection (the headline): detection is now probe-based. Instead of
grepping raw sectors for filename strings, we walk the ISO9660
directory tree and check whether the well-known boot files actually
exist — and the same probes run over NFS READ3 / SFTP seek-reads, so
share-hosted ISOs finally classify instead of registering as Unknown.

iso-store:
- New iso_fs module: the read-only ISO9660 walker (generalized from
  http-api) over an IsoReadAt trait — local files, NFS, SFTP, and the
  in-memory test images all share it. Iterative walk, 4 MiB directory
  cap, strict-mastering trailing-dot normalization (VMLINUZ.;1 now
  matches /vmlinuz), CachingReadAt collapses repeated directory reads
  during the probe pass (~60 → ~6 round-trips per remote ISO).
- introspect.rs rewritten (INTROSPECT_REV 2): PVD label → El Torito →
  /sources/boot.wim probe → verified Linux kernel+initrd probe table →
  local-only 16 MiB UDF-Windows scan → filename-token fallback.
  * Fixes the false-Windows bug: any Linux ISO shipping GRUB/syslinux
    chainload modules contains the literal "bootmgr", so gparted-live
    classified as WindowsPe. Linux probes now run first; the byte scan
    only sees ISOs nothing else claimed. Local ISOs re-probe once on
    startup via the rev bump — no re-upload.
  * Kernel entries are emitted only when kernel+initrd verifiably
    exist (no more guessed paths that 404 at boot). Debian-live /
    d-i netinst / CoreOS shapes classify for the UI but keep their
    working sanboot entries (their boot protocols need args we don't
    render yet; CoreOS additionally needs its embedded ignition).
  * Label + filename vocab extended: rhcos/coreos/openshift/okd,
    gparted/clonezilla/kali/tails, almalinux/rocky, sles, manjaro.
- NFS + SFTP managers: per-ISO IsoReadAt readers (READ3-at-offset with
  short-read looping / seek+read_exact), background introspection pass
  after each scan — entries register instantly with a provisional
  filename-based report (rev 0, optimistic sanboot preserved) and
  upgrade in place as probes land (30s/ISO timeout, failures keep the
  provisional). locate_in_iso() exposes the walker to the HTTP layer.
- remote_cache: introspection results persisted per protocol keyed
  share/path@size and gated on INTROSPECT_REV — container restarts
  re-probe only new/replaced ISOs; upgrades re-probe exactly once.
- SMB: smbclient can't seek, so SMB ISOs get the filename-token family
  (rev stays 0 → sanboot entry + "awaiting introspection" label).
- IsoStore::update_external_introspection swaps in completed reports
  and regenerates boot entries, preserving category/password.

http-api:
- /iso/{id}/{*path} now serves files from inside NFS/SFTP-hosted ISOs
  (remote ISO9660 lookup + ranged share stream) — verified kernel
  entries on remote Linux ISOs are actually bootable, end to end.
- iso_fs.rs deleted in favor of the shared iso-store module.
- full_flow fixtures build real directory trees via the shared
  test-image builder (new iso-store feature) — a label-only blob no
  longer earns a kernel entry, by design.

webui:
- Available images: paged 5 per page with a quiet footer pager
  (Showing X–Y of N · Prev/Next), filter-then-paginate, page resets on
  search input. Fifty images is five clean pages, not a scroll wall.
- Hosts/Queue profile: "Unattended file (in Storage → Advanced)" so
  the picker says where the files live.
- Row badge keys on introspect_rev: probed remote ISOs read like local
  ones; un-probed say "awaiting introspection".

Validation: clippy pedantic clean, fmt clean, 316 workspace tests
green (+17: walker, probe shapes incl. gparted regression + CoreOS,
filename table, cache round-trips), webui syntax-checked.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

.gitignore

@@ -1,5 +1,4 @@
 /target
-Cargo.lock
 data/isos/*.iso
 data/isos/*.partial
 data/isos/*.meta.json
@@ -12,3 +11,6 @@ data/work/
 .claude/settings.local.json
 .claude/worktrees/
 .claude/scheduled_tasks.lock
+
+# local editor / agent settings (not part of the project)
+.claude/

Cargo.toml

@@ -12,52 +12,108 @@ members = [
 ]
 
 [workspace.package]
-version = "0.3.1"
+version = "0.7.4"
 edition = "2021"
-rust-version = "1.80"
+rust-version = "1.95"
 license = "MIT OR Apache-2.0"
 repository = "https://gitea.milesward.dev/mward4/OpenPXE"
 authors = ["OpenPXE contributors"]
 
 [workspace.dependencies]
-tokio = { version = "1.40", features = ["full"] }
+tokio = { version = "1.52", features = ["full"] }
 tokio-util = { version = "0.7", features = ["io"] }
 tokio-stream = { version = "0.1", features = ["sync"] }
 futures = "0.3"
 async-trait = "0.1"
 
-dhcproto = "0.12"
+# v0.6.2: dhcproto 0.15 drops the deprecated trust-dns-proto dependency
-socket2 = { version = "0.5", features = ["all"] }
+# (replaced by hickory-proto) and carries three releases of DHCP option
+# coverage accumulated upstream — both directly relevant to the proxy core.
+dhcproto = "0.15"
+socket2 = { version = "0.6", features = ["all"] }
 bytes = "1.7"
-nom = "7.1"
 
-axum = { version = "0.7", features = ["macros", "multipart", "http2"] }
+axum = { version = "0.8", features = ["macros", "multipart", "http2"] }
 tower = "0.5"
 tower-http = { version = "0.6", features = ["fs", "trace", "cors", "limit"] }
-hyper = "1.4"
+hyper = "1.9"
-reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "stream"] }
+reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "stream", "json"] }
-mime = "0.3"
-mime_guess = "2.0"
 
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 toml = "0.8"
+# v0.5.4: layered config (TOML file + env). Pure-Rust, no C deps; keeps the
+# static-musl build OpenSSL-free. Replaces the hand-rolled apply_env mapping.
+figment = { version = "0.10", features = ["toml", "env"] }
 
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
 
 anyhow = "1.0"
-thiserror = "1.0"
+thiserror = "2.0"
 clap = { version = "4.5", features = ["derive", "env"] }
 uuid = { version = "1.10", features = ["v4", "serde"] }
 time = { version = "0.3", features = ["serde", "serde-human-readable", "formatting", "macros"] }
+# sha2 stays 0.10 deliberately: bergshamra-crypto requires ^0.10, and
+# bumping to 0.11 would split the RustCrypto digest stack in the tree.
 sha2 = "0.10"
 hex = "0.4"
-bcrypt = "0.15"
+bcrypt = "0.19"
-once_cell = "1.19"
 parking_lot = "0.12"
 rust-embed = { version = "8.5", features = ["include-exclude"] }
 
+# v0.4.67: pure-Rust NFSv3 client. Replaces the (deleted-in-v0.4.65)
+# kernel-mount NFS path with an in-process implementation that works
+# in any container — no kernel modules, no CAP_SYS_ADMIN, no
+# subprocess. Ships alongside the userspace SMB consumer; operators
+# pick whichever protocol their NAS prefers.
+nfs3_client = { version = "0.9", features = ["tokio"] }
+nfs3_types = "0.5"
+
+# v0.5.0: SMTP for webhook notifications (Slack/Teams/Discord go over
+# plain HTTP via reqwest; email needs a real SMTP client). rustls TLS
+# to match reqwest and stay musl-static-friendly — no OpenSSL.
+lettre = { version = "0.11", default-features = false, features = ["smtp-transport", "tokio1-rustls-tls", "builder", "hostname"] }
+
+# v0.5.1: pure-Rust SAML 2.0 Service Provider. bergshamra does XML-DSig
+# verification + exclusive c14n with RustCrypto (no OpenSSL/xmlsec/libxml2
+# C deps), so the static musl binary stays OpenSSL-free — samael was
+# rejected precisely because it hard-requires OpenSSL. We build the thin
+# SP layer (AuthnRequest, metadata parse, SAMLResponse semantics) on top.
+bergshamra = "0.5"
+roxmltree = "0.21"
+quick-xml = "0.40"
+x509-parser = "0.18"
+# flate2 default backend is miniz_oxide (pure Rust) — do NOT enable the
+# zlib/zlib-ng C backends, which would break the musl-static build.
+flate2 = "1.1"
+base64 = "0.22"
+
+# v0.5.5: pure-Rust SSH/SFTP client for reading remote ISO libraries
+# over SFTP without a kernel mount.
+#
+# CRITICAL #1 — crypto backend: `default-features = false` +
+# `features = ["ring"]`. russh's *default* backend is `aws-lc-rs`, which
+# pulls `aws-lc-sys` (C code, fiddly under musl); the `ring` feature
+# instead reuses `ring 0.17` — the exact crate+version already in the
+# binary via rustls + bergshamra — so SFTP adds ZERO new C/crypto deps
+# and the static-musl build stays OpenSSL-free.
+#
+# CRITICAL #2 — history: this was pinned to =0.55.0 from v0.5.5 until
+# v0.6.3 because bergshamra-crypto pinned release-candidate RustCrypto
+# crates that conflicted with the stable generation russh 0.56+ pulls.
+# bergshamra 0.5 (2026-06) moved to the stable generation (pkcs8 0.11),
+# lifting the pin. v0.6.3 bumps to 0.61+, which also closes a batch of
+# RUSTSEC advisories reachable from the SFTP *client* path (unbounded
+# allocations in packet parsing — CVE-2026-48110/-46702/-46673 et al.)
+# and drops mlock on non-secret buffers (~21% SSH throughput upstream).
+#
+# SCP was deliberately rejected: the protocol is sequential-only (no
+# random access → no HTTP Range, unlike SFTP/NFS) and the mature SCP
+# crates wrap libssh2 (C + OpenSSL), which would break this build.
+russh = { version = "0.61", default-features = false, features = ["ring"] }
+russh-sftp = "2.3"
+
 openpxe-core = { path = "crates/core" }
 openpxe-dhcp-proxy = { path = "crates/dhcp-proxy" }
 openpxe-tftp = { path = "crates/tftp" }

README.md

@@ -1,301 +1,270 @@
-# OpenPXE
+<p align="center">
+  <img src="docs/openpxe-logo.svg" alt="OpenPXE" width="104" height="104" />
+</p>
 
-Container-native PXE boot server. A Rust reimplementation of
+<h1 align="center">OpenPXE</h1>
-[iVentoy (ventoy/PXE)](https://github.com/ventoy/PXE), designed from scratch
-for Docker/OCI and OpenShift. Upload `.iso` files via the web UI; network
-clients PXE-boot them.
 
-> **Status:** v0.2.0 / pre-beta. Phases 1–5 complete: full PXE stack,
+<p align="center">
-> Queued Deployment queue, NFS-share ISO sources, live tracing log + an
+  <strong>Container-native network boot &amp; OS deployment — built in Rust.</strong>
-> operator terminal, per-MAC host bindings (Tinkerbell-style),
+</p>
-> Prometheus `/metrics`, light/dark theme toggle, animated anvil
-> imaging-progress widget. **66 tests passing**, clippy clean. Ready
-> for real-hardware validation.
 
-## Design non-negotiables
+<p align="center">
+  Drag in an ISO. PXE-boot and image an entire fleet from a browser.<br/>
+  No iPXE scripting. No <code>dnsmasq</code> + <code>tftpd</code> + Samba glue. No glibc. No garbage collector.
+</p>
 
-1. **Fully offline / air-gap deployable.** Zero CDN assets. Zero external
+<p align="center">
-   HTTP calls from the server, the browser, or the generated iPXE scripts.
+  <img alt="release"   src="https://img.shields.io/badge/release-v0.6.0-2874d7" />
-   Build the container once, run forever disconnected.
+  <img alt="license"   src="https://img.shields.io/badge/license-MIT%20%7C%20Apache--2.0-59824f" />
-2. **iPXE is a backend implementation detail.** No `.ipxe` upload path, no
+  <img alt="rust"      src="https://img.shields.io/badge/built%20with-Rust-fb8841?logo=rust&logoColor=white" />
-   manual script editing, no iPXE terminology in the UI. Every knob in the
+  <img alt="container" src="https://img.shields.io/badge/container--native-OCI%20%C2%B7%20OpenShift-2496ED?logo=docker&logoColor=white" />
-   web UI maps to a specific script-generation behavior inside the binary.
+  <img alt="binary"    src="https://img.shields.io/badge/static-musl%20%C2%B7%20~18MB-330f1f" />
-3. **The client trust store is off-limits.** No test-signed drivers, no
+</p>
-   `bcdedit /set testsigning on`, no certificates injected into WinPE or
-   the target OS.
 
-## What it does
+---
 
-1. **DHCP proxy** (RFC 4578). Coexists with your existing DHCP server —
+OpenPXE turns bare-metal provisioning into a single container with a web UI. It's a
-   never assigns IPs. Listens on UDP 67 + UDP 4011.
+ground-up Rust reimplementation of [iVentoy (ventoy/PXE)](https://github.com/ventoy/PXE),
-2. **TFTP server** (RFC 1350 + RFC 2347/2348/2349/7440 option negotiation)
+designed for Docker/OCI and OpenShift instead of a Windows desktop — so it drops onto
-   that serves architecture-specific iPXE binaries to firmware PXE ROMs.
+an Unraid box, a Linux server, or a Kubernetes cluster and just runs.
-3. **HTTP server** that serves the web UI, the generated iPXE boot scripts,
-   raw ISOs (with Range), and files inside ISOs without prior extraction.
-4. **ISO introspection**: auto-detects the distro family and generates the
-   appropriate kernel+initrd or wimboot chain. No manual config.
-5. **Hierarchical PXE menu** mirroring the Phase 2 spec:
-   ```
-   Default        > Boot from Local HDD
-   Installers     > Linux Installers  / Windows Installers
-   Tools          > Utilities / OpenPXE Shell / Network Card Info
-   Queued Deployment
-   ```
-6. **Queued Deployment queue** — the "horse race" launch flow. A client that
-   selects *Queued Deployment* gets a numbered position and waits. The
-   operator picks an ISO in the web UI and fires it to every waiting
-   client simultaneously.
-7. **Web UI** (Netbox-style): sidebar nav (Dashboard / Network / Forge
-   Gate / Storage / Hosts / Terminal / About), light + dark themes
-   (toggle top-right or press `T`), animated anvil "forge progress"
-   widget when devices are imaging. All assets served from the binary —
-   no external requests.
-8. **Per-MAC host bindings.** Pin a MAC to a boot target and the client
-   skips the menu, chains straight through. Inspired by Tinkerbell's
-   `smee` MAC-prepended URL pattern.
-9. **Prometheus metrics** at `/metrics` — DHCP replies by arch, TFTP
-   transfer counts and bytes, HTTP request counts by route, queue /
-   imaging gauges, uptime, build info. Plain text exposition format,
-   no external metrics framework dependency.
-8. **Settings API** lets you change the default boot-menu timeout (default
-   600s), the timeout action (stay / Local HDD / Queued Deployment), and
-   feature toggles like Windows ISO support. The iPXE scripts regenerate
-   on every request using current settings.
 
-### Architectures supported on day one
+Upload `.iso` files (or point at a remote share), and any machine on the network boots
+them — Linux installers, live tools, or stock Windows setup — with **zero iPXE knowledge
+required by the operator.**
 
-| DHCP option 93 | Architecture    | Binary served           |
+> **Status — v0.6.0, late pre-beta.** The full PXE stack, web UI, remote ISO libraries
-|----------------|-----------------|-------------------------|
+> (SMB/NFS/SFTP), Windows deployment, queued fleet rollout, SAML SSO, and Prometheus
-| `0x0000`       | Legacy x86 BIOS | `undionly.kpxe`         |
+> metrics are implemented and test-covered. The release checklist gates every tag on the
-| `0x0006`       | IA32 UEFI       | `snponly-i386.efi`      |
+> full test suite + `clippy`. Currently in real-hardware validation.
-| `0x0007`/`0x0009` | x86_64 UEFI  | `snponly.efi`           |
-| `0x000B`       | ARM64 UEFI      | `snponly-arm64.efi`     |
 
-UEFI firmware that sends `HTTPClient` in option 60 is handled too — we
+## Why OpenPXE
-skip TFTP and respond with an HTTP URL.
 
-## Quick start — MVP container (recommended)
+Standing up network boot the traditional way means hand-wiring `dnsmasq`, a TFTP daemon,
+hand-written iPXE menu scripts, an HTTP server, and Samba — then keeping that fragile
+stack alive, and discovering none of it containerizes cleanly (kernel-mount NFS, raw
+sockets, `CAP_SYS_ADMIN`). iVentoy solved the UX beautifully, but it's a Windows GUI app.
+
+OpenPXE collapses that whole stack into **one statically-linked binary in one container**:
+
+- **A web UI does everything.** iPXE is an internal implementation detail — there is no
+  script upload, no `.ipxe` editing, no PXE jargon in the interface.
+- **It runs anywhere a container runs.** No kernel modules, no privileged mode — proxy-mode
+  DHCP + `NET_BIND_SERVICE` is the entire requirement. Verified on Unraid, plain Docker,
+  and OpenShift's restricted SCC.
+- **It's air-gap native.** Zero CDN assets, zero outbound calls from the server, browser,
+  or generated boot scripts. Build the image once, run it forever, disconnected.
+
+## Highlights
+
+#### Boot stack
+- **DHCP proxy** (RFC 4578) that coexists with your existing DHCP — it never hands out IPs.
+- **TFTP** (RFC 1350 + 2347/2348/2349/7440 option negotiation) serving arch-correct iPXE firmware.
+- **HTTP** serving the UI, generated boot scripts, raw ISOs (with byte-range), and files
+  *inside* ISOs with no prior extraction.
+- **Graphical iPXE boot menu** built from your uploads, with a PNG background and a clean
+  hierarchy — generated fresh on every request from current settings.
+
+#### ISO management & remote libraries
+- **Drag-and-drop chunked uploads** that don't 502 on multi-GB images.
+- **Automatic introspection** — detects the distro family and generates the right
+  kernel+initrd or Windows `wimboot` chain. No manual config.
+- **Remote ISO libraries, streamed on demand** (no local cache) over **SMB, NFS, or SFTP** —
+  see the table below.
+
+#### Fleet deployment
+- **Queued Deployment** — clients join a queue and wait; the operator fires one image at
+  every waiting machine simultaneously.
+- **Per-MAC host bindings** — pin a MAC straight to a target (with optional auto hostname,
+  auto IP, and an unattended answer file); it skips the menu and chains through.
+- **Unattended installs** — upload Kickstart / Preseed / Autoinstall / Windows answer files;
+  they're templated per-host (hostname / IP / MAC) and served only to booting clients.
+- **Windows deployment** from a stock Microsoft ISO — **every binary the client runs stays
+  Microsoft-signed** (details below).
+
+#### Operations & access
+- **SAML 2.0 single sign-on** (pure-Rust SP, no OpenSSL/xmlsec) alongside local accounts.
+- **Custom branding** — light / dark / PXE-client logos and favicon.
+- **Notifications** — Slack / Teams / Discord webhooks and SMTP email on boot events.
+- **Prometheus `/metrics`**, a built-in operator **terminal**, live tracing log, and
+  `/healthz` · `/readyz` probes.
+- **Layered config** — defaults → TOML file → `OPENPXE_*` env, in that order.
+
+## Built in Rust
+
+Rust isn't a checkbox here — it's why OpenPXE deploys the way it does:
+
+- **One static binary, ~18 MB.** Compiled to `x86_64-unknown-linux-musl` — no glibc, no
+  interpreter, no sidecar runtime. The runtime image is "binary + a few CLI tools."
+- **No garbage collector, async throughout.** A Tokio runtime drives DHCP, TFTP, HTTP, and
+  many concurrent multi-GB ISO streams on a tiny, predictable memory footprint — it idles
+  near-zero and never GC-pauses mid-transfer.
+- **Memory-safe by construction.** `unsafe` is **denied workspace-wide**; the only
+  exceptions are two small, individually-audited FFI calls (`statvfs` for disk usage and a
+  Samba `SIGHUP`).
+- **OpenSSL-free, pure-Rust crypto.** TLS via `rustls`/`ring`; the SAML Service Provider
+  does XML-DSig verification with RustCrypto — no `xmlsec`, no `libxml2`, no C crypto to
+  CVE-patch. Even the SMB/NFS/SFTP clients avoid C libraries.
+- **Sub-minute, reproducible container builds.** Cross-compiled with `cargo-zigbuild`
+  (zig as the linker) — a full image builds in well under a minute on a warm cache, with
+  no QEMU emulation.
+
+## Quick start
+
+### Run the container
 
 ```bash
-# 1. Pull bundled iPXE binaries (~2 MB, one-time).
+# Build the self-contained image (iPXE binaries are fetched + built inside the Dockerfile).
-./scripts/fetch-ipxe.sh
+docker build -f deploy/docker/Dockerfile -t openpxe:0.5.5 .
 
-# 2. Build the container image (~3 min first time).
+# Run it on the box plugged into your PXE network. Host networking is required in
-docker buildx build -f deploy/docker/Dockerfile -t openpxe:0.1.0 --load .
+# proxy mode so the container sees DHCPDISCOVER broadcasts; set PUBLIC_IP to this
-
+# host's LAN address so advertised boot URLs are reachable.
-# 3. Run it on the box plugged into your PXE network. Set PUBLIC_IP to
+docker run -d --name openpxe --network host \
-#    this host's LAN address so advertised iPXE URLs are reachable.
-docker run -d --name openpxe \
-  --network host \
   -e OPENPXE_PUBLIC_IP=10.0.0.5 \
   -e OPENPXE_DHCP_MODE=proxy \
   -v $PWD/data/isos:/var/lib/openpxe/isos \
   -v $PWD/data/work:/var/lib/openpxe/work \
-  openpxe:0.1.0
+  openpxe:0.5.5
 
-# 4. Open the UI and drop an ISO in.
+# Open the UI and drop an ISO in.
 open http://10.0.0.5
 ```
 
-Host networking is required in proxy mode so the container sees DHCPDISCOVER
+> On macOS/Windows, Docker runs inside a Linux VM, so "host network" means the VM — use
-broadcasts from the PXE VLAN. On macOS/Windows hosts Docker runs in a Linux
+> the `openpxe-dev` service in `docker-compose.yml` for API-only testing on a laptop:
-VM, so "host" means the VM — use `openpxe-dev` in `docker-compose.yml` for
+> `OPENPXE_PUBLIC_IP=127.0.0.1 docker compose up openpxe-dev`.
-API-only testing on a laptop.
 
-### Quick start — docker compose
+### Build from source
 
 ```bash
-# MVP / API testing on a laptop (no DHCP, high ports):
+./scripts/fetch-ipxe.sh          # populate assets/ipxe/ (embedded at compile time)
-OPENPXE_PUBLIC_IP=127.0.0.1 docker compose up openpxe-dev
+cargo run --release              # needs root or CAP_NET_BIND_SERVICE for :80/:69
-# Real PXE deployment on a Linux host (host network, DHCP proxy on):
-OPENPXE_PUBLIC_IP=10.0.0.5  docker compose up openpxe
 ```
 
-### Multi-arch build + push
+### Pre-seed ISOs from a directory
-
-For deploying to x86_64 servers, build both arches in one manifest:
-
-```bash
-# One-time: bootstrap a multi-arch builder.
-docker buildx create --name openpxe-multi --driver docker-container --use
-
-# Build + push both linux/amd64 and linux/arm64 under one tag.
-docker buildx build --builder openpxe-multi \
-  --platform linux/amd64,linux/arm64 \
-  -t ghcr.io/YOUR-ORG/openpxe:0.1.0 \
-  --push \
-  -f deploy/docker/Dockerfile .
-```
-
-On an Apple Silicon host, the amd64 stage runs under QEMU emulation (~10-15 min for a cold cache). On a Linux x86_64 host, both arches build natively at normal speed. CI runners on GitHub Actions with `docker/build-push-action@v5` handle this cleanly.
-
-### Build from source (no container)
-
-```bash
-./scripts/fetch-ipxe.sh
-cargo run --release            # needs NET_BIND_SERVICE or root for :80/:69
-```
-
-### Container health probes
-
-| Endpoint    | Purpose                                                       |
-|-------------|---------------------------------------------------------------|
-| `/healthz`  | Liveness — HTTP stack alive. Always 200.                      |
-| `/readyz`   | Readiness — 200 only if iPXE binaries bundled + ISO dir OK.   |
-| `/api/status` | Full JSON status: versions, assets, counts, live settings, SMB state. |
-
-### Pre-seeding ISOs from a directory
-
-For CI, pre-baked homelab deployments, or a fresh PVC, the binary has a
-`seed` subcommand that imports every `*.iso` from a host path through the
-same pipeline the web UI uses (introspection + boot-entry generation):
 
 ```bash
 docker run --rm \
   -v /my/iso-library:/seed:ro \
   -v openpxe-data:/var/lib/openpxe/isos \
   -e OPENPXE_PUBLIC_IP=10.0.0.5 \
-  openpxe:0.1.0 seed --from /seed
+  openpxe:0.5.5 seed --from /seed          # add --dry-run to preview
-
-# Dry run first to see what would be imported:
-docker run --rm -v /my/iso-library:/seed:ro openpxe:0.1.0 seed --from /seed --dry-run
 ```
 
-### Environment overrides
+## Remote ISO libraries
 
-| Var                    | Default                     | Meaning                                |
+Point OpenPXE at a NAS and boot ISOs straight off it — **read on demand, no local copy**,
-|------------------------|-----------------------------|----------------------------------------|
+so a 50-ISO library costs zero disk on the OpenPXE host. All three clients are userspace
-| `OPENPXE_HTTP_PORT`   | `80`                        | Web UI + boot script HTTP port         |
+(no kernel mounts, no `CAP_SYS_ADMIN`); pick whichever your storage speaks.
-| `OPENPXE_TFTP_PORT`   | `69`                        | TFTP port                              |
-| `OPENPXE_DHCP_PORT`   | `67`                        | DHCP server-side port                  |
-| `OPENPXE_DHCP_MODE`   | `proxy`                     | `proxy` or `disabled`                  |
-| `OPENPXE_PUBLIC_IP`   | auto-detect                 | Advertised IP for clients. Startup **fails** if unset and auto-detect returns loopback. |
-| `OPENPXE_ISO_DIR`     | `/var/lib/openpxe/isos`    | Where uploaded ISOs live               |
-| `OPENPXE_WORK_DIR`    | `/var/lib/openpxe/work`    | Scratch + runtime settings             |
-| `OPENPXE_LOG`         | `info,openpxe=debug`       | `tracing` filter                       |
 
-## What the boot menu looks like on a real client
+| Protocol | Implementation | Auth | HTTP Range¹ |
+|----------|----------------|------|-------------|
+| **NFS** (v3) | Pure-Rust in-process client | Client-IP (server export list) | ✅ |
+| **SFTP** (SSH) | Pure-Rust in-process client (`russh`) | Password **or** SSH key · host-key TOFU | ✅ |
+| **SMB** / CIFS | Userspace `smbclient` | Guest or username/password | — |
+
+¹ Range support lets clients seek into a multi-GB ISO without downloading what comes
+before it — needed for kernel/initrd extraction and `httpdisk`-style boots. NFS and SFTP
+expose explicit offsets; the SMB CLI streams sequentially, so SMB-sourced ISOs serve whole-file.
+
+## Supported client architectures
+
+| DHCP option 93 | Architecture | Firmware served |
+|----------------|--------------|-----------------|
+| `0x0000` | Legacy x86 BIOS | `undionly.kpxe` |
+| `0x0006` | IA32 UEFI | `snponly-i386.efi` |
+| `0x0007` / `0x0009` | x86_64 UEFI | `snponly.efi` |
+| `0x000B` | ARM64 UEFI | `snponly-arm64.efi` |
+
+UEFI firmware that advertises `HTTPClient` (option 60) skips TFTP entirely and is handed an HTTP URL.
+
+## The boot menu, on a real client
 
 ```
-                        OpenPXE - network boot menu
+                        OpenPXE — network boot menu
 
  ------------------------- Default -------------------------
  Boot from Local HDD
- ----------------------- Installers -----------------------
+ ----------------------- Installers ------------------------
  Linux Installers   >
  Windows Installers >                (only if enabled in Settings)
  -------------------------- Tools --------------------------
- Tools              >                Utilities / Shell /
+ Tools              >    Utilities / OpenPXE Shell / NIC Info / Reboot
-                                     NIC Info / Reboot /
-                                     Exit and continue BIOS
  ---------------------- Queued Deployment ------------------
  Queued Deployment   (join queue)
 ```
 
-Linux/Windows submenus show file sizes iVentoy-style:
+Linux/Windows submenus list images iVentoy-style with sizes:
 
 ```
-                   OpenPXE - Linux Installers
+                   OpenPXE — Linux Installers
 
- [  4376 MB]  CentOS-7-x86_64-DVD-1810
- [  2002 MB]  Fedora-Workstation-Live-x86_64-38-1.6
  [  4699 MB]  ubuntu-22.04.2-desktop-amd64
+ [  2002 MB]  Fedora-Workstation-Live-x86_64-38-1.6
             < Back to main menu
 ```
 
-iPXE never appears in the UI — the whole hierarchy above is generated from
+The entire hierarchy is generated from what you upload and toggle — iPXE never surfaces.
-ISOs you upload via drag-and-drop in the web UI plus toggles in Settings.
+
+## Windows deployment
+
+Enable **Windows ISO support** in Settings, then upload a **stock, unmodified** Microsoft ISO:
+
+1. On upload, OpenPXE uses `wimlib-imagex` to inject exactly two plain-text files into the
+   WinPE image (`winpeshl.ini` + `startnet.cmd`) — no drivers, no certificates.
+2. The container's Samba `smbd` serves the extracted install tree on `:445`.
+3. The client chainloads `wimboot` → patched WinPE → Windows Setup running off the share.
+
+**Every executable the client runs is stock Microsoft-signed.** OpenPXE never ships
+drivers, never installs certificates into the client trust store, and never recommends
+`bcdedit /set testsigning on`. The SMB approach is adapted (re-implemented, not copied)
+from [Bootimus](https://github.com/garybowers/bootimus) (Apache-2.0). Port `445` must be
+directly reachable from clients; Windows 10/11 client SKUs are the tested target.
+
+## Configuration
+
+All settings have defaults and layer **defaults → TOML (`--config` / `OPENPXE_CONFIG`) →
+`OPENPXE_*` env**. The common knobs:
+
+| Var | Default | Meaning |
+|-----|---------|---------|
+| `OPENPXE_PUBLIC_IP` | auto-detect | IP advertised to clients. **Startup fails** if unset and auto-detect yields loopback. |
+| `OPENPXE_DHCP_MODE` | `proxy` | `proxy` or `disabled` |
+| `OPENPXE_HTTP_PORT` | `80` | Web UI + boot-script HTTP port |
+| `OPENPXE_TFTP_PORT` | `69` | TFTP port |
+| `OPENPXE_DHCP_PORT` | `67` | DHCP server-side port |
+| `OPENPXE_ISO_DIR` | `/var/lib/openpxe/isos` | Uploaded ISOs |
+| `OPENPXE_WORK_DIR` | `/var/lib/openpxe/work` | Scratch, settings, share + branding state |
+| `OPENPXE_LOG` | `info,openpxe=info` | `tracing` filter |
 
 ## OpenShift
 
 ```bash
 oc apply -f deploy/openshift/
-oc -n openpxe get all
 oc -n openpxe get route openpxe -o jsonpath='{.spec.host}'
 ```
 
-### Why a custom SCC?
+The bundled `openpxe-scc` grants exactly `hostNetwork` (CNI overlays don't deliver L2
+broadcast into pod netns) and `NET_BIND_SERVICE` (to bind ports <1024) — nothing else.
+No raw sockets, no privileged mode. The Route covers `80/TCP`; PXE clients reach UDP
+67/69/4011 on the node's host IP directly.
 
-The default `restricted-v2` blocks `hostNetwork` and all capabilities. PXE
+## Health & observability
-cannot work without host network (CNI overlays don't deliver L2 broadcast
-into pod netns), and we need `NET_BIND_SERVICE` to bind <1024. The custom
-`openpxe-scc` grants exactly those two and nothing else. No raw sockets,
-no privileged mode — proxy-mode DHCP sidesteps the usual requirements.
 
-### What's on host ports
+| Endpoint | Purpose |
-
+|----------|---------|
-| Port     | Proto | Purpose                         |
+| `/healthz` | Liveness — always 200 if the HTTP stack is up. |
-|----------|-------|---------------------------------|
+| `/readyz` | Readiness — 200 only once iPXE firmware is bundled and the ISO dir is reachable. |
-| 67       | UDP   | DHCP server (proxy replies)     |
+| `/api/status` | Full JSON: version, assets, counts, live settings, share + SMB state. |
-| 69       | UDP   | TFTP                            |
+| `/metrics` | Prometheus text format — DHCP replies by arch, TFTP/HTTP counts, queue gauges, uptime. |
-| 4011     | UDP   | PXE Boot Server discovery       |
-| 80       | TCP   | Web UI + HTTP boot assets       |
-
-The OpenShift Route only covers 80/TCP. Clients on the PXE network talk to
-the node's host IP directly for UDP.
-
-## Windows support
-
-Enabled by toggling **Windows ISO support** under Settings. The flow:
-
-1. Upload a stock Microsoft Windows install ISO (vanilla, no pre-processing).
-2. On upload, OpenPXE extracts the ISO and uses `wimlib-imagex` to rewrite
-   image index 2 (WinPE) of `sources/boot.wim`. It injects exactly two
-   plain-text files:
-   - `Windows/System32/winpeshl.ini` — tells WinPE to run `startnet.cmd`.
-   - `Windows/System32/startnet.cmd` — runs `wpeinit`, waits for the SMB
-     host to be reachable, `net use Z: \\<server>\<share> /user:guest`,
-     then `Z:\setup.exe`.
-3. The container's Samba `smbd` serves the extracted install tree on :445.
-4. The client gets chainloaded into wimboot → patched WinPE → Windows Setup
-   running off the SMB share. **Every binary the client executes is stock
-   Microsoft-signed.**
-
-### What we never do
-
-- Ship drivers — signed, test-signed, or otherwise — that load on the client.
-- Install certificates into the target's trust store or WinPE boot policy.
-- Recommend `bcdedit /set testsigning on` or any equivalent signing-policy
-  weakening.
-
-### Credit & limitations
-
-The SMB-based approach is adapted from [Bootimus](https://github.com/garybowers/bootimus)
-(Apache-2.0). Re-implemented in Rust; no code was copied verbatim. Known
-operational constraints inherited from the design:
-
-- **Port 445 must be directly reachable from PXE clients.** `net use`
-  ignores alternate ports. In OpenShift this means `hostPort: 445` on the
-  deployment; on a host that already runs SMB it will collide.
-- Windows 10/11 client SKUs are the tested target. Server SKUs untested.
-- Hardware with NICs/storage controllers missing from WinPE's bundled
-  drivers will need a driver-pack injection step (not yet implemented).
-
-## Queued Deployment
-
-The "horse race" launch flow, end to end:
-
-1. A client boots and picks **Queued Deployment** in the PXE menu (or falls
-   through on timeout with the default `timeout_action`).
-2. The client joins the queue, gets a numbered queue position, and enters a
-   long-poll loop (25s per request, auto-renewed).
-3. In the web UI's **Queued Deployment** tab, the operator sees each waiting
-   client with its MAC, IP, arch, and position.
-4. The operator selects an image and clicks **Launch for all waiting**.
-   The server broadcasts the assignment to every queued client via a
-   `tokio::sync::Notify`; each client's next poll returns the boot script
-   for the chosen image.
-5. Every client chains the same image at effectively the same moment — the
-   queue releases and the horses run together.
-
-No user-facing iPXE anywhere in this flow. The client only ever runs
-scripts we generate; the operator only interacts with the web UI.
 
 ## Architecture
 
-See [`docs/architecture.md`](docs/architecture.md) for the protocol stack,
+Workspace of focused crates — `core`, `dhcp-proxy`, `tftp`, `http-api`, `iso-store`,
-crate layout, and the full decision log.
+`ipxe-assets`, `webui`, and the `openpxe` binary. See
+[`docs/architecture.md`](docs/architecture.md) for the protocol stack, crate layout, and
+the full decision log.
 
-## Licence
+## License
 
-MIT OR Apache-2.0.
+Dual-licensed under **MIT OR Apache-2.0** — use whichever fits your project.

crates/core/Cargo.toml

@@ -13,6 +13,7 @@ workspace = true
 serde.workspace = true
 serde_json.workspace = true
 toml.workspace = true
+figment.workspace = true
 thiserror.workspace = true
 anyhow.workspace = true
 tracing.workspace = true
@@ -21,6 +22,26 @@ time.workspace = true
 uuid.workspace = true
 parking_lot.workspace = true
 tokio = { workspace = true, features = ["sync", "rt", "macros", "time"] }
+# bcrypt for the admin Forms auth (v0.4.5). Already in the workspace
+# for per-ISO boot passwords; just re-exported here.
+bcrypt.workspace = true
+
+# v0.5.1: pure-Rust SAML 2.0 SP. bergshamra = XML-DSig verify + exclusive
+# c14n (no OpenSSL/C). roxmltree/quick-xml parse + build SAML XML;
+# x509-parser pulls the IdP signing cert out of metadata; flate2+base64
+# encode the HTTP-Redirect binding's SAMLRequest.
+bergshamra.workspace = true
+roxmltree.workspace = true
+quick-xml.workspace = true
+x509-parser.workspace = true
+flate2.workspace = true
+base64.workspace = true
 
 [dev-dependencies]
 tempfile = "3.12"
+# v0.5.4: figment's `Jail` (hermetic env/file sandbox) for the config
+# loader tests lives behind the `test` feature.
+figment = { workspace = true, features = ["test"] }
+# v0.5.1: generate a throwaway self-signed signing cert/key so SAML
+# verification tests can produce genuinely signed SAMLResponses.
+rcgen = "0.13"

crates/core/src/arch.rs

@@ -23,6 +23,36 @@ pub enum ClientArch {
     Unknown(u16),
 }
 
+/// Which boot binary family to advertise to a client (v0.6.1, extended
+/// v0.7.0).
+///
+/// OpenPXE serves [`DriverMode::Firmware`] first (the firmware's own NIC
+/// stack, via `snponly`/`undionly`) and escalates a specific MAC
+/// automatically when a boot never completes its handoff:
+/// `Firmware → Builtin → Shim`. There is no operator toggle — the DHCP
+/// proxy decides per client.
+///
+/// The `Shim` rung (v0.7.0) covers Secure Boot: firmware with SB enabled
+/// downloads our unsigned iPXE fine but refuses to *execute* it, which
+/// looks exactly like a failed chainload. After both iPXE builds go
+/// unconfirmed, the client is offered the Microsoft-signed shim, which
+/// loads the signed GRUB, which fetches a server-rendered menu — a fully
+/// signed chain that boots signed distro kernels with SB still on.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Default, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum DriverMode {
+    /// Reuse the firmware UNDI/SNP NIC stack (`snponly.efi`, `undionly.kpxe`).
+    /// Default, smallest, most reliable for chainloading.
+    #[default]
+    Firmware,
+    /// iPXE's own bundled NIC drivers (`ipxe.efi`, `ipxe.pxe`). Fallback for
+    /// hardware whose firmware NIC stack is missing or buggy.
+    Builtin,
+    /// Microsoft-signed shim + GRUB chain (`shimx64.efi`). Final fallback
+    /// for Secure-Boot-enabled UEFI clients that refuse unsigned iPXE.
+    Shim,
+}
+
 impl ClientArch {
     #[must_use]
     pub fn from_option_93(value: u16) -> Self {
@@ -39,21 +69,73 @@ impl ClientArch {
     /// Default iPXE binary filename to return via TFTP for this architecture.
     /// Uses `snponly` variants which reuse the firmware's UNDI/SNP network
     /// stack — smaller binaries and broader hardware compatibility than the
-    /// all-drivers-included `ipxe.efi`.
+    /// all-drivers-included `ipxe.efi`. Equivalent to
+    /// [`Self::ipxe_bootfile_mode`] with [`DriverMode::Firmware`]; kept as a
+    /// convenience for the common firmware-net path.
     #[must_use]
     pub fn ipxe_bootfile(self) -> Option<&'static str> {
-        Some(match self {
+        self.ipxe_bootfile_mode(DriverMode::Firmware)
-            Self::LegacyX86 => "undionly.kpxe",
+    }
-            Self::Ia32Uefi => "snponly-i386.efi",
+
-            Self::X64Uefi => "snponly.efi",
+    /// iPXE binary filename for this architecture under a given network
-            // ARM32 UEFI: upstream boot.ipxe.org does not publish a prebuilt
+    /// [`DriverMode`].
-            // snponly variant for this arch. We return None so the DHCP
+    ///
-            // proxy declines rather than advertising a file we can't serve.
+    /// * [`DriverMode::Firmware`] — the `snponly`/`undionly` builds that reuse
-            Self::Arm32Uefi | Self::Unknown(_) => return None,
+    ///   the firmware's UNDI/SNP NIC stack. Smallest, and the most reliable
-            Self::Arm64Uefi => "snponly-arm64.efi",
+    ///   choice for chainloading because the firmware just proved its network
+    ///   works by downloading the NBP. This is the default first attempt.
+    /// * [`DriverMode::Builtin`] — the all-drivers `ipxe.efi`/`ipxe.pxe`
+    ///   builds that carry iPXE's *own* NIC drivers. The automatic fallback
+    ///   for clients whose firmware NIC stack is missing or buggy (v0.6.1):
+    ///   the DHCP proxy escalates a MAC to this mode when a firmware-net boot
+    ///   never completes the iPXE handoff. iPXE still includes the `snp`
+    ///   driver here too, so it degrades gracefully.
+    #[must_use]
+    pub fn ipxe_bootfile_mode(self, mode: DriverMode) -> Option<&'static str> {
+        Some(match (self, mode) {
+            // Legacy x86 BIOS: UNDI (firmware) vs full native-driver build.
+            (Self::LegacyX86, DriverMode::Firmware) => "undionly.kpxe",
+            (Self::LegacyX86, DriverMode::Builtin) => "ipxe.pxe",
+            // IA32 UEFI.
+            (Self::Ia32Uefi, DriverMode::Firmware) => "snponly-i386.efi",
+            (Self::Ia32Uefi, DriverMode::Builtin) => "ipxe-i386.efi",
+            // No signed Shim chain for BIOS (no Secure Boot there) or
+            // IA32 UEFI (Fedora publishes no 32-bit shim; SB-on IA32
+            // clients are vanishingly rare). Same outcome as the
+            // no-binary arches below, listed separately for the comment.
+            #[allow(clippy::match_same_arms)]
+            (Self::LegacyX86 | Self::Ia32Uefi, DriverMode::Shim) => return None,
+            // x86_64 UEFI — the overwhelmingly common modern client.
+            (Self::X64Uefi, DriverMode::Firmware) => "snponly.efi",
+            (Self::X64Uefi, DriverMode::Builtin) => "ipxe.efi",
+            (Self::X64Uefi, DriverMode::Shim) => "shimx64.efi",
+            // ARM64 UEFI.
+            (Self::Arm64Uefi, DriverMode::Firmware) => "snponly-arm64.efi",
+            (Self::Arm64Uefi, DriverMode::Builtin) => "ipxe-arm64.efi",
+            (Self::Arm64Uefi, DriverMode::Shim) => "shimaa64.efi",
+            // ARM32 UEFI: upstream boot.ipxe.org publishes no prebuilt binary
+            // for this arch in any mode. Unknown arches likewise. Return
+            // None so the DHCP proxy declines rather than advertising a file
+            // we can't serve.
+            (Self::Arm32Uefi | Self::Unknown(_), _) => return None,
         })
     }
 
+    /// Like [`Self::ipxe_bootfile_mode`], but walks back down the
+    /// escalation ladder (`Shim → Builtin → Firmware`) when the requested
+    /// mode has no binary for this arch — e.g. a BIOS client whose
+    /// escalation state reached `Shim` (BIOS has no Secure Boot) falls
+    /// back to the all-drivers build instead of being ignored.
+    #[must_use]
+    pub fn bootfile_with_fallback(self, mode: DriverMode) -> Option<&'static str> {
+        let ladder: &[DriverMode] = match mode {
+            DriverMode::Shim => &[DriverMode::Shim, DriverMode::Builtin, DriverMode::Firmware],
+            DriverMode::Builtin => &[DriverMode::Builtin, DriverMode::Firmware],
+            DriverMode::Firmware => &[DriverMode::Firmware],
+        };
+        ladder.iter().find_map(|m| self.ipxe_bootfile_mode(*m))
+    }
+
     #[must_use]
     pub fn as_str(self) -> &'static str {
         match self {
@@ -126,10 +208,110 @@ mod tests {
     fn bootfile_names_stable() {
         assert_eq!(ClientArch::LegacyX86.ipxe_bootfile(), Some("undionly.kpxe"));
         assert_eq!(ClientArch::X64Uefi.ipxe_bootfile(), Some("snponly.efi"));
-        assert_eq!(ClientArch::Arm64Uefi.ipxe_bootfile(), Some("snponly-arm64.efi"));
+        assert_eq!(
+            ClientArch::Arm64Uefi.ipxe_bootfile(),
+            Some("snponly-arm64.efi")
+        );
         assert_eq!(ClientArch::Unknown(0xFFFF).ipxe_bootfile(), None);
     }
 
+    #[test]
+    fn bootfile_default_is_firmware_mode() {
+        // The convenience method must equal the explicit Firmware mode.
+        for a in [
+            ClientArch::LegacyX86,
+            ClientArch::Ia32Uefi,
+            ClientArch::X64Uefi,
+            ClientArch::Arm64Uefi,
+            ClientArch::Arm32Uefi,
+            ClientArch::Unknown(0x99),
+        ] {
+            assert_eq!(
+                a.ipxe_bootfile(),
+                a.ipxe_bootfile_mode(DriverMode::Firmware)
+            );
+        }
+    }
+
+    #[test]
+    fn builtin_mode_maps_to_all_drivers_binaries() {
+        assert_eq!(
+            ClientArch::LegacyX86.ipxe_bootfile_mode(DriverMode::Builtin),
+            Some("ipxe.pxe")
+        );
+        assert_eq!(
+            ClientArch::X64Uefi.ipxe_bootfile_mode(DriverMode::Builtin),
+            Some("ipxe.efi")
+        );
+        assert_eq!(
+            ClientArch::Ia32Uefi.ipxe_bootfile_mode(DriverMode::Builtin),
+            Some("ipxe-i386.efi")
+        );
+        assert_eq!(
+            ClientArch::Arm64Uefi.ipxe_bootfile_mode(DriverMode::Builtin),
+            Some("ipxe-arm64.efi")
+        );
+        // No binary for ARM32 / unknown in either mode.
+        assert_eq!(
+            ClientArch::Arm32Uefi.ipxe_bootfile_mode(DriverMode::Builtin),
+            None
+        );
+        assert_eq!(
+            ClientArch::Unknown(0x99).ipxe_bootfile_mode(DriverMode::Builtin),
+            None
+        );
+    }
+
+    #[test]
+    fn driver_mode_default_is_firmware() {
+        assert_eq!(DriverMode::default(), DriverMode::Firmware);
+    }
+
+    #[test]
+    fn shim_mode_maps_to_signed_chain_on_uefi_only() {
+        assert_eq!(
+            ClientArch::X64Uefi.ipxe_bootfile_mode(DriverMode::Shim),
+            Some("shimx64.efi")
+        );
+        assert_eq!(
+            ClientArch::Arm64Uefi.ipxe_bootfile_mode(DriverMode::Shim),
+            Some("shimaa64.efi")
+        );
+        // No Secure Boot on BIOS, no published 32-bit shim.
+        assert_eq!(
+            ClientArch::LegacyX86.ipxe_bootfile_mode(DriverMode::Shim),
+            None
+        );
+        assert_eq!(
+            ClientArch::Ia32Uefi.ipxe_bootfile_mode(DriverMode::Shim),
+            None
+        );
+    }
+
+    #[test]
+    fn fallback_walks_down_the_ladder() {
+        // BIOS escalated to Shim → falls back to the all-drivers build.
+        assert_eq!(
+            ClientArch::LegacyX86.bootfile_with_fallback(DriverMode::Shim),
+            Some("ipxe.pxe")
+        );
+        // UEFI x64 at Shim gets the real shim.
+        assert_eq!(
+            ClientArch::X64Uefi.bootfile_with_fallback(DriverMode::Shim),
+            Some("shimx64.efi")
+        );
+        // Plain modes are unchanged.
+        assert_eq!(
+            ClientArch::X64Uefi.bootfile_with_fallback(DriverMode::Firmware),
+            Some("snponly.efi")
+        );
+        // Arches with nothing stay None.
+        assert_eq!(
+            ClientArch::Arm32Uefi.bootfile_with_fallback(DriverMode::Shim),
+            None
+        );
+    }
+
     #[test]
     fn firmware_class_detects_ipxe_over_pxeclient() {
         let c = FirmwareClass::classify(Some(b"PXEClient:Arch:00007"), Some(b"iPXE"));

crates/core/src/auth.rs

@@ -0,0 +1,351 @@
+//! Operator authentication — Sonarr/Radarr-style single-admin Forms model.
+//!
+//! On a fresh install, no admin account exists; the WebUI's first-run
+//! flow prompts the operator to create one. After that the chosen
+//! credentials gate `/api/*` access. The admin can rotate username +
+//! password from Settings → Account.
+//!
+//! Multi-user RBAC isn't a goal for OpenPXE — the user explicitly asked
+//! for "you have access or you don't". When SSO is configured, additional
+//! users come in through the IdP; the locally-stored admin is the
+//! fallback owner who can change SSO config or the seal-breaker for an
+//! IdP outage. So one record is enough.
+//!
+//! Storage policy mirrors [`crate::host_bindings::HostBindings`] and
+//! [`crate::boot_log::BootLog`]: in-memory authoritative; disk is the
+//! crash-survival cache; a corrupt `auth.json` falls back to "no admin
+//! configured" rather than blocking startup, which puts the UI back
+//! into setup mode rather than locking the operator out.
+
+use parking_lot::RwLock;
+use serde::{Deserialize, Serialize};
+use std::path::PathBuf;
+use std::sync::Arc;
+use time::OffsetDateTime;
+
+use crate::{Error, Result};
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct AdminAccount {
+    pub username: String,
+    /// bcrypt hash (cost 10). The plaintext password never leaves the
+    /// request that set it — same discipline as the per-ISO boot password.
+    pub password_hash: String,
+    #[serde(with = "time::serde::rfc3339")]
+    pub created_at: OffsetDateTime,
+    #[serde(with = "time::serde::rfc3339")]
+    pub updated_at: OffsetDateTime,
+}
+
+/// Public projection — no hash, safe to ship to the WebUI.
+#[derive(Debug, Clone, Serialize)]
+pub struct AdminPublic {
+    pub username: String,
+    #[serde(with = "time::serde::rfc3339")]
+    pub created_at: OffsetDateTime,
+    #[serde(with = "time::serde::rfc3339")]
+    pub updated_at: OffsetDateTime,
+}
+
+impl From<&AdminAccount> for AdminPublic {
+    fn from(a: &AdminAccount) -> Self {
+        Self {
+            username: a.username.clone(),
+            created_at: a.created_at,
+            updated_at: a.updated_at,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+struct Inner {
+    admin: Option<AdminAccount>,
+}
+
+/// In-memory + on-disk admin registry. Cheap to clone.
+#[derive(Debug, Clone)]
+pub struct AdminStore {
+    path: Arc<PathBuf>,
+    inner: Arc<RwLock<Inner>>,
+}
+
+impl AdminStore {
+    /// Load from `<work_dir>/auth.json`, or start empty. A bad file
+    /// logs a warning and falls back to "no admin configured" — better
+    /// to surface the setup flow than lock the operator out of their
+    /// own install.
+    #[must_use]
+    pub fn load_or_default(work_dir: &std::path::Path) -> Self {
+        let path = work_dir.join("auth.json");
+        let inner = match std::fs::read_to_string(&path) {
+            Ok(text) => match serde_json::from_str::<Inner>(&text) {
+                Ok(parsed) => parsed,
+                Err(e) => {
+                    tracing::warn!(
+                        target: "openpxe::auth",
+                        "auth.json present but unreadable ({e}); starting in setup mode"
+                    );
+                    Inner::default()
+                }
+            },
+            Err(_) => Inner::default(),
+        };
+        Self {
+            path: Arc::new(path),
+            inner: Arc::new(RwLock::new(inner)),
+        }
+    }
+
+    /// Has an admin been bootstrapped? Drives the first-run / login
+    /// fork in the HTTP layer.
+    #[must_use]
+    pub fn is_configured(&self) -> bool {
+        self.inner.read().admin.is_some()
+    }
+
+    /// Public-safe snapshot for the WebUI.
+    #[must_use]
+    pub fn snapshot(&self) -> Option<AdminPublic> {
+        self.inner.read().admin.as_ref().map(AdminPublic::from)
+    }
+
+    /// First-run setup: create the admin account. Fails if one already
+    /// exists — the HTTP layer surfaces that as 409.
+    pub fn bootstrap(&self, username: &str, password: &str) -> Result<AdminPublic> {
+        validate_username(username)?;
+        validate_password(password)?;
+        let hash = bcrypt_hash(password)?;
+        let now = OffsetDateTime::now_utc();
+        let admin = AdminAccount {
+            username: username.trim().to_string(),
+            password_hash: hash,
+            created_at: now,
+            updated_at: now,
+        };
+        {
+            let mut g = self.inner.write();
+            if g.admin.is_some() {
+                return Err(Error::Invalid("admin account already configured".into()));
+            }
+            g.admin = Some(admin.clone());
+        }
+        self.persist();
+        tracing::info!(
+            target: "openpxe::auth",
+            username = %admin.username,
+            "admin account created (first-run setup)"
+        );
+        Ok((&admin).into())
+    }
+
+    /// Verify credentials. Returns the admin record (public projection)
+    /// on success, `Ok(None)` on mismatch, `Err` on systemic bcrypt
+    /// failure (treated as "auth not available right now" by callers).
+    pub fn verify(&self, username: &str, password: &str) -> Result<Option<AdminPublic>> {
+        let Some(admin) = self.inner.read().admin.clone() else {
+            return Ok(None);
+        };
+        if username.trim() != admin.username {
+            return Ok(None);
+        }
+        // bcrypt compares in constant time relative to the same hash.
+        // Doing the username check first is fine — a username mismatch
+        // returns immediately, but the only thing leaked is "this isn't
+        // the admin's username" which the operator already knows.
+        match bcrypt::verify(password, &admin.password_hash) {
+            Ok(true) => Ok(Some((&admin).into())),
+            Ok(false) => Ok(None),
+            Err(e) => Err(Error::Other(e.into())),
+        }
+    }
+
+    /// Rotate username and/or password. `current_password` must match
+    /// the *existing* hash — same flow as Sonarr's "current password
+    /// required to change". `new_username`/`new_password` are optional:
+    /// pass only what you want to change.
+    pub fn update_credentials(
+        &self,
+        current_password: &str,
+        new_username: Option<&str>,
+        new_password: Option<&str>,
+    ) -> Result<AdminPublic> {
+        // Re-check ownership before any state mutation.
+        let existing = self
+            .inner
+            .read()
+            .admin
+            .clone()
+            .ok_or_else(|| Error::Invalid("no admin configured".into()))?;
+        match bcrypt::verify(current_password, &existing.password_hash) {
+            Ok(true) => {}
+            Ok(false) => return Err(Error::Invalid("current password is incorrect".into())),
+            Err(e) => return Err(Error::Other(e.into())),
+        }
+
+        let mut updated = existing.clone();
+        if let Some(u) = new_username {
+            validate_username(u)?;
+            updated.username = u.trim().to_string();
+        }
+        if let Some(p) = new_password {
+            validate_password(p)?;
+            updated.password_hash = bcrypt_hash(p)?;
+        }
+        updated.updated_at = OffsetDateTime::now_utc();
+
+        {
+            let mut g = self.inner.write();
+            g.admin = Some(updated.clone());
+        }
+        self.persist();
+        tracing::info!(
+            target: "openpxe::auth",
+            username = %updated.username,
+            "admin credentials updated"
+        );
+        Ok((&updated).into())
+    }
+
+    fn persist(&self) {
+        let snap = self.inner.read().clone();
+        let body = match serde_json::to_vec_pretty(&snap) {
+            Ok(b) => b,
+            Err(e) => {
+                tracing::warn!(target: "openpxe::auth", "serialize auth.json: {e}");
+                return;
+            }
+        };
+        if let Some(parent) = self.path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        let tmp = self.path.with_extension("json.tmp");
+        if let Err(e) = std::fs::write(&tmp, body) {
+            tracing::warn!(target: "openpxe::auth", "write auth.json tmp: {e}");
+            return;
+        }
+        if let Err(e) = std::fs::rename(&tmp, self.path.as_path()) {
+            tracing::warn!(target: "openpxe::auth", "rename auth.json: {e}");
+        }
+    }
+}
+
+fn validate_username(u: &str) -> Result<()> {
+    let u = u.trim();
+    if u.is_empty() {
+        return Err(Error::Invalid("username must not be empty".into()));
+    }
+    if u.len() > 64 {
+        return Err(Error::Invalid("username must be 64 chars or fewer".into()));
+    }
+    if !u.chars().all(|c| c.is_ascii_graphic() && c != ':') {
+        return Err(Error::Invalid(
+            "username must be ASCII printable with no ':' character".into(),
+        ));
+    }
+    Ok(())
+}
+
+fn validate_password(p: &str) -> Result<()> {
+    if p.len() < 8 {
+        return Err(Error::Invalid(
+            "password must be at least 8 characters".into(),
+        ));
+    }
+    if p.len() > 256 {
+        return Err(Error::Invalid(
+            "password must be 256 characters or fewer".into(),
+        ));
+    }
+    Ok(())
+}
+
+fn bcrypt_hash(password: &str) -> Result<String> {
+    bcrypt::hash(password, bcrypt::DEFAULT_COST).map_err(|e| Error::Other(e.into()))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::tempdir;
+
+    #[test]
+    fn empty_after_load_when_no_file() {
+        let dir = tempdir().unwrap();
+        let s = AdminStore::load_or_default(dir.path());
+        assert!(!s.is_configured());
+        assert!(s.snapshot().is_none());
+    }
+
+    #[test]
+    fn bootstrap_then_verify_round_trip() {
+        let dir = tempdir().unwrap();
+        let s = AdminStore::load_or_default(dir.path());
+        let pub_ = s.bootstrap("admin", "hunter2hunter2").unwrap();
+        assert_eq!(pub_.username, "admin");
+        assert!(s.is_configured());
+
+        // Correct creds match; wrong creds don't.
+        assert!(s.verify("admin", "hunter2hunter2").unwrap().is_some());
+        assert!(s.verify("admin", "wrong").unwrap().is_none());
+        assert!(s.verify("nobody", "hunter2hunter2").unwrap().is_none());
+    }
+
+    #[test]
+    fn bootstrap_rejects_second_call() {
+        let dir = tempdir().unwrap();
+        let s = AdminStore::load_or_default(dir.path());
+        s.bootstrap("admin", "hunter2hunter2").unwrap();
+        let r = s.bootstrap("other", "anotherpass1");
+        assert!(matches!(r, Err(Error::Invalid(_))));
+    }
+
+    #[test]
+    fn round_trip_survives_disk_reload() {
+        let dir = tempdir().unwrap();
+        let s = AdminStore::load_or_default(dir.path());
+        s.bootstrap("admin", "hunter2hunter2").unwrap();
+        drop(s);
+        let s2 = AdminStore::load_or_default(dir.path());
+        assert!(s2.is_configured());
+        assert!(s2.verify("admin", "hunter2hunter2").unwrap().is_some());
+    }
+
+    #[test]
+    fn update_credentials_requires_current_password() {
+        let dir = tempdir().unwrap();
+        let s = AdminStore::load_or_default(dir.path());
+        s.bootstrap("admin", "hunter2hunter2").unwrap();
+        // Wrong current password → no change.
+        let r = s.update_credentials("nope", None, Some("newpassword1"));
+        assert!(matches!(r, Err(Error::Invalid(_))));
+        assert!(s.verify("admin", "hunter2hunter2").unwrap().is_some());
+
+        // Correct current password rotates only what's supplied.
+        s.update_credentials("hunter2hunter2", Some("alice"), Some("newpassword1"))
+            .unwrap();
+        assert!(s.verify("admin", "hunter2hunter2").unwrap().is_none());
+        assert!(s.verify("alice", "newpassword1").unwrap().is_some());
+    }
+
+    #[test]
+    fn update_credentials_partial_password_only_keeps_username() {
+        let dir = tempdir().unwrap();
+        let s = AdminStore::load_or_default(dir.path());
+        s.bootstrap("admin", "hunter2hunter2").unwrap();
+        s.update_credentials("hunter2hunter2", None, Some("newpassword1"))
+            .unwrap();
+        assert!(s.verify("admin", "newpassword1").unwrap().is_some());
+    }
+
+    #[test]
+    fn validates_username_and_password() {
+        let dir = tempdir().unwrap();
+        let s = AdminStore::load_or_default(dir.path());
+        assert!(s.bootstrap("", "hunter2hunter2").is_err());
+        assert!(s.bootstrap("ad:min", "hunter2hunter2").is_err()); // ':' reserved
+        assert!(s.bootstrap("admin", "short").is_err()); // <8 chars
+                                                         // 65-char username is too long.
+        let long = "a".repeat(65);
+        assert!(s.bootstrap(&long, "hunter2hunter2").is_err());
+    }
+}

crates/core/src/boot_log.rs

@@ -0,0 +1,249 @@
+//! Boot-event log — "who installed what, when, from where".
+//!
+//! Each `/boot/<entry>.ipxe` fetch that actually goes on to serve a boot
+//! script lands an entry here. The log is bounded in memory (newest-first,
+//! ring-buffered at [`BootLog::CAP`]) and is mirrored append-only to
+//! `<work_dir>/boot_log.jsonl`. Mirrors `HostBindings`'s "in-memory is
+//! authoritative, disk is a cache" policy — a corrupt log file should
+//! never block PXE for the network.
+//!
+//! We deliberately don't push these onto the `LogBus` (the operator
+//! terminal stream). The terminal already shows the http traces; the
+//! Host log is a curated, persistent, easy-to-scan view of "what got
+//! imaged on what hardware" and conflating the two would be noisy.
+
+use parking_lot::RwLock;
+use serde::{Deserialize, Serialize};
+use std::collections::VecDeque;
+use std::io::Write;
+use std::net::IpAddr;
+use std::path::PathBuf;
+use std::sync::Arc;
+use time::OffsetDateTime;
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct BootEvent {
+    #[serde(with = "time::serde::rfc3339")]
+    pub timestamp: OffsetDateTime,
+    /// Lowercase, colon-separated. `None` when iPXE didn't supply
+    /// `?mac=${mac}` in the chain URL (older bookmarks, custom scripts).
+    pub mac: Option<String>,
+    /// Connecting peer's IP — taken from the TCP socket when available
+    /// (PXE clients connect direct, no reverse proxy), and falls back to
+    /// `X-Forwarded-For` for the rare case where one is present.
+    pub ip: Option<IpAddr>,
+    /// `BootEntry::id` — the same id used in `/boot/<id>.ipxe`.
+    pub target_id: String,
+    /// Human-friendly label: the ISO's filename / volume label / entry
+    /// title. Pre-resolved at log time so the UI can render without
+    /// joining against the ISO store (and so "what image was installed?"
+    /// survives the operator deleting the ISO later).
+    pub target_title: String,
+}
+
+/// In-memory ring + disk-backed append log of boot events. Cheap to
+/// clone; the inner state is `Arc<RwLock<_>>`.
+#[derive(Debug, Clone)]
+pub struct BootLog {
+    path: Arc<PathBuf>,
+    inner: Arc<RwLock<VecDeque<BootEvent>>>,
+}
+
+impl BootLog {
+    /// Newest entries we retain in memory. Past this, the oldest gets
+    /// evicted — the on-disk JSONL keeps the full history for offline
+    /// inspection. 500 covers a typical install-day's worth without
+    /// turning the Hosts tab into a wall of text.
+    pub const CAP: usize = 500;
+
+    /// Load up to `CAP` newest events from `<work_dir>/boot_log.jsonl`,
+    /// or start empty if the file is missing / unreadable.
+    #[must_use]
+    pub fn load_or_default(work_dir: &std::path::Path) -> Self {
+        let path = work_dir.join("boot_log.jsonl");
+        let mut events = VecDeque::with_capacity(Self::CAP);
+        if let Ok(text) = std::fs::read_to_string(&path) {
+            for line in text.lines() {
+                if line.trim().is_empty() {
+                    continue;
+                }
+                match serde_json::from_str::<BootEvent>(line) {
+                    Ok(ev) => {
+                        if events.len() == Self::CAP {
+                            events.pop_front();
+                        }
+                        events.push_back(ev);
+                    }
+                    Err(e) => {
+                        tracing::warn!(
+                            target: "openpxe::boot_log",
+                            "skipping unparseable boot_log line: {e}"
+                        );
+                    }
+                }
+            }
+        }
+        Self {
+            path: Arc::new(path),
+            inner: Arc::new(RwLock::new(events)),
+        }
+    }
+
+    /// Append an event. Persistence is best-effort and never blocks the
+    /// caller on a failed write (the in-memory copy is the source of
+    /// truth for the live UI; the JSONL is just for crash survival).
+    pub fn record(&self, ev: &BootEvent) {
+        // Push into the ring first so a slow / failing disk doesn't lose
+        // events for the live UI.
+        {
+            let mut g = self.inner.write();
+            if g.len() == Self::CAP {
+                g.pop_front();
+            }
+            g.push_back(ev.clone());
+        }
+        tracing::info!(
+            target: "openpxe::boot_log",
+            mac = ev.mac.as_deref().unwrap_or("?"),
+            ip = ev.ip.map(|i| i.to_string()).as_deref().unwrap_or("?"),
+            target = %ev.target_id,
+            "boot event"
+        );
+        // Append to disk. We tolerate write failures — they'd show up as
+        // missing entries on the next restart only.
+        let mut line = match serde_json::to_string(ev) {
+            Ok(s) => s,
+            Err(e) => {
+                tracing::warn!(target: "openpxe::boot_log", "serialize boot event: {e}");
+                return;
+            }
+        };
+        line.push('\n');
+        if let Some(parent) = self.path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        match std::fs::OpenOptions::new()
+            .create(true)
+            .append(true)
+            .open(self.path.as_path())
+        {
+            Ok(mut f) => {
+                if let Err(e) = f.write_all(line.as_bytes()) {
+                    tracing::warn!(target: "openpxe::boot_log", "append boot_log.jsonl: {e}");
+                }
+            }
+            Err(e) => {
+                tracing::warn!(target: "openpxe::boot_log", "open boot_log.jsonl: {e}");
+            }
+        }
+    }
+
+    /// Newest-first snapshot, up to `CAP` entries.
+    #[must_use]
+    pub fn list(&self) -> Vec<BootEvent> {
+        let g = self.inner.read();
+        // VecDeque preserves insertion order; reverse so newest is first.
+        g.iter().rev().cloned().collect()
+    }
+
+    #[must_use]
+    pub fn len(&self) -> usize {
+        self.inner.read().len()
+    }
+
+    #[must_use]
+    pub fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+
+    /// Wipe in-memory + the on-disk file. Used by the `terminal clear`
+    /// equivalent or future operator action; not currently wired to a UI
+    /// button but exposed for completeness.
+    pub fn clear(&self) {
+        self.inner.write().clear();
+        let _ = std::fs::remove_file(self.path.as_path());
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::tempdir;
+
+    fn ev(target: &str, mac: Option<&str>) -> BootEvent {
+        BootEvent {
+            timestamp: OffsetDateTime::now_utc(),
+            mac: mac.map(str::to_string),
+            ip: Some("10.0.0.42".parse().unwrap()),
+            target_id: target.into(),
+            target_title: format!("{target}.iso"),
+        }
+    }
+
+    #[test]
+    fn record_then_list_is_newest_first() {
+        let dir = tempdir().unwrap();
+        let log = BootLog::load_or_default(dir.path());
+        assert!(log.is_empty());
+        log.record(&ev("alpha", Some("aa:bb:cc:00:00:01")));
+        log.record(&ev("beta", Some("aa:bb:cc:00:00:02")));
+        let list = log.list();
+        assert_eq!(list.len(), 2);
+        assert_eq!(list[0].target_id, "beta");
+        assert_eq!(list[1].target_id, "alpha");
+    }
+
+    #[test]
+    fn round_trip_through_disk() {
+        let dir = tempdir().unwrap();
+        let log = BootLog::load_or_default(dir.path());
+        log.record(&ev("alpha", Some("aa:bb:cc:00:00:01")));
+        log.record(&ev("beta", None));
+        drop(log);
+        let log2 = BootLog::load_or_default(dir.path());
+        assert_eq!(log2.len(), 2);
+        let list = log2.list();
+        assert_eq!(list[0].target_id, "beta");
+        assert_eq!(list[1].target_id, "alpha");
+        assert!(list[0].mac.is_none());
+        assert_eq!(list[1].mac.as_deref(), Some("aa:bb:cc:00:00:01"));
+    }
+
+    #[test]
+    fn ring_evicts_oldest_past_cap() {
+        let dir = tempdir().unwrap();
+        let log = BootLog::load_or_default(dir.path());
+        for i in 0..(BootLog::CAP + 5) {
+            log.record(&ev(&format!("e{i}"), None));
+        }
+        assert_eq!(log.len(), BootLog::CAP);
+        let list = log.list();
+        // Newest first; the most recent push is the last index inserted.
+        assert_eq!(list[0].target_id, format!("e{}", BootLog::CAP + 4));
+        // Oldest in-memory should be the 6th push (0..5 were evicted).
+        assert_eq!(list[BootLog::CAP - 1].target_id, "e5");
+    }
+
+    #[test]
+    fn clear_wipes_memory_and_disk() {
+        let dir = tempdir().unwrap();
+        let log = BootLog::load_or_default(dir.path());
+        log.record(&ev("alpha", None));
+        log.clear();
+        assert!(log.is_empty());
+        let log2 = BootLog::load_or_default(dir.path());
+        assert!(log2.is_empty());
+    }
+
+    #[test]
+    fn corrupt_disk_lines_are_skipped_not_fatal() {
+        // Write a file with one valid + one garbage line; loader should
+        // surface the valid one and skip the garbage.
+        let dir = tempdir().unwrap();
+        let path = dir.path().join("boot_log.jsonl");
+        let valid = serde_json::to_string(&ev("ok", Some("aa:bb:cc:00:00:09"))).unwrap();
+        std::fs::write(&path, format!("{valid}\nNOT_JSON\n{valid}\n")).unwrap();
+        let log = BootLog::load_or_default(dir.path());
+        assert_eq!(log.len(), 2);
+    }
+}

crates/core/src/boot_rules.rs

@@ -0,0 +1,369 @@
+//! Label-based boot rules + boot-decision webhook (v0.7.0).
+//!
+//! Generalizes [`crate::host_bindings::HostBindings`] (exact-MAC pins)
+//! into ordered, first-match-wins rules over what the boot chain knows
+//! about a client — MAC prefix (OUI or longer) and firmware
+//! architecture — plus an optional outbound webhook so external
+//! automation (CMDB, netbox, a shell script) can decide the boot target
+//! per machine, pixiecore-style.
+//!
+//! Decision order in the boot script handler, most-specific first:
+//!   1. exact per-MAC host binding (operator pin)
+//!   2. first matching enabled rule here
+//!   3. webhook, if configured (fail-open: timeout/error → menu)
+//!   4. interactive menu
+//!
+//! With no rules and no webhook configured the behavior is byte-for-byte
+//! what it was before this feature existed — no toggles to flip.
+//!
+//! Persisted to `<work_dir>/boot_rules.json` with the same "in-memory
+//! authoritative, disk is a crash cache, corruption falls back to empty"
+//! policy as the host bindings — a bad rules file must never block PXE.
+
+use crate::host_bindings::normalize_mac;
+use parking_lot::RwLock;
+use serde::{Deserialize, Serialize};
+use std::path::PathBuf;
+use std::sync::Arc;
+
+/// One ordered rule. All present (non-empty) selectors must match —
+/// empty selector fields match anything, so a rule with only `arch` set
+/// applies to every client of that architecture.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct BootRule {
+    /// Case-insensitive MAC prefix, `:`-separated (e.g. `dc:a6:32` for
+    /// an OUI, or longer). Empty = any MAC.
+    #[serde(default)]
+    pub mac_prefix: String,
+    /// Client architecture selector — matches `ClientArch::as_str()`
+    /// (`bios`, `uefi-x64`, `uefi-ia32`, `uefi-arm64`). Empty = any.
+    #[serde(default)]
+    pub arch: String,
+    /// Boot entry id (a `BootEntry::id`) or reserved menu name
+    /// (`_local`, `_queue`, …) to chain to when this rule matches.
+    /// May be empty for a rule that only pins a driver mode.
+    #[serde(default)]
+    pub target: String,
+    /// v0.7.1: optional first-boot binary pin — `""` (auto: let the
+    /// escalation ladder decide), `"firmware"`, `"builtin"`, or
+    /// `"shim"`. Lets an operator declare "this rack is all Secure
+    /// Boot → serve the signed chain immediately", skipping the
+    /// learn-by-failing walk entirely for known fleets.
+    #[serde(default)]
+    pub driver_mode: String,
+    /// Rules can be parked without deleting them.
+    #[serde(default = "default_true")]
+    pub enabled: bool,
+    /// Operator note shown in the UI (`"all Pi 4s"`, `"QA rack"`).
+    #[serde(default)]
+    pub note: String,
+}
+
+fn default_true() -> bool {
+    true
+}
+
+/// The whole persisted config: ordered rules + optional webhook.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(default)]
+pub struct BootRulesConfig {
+    pub rules: Vec<BootRule>,
+    /// Optional boot-decision webhook URL. When set, unmatched boots GET
+    /// `<url>?mac=<mac>&arch=<arch>` and a `200 {"target": "<id>"}`
+    /// reply chains to that target. Anything else (404, timeout, bad
+    /// JSON) falls through to the menu. Empty = disabled.
+    pub webhook_url: String,
+}
+
+/// Store for the rules config. Cheap to clone; locks held briefly.
+#[derive(Debug, Clone)]
+pub struct BootRulesStore {
+    path: Arc<PathBuf>,
+    inner: Arc<RwLock<BootRulesConfig>>,
+}
+
+impl BootRulesStore {
+    /// Load from `work_dir/boot_rules.json`, or start empty if absent /
+    /// unreadable.
+    #[must_use]
+    pub fn load_or_default(work_dir: &std::path::Path) -> Self {
+        let path = work_dir.join("boot_rules.json");
+        let inner = match std::fs::read_to_string(&path) {
+            Ok(text) => match serde_json::from_str::<BootRulesConfig>(&text) {
+                Ok(cfg) => cfg,
+                Err(e) => {
+                    tracing::warn!(
+                        target: "openpxe::boot_rules",
+                        "boot_rules.json present but unreadable ({e}); starting empty"
+                    );
+                    BootRulesConfig::default()
+                }
+            },
+            Err(_) => BootRulesConfig::default(),
+        };
+        Self {
+            path: Arc::new(path),
+            inner: Arc::new(RwLock::new(inner)),
+        }
+    }
+
+    /// Current config snapshot (for the API / UI).
+    #[must_use]
+    pub fn snapshot(&self) -> BootRulesConfig {
+        self.inner.read().clone()
+    }
+
+    /// Replace the whole config (the UI saves the full table at once —
+    /// rules are ordered, so partial updates would be ambiguous).
+    pub fn replace(&self, mut cfg: BootRulesConfig) {
+        for r in &mut cfg.rules {
+            r.mac_prefix = normalize_mac(&r.mac_prefix);
+            r.arch = r.arch.trim().to_ascii_lowercase();
+            r.target = r.target.trim().to_string();
+            r.driver_mode = r.driver_mode.trim().to_ascii_lowercase();
+            r.note = r.note.trim().to_string();
+        }
+        cfg.webhook_url = cfg.webhook_url.trim().to_string();
+        *self.inner.write() = cfg;
+        self.persist();
+    }
+
+    /// Webhook URL, when configured.
+    #[must_use]
+    pub fn webhook_url(&self) -> Option<String> {
+        let g = self.inner.read();
+        if g.webhook_url.is_empty() {
+            None
+        } else {
+            Some(g.webhook_url.clone())
+        }
+    }
+
+    /// First enabled rule matching `(mac, arch)`, in stored order.
+    /// `arch` is the `ClientArch::as_str()` form when the boot chain
+    /// passed one along, `None` otherwise (older chains).
+    #[must_use]
+    pub fn match_target(&self, mac: &str, arch: Option<&str>) -> Option<String> {
+        self.first_match(mac, arch, |r| {
+            (!r.target.is_empty()).then(|| r.target.clone())
+        })
+    }
+
+    /// v0.7.1: first enabled rule that pins a driver mode for `(mac,
+    /// arch)`. Consulted by the DHCP proxy *before* the automatic
+    /// escalation ladder — an operator who knows a rack is all Secure
+    /// Boot pins it to `shim` and those machines never walk the ladder.
+    /// Unknown mode strings are ignored (forward compatibility).
+    #[must_use]
+    pub fn driver_mode_hint(&self, mac: &str, arch: Option<&str>) -> Option<crate::DriverMode> {
+        self.first_match(mac, arch, |r| match r.driver_mode.as_str() {
+            "firmware" => Some(crate::DriverMode::Firmware),
+            "builtin" => Some(crate::DriverMode::Builtin),
+            "shim" => Some(crate::DriverMode::Shim),
+            _ => None,
+        })
+    }
+
+    /// Shared rule-matching walk: returns the first `extract` result from
+    /// an enabled rule whose selectors match. Rules that match but yield
+    /// `None` from `extract` (e.g. no target set, or no driver mode set)
+    /// don't stop the walk — target rules and mode-pin rules coexist.
+    fn first_match<T>(
+        &self,
+        mac: &str,
+        arch: Option<&str>,
+        extract: impl Fn(&BootRule) -> Option<T>,
+    ) -> Option<T> {
+        let mac = normalize_mac(mac);
+        let g = self.inner.read();
+        for r in &g.rules {
+            if !r.enabled {
+                continue;
+            }
+            if !r.mac_prefix.is_empty() && !mac.starts_with(r.mac_prefix.as_str()) {
+                continue;
+            }
+            if !r.arch.is_empty() {
+                // An arch-selective rule can only match when the chain
+                // told us the client's arch.
+                match arch {
+                    Some(a) if a.eq_ignore_ascii_case(&r.arch) => {}
+                    _ => continue,
+                }
+            }
+            if let Some(v) = extract(r) {
+                return Some(v);
+            }
+        }
+        None
+    }
+
+    fn persist(&self) {
+        let snap = self.inner.read().clone();
+        let body = match serde_json::to_vec_pretty(&snap) {
+            Ok(b) => b,
+            Err(e) => {
+                tracing::warn!(target: "openpxe::boot_rules", "serialize boot_rules.json: {e}");
+                return;
+            }
+        };
+        if let Some(parent) = self.path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        let tmp = self.path.with_extension("json.tmp");
+        if let Err(e) = std::fs::write(&tmp, body) {
+            tracing::warn!(target: "openpxe::boot_rules", "write boot_rules.json tmp: {e}");
+            return;
+        }
+        if let Err(e) = std::fs::rename(&tmp, self.path.as_path()) {
+            tracing::warn!(target: "openpxe::boot_rules", "rename boot_rules.json: {e}");
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::tempdir;
+
+    fn rule(mac_prefix: &str, arch: &str, target: &str) -> BootRule {
+        BootRule {
+            mac_prefix: mac_prefix.into(),
+            arch: arch.into(),
+            target: target.into(),
+            driver_mode: String::new(),
+            enabled: true,
+            note: String::new(),
+        }
+    }
+
+    #[test]
+    fn driver_mode_hint_pins_known_modes_and_ignores_unknown() {
+        let dir = tempdir().unwrap();
+        let s = BootRulesStore::load_or_default(dir.path());
+        let mut sb_rack = rule("aa:bb:cc", "", "");
+        sb_rack.driver_mode = "SHIM".into(); // normalized on replace
+        let mut weird = rule("11:22:33", "", "");
+        weird.driver_mode = "quantum".into(); // unknown → ignored
+        s.replace(BootRulesConfig {
+            rules: vec![sb_rack, weird],
+            webhook_url: String::new(),
+        });
+        assert_eq!(
+            s.driver_mode_hint("aa:bb:cc:00:00:01", None),
+            Some(crate::DriverMode::Shim)
+        );
+        assert_eq!(s.driver_mode_hint("11:22:33:00:00:01", None), None);
+        assert_eq!(s.driver_mode_hint("99:99:99:00:00:01", None), None);
+    }
+
+    #[test]
+    fn mode_pin_rule_does_not_shadow_later_target_rule() {
+        // A mode-only rule and a target rule can both apply to the same
+        // client: the mode pin must not consume the target walk.
+        let dir = tempdir().unwrap();
+        let s = BootRulesStore::load_or_default(dir.path());
+        let mut pin = rule("aa:bb", "", "");
+        pin.driver_mode = "builtin".into();
+        s.replace(BootRulesConfig {
+            rules: vec![pin, rule("aa:bb", "", "rack-image")],
+            webhook_url: String::new(),
+        });
+        assert_eq!(
+            s.driver_mode_hint("aa:bb:00:00:00:01", None),
+            Some(crate::DriverMode::Builtin)
+        );
+        assert_eq!(
+            s.match_target("aa:bb:00:00:00:01", None).as_deref(),
+            Some("rack-image")
+        );
+    }
+
+    #[test]
+    fn empty_config_matches_nothing() {
+        let dir = tempdir().unwrap();
+        let s = BootRulesStore::load_or_default(dir.path());
+        assert!(s
+            .match_target("aa:bb:cc:dd:ee:ff", Some("uefi-x64"))
+            .is_none());
+        assert!(s.webhook_url().is_none());
+    }
+
+    #[test]
+    fn first_match_wins_in_order() {
+        let dir = tempdir().unwrap();
+        let s = BootRulesStore::load_or_default(dir.path());
+        s.replace(BootRulesConfig {
+            rules: vec![
+                rule("aa:bb:cc", "", "rack-image"),
+                rule("", "", "catch-all"),
+            ],
+            webhook_url: String::new(),
+        });
+        assert_eq!(
+            s.match_target("AA-BB-CC-00-00-01", None).as_deref(),
+            Some("rack-image")
+        );
+        assert_eq!(
+            s.match_target("11:22:33:44:55:66", None).as_deref(),
+            Some("catch-all")
+        );
+    }
+
+    #[test]
+    fn arch_selector_requires_known_arch() {
+        let dir = tempdir().unwrap();
+        let s = BootRulesStore::load_or_default(dir.path());
+        s.replace(BootRulesConfig {
+            rules: vec![rule("", "uefi-arm64", "arm-image")],
+            webhook_url: String::new(),
+        });
+        assert_eq!(
+            s.match_target("aa:bb:cc:00:00:01", Some("uefi-arm64"))
+                .as_deref(),
+            Some("arm-image")
+        );
+        // Wrong arch, or arch unknown to the chain → no match.
+        assert!(s.match_target("aa:bb:cc:00:00:01", Some("bios")).is_none());
+        assert!(s.match_target("aa:bb:cc:00:00:01", None).is_none());
+    }
+
+    #[test]
+    fn disabled_rules_are_skipped() {
+        let dir = tempdir().unwrap();
+        let s = BootRulesStore::load_or_default(dir.path());
+        let mut r = rule("", "", "x");
+        r.enabled = false;
+        s.replace(BootRulesConfig {
+            rules: vec![r],
+            webhook_url: String::new(),
+        });
+        assert!(s.match_target("aa:bb:cc:00:00:01", None).is_none());
+    }
+
+    #[test]
+    fn config_round_trips_to_disk() {
+        let dir = tempdir().unwrap();
+        let s = BootRulesStore::load_or_default(dir.path());
+        s.replace(BootRulesConfig {
+            rules: vec![rule("DC-A6-32", "", "pi-image")],
+            webhook_url: "  http://automation/boot  ".into(),
+        });
+        drop(s);
+        let s2 = BootRulesStore::load_or_default(dir.path());
+        // Prefix was normalized on replace, webhook trimmed.
+        assert_eq!(
+            s2.match_target("dc:a6:32:01:02:03", None).as_deref(),
+            Some("pi-image")
+        );
+        assert_eq!(s2.webhook_url().as_deref(), Some("http://automation/boot"));
+    }
+
+    #[test]
+    fn corrupt_file_falls_back_to_empty() {
+        let dir = tempdir().unwrap();
+        std::fs::write(dir.path().join("boot_rules.json"), b"{nope").unwrap();
+        let s = BootRulesStore::load_or_default(dir.path());
+        assert!(s.snapshot().rules.is_empty());
+    }
+}

crates/core/src/boot_tokens.rs

@@ -0,0 +1,138 @@
+//! One-time(ish) access tokens for unattended answer files (v0.7.0).
+//!
+//! Why: answer files routinely embed credentials (local admin passwords,
+//! domain-join accounts, root hashes). Serving them to anyone who can
+//! GET `/unattended/<id>` is exactly the exposure that got WDS
+//! hands-free deployment disabled upstream (CVE-2026-0386 hardening
+//! guidance). OpenPXE generates every answer-file URL it injects into a
+//! boot chain, so it can scope each URL to the boot that requested it:
+//! when a boot script is rendered, a short-lived token is minted and
+//! appended; the serving endpoint requires it (or a logged-in operator
+//! session, so browser testing keeps working).
+//!
+//! Deliberately multi-use within the TTL rather than strictly one-shot:
+//! real installers fetch the same file more than once (initramfs +
+//! installer stage, cloud-init retries), and the token's job is to stop
+//! *unrelated* hosts from harvesting credentials, not to count fetches.
+//!
+//! In-memory only. A server restart invalidates outstanding tokens —
+//! acceptable because a restart also interrupts the ISO streaming an
+//! in-flight install depends on, and the next boot mints fresh ones.
+
+use parking_lot::Mutex;
+use std::collections::HashMap;
+use std::time::{Duration, Instant};
+use uuid::Uuid;
+
+/// Long enough to cover a slow OS install end-to-end (the answer file is
+/// fetched early, but cloud-init can re-read late), short enough that a
+/// leaked URL goes stale the same afternoon.
+const TOKEN_TTL: Duration = Duration::from_hours(4);
+
+/// Hard cap on outstanding tokens; past it the oldest is evicted. Tokens
+/// are minted once per boot-script render, so this only matters under
+/// abuse, and serving must never become a memory-growth vector.
+const MAX_TOKENS: usize = 4096;
+
+#[derive(Debug, Clone)]
+struct Grant {
+    file_id: String,
+    issued: Instant,
+}
+
+/// In-memory token table. Cheap to clone (`Arc`-shared).
+#[derive(Debug, Clone, Default)]
+pub struct BootTokens {
+    inner: std::sync::Arc<Mutex<HashMap<String, Grant>>>,
+}
+
+impl BootTokens {
+    #[must_use]
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Mint a token granting access to unattended file `file_id` for the
+    /// next [`TOKEN_TTL`]. Returns the opaque token value to embed in the
+    /// generated URL.
+    #[must_use]
+    pub fn mint(&self, file_id: &str) -> String {
+        self.mint_at(file_id, Instant::now())
+    }
+
+    /// Is `token` a live grant for `file_id`?
+    #[must_use]
+    pub fn check(&self, token: &str, file_id: &str) -> bool {
+        self.check_at(token, file_id, Instant::now())
+    }
+
+    fn mint_at(&self, file_id: &str, now: Instant) -> String {
+        let token = Uuid::new_v4().simple().to_string();
+        let mut g = self.inner.lock();
+        g.retain(|_, gr| now.duration_since(gr.issued) < TOKEN_TTL);
+        if g.len() >= MAX_TOKENS {
+            if let Some(oldest) = g
+                .iter()
+                .min_by_key(|(_, gr)| gr.issued)
+                .map(|(k, _)| k.clone())
+            {
+                g.remove(&oldest);
+            }
+        }
+        g.insert(
+            token.clone(),
+            Grant {
+                file_id: file_id.to_string(),
+                issued: now,
+            },
+        );
+        token
+    }
+
+    fn check_at(&self, token: &str, file_id: &str, now: Instant) -> bool {
+        let g = self.inner.lock();
+        g.get(token)
+            .is_some_and(|gr| gr.file_id == file_id && now.duration_since(gr.issued) < TOKEN_TTL)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn mint_then_check_round_trip() {
+        let t = BootTokens::new();
+        let tok = t.mint("ks-1");
+        assert!(t.check(&tok, "ks-1"));
+        // Multi-use within TTL: a second fetch still passes.
+        assert!(t.check(&tok, "ks-1"));
+        // Wrong file id never passes, even with a live token.
+        assert!(!t.check(&tok, "ks-2"));
+        // Unknown token never passes.
+        assert!(!t.check("nope", "ks-1"));
+    }
+
+    #[test]
+    fn token_expires_after_ttl() {
+        let t = BootTokens::new();
+        let now = Instant::now();
+        let tok = t.mint_at("ks-1", now);
+        let just_before = TOKEN_TTL.checked_sub(Duration::from_secs(1)).unwrap();
+        assert!(t.check_at(&tok, "ks-1", now + just_before));
+        assert!(!t.check_at(&tok, "ks-1", now + TOKEN_TTL + Duration::from_secs(1)));
+    }
+
+    #[test]
+    fn table_is_capped() {
+        let t = BootTokens::new();
+        let now = Instant::now();
+        let first = t.mint_at("f", now);
+        for i in 0..MAX_TOKENS {
+            let _ = t.mint_at(&format!("f{i}"), now + Duration::from_secs(1));
+        }
+        // The oldest grant was evicted to stay within the cap.
+        assert!(!t.check_at(&first, "f", now + Duration::from_secs(2)));
+        assert!(t.inner.lock().len() <= MAX_TOKENS);
+    }
+}

crates/core/src/branding.rs

@@ -0,0 +1,665 @@
+//! Operator-controlled branding overrides.
+//!
+//! v0.5.2 splits the single brand mark into **three independent slots**,
+//! FleetDM-style:
+//!
+//! * `light` — shown in the WebUI top-left and on the form-login page
+//!   when the active theme is light.
+//! * `dark` — same surfaces, when the active theme is dark.
+//! * `client` — the raster painted above the iPXE boot menu entries
+//!   (`/branding/pxe-logo`), i.e. what a PXE client sees on the screen.
+//!
+//! Each slot lives at `<work_dir>/branding/logo-<slot>.<ext>` and is
+//! served in preference to the bundled rainbow-horizon mark when present.
+//! Borrowed-from-FleetDM: tenant chrome, same product.
+//!
+//! Legacy continuity: a pre-v0.5.2 single `logo.<ext>` (recorded under
+//! the old `logo_filename`/`logo_mime` keys) is migrated on first load
+//! into both the `dark` and `client` slots — that preserves the previous
+//! behaviour (one mark fed both the dark WebUI and the PXE screen) until
+//! the operator uploads dedicated variants.
+//!
+//! Storage policy mirrors `HostBindings` / `BootLog`: in-memory cache is
+//! authoritative for the current process, disk is the source of truth on
+//! restart, and a corrupt cache file falls back to the bundled default
+//! rather than blocking startup.
+
+use parking_lot::RwLock;
+use serde::{Deserialize, Serialize};
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+
+/// Allowed MIME types for an uploaded logo. We deliberately keep this
+/// narrow — anything that can be `<img src="...">`'d into the brand
+/// block, no scripts. SVG carries the obvious XSS risk for raw inline
+/// HTML; we always serve the bytes as a separate asset with a strict
+/// content-type rather than inlining, so SVG is safe.
+pub const ALLOWED_LOGO_MIMES: &[&str] = &[
+    "image/svg+xml",
+    "image/png",
+    "image/jpeg",
+    "image/webp",
+    "image/gif",
+];
+
+/// Disk cap for an uploaded logo. PXE WebUIs are operator-facing — even
+/// a generous 2 MB cap is comfortable for any reasonable brand mark and
+/// puts a clear bound on memory + serialization cost.
+pub const MAX_LOGO_BYTES: usize = 2 * 1024 * 1024;
+
+/// Which branded surface a logo upload targets.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum LogoSlot {
+    /// WebUI + form-login page, light theme.
+    Light,
+    /// WebUI + form-login page, dark theme.
+    Dark,
+    /// iPXE boot-menu background seen by PXE clients.
+    Client,
+}
+
+impl LogoSlot {
+    #[must_use]
+    pub fn as_str(self) -> &'static str {
+        match self {
+            LogoSlot::Light => "light",
+            LogoSlot::Dark => "dark",
+            LogoSlot::Client => "client",
+        }
+    }
+
+    /// Parse a slot name from the URL path segment. Case-insensitive.
+    #[must_use]
+    pub fn parse(s: &str) -> Option<Self> {
+        match s.trim().to_ascii_lowercase().as_str() {
+            "light" => Some(LogoSlot::Light),
+            "dark" => Some(LogoSlot::Dark),
+            "client" => Some(LogoSlot::Client),
+            _ => None,
+        }
+    }
+}
+
+/// One brand-mark slot: a filename (relative to the branding dir) plus
+/// the MIME we cached at upload time so the HTTP layer can set the
+/// Content-Type without re-sniffing.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+struct Slot {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    filename: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    mime: Option<String>,
+}
+
+impl Slot {
+    fn clear_file(&mut self, dir: &Path) {
+        if let Some(name) = self.filename.take() {
+            let _ = std::fs::remove_file(dir.join(name));
+        }
+        self.mime = None;
+    }
+}
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+struct Inner {
+    #[serde(default)]
+    light: Slot,
+    #[serde(default)]
+    dark: Slot,
+    #[serde(default)]
+    client: Slot,
+    /// Monotonic counter bumped on every set/clear (any slot). Surfaces
+    /// as a cache-bust token (`/assets/logo.svg?r=<rev>`) so the browser
+    /// fetches the new bytes the moment the operator swaps a logo — the
+    /// app version alone can't do this since it doesn't change on upload.
+    /// Persisted so the token stays stable across restarts and keeps
+    /// climbing across multiple swaps.
+    #[serde(default)]
+    rev: u64,
+    // ── Legacy (pre-v0.5.2) single-logo keys ──────────────────────────
+    // Read on load for one-way migration into `dark` + `client`, then
+    // dropped from the persisted form (skip_serializing_if).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    logo_filename: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    logo_mime: Option<String>,
+}
+
+impl Inner {
+    fn slot(&self, slot: LogoSlot) -> &Slot {
+        match slot {
+            LogoSlot::Light => &self.light,
+            LogoSlot::Dark => &self.dark,
+            LogoSlot::Client => &self.client,
+        }
+    }
+
+    fn slot_mut(&mut self, slot: LogoSlot) -> &mut Slot {
+        match slot {
+            LogoSlot::Light => &mut self.light,
+            LogoSlot::Dark => &mut self.dark,
+            LogoSlot::Client => &mut self.client,
+        }
+    }
+}
+
+/// In-memory + on-disk override registry. Cheap to clone; locks are
+/// brief. The `branding.json` cache lives alongside the active assets
+/// inside `<work_dir>/branding/`.
+#[derive(Debug, Clone)]
+pub struct BrandingStore {
+    /// Root directory: `<work_dir>/branding/`. Created on first write.
+    dir: Arc<PathBuf>,
+    inner: Arc<RwLock<Inner>>,
+}
+
+impl BrandingStore {
+    /// Load (or initialise empty) from `<work_dir>/branding/`. Tolerates
+    /// missing directories, partial state, and corrupt JSON — a bad
+    /// cache should never block PXE for the network. Migrates a legacy
+    /// single-logo file into the dark + client slots.
+    #[must_use]
+    pub fn load_or_default(work_dir: &Path) -> Self {
+        let dir = work_dir.join("branding");
+        let path = dir.join("branding.json");
+        let mut inner = Inner::default();
+        if let Ok(text) = std::fs::read_to_string(&path) {
+            match serde_json::from_str::<Inner>(&text) {
+                Ok(parsed) => inner = parsed,
+                Err(e) => {
+                    tracing::warn!(
+                        target: "openpxe::branding",
+                        "branding.json present but unreadable ({e}); starting empty"
+                    );
+                }
+            }
+        }
+        let store = Self {
+            dir: Arc::new(dir),
+            inner: Arc::new(RwLock::new(inner)),
+        };
+        store.migrate_legacy();
+        store.prune_missing();
+        store
+    }
+
+    /// One-way migration: a pre-v0.5.2 `logo.<ext>` becomes the dark +
+    /// client slots (the old single mark fed both the dark WebUI and the
+    /// PXE screen). Best-effort; failures leave the legacy file in place
+    /// rather than blocking startup.
+    fn migrate_legacy(&self) {
+        let (legacy_name, legacy_mime) = {
+            let g = self.inner.read();
+            (g.logo_filename.clone(), g.logo_mime.clone())
+        };
+        let Some(name) = legacy_name else { return };
+        let src = self.dir.join(&name);
+        if !src.is_file() {
+            // Legacy pointer is stale — just drop it.
+            let mut g = self.inner.write();
+            g.logo_filename = None;
+            g.logo_mime = None;
+            drop(g);
+            self.persist();
+            return;
+        }
+        let mime = legacy_mime.unwrap_or_else(|| "image/svg+xml".to_string());
+        let ext = ext_for_mime(&mime).unwrap_or("bin");
+        if let Ok(bytes) = std::fs::read(&src) {
+            // Seed dark + client only when those slots are still empty so
+            // a re-run (or a manual edit) never clobbers operator intent.
+            let needs_dark = self.inner.read().dark.filename.is_none();
+            let needs_client = self.inner.read().client.filename.is_none();
+            if needs_dark {
+                let _ = self.write_slot(LogoSlot::Dark, &mime, ext, &bytes);
+            }
+            if needs_client {
+                let _ = self.write_slot(LogoSlot::Client, &mime, ext, &bytes);
+            }
+        }
+        let _ = std::fs::remove_file(&src);
+        {
+            let mut g = self.inner.write();
+            g.logo_filename = None;
+            g.logo_mime = None;
+        }
+        self.persist();
+        tracing::info!(
+            target: "openpxe::branding",
+            "migrated legacy single logo into dark + client slots"
+        );
+    }
+
+    /// Drop in-memory slot pointers whose backing file vanished from disk
+    /// so the HTTP layer falls back to the bundled mark instead of 500ing.
+    fn prune_missing(&self) {
+        let mut changed = false;
+        {
+            let mut g = self.inner.write();
+            for slot in [LogoSlot::Light, LogoSlot::Dark, LogoSlot::Client] {
+                let present = g
+                    .slot(slot)
+                    .filename
+                    .as_deref()
+                    .is_some_and(|n| self.dir.join(n).is_file());
+                if !present && g.slot(slot).filename.is_some() {
+                    g.slot_mut(slot).filename = None;
+                    g.slot_mut(slot).mime = None;
+                    changed = true;
+                }
+            }
+        }
+        if changed {
+            self.persist();
+        }
+    }
+
+    /// Absolute path to the logo for `slot`, if set and present on disk.
+    #[must_use]
+    pub fn slot_path(&self, slot: LogoSlot) -> Option<PathBuf> {
+        let g = self.inner.read();
+        g.slot(slot).filename.as_deref().map(|n| self.dir.join(n))
+    }
+
+    /// MIME of the logo for `slot`, if any.
+    #[must_use]
+    pub fn slot_mime(&self, slot: LogoSlot) -> Option<String> {
+        self.inner.read().slot(slot).mime.clone()
+    }
+
+    /// Resolve the WebUI logo for a theme, with fallback: light falls
+    /// back to dark and vice-versa, so a single uploaded variant still
+    /// shows on both themes. Returns `(path, mime)` or `None` (→ bundled).
+    #[must_use]
+    pub fn web_logo(&self, theme_is_light: bool) -> Option<(PathBuf, String)> {
+        let (primary, secondary) = if theme_is_light {
+            (LogoSlot::Light, LogoSlot::Dark)
+        } else {
+            (LogoSlot::Dark, LogoSlot::Light)
+        };
+        let g = self.inner.read();
+        let chosen = if g.slot(primary).filename.is_some() {
+            primary
+        } else {
+            secondary
+        };
+        let s = g.slot(chosen);
+        s.filename.as_deref().map(|n| {
+            (
+                self.dir.join(n),
+                s.mime
+                    .clone()
+                    .unwrap_or_else(|| "image/svg+xml".to_string()),
+            )
+        })
+    }
+
+    /// Resolve the PXE client logo (no theme fallback — the PXE screen
+    /// has a single mark). Returns `(path, mime)` or `None` (→ default
+    /// composed background).
+    #[must_use]
+    pub fn client_logo(&self) -> Option<(PathBuf, String)> {
+        let g = self.inner.read();
+        let s = &g.client;
+        s.filename.as_deref().map(|n| {
+            (
+                self.dir.join(n),
+                s.mime
+                    .clone()
+                    .unwrap_or_else(|| "application/octet-stream".to_string()),
+            )
+        })
+    }
+
+    /// Replace the logo for `slot`. Returns the chosen on-disk filename so
+    /// the caller can echo it back in the API response.
+    pub fn set_logo(
+        &self,
+        slot: LogoSlot,
+        mime: &str,
+        ext: &str,
+        bytes: &[u8],
+    ) -> std::io::Result<String> {
+        let filename = self.write_slot(slot, mime, ext, bytes)?;
+        self.persist();
+        tracing::info!(
+            target: "openpxe::branding",
+            slot = slot.as_str(), file = %filename, mime = %mime, size = bytes.len(),
+            "custom logo installed"
+        );
+        Ok(filename)
+    }
+
+    /// Write the bytes for a slot and update the in-memory pointer + rev,
+    /// without persisting (the caller decides when to flush). Cleans up
+    /// any sibling `logo-<slot>.*` so there's exactly one file per slot.
+    fn write_slot(
+        &self,
+        slot: LogoSlot,
+        mime: &str,
+        ext: &str,
+        bytes: &[u8],
+    ) -> std::io::Result<String> {
+        std::fs::create_dir_all(self.dir.as_path())?;
+        let safe_ext = sanitize_ext(ext);
+        let stem = format!("logo-{}", slot.as_str());
+        let filename = format!("{stem}.{safe_ext}");
+        let final_path = self.dir.join(&filename);
+        // Atomic write: tmp -> rename.
+        let tmp = final_path.with_extension(format!("{safe_ext}.tmp"));
+        std::fs::write(&tmp, bytes)?;
+        std::fs::rename(&tmp, &final_path)?;
+        // Clean up any sibling `logo-<slot>.<otherext>`.
+        if let Ok(entries) = std::fs::read_dir(self.dir.as_path()) {
+            for e in entries.flatten() {
+                let p = e.path();
+                let name = p.file_name().and_then(|s| s.to_str()).unwrap_or("");
+                if name.starts_with(&format!("{stem}.")) && name != filename {
+                    let _ = std::fs::remove_file(&p);
+                }
+            }
+        }
+        let mut g = self.inner.write();
+        let s = g.slot_mut(slot);
+        s.filename = Some(filename.clone());
+        s.mime = Some(mime.to_string());
+        g.rev = g.rev.wrapping_add(1);
+        Ok(filename)
+    }
+
+    /// Drop the override for `slot` and return to the bundled / default.
+    pub fn clear_logo(&self, slot: LogoSlot) -> std::io::Result<()> {
+        {
+            let mut g = self.inner.write();
+            let dir = self.dir.as_path();
+            g.slot_mut(slot).clear_file(dir);
+            g.rev = g.rev.wrapping_add(1);
+        }
+        self.persist();
+        tracing::info!(target: "openpxe::branding", slot = slot.as_str(), "custom logo cleared");
+        Ok(())
+    }
+
+    /// True if a custom logo is configured for `slot`.
+    #[must_use]
+    pub fn has_logo(&self, slot: LogoSlot) -> bool {
+        self.inner.read().slot(slot).filename.is_some()
+    }
+
+    /// True if either WebUI theme slot has a custom logo — drives the
+    /// FleetDM-style full-width brand block (and the `has-custom-logo`
+    /// class) on the sidebar + login page.
+    #[must_use]
+    pub fn has_any_web_logo(&self) -> bool {
+        let g = self.inner.read();
+        g.light.filename.is_some() || g.dark.filename.is_some()
+    }
+
+    /// Presence triple `(light, dark, client)` for the `/api/me` and
+    /// `/api/status` bootstrap payloads.
+    #[must_use]
+    pub fn presence(&self) -> (bool, bool, bool) {
+        let g = self.inner.read();
+        (
+            g.light.filename.is_some(),
+            g.dark.filename.is_some(),
+            g.client.filename.is_some(),
+        )
+    }
+
+    /// Cache-bust token for the logo asset URLs. Changes on every
+    /// set/clear so `/assets/logo.svg?r=<rev>` resolves to a fresh URL
+    /// whenever the operator swaps a brand mark. Stable otherwise.
+    #[must_use]
+    pub fn logo_rev(&self) -> u64 {
+        self.inner.read().rev
+    }
+
+    fn persist(&self) {
+        let snap = self.inner.read().clone();
+        let body = match serde_json::to_vec_pretty(&snap) {
+            Ok(b) => b,
+            Err(e) => {
+                tracing::warn!(target: "openpxe::branding", "serialize branding.json: {e}");
+                return;
+            }
+        };
+        if let Err(e) = std::fs::create_dir_all(self.dir.as_path()) {
+            tracing::warn!(target: "openpxe::branding", "mkdir branding/: {e}");
+            return;
+        }
+        let path = self.dir.join("branding.json");
+        let tmp = path.with_extension("json.tmp");
+        if let Err(e) = std::fs::write(&tmp, body) {
+            tracing::warn!(target: "openpxe::branding", "write branding.json tmp: {e}");
+            return;
+        }
+        if let Err(e) = std::fs::rename(&tmp, &path) {
+            tracing::warn!(target: "openpxe::branding", "rename branding.json: {e}");
+        }
+    }
+}
+
+/// Trim arbitrary operator-supplied extension strings to a small, safe
+/// alphanumeric form. Anything weird collapses to `bin`. We never let
+/// the extension affect the path beyond the final segment of `logo.<x>`.
+fn sanitize_ext(ext: &str) -> String {
+    let lc: String = ext
+        .chars()
+        .filter(char::is_ascii_alphanumeric)
+        .map(|c| c.to_ascii_lowercase())
+        .collect();
+    if lc.is_empty() || lc.len() > 5 {
+        "bin".into()
+    } else {
+        lc
+    }
+}
+
+/// Pick a safe filesystem extension from a MIME type. Returns `None`
+/// if the MIME isn't on the [`ALLOWED_LOGO_MIMES`] allowlist.
+#[must_use]
+pub fn ext_for_mime(mime: &str) -> Option<&'static str> {
+    match mime {
+        "image/svg+xml" => Some("svg"),
+        "image/png" => Some("png"),
+        "image/jpeg" => Some("jpg"),
+        "image/webp" => Some("webp"),
+        "image/gif" => Some("gif"),
+        _ => None,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::tempdir;
+
+    #[test]
+    fn empty_after_load_when_no_branding_dir() {
+        let dir = tempdir().unwrap();
+        let b = BrandingStore::load_or_default(dir.path());
+        assert!(!b.has_logo(LogoSlot::Light));
+        assert!(!b.has_logo(LogoSlot::Dark));
+        assert!(!b.has_logo(LogoSlot::Client));
+        assert!(b.web_logo(false).is_none());
+        assert!(b.client_logo().is_none());
+        assert!(!b.has_any_web_logo());
+    }
+
+    #[test]
+    fn set_clear_round_trip_persists() {
+        let dir = tempdir().unwrap();
+        let b = BrandingStore::load_or_default(dir.path());
+        let name = b
+            .set_logo(LogoSlot::Dark, "image/png", "png", b"\x89PNG\r\n\x1a\nfake")
+            .unwrap();
+        assert_eq!(name, "logo-dark.png");
+        assert!(b.has_logo(LogoSlot::Dark));
+        assert_eq!(b.slot_mime(LogoSlot::Dark).as_deref(), Some("image/png"));
+        let (p, _) = b.web_logo(false).unwrap();
+        assert!(p.is_file());
+
+        // Re-open and confirm the override survives a restart.
+        drop(b);
+        let b2 = BrandingStore::load_or_default(dir.path());
+        assert!(b2.has_logo(LogoSlot::Dark));
+        assert_eq!(b2.slot_mime(LogoSlot::Dark).as_deref(), Some("image/png"));
+
+        // Clear; the file goes away and has_logo flips off.
+        b2.clear_logo(LogoSlot::Dark).unwrap();
+        assert!(!b2.has_logo(LogoSlot::Dark));
+        assert!(!p.exists());
+    }
+
+    #[test]
+    fn web_logo_falls_back_across_themes() {
+        let dir = tempdir().unwrap();
+        let b = BrandingStore::load_or_default(dir.path());
+        // Only dark uploaded — light theme falls back to it.
+        b.set_logo(LogoSlot::Dark, "image/png", "png", b"dark")
+            .unwrap();
+        let (p_light, _) = b.web_logo(true).expect("light falls back to dark");
+        assert!(p_light.ends_with("logo-dark.png"));
+        // Upload a distinct light — now light theme uses its own.
+        b.set_logo(LogoSlot::Light, "image/png", "png", b"light")
+            .unwrap();
+        let (p_light2, _) = b.web_logo(true).unwrap();
+        assert!(p_light2.ends_with("logo-light.png"));
+        // Client is independent and still unset.
+        assert!(b.client_logo().is_none());
+    }
+
+    #[test]
+    fn replacing_slot_removes_old_extension_sibling() {
+        let dir = tempdir().unwrap();
+        let b = BrandingStore::load_or_default(dir.path());
+        b.set_logo(
+            LogoSlot::Client,
+            "image/png",
+            "png",
+            b"\x89PNG\r\n\x1a\nfake",
+        )
+        .unwrap();
+        b.set_logo(
+            LogoSlot::Client,
+            "image/svg+xml",
+            "svg",
+            br#"<svg xmlns="http://www.w3.org/2000/svg"/>"#,
+        )
+        .unwrap();
+        let entries: Vec<_> = std::fs::read_dir(dir.path().join("branding"))
+            .unwrap()
+            .filter_map(|e| e.ok().map(|e| e.file_name().to_string_lossy().into_owned()))
+            .collect();
+        assert!(
+            entries.iter().any(|n| n == "logo-client.svg"),
+            "got {entries:?}"
+        );
+        assert!(
+            !entries.iter().any(|n| n == "logo-client.png"),
+            "stale PNG left over: {entries:?}"
+        );
+    }
+
+    #[test]
+    fn logo_rev_bumps_on_each_set_and_clear() {
+        let dir = tempdir().unwrap();
+        let b = BrandingStore::load_or_default(dir.path());
+        assert_eq!(b.logo_rev(), 0);
+        b.set_logo(LogoSlot::Light, "image/png", "png", b"a")
+            .unwrap();
+        assert_eq!(b.logo_rev(), 1);
+        b.set_logo(LogoSlot::Dark, "image/png", "png", b"b")
+            .unwrap();
+        assert_eq!(b.logo_rev(), 2);
+        b.clear_logo(LogoSlot::Light).unwrap();
+        assert_eq!(b.logo_rev(), 3);
+        drop(b);
+        let b2 = BrandingStore::load_or_default(dir.path());
+        assert_eq!(b2.logo_rev(), 3);
+    }
+
+    #[test]
+    fn legacy_single_logo_migrates_to_dark_and_client() {
+        // A pre-v0.5.2 branding.json + logo.png migrates on load.
+        let dir = tempdir().unwrap();
+        let brand_dir = dir.path().join("branding");
+        std::fs::create_dir_all(&brand_dir).unwrap();
+        std::fs::write(brand_dir.join("logo.png"), b"\x89PNG\r\n\x1a\nlegacy").unwrap();
+        // Hand-write the old shape (logo_filename/logo_mime, no slots).
+        std::fs::write(
+            brand_dir.join("branding.json"),
+            br#"{"logo_filename":"logo.png","logo_mime":"image/png","rev":4}"#,
+        )
+        .unwrap();
+        let b = BrandingStore::load_or_default(dir.path());
+        assert!(b.has_logo(LogoSlot::Dark), "dark seeded from legacy");
+        assert!(b.has_logo(LogoSlot::Client), "client seeded from legacy");
+        assert!(!b.has_logo(LogoSlot::Light), "light stays empty");
+        // The old logo.png is gone; per-slot files exist.
+        assert!(!brand_dir.join("logo.png").exists());
+        assert!(brand_dir.join("logo-dark.png").is_file());
+        assert!(brand_dir.join("logo-client.png").is_file());
+        // rev carried over from the legacy file and advanced as the two
+        // slots were seeded (each write bumps it), so it never regresses.
+        let migrated_rev = b.logo_rev();
+        assert!(
+            migrated_rev >= 4,
+            "rev should not regress below legacy: {migrated_rev}"
+        );
+        // And the migration is sticky across a restart (no re-migrate, no
+        // further rev churn).
+        drop(b);
+        let b2 = BrandingStore::load_or_default(dir.path());
+        assert!(b2.has_logo(LogoSlot::Dark));
+        assert!(b2.has_logo(LogoSlot::Client));
+        assert!(!b2.has_logo(LogoSlot::Light));
+        assert_eq!(b2.logo_rev(), migrated_rev, "restart must not re-migrate");
+    }
+
+    #[test]
+    fn sanitize_ext_strips_separators_and_path_chars() {
+        assert_eq!(sanitize_ext("svg"), "svg");
+        assert_eq!(sanitize_ext("../etc/passwd"), "bin");
+        assert_eq!(sanitize_ext("../svg"), "svg");
+        assert_eq!(sanitize_ext(""), "bin");
+        assert_eq!(sanitize_ext("PNG"), "png");
+        assert_eq!(sanitize_ext("svgvvvv"), "bin");
+    }
+
+    #[test]
+    fn missing_file_referenced_by_json_resolves_to_empty() {
+        let dir = tempdir().unwrap();
+        let brand_dir = dir.path().join("branding");
+        std::fs::create_dir_all(&brand_dir).unwrap();
+        // branding.json claims a dark slot whose file doesn't exist.
+        std::fs::write(
+            brand_dir.join("branding.json"),
+            br#"{"dark":{"filename":"logo-dark.png","mime":"image/png"},"rev":1}"#,
+        )
+        .unwrap();
+        let b = BrandingStore::load_or_default(dir.path());
+        assert!(
+            !b.has_logo(LogoSlot::Dark),
+            "should fall back when referenced file is missing"
+        );
+    }
+
+    #[test]
+    fn slot_parse_round_trips() {
+        assert_eq!(LogoSlot::parse("light"), Some(LogoSlot::Light));
+        assert_eq!(LogoSlot::parse("DARK"), Some(LogoSlot::Dark));
+        assert_eq!(LogoSlot::parse(" client "), Some(LogoSlot::Client));
+        assert_eq!(LogoSlot::parse("nope"), None);
+        assert_eq!(LogoSlot::Light.as_str(), "light");
+    }
+
+    #[test]
+    fn ext_for_mime_only_accepts_known_types() {
+        assert_eq!(ext_for_mime("image/png"), Some("png"));
+        assert_eq!(ext_for_mime("image/svg+xml"), Some("svg"));
+        assert_eq!(ext_for_mime("application/octet-stream"), None);
+        assert_eq!(ext_for_mime("text/html"), None);
+    }
+}

crates/core/src/client.rs

@@ -12,11 +12,9 @@ use time::OffsetDateTime;
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub enum ClientEvent {
     DhcpDiscover,
-    DhcpRequest,
     PxeBootServerRequest,
     TftpRead { file: String },
     HttpScriptFetch { target: String },
-    HttpIsoAsset { file: String },
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -32,8 +30,6 @@ pub struct ClientSnapshot {
     // Events are left with default serialization (9-tuple) — they're
     // diagnostic only and not consumed by the UI today.
     pub events: Vec<(OffsetDateTime, ClientEvent)>,
-    /// The boot target (ISO id) last selected via the iPXE menu, if any.
-    pub selected_target: Option<String>,
 }
 
 #[derive(Debug, Default)]
@@ -56,19 +52,24 @@ impl ClientRegistry {
     ) {
         let mut guard = self.inner.write();
         let now = OffsetDateTime::now_utc();
-        let entry = guard.entry(mac.to_string()).or_insert_with(|| ClientSnapshot {
+        let entry = guard
-            mac: mac.to_string(),
+            .entry(mac.to_string())
-            last_ip: ip,
+            .or_insert_with(|| ClientSnapshot {
-            arch,
+                mac: mac.to_string(),
-            hostname: None,
+                last_ip: ip,
-            first_seen: now,
+                arch,
-            last_seen: now,
+                hostname: None,
-            events: Vec::new(),
+                first_seen: now,
-            selected_target: None,
+                last_seen: now,
-        });
+                events: Vec::new(),
+            });
         entry.last_seen = now;
-        if ip.is_some() { entry.last_ip = ip; }
+        if ip.is_some() {
-        if arch.is_some() { entry.arch = arch; }
+            entry.last_ip = ip;
+        }
+        if arch.is_some() {
+            entry.arch = arch;
+        }
         entry.events.push((now, event));
         // Cap event history per client to keep memory bounded.
         const MAX_EVENTS: usize = 64;
@@ -78,13 +79,6 @@ impl ClientRegistry {
         }
     }
 
-    pub fn set_selected_target(&self, mac: &str, target: Option<String>) {
-        let mut guard = self.inner.write();
-        if let Some(c) = guard.get_mut(mac) {
-            c.selected_target = target;
-        }
-    }
-
     #[must_use]
     pub fn list(&self) -> Vec<ClientSnapshot> {
         let guard = self.inner.read();
@@ -93,9 +87,4 @@ impl ClientRegistry {
         v.sort_by_key(|c| std::cmp::Reverse(c.last_seen));
         v
     }
-
-    #[must_use]
-    pub fn get(&self, mac: &str) -> Option<ClientSnapshot> {
-        self.inner.read().get(mac).cloned()
-    }
 }

crates/core/src/config.rs

@@ -1,3 +1,5 @@
+use figment::providers::{Env, Format, Serialized, Toml};
+use figment::Figment;
 use serde::{Deserialize, Serialize};
 use std::net::{IpAddr, Ipv4Addr};
 use std::path::{Path, PathBuf};
@@ -38,10 +40,6 @@ pub struct NetworkConfig {
     pub dhcp_port: u16,
     /// UDP port for PXE Boot Server discovery. Standard is 4011.
     pub pxe_port: u16,
-    /// Optional allowlist of client MAC prefixes (OUI). Empty = serve everyone.
-    pub mac_allowlist: Vec<String>,
-    /// Optional allowlist of subnets (CIDR). Empty = serve everyone.
-    pub subnet_allowlist: Vec<String>,
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, Default)]
@@ -56,6 +54,9 @@ pub enum DhcpMode {
     /// Disabled — rely on an external DHCP server that has been manually
     /// configured with `next-server` / `filename`. OpenPXE only serves TFTP
     /// + HTTP in this mode. Useful for home routers that can be pre-set.
+    // `off`/`none` are accepted as aliases for backward-compat with the old
+    // hand-rolled `apply_env`, which mapped them to Disabled.
+    #[serde(alias = "off", alias = "none")]
     Disabled,
 }
 
@@ -68,12 +69,17 @@ pub struct Paths {
     pub work_dir: PathBuf,
     /// Directory containing bundled iPXE binaries (undionly.kpxe, snponly.efi, ...).
     pub ipxe_dir: PathBuf,
-    /// Path to the wimboot binary for Windows ISOs (optional — feature-gated).
+    /// Path to the wimboot binary for Windows ISOs (optional — feature-controlled).
     pub wimboot_path: Option<PathBuf>,
     /// Directory under which Windows ISOs are extracted and served via SMB.
     /// Only used when `settings.windows_enabled = true`. Defaults to
     /// `/var/lib/openpxe/smb` in the container image.
     pub smb_dir: PathBuf,
+    /// v0.5.2: directory holding uploaded unattended-install answer files
+    /// (Kickstart / Preseed / Autoinstall / Windows answer files). Kept
+    /// separate from `iso_dir` so answer files never appear in the ISO
+    /// listing or the PXE menu. Defaults to `/var/lib/openpxe/unattended`.
+    pub unattended_dir: PathBuf,
 }
 
 impl Default for ServerConfig {
@@ -95,8 +101,6 @@ impl Default for NetworkConfig {
             dhcp_bind: IpAddr::V4(Ipv4Addr::UNSPECIFIED),
             dhcp_port: 67,
             pxe_port: 4011,
-            mac_allowlist: Vec::new(),
-            subnet_allowlist: Vec::new(),
         }
     }
 }
@@ -109,6 +113,7 @@ impl Default for Paths {
             ipxe_dir: PathBuf::from("/usr/share/openpxe/ipxe"),
             wimboot_path: None,
             smb_dir: PathBuf::from("/var/lib/openpxe/smb"),
+            unattended_dir: PathBuf::from("/var/lib/openpxe/unattended"),
         }
     }
 }
@@ -123,40 +128,162 @@ impl Config {
         toml::from_str(&text).map_err(|e| crate::Error::Config(e.to_string()))
     }
 
-    /// Apply environment variable overrides. Env var names follow the pattern
+    /// Load configuration with layered precedence (v0.5.4, via `figment`):
-    /// `OPENPXE_<SECTION>_<FIELD>`, uppercase. Unknown vars are ignored.
+    /// built-in [`Default`] → optional TOML file → `OPENPXE_*` environment
-    /// Call this after loading the TOML file so env takes precedence.
+    /// (highest). Replaces the old `from_toml_file` + `apply_env` two-step
-    pub fn apply_env(&mut self) {
+    /// and now covers **every** field automatically (the previous hand-rolled
-        if let Ok(v) = std::env::var("OPENPXE_HTTP_PORT") {
+    /// mapping silently skipped `unattended_dir`, the bind addresses, etc.).
-            if let Ok(p) = v.parse() { self.server.http_port = p; }
+    ///
-        }
+    /// The env layer preserves the historical flat names
-        if let Ok(v) = std::env::var("OPENPXE_TFTP_PORT") {
+    /// (`OPENPXE_HTTP_PORT`, `OPENPXE_ISO_DIR`, …) so existing deployments
-            if let Ok(p) = v.parse() { self.server.tftp_port = p; }
+    /// (the Unraid template, `entrypoint.sh`) keep working unchanged, and
-        }
+    /// additionally accepts the explicit nested form
-        if let Ok(v) = std::env::var("OPENPXE_DHCP_PORT") {
+    /// `OPENPXE_<SECTION>__<FIELD>` (double underscore).
-            if let Ok(p) = v.parse() { self.network.dhcp_port = p; }
+    pub fn load(path: Option<&Path>) -> crate::Result<Self> {
-        }
+        let mut fig = Figment::from(Serialized::defaults(Config::default()));
-        if let Ok(v) = std::env::var("OPENPXE_PUBLIC_IP") {
+        if let Some(p) = path {
-            if let Ok(ip) = v.parse() { self.server.public_ip = Some(ip); }
+            if p.exists() {
-        }
+                fig = fig.merge(Toml::file(p));
-        if let Ok(v) = std::env::var("OPENPXE_DHCP_MODE") {
+            }
-            self.network.dhcp_mode = match v.to_ascii_lowercase().as_str() {
-                "proxy" => DhcpMode::Proxy,
-                "disabled" | "off" | "none" => DhcpMode::Disabled,
-                _ => self.network.dhcp_mode,
-            };
-        }
-        if let Ok(v) = std::env::var("OPENPXE_ISO_DIR") {
-            self.paths.iso_dir = PathBuf::from(v);
-        }
-        if let Ok(v) = std::env::var("OPENPXE_WORK_DIR") {
-            self.paths.work_dir = PathBuf::from(v);
-        }
-        if let Ok(v) = std::env::var("OPENPXE_IPXE_DIR") {
-            self.paths.ipxe_dir = PathBuf::from(v);
-        }
-        if let Ok(v) = std::env::var("OPENPXE_SMB_DIR") {
-            self.paths.smb_dir = PathBuf::from(v);
         }
+        fig = fig.merge(env_provider());
+        fig.extract()
+            .map_err(|e| crate::Error::Config(e.to_string()))
+    }
+}
+
+/// The `OPENPXE_*` environment provider. Maps the historical flat variable
+/// names onto the nested [`Config`] fields, and also accepts the explicit
+/// `OPENPXE_SECTION__FIELD` nested form. Keys that match nothing (e.g.
+/// `OPENPXE_CONFIG`, `OPENPXE_UID` from the entrypoint) become stray
+/// top-level keys that `Config` ignores on extract.
+fn env_provider() -> Env {
+    Env::prefixed("OPENPXE_")
+        .map(|key| {
+            // Lowercase so the match is robust regardless of how the OS
+            // reports the var's case.
+            let k = key.as_str().to_ascii_lowercase();
+            let mapped = match k.as_str() {
+                "http_port" => "server.http_port",
+                "http_bind" => "server.http_bind",
+                "tftp_port" => "server.tftp_port",
+                "tftp_bind" => "server.tftp_bind",
+                "public_ip" => "server.public_ip",
+                "dhcp_port" => "network.dhcp_port",
+                "dhcp_bind" => "network.dhcp_bind",
+                "dhcp_mode" => "network.dhcp_mode",
+                "pxe_port" => "network.pxe_port",
+                "iso_dir" => "paths.iso_dir",
+                "work_dir" => "paths.work_dir",
+                "ipxe_dir" => "paths.ipxe_dir",
+                "smb_dir" => "paths.smb_dir",
+                "wimboot_path" => "paths.wimboot_path",
+                "unattended_dir" => "paths.unattended_dir",
+                // Unknown: support the explicit nested form
+                // (OPENPXE_SERVER__HTTP_PORT). `replace` is a no-op for the
+                // already-handled flat names above.
+                other => return other.replace("__", ".").into(),
+            };
+            mapped.into()
+        })
+        .split(".")
+}
+
+#[cfg(test)]
+mod tests {
+    // figment's `Jail::expect_with` closure returns `Result<(), figment::Error>`
+    // and `figment::Error` is large; that's the library's API, not ours.
+    #![allow(clippy::result_large_err)]
+    use super::*;
+
+    #[test]
+    fn defaults_load_when_no_file_or_env() {
+        figment::Jail::expect_with(|_jail| {
+            let c = Config::load(None).expect("load defaults");
+            assert_eq!(c.server.http_port, 80);
+            assert_eq!(c.network.dhcp_mode, DhcpMode::Proxy);
+            assert_eq!(c.paths.iso_dir, PathBuf::from("/var/lib/openpxe/isos"));
+            Ok(())
+        });
+    }
+
+    #[test]
+    fn legacy_flat_env_vars_still_apply() {
+        figment::Jail::expect_with(|jail| {
+            jail.set_env("OPENPXE_HTTP_PORT", "8123");
+            jail.set_env("OPENPXE_TFTP_PORT", "6900");
+            jail.set_env("OPENPXE_DHCP_PORT", "6767");
+            jail.set_env("OPENPXE_PXE_PORT", "4444");
+            jail.set_env("OPENPXE_PUBLIC_IP", "10.20.30.40");
+            jail.set_env("OPENPXE_DHCP_MODE", "disabled");
+            jail.set_env("OPENPXE_ISO_DIR", "/data/isos");
+            jail.set_env("OPENPXE_WORK_DIR", "/data/work");
+            jail.set_env("OPENPXE_IPXE_DIR", "/data/ipxe");
+            jail.set_env("OPENPXE_SMB_DIR", "/data/smb");
+            // v0.5.4: a field the old apply_env never covered.
+            jail.set_env("OPENPXE_UNATTENDED_DIR", "/data/unattended");
+            let c = Config::load(None).expect("load with env");
+            assert_eq!(c.server.http_port, 8123);
+            assert_eq!(c.server.tftp_port, 6900);
+            assert_eq!(c.network.dhcp_port, 6767);
+            assert_eq!(c.network.pxe_port, 4444);
+            assert_eq!(c.server.public_ip, Some("10.20.30.40".parse().unwrap()));
+            assert_eq!(c.network.dhcp_mode, DhcpMode::Disabled);
+            assert_eq!(c.paths.iso_dir, PathBuf::from("/data/isos"));
+            assert_eq!(c.paths.work_dir, PathBuf::from("/data/work"));
+            assert_eq!(c.paths.ipxe_dir, PathBuf::from("/data/ipxe"));
+            assert_eq!(c.paths.smb_dir, PathBuf::from("/data/smb"));
+            assert_eq!(c.paths.unattended_dir, PathBuf::from("/data/unattended"));
+            Ok(())
+        });
+    }
+
+    #[test]
+    fn dhcp_mode_off_alias_maps_to_disabled() {
+        figment::Jail::expect_with(|jail| {
+            jail.set_env("OPENPXE_DHCP_MODE", "off");
+            let c = Config::load(None).unwrap();
+            assert_eq!(c.network.dhcp_mode, DhcpMode::Disabled);
+            Ok(())
+        });
+    }
+
+    #[test]
+    fn nested_double_underscore_form_also_works() {
+        figment::Jail::expect_with(|jail| {
+            jail.set_env("OPENPXE_SERVER__HTTP_PORT", "9001");
+            let c = Config::load(None).unwrap();
+            assert_eq!(c.server.http_port, 9001);
+            Ok(())
+        });
+    }
+
+    #[test]
+    fn env_overrides_toml_file() {
+        figment::Jail::expect_with(|jail| {
+            jail.create_file(
+                "openpxe.toml",
+                "[server]\nhttp_port = 8080\n[paths]\niso_dir = \"/from/toml\"\n",
+            )?;
+            jail.set_env("OPENPXE_HTTP_PORT", "8443");
+            let c = Config::load(Some(Path::new("openpxe.toml"))).unwrap();
+            // env wins over TOML…
+            assert_eq!(c.server.http_port, 8443);
+            // …but TOML-only values still apply.
+            assert_eq!(c.paths.iso_dir, PathBuf::from("/from/toml"));
+            Ok(())
+        });
+    }
+
+    #[test]
+    fn unrelated_openpxe_env_vars_are_ignored() {
+        figment::Jail::expect_with(|jail| {
+            // entrypoint.sh sets these; they must not break config load.
+            jail.set_env("OPENPXE_UID", "10001");
+            jail.set_env("OPENPXE_CONFIG", "/etc/openpxe.toml");
+            let c = Config::load(None).expect("stray vars ignored");
+            assert_eq!(c.server.http_port, 80);
+            Ok(())
+        });
     }
 }

crates/core/src/encoding.rs

@@ -0,0 +1,65 @@
+//! Small, dependency-free encoding helpers shared across crates.
+//!
+//! v0.5.4: `pct_encode` and `xml_escape` were duplicated in the SAML
+//! modules and the HTTP layer; they live here now. They're deliberately
+//! hand-rolled rather than pulling in `percent-encoding` / `url`: the
+//! unreserved set below is exactly the RFC 3986 set that iPXE's
+//! `:uristring` modifier and the SAML HTTP-Redirect binding both expect,
+//! and a general-purpose URL crate escapes a different set.
+
+use std::fmt::Write as _;
+
+/// Percent-encode `s` per RFC 3986: the unreserved set
+/// (`A-Z` `a-z` `0-9` `-` `_` `.` `~`) passes through unchanged; every
+/// other byte becomes `%XX` (uppercase hex).
+#[must_use]
+pub fn pct_encode(s: &str) -> String {
+    let mut out = String::with_capacity(s.len());
+    for b in s.bytes() {
+        match b {
+            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => {
+                out.push(b as char);
+            }
+            _ => {
+                let _ = write!(out, "%{b:02X}");
+            }
+        }
+    }
+    out
+}
+
+/// Escape the five XML predefined entities so `s` is safe inside element
+/// text or a double-quoted attribute value.
+#[must_use]
+pub fn xml_escape(s: &str) -> String {
+    let mut out = String::with_capacity(s.len());
+    for c in s.chars() {
+        match c {
+            '&' => out.push_str("&"),
+            '<' => out.push_str("&lt;"),
+            '>' => out.push_str("&gt;"),
+            '"' => out.push_str("&quot;"),
+            '\'' => out.push_str("&apos;"),
+            _ => out.push(c),
+        }
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn pct_encode_unreserved_passthrough_else_hex() {
+        assert_eq!(pct_encode("node-7.lab_1~"), "node-7.lab_1~");
+        assert_eq!(pct_encode("aa:bb cc/?&="), "aa%3Abb%20cc%2F%3F%26%3D");
+        assert_eq!(pct_encode(""), "");
+    }
+
+    #[test]
+    fn xml_escape_all_five_entities() {
+        assert_eq!(xml_escape("a&b<c>\"d'e"), "a&amp;b&lt;c&gt;&quot;d&apos;e");
+        assert_eq!(xml_escape("plain text"), "plain text");
+    }
+}

crates/core/src/host_bindings.rs

@@ -1,10 +1,9 @@
 //! Per-MAC host bindings.
 //!
-//! Inspired by the Tinkerbell `smee` "MAC-prepended URL" pattern: an
+//! Operators can attach a preferred boot target (a `BootEntry::id`) to a
-//! operator can attach a preferred boot target (a `BootEntry::id`) to a
+//! specific MAC address. When a client with that MAC arrives, the top-level
-//! specific MAC address. When a client with that MAC arrives, the
+//! boot script chains straight to that target instead of showing the
-//! top-level boot script chains straight to that target instead of
+//! interactive menu.
-//! showing the interactive menu.
 //!
 //! Use cases:
 //! - "This rack of Dell servers always images with Ubuntu Server 24.04"
@@ -22,6 +21,8 @@ use std::path::PathBuf;
 use std::sync::Arc;
 use time::OffsetDateTime;
 
+use crate::profile::DeployProfile;
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct HostBinding {
     /// Lowercase, colon-separated MAC (e.g. `aa:bb:cc:dd:ee:ff`). The
@@ -29,13 +30,18 @@ pub struct HostBinding {
     /// don't have to worry about case.
     pub mac: String,
     /// Preferred boot entry id (matches a `BootEntry::id` in the iso
-    /// store) OR one of the reserved menu names: `_local`, `_gate`,
+    /// store) OR one of the reserved menu names: `_local`, `_queue`,
     /// `_tools_menu`. Empty string falls back to the menu.
     pub target: String,
     /// Optional human-readable label shown in the UI (`"Tom's laptop"`,
     /// `"rack-3 spine"`). Empty if unset.
     #[serde(default)]
     pub label: String,
+    /// v0.5.2: optional unattended-install hints (auto hostname / IP /
+    /// answer-file id). Flattened into the binding JSON so pre-v0.5.2
+    /// `hosts.json` files (which lack these keys) still deserialize.
+    #[serde(default, flatten)]
+    pub profile: DeployProfile,
     #[serde(with = "time::serde::rfc3339")]
     pub created_at: OffsetDateTime,
     #[serde(with = "time::serde::rfc3339")]
@@ -95,20 +101,31 @@ impl HostBindings {
     }
 
     /// Insert or update. Returns the resulting binding (with timestamps).
-    pub fn upsert(&self, mac: &str, target: &str, label: &str) -> HostBinding {
+    /// The `profile` carries optional unattended-install hints (v0.5.2);
+    /// pass `DeployProfile::default()` for a plain pin.
+    pub fn upsert(
+        &self,
+        mac: &str,
+        target: &str,
+        label: &str,
+        profile: DeployProfile,
+    ) -> HostBinding {
         let key = normalize_mac(mac);
         let now = OffsetDateTime::now_utc();
+        let profile = profile.normalized();
         let binding = {
             let mut g = self.inner.write();
             let entry = g.by_mac.entry(key.clone()).or_insert_with(|| HostBinding {
                 mac: key.clone(),
                 target: target.to_string(),
                 label: label.to_string(),
+                profile: profile.clone(),
                 created_at: now,
                 updated_at: now,
             });
             entry.target = target.to_string();
             entry.label = label.to_string();
+            entry.profile = profile.clone();
             entry.updated_at = now;
             entry.clone()
         };
@@ -180,6 +197,10 @@ mod tests {
     use super::*;
     use tempfile::tempdir;
 
+    fn np() -> DeployProfile {
+        DeployProfile::default()
+    }
+
     #[test]
     fn normalize_handles_case_and_dashes() {
         assert_eq!(normalize_mac("AA:BB:CC:DD:EE:FF"), "aa:bb:cc:dd:ee:ff");
@@ -192,7 +213,12 @@ mod tests {
         let dir = tempdir().unwrap();
         let h = HostBindings::load_or_default(dir.path());
         assert!(h.is_empty());
-        h.upsert("AA:BB:CC:00:00:01", "ubuntu-24-04-linux", "rack-3 spine");
+        h.upsert(
+            "AA:BB:CC:00:00:01",
+            "ubuntu-24-04-linux",
+            "rack-3 spine",
+            np(),
+        );
         let found = h.lookup("aa-bb-cc-00-00-01").expect("lookup");
         assert_eq!(found.target, "ubuntu-24-04-linux");
         assert_eq!(found.label, "rack-3 spine");
@@ -203,8 +229,8 @@ mod tests {
     fn upsert_replaces_existing_target() {
         let dir = tempdir().unwrap();
         let h = HostBindings::load_or_default(dir.path());
-        h.upsert("aa:bb:cc:00:00:01", "old-target", "label1");
+        h.upsert("aa:bb:cc:00:00:01", "old-target", "label1", np());
-        h.upsert("aa:bb:cc:00:00:01", "new-target", "label2");
+        h.upsert("aa:bb:cc:00:00:01", "new-target", "label2", np());
         assert_eq!(h.len(), 1);
         let b = h.lookup("aa:bb:cc:00:00:01").unwrap();
         assert_eq!(b.target, "new-target");
@@ -215,7 +241,7 @@ mod tests {
     fn remove_works_and_reports_outcome() {
         let dir = tempdir().unwrap();
         let h = HostBindings::load_or_default(dir.path());
-        h.upsert("aa:bb:cc:00:00:01", "x", "");
+        h.upsert("aa:bb:cc:00:00:01", "x", "", np());
         assert!(h.remove("AA:BB:CC:00:00:01"));
         assert!(!h.remove("aa:bb:cc:00:00:01")); // already gone
         assert!(h.is_empty());
@@ -225,11 +251,44 @@ mod tests {
     fn round_trip_persists_to_disk() {
         let dir = tempdir().unwrap();
         let h = HostBindings::load_or_default(dir.path());
-        h.upsert("aa:bb:cc:00:00:01", "ubuntu-linux", "rack-3");
+        h.upsert("aa:bb:cc:00:00:01", "ubuntu-linux", "rack-3", np());
-        h.upsert("aa:bb:cc:00:00:02", "_local", "tom-laptop");
+        h.upsert("aa:bb:cc:00:00:02", "_local", "tom-laptop", np());
         drop(h);
         let h2 = HostBindings::load_or_default(dir.path());
         assert_eq!(h2.len(), 2);
         assert_eq!(h2.lookup("aa:bb:cc:00:00:02").unwrap().target, "_local");
     }
+
+    #[test]
+    fn profile_round_trips_to_disk() {
+        let dir = tempdir().unwrap();
+        let h = HostBindings::load_or_default(dir.path());
+        let prof = DeployProfile {
+            auto_hostname: Some("node-7".into()),
+            auto_ip: Some("10.0.0.7".into()),
+            unattended_file: Some("ubuntu-ks".into()),
+        };
+        h.upsert("aa:bb:cc:00:00:09", "ubuntu-linux", "lab", prof);
+        drop(h);
+        let h2 = HostBindings::load_or_default(dir.path());
+        let b = h2.lookup("aa:bb:cc:00:00:09").unwrap();
+        assert_eq!(b.profile.auto_hostname.as_deref(), Some("node-7"));
+        assert_eq!(b.profile.auto_ip.as_deref(), Some("10.0.0.7"));
+        assert_eq!(b.profile.unattended_file.as_deref(), Some("ubuntu-ks"));
+    }
+
+    #[test]
+    fn legacy_hosts_json_without_profile_still_loads() {
+        // A pre-v0.5.2 hosts.json has no profile keys at all.
+        let dir = tempdir().unwrap();
+        std::fs::write(
+            dir.path().join("hosts.json"),
+            br#"[{"mac":"aa:bb:cc:00:00:01","target":"_local","label":"old","created_at":"2024-01-01T00:00:00Z","updated_at":"2024-01-01T00:00:00Z"}]"#,
+        )
+        .unwrap();
+        let h = HostBindings::load_or_default(dir.path());
+        let b = h.lookup("aa:bb:cc:00:00:01").unwrap();
+        assert_eq!(b.target, "_local");
+        assert!(b.profile.is_empty());
+    }
 }

crates/core/src/lib.rs

@@ -3,21 +3,41 @@
 #![forbid(unsafe_code)]
 
 pub mod arch;
+pub mod auth;
+pub mod boot_log;
+pub mod boot_rules;
+pub mod boot_tokens;
+pub mod branding;
 pub mod client;
 pub mod config;
+pub mod encoding;
 pub mod error;
-pub mod queue;
 pub mod host_bindings;
 pub mod log_bus;
 pub mod metrics;
+pub mod notify;
+pub mod profile;
+pub mod queue;
+pub mod saml;
 pub mod settings;
+pub mod sso;
+pub mod wol;
 
-pub use arch::{ClientArch, FirmwareClass};
+pub use arch::{ClientArch, DriverMode, FirmwareClass};
+pub use auth::{AdminAccount, AdminPublic, AdminStore};
+pub use boot_log::{BootEvent, BootLog};
+pub use boot_rules::{BootRule, BootRulesConfig, BootRulesStore};
+pub use boot_tokens::BootTokens;
+pub use branding::{ext_for_mime, BrandingStore, LogoSlot, ALLOWED_LOGO_MIMES, MAX_LOGO_BYTES};
 pub use client::{ClientEvent, ClientRegistry, ClientSnapshot};
 pub use config::{Config, DhcpMode, NetworkConfig, Paths, ServerConfig};
 pub use error::{Error, Result};
-pub use queue::{Gate, DeploymentQueue};
 pub use host_bindings::{normalize_mac, HostBinding, HostBindings};
 pub use log_bus::{LogBus, LogBusLayer, LogLine};
 pub use metrics::{HttpRoute, Metrics};
+pub use notify::{NotifyConfig, NotifyKind, NotifyStore};
+pub use profile::DeployProfile;
+pub use queue::{DeploymentQueue, QueueEntry};
+pub use saml::{IdpMetadata, SamlError, SpParams, VerifiedPrincipal, VerifiedResponse};
 pub use settings::{Settings, SettingsStore, TimeoutAction};
+pub use sso::{SsoConfig, SsoLoginInfo, SsoStore};

crates/core/src/metrics.rs

@@ -87,7 +87,9 @@ impl Metrics {
     }
 
     pub fn record_tftp_err(&self) {
-        self.inner.tftp_transfers_err.fetch_add(1, Ordering::Relaxed);
+        self.inner
+            .tftp_transfers_err
+            .fetch_add(1, Ordering::Relaxed);
     }
 
     // ── HTTP ───────────────────────────────────────────────────────────
@@ -181,7 +183,10 @@ impl Metrics {
             "",
         );
 
-        let _ = writeln!(out, "# HELP openpxe_tftp_transfers_total TFTP transfers, by status.");
+        let _ = writeln!(
+            out,
+            "# HELP openpxe_tftp_transfers_total TFTP transfers, by status."
+        );
         let _ = writeln!(out, "# TYPE openpxe_tftp_transfers_total counter");
         let _ = writeln!(
             out,
@@ -201,7 +206,10 @@ impl Metrics {
             "",
         );
 
-        let _ = writeln!(out, "# HELP openpxe_http_requests_total HTTP requests served, by route family.");
+        let _ = writeln!(
+            out,
+            "# HELP openpxe_http_requests_total HTTP requests served, by route family."
+        );
         let _ = writeln!(out, "# TYPE openpxe_http_requests_total counter");
         for (label, counter) in [
             ("boot_script", &i.http_boot_script),
@@ -218,14 +226,53 @@ impl Metrics {
         }
 
         // Gauges.
-        write_gauge(&mut out, "openpxe_iso_count", "ISOs currently registered (local + NFS).", i.iso_count.load(Ordering::Relaxed), "");
+        write_gauge(
-        write_gauge(&mut out, "openpxe_client_count", "PXE clients seen this process lifetime.", i.client_count.load(Ordering::Relaxed), "");
+            &mut out,
-        write_gauge(&mut out, "openpxe_queue_count", "Clients currently waiting at the deployment queue.", i.queue_count.load(Ordering::Relaxed), "");
+            "openpxe_iso_count",
-        write_gauge(&mut out, "openpxe_queue_imaging", "Clients currently imaging (queue + assigned target).", i.queue_imaging.load(Ordering::Relaxed), "");
+            "ISOs currently registered (local + NFS).",
-        write_gauge(&mut out, "openpxe_nfs_mounts_active", "NFS shares currently mounted.", i.nfs_mounts_active.load(Ordering::Relaxed), "");
+            i.iso_count.load(Ordering::Relaxed),
-        write_gauge(&mut out, "openpxe_uptime_seconds", "Seconds since this OpenPXE instance started.", uptime_secs, "");
+            "",
+        );
+        write_gauge(
+            &mut out,
+            "openpxe_client_count",
+            "PXE clients seen this process lifetime.",
+            i.client_count.load(Ordering::Relaxed),
+            "",
+        );
+        write_gauge(
+            &mut out,
+            "openpxe_queue_count",
+            "Clients currently waiting at the deployment queue.",
+            i.queue_count.load(Ordering::Relaxed),
+            "",
+        );
+        write_gauge(
+            &mut out,
+            "openpxe_queue_imaging",
+            "Clients currently imaging (queue + assigned target).",
+            i.queue_imaging.load(Ordering::Relaxed),
+            "",
+        );
+        write_gauge(
+            &mut out,
+            "openpxe_nfs_mounts_active",
+            "NFS shares currently mounted.",
+            i.nfs_mounts_active.load(Ordering::Relaxed),
+            "",
+        );
+        write_gauge(
+            &mut out,
+            "openpxe_uptime_seconds",
+            "Seconds since this OpenPXE instance started.",
+            uptime_secs,
+            "",
+        );
 
-        let _ = writeln!(out, "# HELP openpxe_build_info Build metadata. Always 1; the version is in the label.");
+        let _ = writeln!(
+            out,
+            "# HELP openpxe_build_info Build metadata. Always 1; the version is in the label."
+        );
         let _ = writeln!(out, "# TYPE openpxe_build_info gauge");
         let _ = writeln!(out, "openpxe_build_info{{version=\"{version}\"}} 1");
 
@@ -259,7 +306,11 @@ mod tests {
         m.record_http(HttpRoute::Api);
         m.set_iso_count(3);
         let out = m.render("0.2.0", 42);
-        assert_eq!(out.matches("# TYPE openpxe_dhcp_replies_total counter").count(), 1);
+        assert_eq!(
+            out.matches("# TYPE openpxe_dhcp_replies_total counter")
+                .count(),
+            1
+        );
         assert_eq!(out.matches("# TYPE openpxe_iso_count gauge").count(), 1);
         assert!(out.contains("openpxe_dhcp_replies_total{arch=\"uefi\"} 1"));
         assert!(out.contains("openpxe_dhcp_replies_total{arch=\"bios\"} 1"));

crates/core/src/notify.rs

@@ -0,0 +1,365 @@
+//! Webhook / email notification configuration.
+//!
+//! v0.5.0: OpenPXE can ping a chat webhook or send an email when
+//! something noteworthy happens (a machine PXE-booted an image, a
+//! deployment was assigned, a WoL was sent). One active provider at a
+//! time, chosen by `kind` — dead-simple for an L1 tech: pick Slack,
+//! paste the incoming-webhook URL, done.
+//!
+//! This module owns only the *configuration* (validation + persistence
+//! to `<work_dir>/notify.json`). The actual sending — HTTP POST for the
+//! chat providers, SMTP for email — lives in the http-api crate, which
+//! already carries an HTTP client and the SMTP dependency. Keeping the
+//! network I/O out of `core` matches how `BrandingStore`/`SsoStore`
+//! stay pure config stores.
+//!
+//! Secrets note: the SMTP password is persisted in `notify.json`
+//! alongside the rest of the config (0644 like the other state files).
+//! It is never echoed back through the API — the snapshot used for the
+//! GET response blanks it (see `Self::redacted`).
+
+use parking_lot::RwLock;
+use serde::{Deserialize, Serialize};
+use std::path::PathBuf;
+use std::sync::Arc;
+
+use crate::{Error, Result};
+
+const MAX_URL_LEN: usize = 2048;
+const MAX_FIELD_LEN: usize = 512;
+
+/// Which notification transport is active.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum NotifyKind {
+    /// Slack incoming webhook (`{ "text": ... }`).
+    #[default]
+    Slack,
+    /// Discord webhook (`{ "content": ... }`).
+    Discord,
+    /// Microsoft Teams incoming webhook (legacy MessageCard JSON).
+    Teams,
+    /// Email via SMTP.
+    Smtp,
+}
+
+impl NotifyKind {
+    /// True when this kind drives a chat webhook (POST a JSON body to a
+    /// single URL) rather than SMTP.
+    #[must_use]
+    pub fn is_webhook(self) -> bool {
+        matches!(self, Self::Slack | Self::Discord | Self::Teams)
+    }
+}
+
+/// Operator-configurable notification settings. Single provider active
+/// at a time; the inactive fields are kept so switching providers
+/// doesn't wipe the other one's values.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+pub struct NotifyConfig {
+    #[serde(default)]
+    pub enabled: bool,
+    #[serde(default)]
+    pub kind: NotifyKind,
+    /// Incoming-webhook URL for Slack / Discord / Teams.
+    #[serde(default)]
+    pub webhook_url: String,
+
+    // ── SMTP fields (used when kind == Smtp) ──
+    #[serde(default)]
+    pub smtp_host: String,
+    #[serde(default = "default_smtp_port")]
+    pub smtp_port: u16,
+    #[serde(default)]
+    pub smtp_username: String,
+    #[serde(default)]
+    pub smtp_password: String,
+    /// `From:` address. Falls back to `smtp_username` when blank.
+    #[serde(default)]
+    pub smtp_from: String,
+    /// `To:` address (single recipient — keep it simple).
+    #[serde(default)]
+    pub smtp_to: String,
+    /// Use implicit TLS (port 465). When false we use STARTTLS on the
+    /// configured port (587 typical). Either way the connection is
+    /// encrypted — we never offer plaintext SMTP.
+    #[serde(default)]
+    pub smtp_implicit_tls: bool,
+}
+
+fn default_smtp_port() -> u16 {
+    587
+}
+
+impl NotifyConfig {
+    /// True when enabled and the active provider has the fields it
+    /// needs to actually send.
+    #[must_use]
+    pub fn is_usable(&self) -> bool {
+        if !self.enabled {
+            return false;
+        }
+        if self.kind.is_webhook() {
+            !self.webhook_url.trim().is_empty()
+        } else {
+            !self.smtp_host.trim().is_empty() && !self.smtp_to.trim().is_empty()
+        }
+    }
+
+    /// A copy safe to return over the API: the SMTP password is blanked
+    /// (replaced with a non-empty sentinel only when one is set, so the
+    /// UI can show "configured" without leaking it).
+    #[must_use]
+    pub fn redacted(&self) -> NotifyConfig {
+        let mut c = self.clone();
+        if !c.smtp_password.is_empty() {
+            c.smtp_password = SECRET_SENTINEL.to_string();
+        }
+        c
+    }
+}
+
+/// Returned by the API in place of a stored password. When the UI PUTs
+/// this value back unchanged we keep the existing password rather than
+/// overwriting it with the sentinel.
+pub const SECRET_SENTINEL: &str = "__keep__";
+
+/// In-memory + on-disk notification config registry.
+#[derive(Debug, Clone)]
+pub struct NotifyStore {
+    path: Arc<PathBuf>,
+    inner: Arc<RwLock<NotifyConfig>>,
+}
+
+impl NotifyStore {
+    #[must_use]
+    pub fn load_or_default(work_dir: &std::path::Path) -> Self {
+        let path = work_dir.join("notify.json");
+        let cfg = match std::fs::read_to_string(&path) {
+            Ok(text) => serde_json::from_str::<NotifyConfig>(&text).unwrap_or_else(|e| {
+                tracing::warn!(
+                    target: "openpxe::notify",
+                    "notify.json unreadable ({e}); starting with defaults"
+                );
+                NotifyConfig::default()
+            }),
+            Err(_) => NotifyConfig::default(),
+        };
+        Self {
+            path: Arc::new(path),
+            inner: Arc::new(RwLock::new(cfg)),
+        }
+    }
+
+    #[must_use]
+    pub fn snapshot(&self) -> NotifyConfig {
+        self.inner.read().clone()
+    }
+
+    /// Replace the whole config. `incoming.smtp_password == SECRET_SENTINEL`
+    /// is treated as "keep the existing password" so the UI never has to
+    /// round-trip the real secret.
+    pub fn replace(&self, mut incoming: NotifyConfig) -> Result<NotifyConfig> {
+        incoming.webhook_url = incoming.webhook_url.trim().to_string();
+        incoming.smtp_host = incoming.smtp_host.trim().to_string();
+        incoming.smtp_username = incoming.smtp_username.trim().to_string();
+        incoming.smtp_from = incoming.smtp_from.trim().to_string();
+        incoming.smtp_to = incoming.smtp_to.trim().to_string();
+
+        // Preserve the stored password when the UI sends the sentinel.
+        if incoming.smtp_password == SECRET_SENTINEL {
+            incoming
+                .smtp_password
+                .clone_from(&self.inner.read().smtp_password);
+        }
+
+        // Length caps.
+        if incoming.webhook_url.len() > MAX_URL_LEN {
+            return Err(Error::Invalid(format!(
+                "webhook URL exceeds {MAX_URL_LEN}-char cap"
+            )));
+        }
+        for (name, v) in [
+            ("smtp_host", &incoming.smtp_host),
+            ("smtp_username", &incoming.smtp_username),
+            ("smtp_from", &incoming.smtp_from),
+            ("smtp_to", &incoming.smtp_to),
+        ] {
+            if v.len() > MAX_FIELD_LEN {
+                return Err(Error::Invalid(format!(
+                    "{name} exceeds {MAX_FIELD_LEN}-char cap"
+                )));
+            }
+        }
+
+        // Validate the active provider only when enabling.
+        if incoming.enabled {
+            if incoming.kind.is_webhook() {
+                if incoming.webhook_url.is_empty() {
+                    return Err(Error::Invalid(
+                        "a webhook URL is required to enable chat notifications".into(),
+                    ));
+                }
+                if !incoming.webhook_url.starts_with("https://")
+                    && !incoming.webhook_url.starts_with("http://")
+                {
+                    return Err(Error::Invalid(
+                        "webhook URL must start with http:// or https://".into(),
+                    ));
+                }
+            } else {
+                if incoming.smtp_host.is_empty() {
+                    return Err(Error::Invalid(
+                        "SMTP host is required to enable email notifications".into(),
+                    ));
+                }
+                if incoming.smtp_to.is_empty() {
+                    return Err(Error::Invalid(
+                        "a recipient (To) is required to enable email notifications".into(),
+                    ));
+                }
+                if incoming.smtp_port == 0 {
+                    return Err(Error::Invalid("SMTP port must be non-zero".into()));
+                }
+            }
+        }
+
+        {
+            let mut g = self.inner.write();
+            *g = incoming.clone();
+        }
+        self.persist();
+        tracing::info!(
+            target: "openpxe::notify",
+            enabled = incoming.enabled, kind = ?incoming.kind,
+            "notification configuration updated"
+        );
+        Ok(incoming)
+    }
+
+    fn persist(&self) {
+        let snap = self.inner.read().clone();
+        let body = match serde_json::to_vec_pretty(&snap) {
+            Ok(b) => b,
+            Err(e) => {
+                tracing::warn!(target: "openpxe::notify", "serialize notify.json: {e}");
+                return;
+            }
+        };
+        if let Some(parent) = self.path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        let tmp = self.path.with_extension("json.tmp");
+        if let Err(e) = std::fs::write(&tmp, body) {
+            tracing::warn!(target: "openpxe::notify", "write notify.json tmp: {e}");
+            return;
+        }
+        if let Err(e) = std::fs::rename(&tmp, self.path.as_path()) {
+            tracing::warn!(target: "openpxe::notify", "rename notify.json: {e}");
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::tempdir;
+
+    #[test]
+    fn default_disabled_not_usable() {
+        let dir = tempdir().unwrap();
+        let s = NotifyStore::load_or_default(dir.path());
+        assert!(!s.snapshot().enabled);
+        assert!(!s.snapshot().is_usable());
+    }
+
+    #[test]
+    fn slack_requires_url_when_enabled() {
+        let dir = tempdir().unwrap();
+        let s = NotifyStore::load_or_default(dir.path());
+        let r = s.replace(NotifyConfig {
+            enabled: true,
+            kind: NotifyKind::Slack,
+            ..Default::default()
+        });
+        assert!(matches!(r, Err(Error::Invalid(_))));
+        s.replace(NotifyConfig {
+            enabled: true,
+            kind: NotifyKind::Slack,
+            webhook_url: "https://hooks.slack.com/services/XXX".into(),
+            ..Default::default()
+        })
+        .unwrap();
+        assert!(s.snapshot().is_usable());
+    }
+
+    #[test]
+    fn smtp_requires_host_and_recipient() {
+        let dir = tempdir().unwrap();
+        let s = NotifyStore::load_or_default(dir.path());
+        let r = s.replace(NotifyConfig {
+            enabled: true,
+            kind: NotifyKind::Smtp,
+            smtp_host: "smtp.example.com".into(),
+            ..Default::default()
+        });
+        assert!(
+            matches!(r, Err(Error::Invalid(_))),
+            "missing recipient should reject"
+        );
+        s.replace(NotifyConfig {
+            enabled: true,
+            kind: NotifyKind::Smtp,
+            smtp_host: "smtp.example.com".into(),
+            smtp_port: 587,
+            smtp_to: "[email protected]".into(),
+            smtp_from: "[email protected]".into(),
+            ..Default::default()
+        })
+        .unwrap();
+        assert!(s.snapshot().is_usable());
+    }
+
+    #[test]
+    fn password_sentinel_preserves_stored_secret() {
+        let dir = tempdir().unwrap();
+        let s = NotifyStore::load_or_default(dir.path());
+        s.replace(NotifyConfig {
+            enabled: true,
+            kind: NotifyKind::Smtp,
+            smtp_host: "smtp.example.com".into(),
+            smtp_port: 587,
+            smtp_to: "[email protected]".into(),
+            smtp_password: "s3cret".into(),
+            ..Default::default()
+        })
+        .unwrap();
+        // Redacted snapshot hides the password behind the sentinel.
+        assert_eq!(s.snapshot().redacted().smtp_password, SECRET_SENTINEL);
+        // PUTting the sentinel back keeps the real password.
+        s.replace(NotifyConfig {
+            enabled: true,
+            kind: NotifyKind::Smtp,
+            smtp_host: "smtp.example.com".into(),
+            smtp_port: 587,
+            smtp_to: "[email protected]".into(),
+            smtp_password: SECRET_SENTINEL.into(),
+            ..Default::default()
+        })
+        .unwrap();
+        assert_eq!(s.snapshot().smtp_password, "s3cret");
+    }
+
+    #[test]
+    fn webhook_url_scheme_enforced() {
+        let dir = tempdir().unwrap();
+        let s = NotifyStore::load_or_default(dir.path());
+        let r = s.replace(NotifyConfig {
+            enabled: true,
+            kind: NotifyKind::Discord,
+            webhook_url: "ftp://example.com/hook".into(),
+            ..Default::default()
+        });
+        assert!(matches!(r, Err(Error::Invalid(_))));
+    }
+}

crates/core/src/profile.rs

@@ -0,0 +1,122 @@
+//! Per-host deployment profile.
+//!
+//! v0.5.2: a small, optional bundle of "what should this machine do when
+//! it images" attached to either a pinned host binding ([`crate::HostBinding`])
+//! or a queued device ([`crate::QueueEntry`]). All three fields are
+//! optional and independent:
+//!
+//! * `auto_hostname` — substituted into the served unattended answer file
+//!   (`{{HOSTNAME}}`) so the installer sets the machine name.
+//! * `auto_ip` — substituted as `{{IP}}`. OpenPXE is a DHCP **proxy** and
+//!   does not hand out leases, so this is applied by the installer as a
+//!   static-network directive inside the answer file, not by DHCP.
+//! * `unattended_file` — the id of an uploaded file in the unattended
+//!   store (Kickstart / Preseed / Autoinstall / Windows answer file). When
+//!   set, the boot chain injects the appropriate kernel argument so the
+//!   install runs unattended.
+
+use serde::{Deserialize, Serialize};
+
+/// Optional deployment hints carried on a host pin or a queue entry.
+///
+/// The fields are flattened into `HostBinding` / `QueueEntry` on the wire
+/// (so existing JSON stays compatible via `#[serde(default)]`); this type
+/// is the in-code bundle the boot chain consumes.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct DeployProfile {
+    /// Hostname to set on the imaged machine (`{{HOSTNAME}}`). Empty/None
+    /// leaves the installer default.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub auto_hostname: Option<String>,
+    /// Static IPv4/IPv6 the installer should configure (`{{IP}}`). Stored
+    /// as a free-form string — validated lightly at the HTTP layer.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub auto_ip: Option<String>,
+    /// Id of an uploaded file in the unattended store. Empty/None means
+    /// "no unattended install — boot interactively".
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub unattended_file: Option<String>,
+}
+
+/// Cap on the stored hostname / IP strings — generous for any real value
+/// but bounds what an operator can stuff into the JSON.
+pub const MAX_PROFILE_FIELD_LEN: usize = 255;
+
+impl DeployProfile {
+    /// True when nothing is set — lets call sites skip work entirely.
+    #[must_use]
+    pub fn is_empty(&self) -> bool {
+        self.auto_hostname.is_none() && self.auto_ip.is_none() && self.unattended_file.is_none()
+    }
+
+    /// True when an unattended file is selected (drives boot-chain injection).
+    #[must_use]
+    pub fn has_unattended(&self) -> bool {
+        self.unattended_file
+            .as_deref()
+            .is_some_and(|s| !s.trim().is_empty())
+    }
+
+    /// Normalise: trim every field and collapse empty strings to `None`
+    /// so persisted JSON never carries `""` for an unset value.
+    #[must_use]
+    pub fn normalized(mut self) -> Self {
+        fn clean(v: Option<String>) -> Option<String> {
+            v.map(|s| s.trim().to_string())
+                .filter(|s| !s.is_empty())
+                .map(|s| s.chars().take(MAX_PROFILE_FIELD_LEN).collect())
+        }
+        self.auto_hostname = clean(self.auto_hostname);
+        self.auto_ip = clean(self.auto_ip);
+        self.unattended_file = clean(self.unattended_file);
+        self
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn empty_profile_is_empty() {
+        assert!(DeployProfile::default().is_empty());
+        assert!(!DeployProfile::default().has_unattended());
+    }
+
+    #[test]
+    fn normalize_trims_and_nulls_empty() {
+        let p = DeployProfile {
+            auto_hostname: Some("  node-7  ".into()),
+            auto_ip: Some("   ".into()),
+            unattended_file: Some(String::new()),
+        }
+        .normalized();
+        assert_eq!(p.auto_hostname.as_deref(), Some("node-7"));
+        assert_eq!(p.auto_ip, None);
+        assert_eq!(p.unattended_file, None);
+        assert!(!p.is_empty());
+    }
+
+    #[test]
+    fn has_unattended_detects_real_id() {
+        let p = DeployProfile {
+            unattended_file: Some("ubuntu-ks".into()),
+            ..Default::default()
+        };
+        assert!(p.has_unattended());
+    }
+
+    #[test]
+    fn long_field_is_capped() {
+        let long = "a".repeat(1000);
+        let p = DeployProfile {
+            auto_hostname: Some(long),
+            ..Default::default()
+        }
+        .normalized();
+        assert_eq!(
+            p.auto_hostname.as_deref().map(str::len),
+            Some(MAX_PROFILE_FIELD_LEN)
+        );
+    }
+}

crates/core/src/queue.rs

@@ -1,16 +1,16 @@
 //! Queued Deployment queue.
 //!
 //! When a client selects "Queued Deployment" at the PXE menu, iPXE POSTs to
-//! `/api/queue/join` and receives a gate position. It then enters a poll
+//! `/api/queue/join` and receives a queue position. It then enters a poll
 //! loop hitting `/api/queue/poll/<id>`; the server holds the request open
 //! until either (a) the operator assigns an ISO from the WebUI, in which
 //! case the poll returns an iPXE `chain` URL, or (b) the poll times out
 //! (iPXE's HTTP client has its own timeout), in which case iPXE re-POSTs.
 //!
-//! The WebUI shows the queue (`GET /api/gate`) and issues
+//! The WebUI shows the queue (`GET /api/queue`) and issues
 //! `POST /api/queue/assign { iso_id, entry_ids: [...] }` to launch a single
-//! ISO across many gated clients at once. This is the "horse-race gate"
+//! ISO across many queued clients at once. Every waiting machine receives
-//! UX the user asked for — every horse leaves the line simultaneously.
+//! the assignment without operator visits at the rack.
 
 use parking_lot::RwLock;
 use serde::{Deserialize, Serialize};
@@ -21,13 +21,14 @@ use time::OffsetDateTime;
 use tokio::sync::Notify;
 use uuid::Uuid;
 
+use crate::profile::DeployProfile;
 use crate::ClientArch;
 
-/// Per-gate state visible to the WebUI.
+/// Per-client queue state visible to the WebUI.
 #[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct Gate {
+pub struct QueueEntry {
     pub id: String,
-    /// 1-based race-gate position — position 1 is whoever got there first.
+    /// 1-based queue position — position 1 is whoever got there first.
     pub position: u32,
     pub mac: String,
     pub ip: Option<IpAddr>,
@@ -37,6 +38,11 @@ pub struct Gate {
     #[serde(with = "time::serde::rfc3339")]
     pub last_poll_at: OffsetDateTime,
     pub assigned_target: Option<String>,
+    /// v0.5.2: optional per-device deployment profile set via the queue
+    /// "Profile" button (auto hostname / IP / unattended file). Flattened
+    /// so the JSON stays flat alongside the other queue fields.
+    #[serde(default, flatten)]
+    pub profile: DeployProfile,
 }
 
 #[derive(Debug)]
@@ -49,14 +55,15 @@ struct QueueEntryInner {
     joined_at: OffsetDateTime,
     last_poll_at: OffsetDateTime,
     assigned_target: Option<String>,
+    profile: DeployProfile,
     /// Broadcast primitive that wakes the long-poll as soon as an
     /// assignment lands — no polling on our side, no sleep-loops.
     notify: Arc<Notify>,
 }
 
 impl QueueEntryInner {
-    fn snapshot(&self) -> Gate {
+    fn snapshot(&self) -> QueueEntry {
-        Gate {
+        QueueEntry {
             id: self.id.clone(),
             position: self.position,
             mac: self.mac.clone(),
@@ -65,6 +72,7 @@ impl QueueEntryInner {
             joined_at: self.joined_at,
             last_poll_at: self.last_poll_at,
             assigned_target: self.assigned_target.clone(),
+            profile: self.profile.clone(),
         }
     }
 }
@@ -80,21 +88,25 @@ impl DeploymentQueue {
         Arc::new(Self::default())
     }
 
-    /// Add a client to the gate. Returns the new `Gate` snapshot. If the
+    /// Add a client to the queue. Returns the current queue snapshot. If the
-    /// MAC is already queued, the existing gate is returned unchanged —
+    /// MAC is already queued, the existing entry is returned unchanged —
     /// retrying iPXE clients don't duplicate their slot.
-    pub fn join(&self, mac: &str, ip: Option<IpAddr>, arch: Option<ClientArch>) -> Gate {
+    pub fn join(&self, mac: &str, ip: Option<IpAddr>, arch: Option<ClientArch>) -> QueueEntry {
         let now = OffsetDateTime::now_utc();
         let mut guard = self.inner.write();
 
         if let Some(existing) = guard.values_mut().find(|g| g.mac == mac) {
             existing.last_poll_at = now;
-            if ip.is_some() { existing.ip = ip; }
+            if ip.is_some() {
-            if arch.is_some() { existing.arch = arch; }
+                existing.ip = ip;
+            }
+            if arch.is_some() {
+                existing.arch = arch;
+            }
             return existing.snapshot();
         }
 
-        // Race position = max(position) + 1, or 1 if empty.
+        // Queue position = max(position) + 1, or 1 if empty.
         let next_pos = guard.values().map(|g| g.position).max().unwrap_or(0) + 1;
         let id = Uuid::new_v4().to_string();
         let inner = QueueEntryInner {
@@ -106,6 +118,7 @@ impl DeploymentQueue {
             joined_at: now,
             last_poll_at: now,
             assigned_target: None,
+            profile: DeployProfile::default(),
             notify: Arc::new(Notify::new()),
         };
         let snap = inner.snapshot();
@@ -113,24 +126,47 @@ impl DeploymentQueue {
         snap
     }
 
-    /// Look up the `Notify` primitive for a given gate id, for long-polling.
+    /// Look up the `Notify` primitive for a given queue entry id, for long-polling.
     #[must_use]
     pub fn notifier(&self, entry_id: &str) -> Option<Arc<Notify>> {
         self.inner.read().get(entry_id).map(|g| g.notify.clone())
     }
 
-    /// Update the last-poll timestamp (keeps the gate's "live" indicator
+    /// Update the last-poll timestamp (keeps the queue's "live" indicator
     /// fresh in the UI) and return the current snapshot. Returns None if
-    /// the gate was released/expired between requests.
+    /// the entry was released/expired between requests.
-    pub fn touch(&self, entry_id: &str) -> Option<Gate> {
+    pub fn touch(&self, entry_id: &str) -> Option<QueueEntry> {
         let mut guard = self.inner.write();
         let g = guard.get_mut(entry_id)?;
         g.last_poll_at = OffsetDateTime::now_utc();
         Some(g.snapshot())
     }
 
-    /// Operator assigns an ISO entry (boot_entry id) to one or more gates.
+    /// Operator sets (or clears) the deployment profile for a queued
-    /// Returns the number of gates that were updated. Gates not in the
+    /// device via the WebUI "Profile" button. Returns the updated
+    /// snapshot, or `None` if the entry has since been released.
+    pub fn set_profile(&self, entry_id: &str, profile: DeployProfile) -> Option<QueueEntry> {
+        let mut guard = self.inner.write();
+        let g = guard.get_mut(entry_id)?;
+        g.profile = profile.normalized();
+        Some(g.snapshot())
+    }
+
+    /// Look up the deployment profile for a queued MAC, if any. Used by
+    /// the boot chain to inject an unattended file / template the
+    /// hostname + IP when an assigned device chains to its target.
+    #[must_use]
+    pub fn profile_for_mac(&self, mac: &str) -> Option<DeployProfile> {
+        let guard = self.inner.read();
+        guard
+            .values()
+            .find(|g| g.mac == mac)
+            .map(|g| g.profile.clone())
+            .filter(|p| !p.is_empty())
+    }
+
+    /// Operator assigns an ISO entry (boot_entry id) to one or more clients.
+    /// Returns the number of queue entries that were updated. Entries not in the
     /// queue are silently skipped.
     pub fn assign(&self, entry_ids: &[String], target: &str) -> usize {
         let mut guard = self.inner.write();
@@ -145,9 +181,9 @@ impl DeploymentQueue {
         updated
     }
 
-    /// Remove a gate and return its final snapshot. Called after the client
+    /// Remove a queue entry and return its final snapshot. Called after the client
     /// has successfully chained onto its assignment.
-    pub fn release(&self, entry_id: &str) -> Option<Gate> {
+    pub fn release(&self, entry_id: &str) -> Option<QueueEntry> {
         let mut guard = self.inner.write();
         let g = guard.remove(entry_id)?;
         g.notify.notify_waiters();
@@ -162,7 +198,7 @@ impl DeploymentQueue {
     }
 
     #[must_use]
-    pub fn list(&self) -> Vec<Gate> {
+    pub fn list(&self) -> Vec<QueueEntry> {
         let guard = self.inner.read();
         let mut v: Vec<_> = guard.values().map(QueueEntryInner::snapshot).collect();
         v.sort_by_key(|g| g.position);

crates/core/src/saml/authn_request.rs

@@ -0,0 +1,159 @@
+//! AuthnRequest construction + HTTP-Redirect binding encoding.
+//!
+//! For SP-initiated login we build an `<AuthnRequest>`, then encode it for the
+//! HTTP-Redirect binding: raw DEFLATE (RFC 1951) → base64 → percent-encode,
+//! appended as the `SAMLRequest` query parameter. AuthnRequests are sent
+//! unsigned in this release (the IdP must not require client signatures).
+
+use std::io::Write as _;
+
+use base64::Engine;
+use flate2::write::DeflateEncoder;
+use flate2::Compression;
+use time::format_description::well_known::Rfc3339;
+use time::OffsetDateTime;
+
+use super::{SamlError, SpParams};
+use crate::encoding::{pct_encode, xml_escape};
+
+const NS_PROTOCOL: &str = "urn:oasis:names:tc:SAML:2.0:protocol";
+const NS_ASSERTION: &str = "urn:oasis:names:tc:SAML:2.0:assertion";
+const NAMEID_EMAIL: &str = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress";
+const BINDING_POST: &str = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST";
+
+/// A built AuthnRequest, ready to redirect the browser to the IdP.
+#[derive(Debug, Clone)]
+pub struct AuthnRequest {
+    /// The request `ID` — the caller records this so the matching response's
+    /// `InResponseTo` can be correlated (replay/CSRF protection).
+    pub id: String,
+    /// The full IdP URL to 302 the browser to (includes `SAMLRequest` and,
+    /// when supplied, `RelayState`).
+    pub location: String,
+}
+
+/// Build an AuthnRequest targeting `idp_sso_url` and encode it for the
+/// HTTP-Redirect binding. `relay_state`, if given, round-trips back to us via
+/// the response (we use it to send the operator to their intended page).
+pub fn build(
+    sp: &SpParams,
+    idp_sso_url: &str,
+    relay_state: Option<&str>,
+) -> Result<AuthnRequest, SamlError> {
+    let id = format!("_{}", uuid::Uuid::new_v4().simple());
+    let issue_instant = OffsetDateTime::now_utc()
+        .replace_nanosecond(0)
+        .unwrap_or_else(|_| OffsetDateTime::now_utc())
+        .format(&Rfc3339)
+        .map_err(|e| SamlError::Timestamp(e.to_string()))?;
+
+    let xml = format!(
+        r#"<samlp:AuthnRequest xmlns:samlp="{NS_PROTOCOL}" xmlns:saml="{NS_ASSERTION}" ID="{id}" Version="2.0" IssueInstant="{instant}" Destination="{dest}" ProtocolBinding="{BINDING_POST}" AssertionConsumerServiceURL="{acs}"><saml:Issuer>{issuer}</saml:Issuer><samlp:NameIDPolicy Format="{NAMEID_EMAIL}" AllowCreate="true"/></samlp:AuthnRequest>"#,
+        instant = issue_instant,
+        dest = xml_escape(idp_sso_url),
+        acs = xml_escape(&sp.acs_url),
+        issuer = xml_escape(&sp.entity_id),
+    );
+
+    let encoded = deflate_base64(&xml)?;
+
+    let sep = if idp_sso_url.contains('?') { '&' } else { '?' };
+    let mut location = format!("{idp_sso_url}{sep}SAMLRequest={}", pct_encode(&encoded));
+    if let Some(rs) = relay_state {
+        location.push_str("&RelayState=");
+        location.push_str(&pct_encode(rs));
+    }
+
+    Ok(AuthnRequest { id, location })
+}
+
+/// Raw-DEFLATE then base64 — the HTTP-Redirect binding's `SAMLRequest` payload.
+fn deflate_base64(xml: &str) -> Result<String, SamlError> {
+    let mut enc = DeflateEncoder::new(Vec::new(), Compression::default());
+    enc.write_all(xml.as_bytes())
+        .and_then(|()| enc.try_finish())
+        .map_err(|e| SamlError::Xml(format!("deflate: {e}")))?;
+    let compressed = enc
+        .finish()
+        .map_err(|e| SamlError::Xml(format!("deflate: {e}")))?;
+    Ok(base64::engine::general_purpose::STANDARD.encode(compressed))
+}
+
+// `pct_encode` + `xml_escape` now live in `openpxe_core::encoding` (v0.5.4)
+// — imported above.
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use flate2::read::DeflateDecoder;
+    use std::io::Read;
+
+    fn sp() -> SpParams {
+        SpParams {
+            entity_id: "https://pxe.example.com".into(),
+            acs_url: "https://pxe.example.com/api/sso/acs".into(),
+        }
+    }
+
+    fn pct_decode(s: &str) -> Vec<u8> {
+        let bytes = s.as_bytes();
+        let mut out = Vec::with_capacity(bytes.len());
+        let mut i = 0;
+        while i < bytes.len() {
+            if bytes[i] == b'%' && i + 2 < bytes.len() {
+                let hi = (bytes[i + 1] as char).to_digit(16).unwrap();
+                let lo = (bytes[i + 2] as char).to_digit(16).unwrap();
+                out.push((hi * 16 + lo) as u8);
+                i += 3;
+            } else {
+                out.push(bytes[i]);
+                i += 1;
+            }
+        }
+        out
+    }
+
+    #[test]
+    fn id_is_ncname_and_location_has_request() {
+        let req = build(&sp(), "https://idp.example.com/sso", Some("/dashboard")).unwrap();
+        assert!(req.id.starts_with('_'));
+        assert!(req
+            .location
+            .starts_with("https://idp.example.com/sso?SAMLRequest="));
+        assert!(req.location.contains("&RelayState=%2Fdashboard"));
+    }
+
+    #[test]
+    fn redirect_payload_round_trips_to_our_authn_request() {
+        let req = build(&sp(), "https://idp.example.com/sso", None).unwrap();
+        // Pull SAMLRequest value out of the query string.
+        let q = req.location.split("SAMLRequest=").nth(1).unwrap();
+        let val = q.split('&').next().unwrap();
+        let compressed = base64::engine::general_purpose::STANDARD
+            .decode(pct_decode(val))
+            .unwrap();
+        let mut inflate = DeflateDecoder::new(&compressed[..]);
+        let mut xml = String::new();
+        inflate.read_to_string(&mut xml).unwrap();
+
+        let doc = roxmltree::Document::parse(&xml).unwrap();
+        let root = doc.root_element();
+        assert_eq!(root.tag_name().name(), "AuthnRequest");
+        assert_eq!(root.attribute("ID").unwrap(), req.id);
+        assert_eq!(
+            root.attribute("AssertionConsumerServiceURL").unwrap(),
+            "https://pxe.example.com/api/sso/acs"
+        );
+        let issuer = root
+            .descendants()
+            .find(|n| n.tag_name().name() == "Issuer")
+            .unwrap();
+        assert_eq!(issuer.text().unwrap(), "https://pxe.example.com");
+    }
+
+    #[test]
+    fn existing_query_uses_ampersand_separator() {
+        let req = build(&sp(), "https://idp.example.com/sso?foo=bar", None).unwrap();
+        assert!(req.location.contains("?foo=bar&SAMLRequest="));
+    }
+}

crates/core/src/saml/metadata.rs

@@ -0,0 +1,228 @@
+//! IdP metadata parsing + SP metadata generation.
+//!
+//! We parse only what the SP flow needs: the IdP Entity ID, its
+//! `SingleSignOnService` endpoints (HTTP-Redirect / HTTP-POST), and the
+//! X.509 signing certificate(s). Everything else in the document is ignored.
+
+use base64::Engine;
+
+use super::{SamlError, SpParams};
+use crate::encoding::xml_escape;
+
+/// SAML 2.0 binding URIs.
+pub const BINDING_REDIRECT: &str = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect";
+pub const BINDING_POST: &str = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST";
+
+/// The subset of an IdP's `EntityDescriptor` the SP flow consumes.
+#[derive(Debug, Clone)]
+pub struct IdpMetadata {
+    /// The IdP's Entity ID — we require incoming assertions to be issued by it.
+    pub entity_id: String,
+    /// SSO endpoint for the HTTP-Redirect binding (where we send AuthnRequests).
+    pub sso_redirect_url: Option<String>,
+    /// SSO endpoint for the HTTP-POST binding (fallback target).
+    pub sso_post_url: Option<String>,
+    /// DER-encoded X.509 signing certificate(s). More than one appears during
+    /// key rotation; verification tries each.
+    pub signing_certs_der: Vec<Vec<u8>>,
+}
+
+impl IdpMetadata {
+    /// Parse an IdP `EntityDescriptor` document.
+    ///
+    /// Robust to namespace-prefix variation (matches on local element names),
+    /// since IdPs disagree on prefixes (`md:`, `ns0:`, default, …).
+    pub fn parse(xml: &str) -> Result<Self, SamlError> {
+        let doc = roxmltree::Document::parse(xml).map_err(|e| SamlError::Xml(e.to_string()))?;
+        let root = doc.root_element();
+
+        // The signing IDP descriptor. Some metadata wraps multiple
+        // descriptors (AA, SP) in one document; we want IDPSSODescriptor.
+        let idp_desc = root
+            .descendants()
+            .find(|n| n.is_element() && n.tag_name().name() == "IDPSSODescriptor")
+            .ok_or_else(|| SamlError::Metadata("IDPSSODescriptor".into()))?;
+
+        // Entity ID lives on the EntityDescriptor (root, or an ancestor of the
+        // IDPSSODescriptor when several are nested).
+        let entity_id = idp_desc
+            .ancestors()
+            .find_map(|n| {
+                if n.tag_name().name() == "EntityDescriptor" {
+                    n.attribute("entityID")
+                } else {
+                    None
+                }
+            })
+            .or_else(|| root.attribute("entityID"))
+            .map(str::to_owned)
+            .ok_or_else(|| SamlError::Metadata("entityID".into()))?;
+
+        let mut sso_redirect_url = None;
+        let mut sso_post_url = None;
+        for sso in idp_desc
+            .children()
+            .filter(|n| n.is_element() && n.tag_name().name() == "SingleSignOnService")
+        {
+            let binding = sso.attribute("Binding").unwrap_or("");
+            let location = sso.attribute("Location").map(str::to_owned);
+            match binding {
+                BINDING_REDIRECT if sso_redirect_url.is_none() => sso_redirect_url = location,
+                BINDING_POST if sso_post_url.is_none() => sso_post_url = location,
+                _ => {}
+            }
+        }
+
+        // Signing certs: KeyDescriptor with use="signing" or no use attribute
+        // (a bare KeyDescriptor is valid for both signing and encryption).
+        let mut signing_certs_der = Vec::new();
+        for kd in idp_desc
+            .children()
+            .filter(|n| n.is_element() && n.tag_name().name() == "KeyDescriptor")
+        {
+            match kd.attribute("use") {
+                Some("signing") | None => {}
+                Some(_) => continue, // encryption-only key — skip
+            }
+            for cert_node in kd
+                .descendants()
+                .filter(|n| n.is_element() && n.tag_name().name() == "X509Certificate")
+            {
+                let b64: String = node_text(&cert_node)
+                    .chars()
+                    .filter(|c| !c.is_whitespace())
+                    .collect();
+                if b64.is_empty() {
+                    continue;
+                }
+                let der = base64::engine::general_purpose::STANDARD
+                    .decode(b64.as_bytes())
+                    .map_err(|e| SamlError::Base64(e.to_string()))?;
+                signing_certs_der.push(der);
+            }
+        }
+
+        if signing_certs_der.is_empty() {
+            return Err(SamlError::NoSigningCert);
+        }
+
+        Ok(Self {
+            entity_id,
+            sso_redirect_url,
+            sso_post_url,
+            signing_certs_der,
+        })
+    }
+
+    /// Preferred SSO destination for an outbound AuthnRequest: HTTP-Redirect
+    /// if advertised, otherwise HTTP-POST.
+    pub fn sso_destination(&self) -> Option<&str> {
+        self.sso_redirect_url
+            .as_deref()
+            .or(self.sso_post_url.as_deref())
+    }
+}
+
+/// Build our SP `EntityDescriptor` XML so an IdP admin can import OpenPXE as a
+/// relying party. Advertises the ACS URL (HTTP-POST binding) and an emailAddress
+/// NameID format — matching what the response path expects.
+pub fn build_sp_metadata(sp: &SpParams) -> String {
+    let entity = xml_escape(&sp.entity_id);
+    let acs = xml_escape(&sp.acs_url);
+    format!(
+        r#"<?xml version="1.0" encoding="UTF-8"?>
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="{entity}">
+  <SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
+    <AssertionConsumerService Binding="{BINDING_POST}" Location="{acs}" index="0" isDefault="true"/>
+  </SPSSODescriptor>
+</EntityDescriptor>
+"#
+    )
+}
+
+/// Collect the concatenated text of an element's direct text children.
+fn node_text(n: &roxmltree::Node<'_, '_>) -> String {
+    n.children()
+        .filter(roxmltree::Node::is_text)
+        .filter_map(|c| c.text())
+        .collect()
+}
+
+// `xml_escape` now lives in `openpxe_core::encoding` (v0.5.4) — imported above.
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    // A trimmed-down Keycloak-style IdP descriptor (cert body is a stand-in;
+    // signing tests build real certs in the parent module's tests).
+    const SAMPLE: &str = r#"<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
+        xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
+        entityID="https://idp.example.com/realms/fleet">
+      <md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+        <md:KeyDescriptor use="signing">
+          <ds:KeyInfo><ds:X509Data><ds:X509Certificate>
+            QUJDREVG
+          </ds:X509Certificate></ds:X509Data></ds:KeyInfo>
+        </md:KeyDescriptor>
+        <md:KeyDescriptor use="encryption">
+          <ds:KeyInfo><ds:X509Data><ds:X509Certificate>WlpaWg==</ds:X509Certificate></ds:X509Data></ds:KeyInfo>
+        </md:KeyDescriptor>
+        <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
+            Location="https://idp.example.com/realms/fleet/protocol/saml"/>
+        <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
+            Location="https://idp.example.com/realms/fleet/protocol/saml"/>
+      </md:IDPSSODescriptor>
+    </md:EntityDescriptor>"#;
+
+    #[test]
+    fn parses_entity_sso_and_signing_cert() {
+        let m = IdpMetadata::parse(SAMPLE).unwrap();
+        assert_eq!(m.entity_id, "https://idp.example.com/realms/fleet");
+        assert_eq!(
+            m.sso_redirect_url.as_deref(),
+            Some("https://idp.example.com/realms/fleet/protocol/saml")
+        );
+        assert!(m.sso_post_url.is_some());
+        // Only the signing KeyDescriptor's cert is collected (ABCDEF), not the
+        // encryption one (ZZZZ).
+        assert_eq!(m.signing_certs_der.len(), 1);
+        assert_eq!(m.signing_certs_der[0], b"ABCDEF");
+    }
+
+    #[test]
+    fn missing_signing_cert_is_rejected() {
+        let xml = r#"<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="x">
+            <IDPSSODescriptor>
+              <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://x/sso"/>
+            </IDPSSODescriptor></EntityDescriptor>"#;
+        assert!(matches!(
+            IdpMetadata::parse(xml),
+            Err(SamlError::NoSigningCert)
+        ));
+    }
+
+    #[test]
+    fn missing_idp_descriptor_is_rejected() {
+        let xml = r#"<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="x"></EntityDescriptor>"#;
+        assert!(matches!(
+            IdpMetadata::parse(xml),
+            Err(SamlError::Metadata(_))
+        ));
+    }
+
+    #[test]
+    fn sp_metadata_contains_entity_and_acs() {
+        let sp = SpParams {
+            entity_id: "https://pxe.example.com".into(),
+            acs_url: "https://pxe.example.com/api/sso/acs".into(),
+        };
+        let xml = build_sp_metadata(&sp);
+        assert!(xml.contains(r#"entityID="https://pxe.example.com""#));
+        assert!(xml.contains("https://pxe.example.com/api/sso/acs"));
+        assert!(xml.contains(BINDING_POST));
+        // Must be well-formed.
+        roxmltree::Document::parse(&xml).unwrap();
+    }
+}

crates/core/src/saml/mod.rs

@@ -0,0 +1,92 @@
+//! Pure-Rust SAML 2.0 Service Provider (v0.5.1).
+//!
+//! This module implements the SP half of a SAML Web-Browser-SSO profile:
+//!
+//! * [`metadata`] — parse the IdP's `EntityDescriptor` (SSO URLs + signing
+//!   certificates) and build *our* SP metadata for the IdP admin to import.
+//! * [`authn_request`] — build an `AuthnRequest` and encode it for the
+//!   HTTP-Redirect binding.
+//! * [`response`] — decode a `SAMLResponse`, **verify its XML signature**
+//!   against the IdP's pinned certificate (via the pure-Rust `bergshamra`
+//!   crate — no OpenSSL/libxml2/xmlsec, so the static musl binary stays
+//!   C-free), then enforce the SP-side semantic checks (Status, Destination,
+//!   Audience, time bounds) that are where SAML SPs actually get attacked.
+//!
+//! Stateful checks (replay of assertion IDs, correlating `InResponseTo`
+//! against requests *we* issued, gating IdP-initiated login) live in the
+//! HTTP layer — [`response::consume`] is deliberately stateless and returns
+//! the IDs the caller needs to perform them.
+//!
+//! Access model: any assertion the IdP authenticates and we cryptographically
+//! verify yields an operator [`VerifiedPrincipal`]. OpenPXE is single-tier —
+//! there is no per-user role table — and the local admin account remains a
+//! guaranteed fallback owner regardless of SSO state.
+
+pub mod authn_request;
+pub mod metadata;
+pub mod response;
+
+pub use authn_request::AuthnRequest;
+pub use metadata::IdpMetadata;
+pub use response::{VerifiedPrincipal, VerifiedResponse};
+
+use thiserror::Error;
+
+/// Default clock-skew tolerance applied to assertion time bounds. SAML IdPs
+/// and SPs rarely have perfectly synced clocks; 60s matches common practice
+/// (Shibboleth/FleetDM defaults are in this ballpark).
+pub const DEFAULT_CLOCK_SKEW_SECS: i64 = 60;
+
+/// Runtime SP parameters, derived from [`crate::SsoConfig`] + the advertised
+/// public base URL by the HTTP layer.
+#[derive(Debug, Clone)]
+pub struct SpParams {
+    /// Our SP Entity ID (the `<Issuer>` we send and the `Audience` we require
+    /// in responses). Defaults to the public base URL when the operator left
+    /// the Entity ID field blank.
+    pub entity_id: String,
+    /// The Assertion Consumer Service URL the IdP POSTs the response to —
+    /// `<public_base_url>/api/sso/acs`.
+    pub acs_url: String,
+}
+
+/// Everything that can go wrong consuming a SAML response. Kept coarse on
+/// purpose: the HTTP layer logs the detail and shows the operator a generic
+/// "SSO sign-in failed" — we never leak which specific check tripped to the
+/// browser, since that aids an attacker probing the SP.
+#[derive(Debug, Error)]
+pub enum SamlError {
+    #[error("SAML XML parse error: {0}")]
+    Xml(String),
+    #[error("IdP metadata is missing a required element: {0}")]
+    Metadata(String),
+    #[error("no usable IdP signing certificate in metadata")]
+    NoSigningCert,
+    #[error("signature verification failed: {0}")]
+    Signature(String),
+    #[error("the signature does not cover the assertion we read")]
+    SignatureScope,
+    #[error("SAML response status was not Success: {0}")]
+    Status(String),
+    #[error("response is missing a required element: {0}")]
+    MissingElement(String),
+    #[error("encrypted assertions are not supported in this release")]
+    EncryptedAssertionUnsupported,
+    #[error("expected exactly one assertion, found {0}")]
+    AssertionCount(usize),
+    #[error("issuer mismatch: response was not issued by the configured IdP")]
+    IssuerMismatch,
+    #[error("audience mismatch: assertion is not addressed to this service provider")]
+    AudienceMismatch,
+    #[error("response destination does not match our ACS URL")]
+    DestinationMismatch,
+    #[error("assertion is expired or not yet valid")]
+    TimeBounds,
+    #[error("invalid SAML timestamp: {0}")]
+    Timestamp(String),
+    #[error("base64 decode failed: {0}")]
+    Base64(String),
+}
+
+#[cfg(test)]
+mod tests;

crates/core/src/saml/response.rs

@@ -0,0 +1,294 @@
+//! SAMLResponse consumption: signature verification + SP-side validation.
+//!
+//! [`consume`] is intentionally **stateless** — it verifies the XML signature
+//! against the IdP's pinned certificate(s) and enforces every check that can
+//! be made from the response alone (Status, Destination, Issuer, Audience,
+//! time bounds, signature scope). It then returns the `assertion_id` and
+//! `in_response_to` so the HTTP layer can perform the *stateful* checks it
+//! owns: replay rejection, correlating the request we issued, and gating
+//! IdP-initiated login.
+
+use roxmltree::{Document, Node};
+use time::format_description::well_known::Rfc3339;
+use time::{Duration, OffsetDateTime};
+
+use super::metadata::IdpMetadata;
+use super::{SamlError, SpParams};
+
+const STATUS_SUCCESS: &str = "urn:oasis:names:tc:SAML:2.0:status:Success";
+
+/// The verified subject of a SAML assertion. OpenPXE is single-tier, so this
+/// is all an operator session needs.
+#[derive(Debug, Clone)]
+pub struct VerifiedPrincipal {
+    /// The `<NameID>` value (an email, per our requested NameID format).
+    pub name_id: String,
+    /// Email used as the session identity. Equals `name_id` for the
+    /// emailAddress NameID format.
+    pub email: String,
+    /// Human-readable display name, if the IdP sent one as an attribute.
+    pub display_name: Option<String>,
+}
+
+/// Result of a successful [`consume`]. The IDs/expiry feed the HTTP layer's
+/// stateful checks.
+#[derive(Debug, Clone)]
+pub struct VerifiedResponse {
+    pub principal: VerifiedPrincipal,
+    /// `InResponseTo` from the response, if present. `None` = unsolicited
+    /// (IdP-initiated) — the HTTP layer only accepts that when the operator
+    /// enabled it.
+    pub in_response_to: Option<String>,
+    /// The assertion's `ID` — used by the caller as the replay-guard key.
+    pub assertion_id: String,
+    /// The assertion's expiry (`Conditions/@NotOnOrAfter`) — the replay
+    /// guard can drop the consumed ID after this instant.
+    pub assertion_expiry: OffsetDateTime,
+    /// `AuthnStatement/@SessionIndex`, if present (useful for future SLO).
+    pub session_index: Option<String>,
+}
+
+/// Verify and validate a decoded `SAMLResponse` XML document.
+pub fn consume(
+    xml: &str,
+    sp: &SpParams,
+    idp: &IdpMetadata,
+    now: OffsetDateTime,
+    clock_skew: Duration,
+) -> Result<VerifiedResponse, SamlError> {
+    // 1. Cryptographically verify the signature against the pinned IdP cert(s).
+    //    `trusted_keys_only` ignores any cert embedded in the document's
+    //    KeyInfo, so an attacker can't substitute their own key.
+    let verified_uris = verify_signature(xml, &idp.signing_certs_der)?;
+
+    // 2. Parse for semantic validation.
+    let doc = Document::parse(xml).map_err(|e| SamlError::Xml(e.to_string()))?;
+    let root = doc.root_element();
+    if root.tag_name().name() != "Response" {
+        return Err(SamlError::MissingElement("Response".into()));
+    }
+    let response_id = root.attribute("ID").map(str::to_owned);
+    let in_response_to = root.attribute("InResponseTo").map(str::to_owned);
+
+    // 3. Status must be Success.
+    let status_value = root
+        .descendants()
+        .find(|n| n.is_element() && n.tag_name().name() == "StatusCode")
+        .and_then(|sc| sc.attribute("Value"))
+        .unwrap_or("");
+    if status_value != STATUS_SUCCESS && !status_value.ends_with(":Success") {
+        return Err(SamlError::Status(status_value.to_owned()));
+    }
+
+    // 4. Destination (if the IdP set one) must be our ACS.
+    if let Some(dest) = root.attribute("Destination") {
+        if !urls_equal(dest, &sp.acs_url) {
+            return Err(SamlError::DestinationMismatch);
+        }
+    }
+
+    // 5. Exactly one (unencrypted) Assertion.
+    if root
+        .descendants()
+        .any(|n| n.is_element() && n.tag_name().name() == "EncryptedAssertion")
+    {
+        return Err(SamlError::EncryptedAssertionUnsupported);
+    }
+    let assertions: Vec<Node<'_, '_>> = root
+        .children()
+        .filter(|c| c.is_element() && c.tag_name().name() == "Assertion")
+        .collect();
+    if assertions.len() != 1 {
+        return Err(SamlError::AssertionCount(assertions.len()));
+    }
+    let assertion = assertions[0];
+    let assertion_id = assertion
+        .attribute("ID")
+        .map(str::to_owned)
+        .ok_or_else(|| SamlError::MissingElement("Assertion/@ID".into()))?;
+
+    // 6. The signature must actually cover the assertion we're about to trust:
+    //    either the assertion itself, the enclosing response, or the whole
+    //    document. (bergshamra's strict_verification already constrains where
+    //    the signed element may sit; this ties it to *our* assertion.)
+    let covers_assertion = verified_uris.iter().any(|u| {
+        u.is_empty()
+            || u == &format!("#{assertion_id}")
+            || response_id
+                .as_ref()
+                .is_some_and(|rid| u == &format!("#{rid}"))
+    });
+    if !covers_assertion {
+        return Err(SamlError::SignatureScope);
+    }
+
+    // 7. Issuer must be the configured IdP.
+    let issuer = first_child(assertion, "Issuer")
+        .map(text_of)
+        .unwrap_or_default();
+    if !idp.entity_id.is_empty() && issuer != idp.entity_id {
+        return Err(SamlError::IssuerMismatch);
+    }
+
+    // 8. Subject → NameID + SubjectConfirmationData time/recipient checks.
+    let subject = first_child(assertion, "Subject")
+        .ok_or_else(|| SamlError::MissingElement("Subject".into()))?;
+    let name_id = first_child(subject, "NameID")
+        .map(text_of)
+        .filter(|s| !s.is_empty())
+        .ok_or_else(|| SamlError::MissingElement("NameID".into()))?;
+    if let Some(scd) = subject
+        .descendants()
+        .find(|n| n.is_element() && n.tag_name().name() == "SubjectConfirmationData")
+    {
+        if let Some(recipient) = scd.attribute("Recipient") {
+            if !urls_equal(recipient, &sp.acs_url) {
+                return Err(SamlError::DestinationMismatch);
+            }
+        }
+        if let Some(noa) = scd.attribute("NotOnOrAfter") {
+            let noa = parse_instant(noa)?;
+            if now >= noa + clock_skew {
+                return Err(SamlError::TimeBounds);
+            }
+        }
+    }
+
+    // 9. Conditions: time window + audience.
+    let conditions = first_child(assertion, "Conditions");
+    if let Some(cond) = conditions {
+        if let Some(nb) = cond.attribute("NotBefore") {
+            let nb = parse_instant(nb)?;
+            if now < nb - clock_skew {
+                return Err(SamlError::TimeBounds);
+            }
+        }
+    }
+    let assertion_expiry = conditions
+        .and_then(|c| c.attribute("NotOnOrAfter"))
+        .map(parse_instant)
+        .transpose()?
+        .ok_or_else(|| SamlError::MissingElement("Conditions/@NotOnOrAfter".into()))?;
+    if now >= assertion_expiry + clock_skew {
+        return Err(SamlError::TimeBounds);
+    }
+
+    let audience_ok = conditions.is_some_and(|c| {
+        c.descendants()
+            .filter(|n| n.is_element() && n.tag_name().name() == "Audience")
+            .any(|a| text_of(a) == sp.entity_id)
+    });
+    if !audience_ok {
+        return Err(SamlError::AudienceMismatch);
+    }
+
+    // 10. Optional: SessionIndex + display-name attribute.
+    let session_index = assertion
+        .descendants()
+        .find(|n| n.is_element() && n.tag_name().name() == "AuthnStatement")
+        .and_then(|a| a.attribute("SessionIndex"))
+        .map(str::to_owned);
+
+    let display_name = extract_display_name(assertion);
+
+    Ok(VerifiedResponse {
+        principal: VerifiedPrincipal {
+            email: name_id.clone(),
+            name_id,
+            display_name,
+        },
+        in_response_to,
+        assertion_id,
+        assertion_expiry,
+        session_index,
+    })
+}
+
+/// Verify the document's XML-DSig against each pinned IdP cert in turn
+/// (handles key rotation), returning the verified `<Reference>` URIs.
+fn verify_signature(xml: &str, certs_der: &[Vec<u8>]) -> Result<Vec<String>, SamlError> {
+    let mut last_err = String::from("no signing certificate matched");
+    for der in certs_der {
+        let key = match bergshamra::keys::loader::load_x509_cert_der(der) {
+            Ok(k) => k,
+            Err(e) => {
+                last_err = e.to_string();
+                continue;
+            }
+        };
+        let mut km = bergshamra::keys::KeysManager::new();
+        km.add_key(key);
+        // trusted_keys_only: only ever trust the pinned IdP key, never an
+        // inline KeyInfo cert. strict_verification: XSW positional defense.
+        let ctx = bergshamra::DsigContext::new(km)
+            .with_trusted_keys_only(true)
+            .with_strict_verification(true);
+        match bergshamra::verify(&ctx, xml) {
+            Ok(bergshamra::VerifyResult::Valid { references, .. }) => {
+                return Ok(references.into_iter().map(|r| r.uri).collect());
+            }
+            Ok(bergshamra::VerifyResult::Invalid { reason }) => last_err = reason,
+            Err(e) => last_err = e.to_string(),
+        }
+    }
+    Err(SamlError::Signature(last_err))
+}
+
+/// Pull a display name from the assertion's attribute statement, trying the
+/// common attribute names IdPs use (FleetDM checks the same set).
+fn extract_display_name(assertion: Node<'_, '_>) -> Option<String> {
+    const WANTED: &[&str] = &[
+        "name",
+        "displayname",
+        "cn",
+        "urn:oid:2.5.4.3",
+        "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
+    ];
+    for attr in assertion
+        .descendants()
+        .filter(|n| n.is_element() && n.tag_name().name() == "Attribute")
+    {
+        let key = attr
+            .attribute("Name")
+            .or_else(|| attr.attribute("FriendlyName"))
+            .unwrap_or("")
+            .to_ascii_lowercase();
+        if WANTED.contains(&key.as_str()) {
+            if let Some(val) = attr
+                .descendants()
+                .find(|n| n.is_element() && n.tag_name().name() == "AttributeValue")
+            {
+                let v = text_of(val);
+                if !v.is_empty() {
+                    return Some(v);
+                }
+            }
+        }
+    }
+    None
+}
+
+fn first_child<'a, 'i>(n: Node<'a, 'i>, local: &str) -> Option<Node<'a, 'i>> {
+    n.children()
+        .find(|c| c.is_element() && c.tag_name().name() == local)
+}
+
+fn text_of(n: Node<'_, '_>) -> String {
+    n.children()
+        .filter(Node::is_text)
+        .filter_map(|c| c.text())
+        .collect::<String>()
+        .trim()
+        .to_owned()
+}
+
+/// Parse an `xs:dateTime` (e.g. `2026-05-31T12:00:00.000Z`).
+fn parse_instant(s: &str) -> Result<OffsetDateTime, SamlError> {
+    OffsetDateTime::parse(s.trim(), &Rfc3339).map_err(|e| SamlError::Timestamp(format!("{s}: {e}")))
+}
+
+/// Compare two URLs for SAML endpoint-matching purposes: exact, or differing
+/// only by a single trailing slash.
+fn urls_equal(a: &str, b: &str) -> bool {
+    a == b || a.trim_end_matches('/') == b.trim_end_matches('/')
+}

crates/core/src/saml/tests.rs

@@ -0,0 +1,287 @@
+//! End-to-end SAML SP tests.
+//!
+//! We mint a throwaway self-signed cert/key with `rcgen`, sign a SAML Response
+//! template with `bergshamra::sign` (the same engine that verifies it), and
+//! drive [`response::consume`] through the accept path and every reject path.
+//! This proves both the signature wiring and the SP-semantic checks.
+
+use time::format_description::well_known::Rfc3339;
+use time::{Duration, OffsetDateTime};
+
+use super::metadata::IdpMetadata;
+use super::{response, SamlError, SpParams};
+
+const SP_ENTITY: &str = "https://pxe.example.com";
+const ACS: &str = "https://pxe.example.com/api/sso/acs";
+const IDP_ENTITY: &str = "https://idp.example.com/realms/fleet";
+const EMAIL: &str = "[email protected]";
+
+struct TestIdp {
+    cert_der: Vec<u8>,
+    key_pem: String,
+}
+
+fn test_idp() -> TestIdp {
+    let ck = rcgen::generate_simple_self_signed(vec!["idp.example.com".to_string()]).unwrap();
+    TestIdp {
+        cert_der: ck.cert.der().as_ref().to_vec(),
+        key_pem: ck.key_pair.serialize_pem(),
+    }
+}
+
+fn fmt(t: OffsetDateTime) -> String {
+    t.replace_nanosecond(0).unwrap().format(&Rfc3339).unwrap()
+}
+
+/// Knobs for building a response template — defaults are a valid response.
+struct Resp {
+    issuer: String,
+    audience: String,
+    status: String,
+    not_before: OffsetDateTime,
+    not_on_or_after: OffsetDateTime,
+    in_response_to: Option<String>,
+    recipient: String,
+}
+
+impl Default for Resp {
+    fn default() -> Self {
+        let now = OffsetDateTime::now_utc();
+        Self {
+            issuer: IDP_ENTITY.into(),
+            audience: SP_ENTITY.into(),
+            status: "urn:oasis:names:tc:SAML:2.0:status:Success".into(),
+            not_before: now - Duration::minutes(5),
+            not_on_or_after: now + Duration::hours(1),
+            in_response_to: Some("_req-abc".into()),
+            recipient: ACS.into(),
+        }
+    }
+}
+
+impl Resp {
+    /// The unsigned template (a `<ds:Signature>` with empty values).
+    fn template(&self) -> String {
+        let now = fmt(OffsetDateTime::now_utc());
+        let irt = self
+            .in_response_to
+            .as_ref()
+            .map(|v| format!(r#" InResponseTo="{v}""#))
+            .unwrap_or_default();
+        format!(
+            r##"<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_resp1" Version="2.0" IssueInstant="{now}" Destination="{ACS}"{irt}>
+  <saml:Issuer>{issuer}</saml:Issuer>
+  <samlp:Status><samlp:StatusCode Value="{status}"/></samlp:Status>
+  <saml:Assertion ID="_assertion1" Version="2.0" IssueInstant="{now}">
+    <saml:Issuer>{issuer}</saml:Issuer>
+    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+      <ds:SignedInfo>
+        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+        <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256"/>
+        <ds:Reference URI="#_assertion1">
+          <ds:Transforms>
+            <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
+            <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+          </ds:Transforms>
+          <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
+          <ds:DigestValue></ds:DigestValue>
+        </ds:Reference>
+      </ds:SignedInfo>
+      <ds:SignatureValue></ds:SignatureValue>
+    </ds:Signature>
+    <saml:Subject>
+      <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">{EMAIL}</saml:NameID>
+      <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
+        <saml:SubjectConfirmationData Recipient="{recipient}" NotOnOrAfter="{noa}"{irt}/>
+      </saml:SubjectConfirmation>
+    </saml:Subject>
+    <saml:Conditions NotBefore="{nb}" NotOnOrAfter="{noa}">
+      <saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction>
+    </saml:Conditions>
+    <saml:AuthnStatement AuthnInstant="{now}" SessionIndex="sess-123">
+      <saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef></saml:AuthnContext>
+    </saml:AuthnStatement>
+    <saml:AttributeStatement>
+      <saml:Attribute Name="displayName"><saml:AttributeValue>Miles Ward</saml:AttributeValue></saml:Attribute>
+    </saml:AttributeStatement>
+  </saml:Assertion>
+</samlp:Response>"##,
+            issuer = self.issuer,
+            status = self.status,
+            audience = self.audience,
+            recipient = self.recipient,
+            nb = fmt(self.not_before),
+            noa = fmt(self.not_on_or_after),
+        )
+    }
+}
+
+fn sign(template: &str, key_pem: &str) -> String {
+    let key = bergshamra::keys::loader::load_pem_auto(key_pem.as_bytes(), None)
+        .expect("load test signing key");
+    let mut km = bergshamra::keys::KeysManager::new();
+    km.add_key(key);
+    let ctx = bergshamra::DsigContext::new(km);
+    bergshamra::sign(&ctx, template).expect("sign test response")
+}
+
+fn sp() -> SpParams {
+    SpParams {
+        entity_id: SP_ENTITY.into(),
+        acs_url: ACS.into(),
+    }
+}
+
+fn idp(cert_der: Vec<u8>) -> IdpMetadata {
+    IdpMetadata {
+        entity_id: IDP_ENTITY.into(),
+        sso_redirect_url: None,
+        sso_post_url: None,
+        signing_certs_der: vec![cert_der],
+    }
+}
+
+fn consume(xml: &str, cert_der: Vec<u8>) -> Result<response::VerifiedResponse, SamlError> {
+    response::consume(
+        xml,
+        &sp(),
+        &idp(cert_der),
+        OffsetDateTime::now_utc(),
+        Duration::seconds(60),
+    )
+}
+
+#[test]
+fn good_response_yields_principal() {
+    let t = test_idp();
+    let signed = sign(&Resp::default().template(), &t.key_pem);
+    let out = consume(&signed, t.cert_der).expect("valid response should verify");
+    assert_eq!(out.principal.email, EMAIL);
+    assert_eq!(out.principal.name_id, EMAIL);
+    assert_eq!(out.principal.display_name.as_deref(), Some("Miles Ward"));
+    assert_eq!(out.in_response_to.as_deref(), Some("_req-abc"));
+    assert_eq!(out.assertion_id, "_assertion1");
+    assert_eq!(out.session_index.as_deref(), Some("sess-123"));
+}
+
+#[test]
+fn tampered_assertion_is_rejected() {
+    let t = test_idp();
+    let signed = sign(&Resp::default().template(), &t.key_pem);
+    // Flip the subject email after signing — breaks the digest.
+    let tampered = signed.replace(EMAIL, "[email protected]");
+    assert_ne!(signed, tampered);
+    assert!(matches!(
+        consume(&tampered, t.cert_der),
+        Err(SamlError::Signature(_) | SamlError::SignatureScope)
+    ));
+}
+
+#[test]
+fn unsigned_response_is_rejected() {
+    let t = test_idp();
+    // Feed the *unsigned* template (empty SignatureValue) straight in.
+    let unsigned = Resp::default().template();
+    assert!(matches!(
+        consume(&unsigned, t.cert_der),
+        Err(SamlError::Signature(_))
+    ));
+}
+
+#[test]
+fn wrong_signing_key_is_rejected() {
+    let signer = test_idp();
+    let other = test_idp(); // different keypair pinned as the "IdP" cert
+    let signed = sign(&Resp::default().template(), &signer.key_pem);
+    assert!(matches!(
+        consume(&signed, other.cert_der),
+        Err(SamlError::Signature(_))
+    ));
+}
+
+#[test]
+fn wrong_audience_is_rejected() {
+    let t = test_idp();
+    let r = Resp {
+        audience: "https://someone-else.example".into(),
+        ..Resp::default()
+    };
+    let signed = sign(&r.template(), &t.key_pem);
+    assert!(matches!(
+        consume(&signed, t.cert_der),
+        Err(SamlError::AudienceMismatch)
+    ));
+}
+
+#[test]
+fn expired_assertion_is_rejected() {
+    let t = test_idp();
+    let now = OffsetDateTime::now_utc();
+    let r = Resp {
+        not_before: now - Duration::hours(2),
+        not_on_or_after: now - Duration::hours(1),
+        ..Resp::default()
+    };
+    let signed = sign(&r.template(), &t.key_pem);
+    assert!(matches!(
+        consume(&signed, t.cert_der),
+        Err(SamlError::TimeBounds)
+    ));
+}
+
+#[test]
+fn future_assertion_is_rejected() {
+    let t = test_idp();
+    let now = OffsetDateTime::now_utc();
+    let r = Resp {
+        not_before: now + Duration::hours(1),
+        not_on_or_after: now + Duration::hours(2),
+        ..Resp::default()
+    };
+    let signed = sign(&r.template(), &t.key_pem);
+    assert!(matches!(
+        consume(&signed, t.cert_der),
+        Err(SamlError::TimeBounds)
+    ));
+}
+
+#[test]
+fn wrong_issuer_is_rejected() {
+    let t = test_idp();
+    let r = Resp {
+        issuer: "https://evil-idp.example".into(),
+        ..Resp::default()
+    };
+    let signed = sign(&r.template(), &t.key_pem);
+    assert!(matches!(
+        consume(&signed, t.cert_der),
+        Err(SamlError::IssuerMismatch)
+    ));
+}
+
+#[test]
+fn non_success_status_is_rejected() {
+    let t = test_idp();
+    let r = Resp {
+        status: "urn:oasis:names:tc:SAML:2.0:status:Requester".into(),
+        ..Resp::default()
+    };
+    let signed = sign(&r.template(), &t.key_pem);
+    assert!(matches!(
+        consume(&signed, t.cert_der),
+        Err(SamlError::Status(_))
+    ));
+}
+
+#[test]
+fn idp_initiated_has_no_in_response_to() {
+    // No InResponseTo => the HTTP layer must gate it behind allow_idp_initiated.
+    let t = test_idp();
+    let r = Resp {
+        in_response_to: None,
+        ..Resp::default()
+    };
+    let signed = sign(&r.template(), &t.key_pem);
+    let out = consume(&signed, t.cert_der).expect("unsolicited but otherwise valid");
+    assert!(out.in_response_to.is_none());
+}

crates/core/src/settings.rs

@@ -48,9 +48,9 @@ pub struct Settings {
     pub default_local_hdd: bool,
 
     /// When a client hits the Queued Deployment item, how long (seconds) to
-    /// hold it at the gate before giving up and falling back to the menu.
+    /// hold it in queue before giving up and falling back to the menu.
     /// 0 = forever.
-    pub gate_wait_max_secs: u32,
+    pub queue_wait_max_secs: u32,
 
     /// Optional DNS server advertised on the Network tab. Purely
     /// informational today — OpenPXE does not run a DNS server, but
@@ -67,11 +67,8 @@ pub enum TimeoutAction {
     /// Chain the "Boot from Local HDD" entry.
     LocalHdd,
     /// Put the client into the deployment queue, waiting for operator
-    /// assignment. The serde alias keeps v0.2.0 settings.json files
+    /// assignment.
-    /// readable after the v0.3.0 rename — old `"gated_deployment"`
-    /// values deserialize transparently.
     #[default]
-    #[serde(alias = "gated_deployment")]
     QueuedDeployment,
 }
 
@@ -84,7 +81,7 @@ impl Default for Settings {
             smb_host_override: String::new(),
             extra_kernel_args: String::new(),
             default_local_hdd: true,
-            gate_wait_max_secs: 0,
+            queue_wait_max_secs: 0,
             dns_server: String::new(),
         }
     }
@@ -115,7 +112,10 @@ impl SettingsStore {
             },
             Err(_) => Settings::default(),
         };
-        Arc::new(Self { path, inner: RwLock::new(initial) })
+        Arc::new(Self {
+            path,
+            inner: RwLock::new(initial),
+        })
     }
 
     #[must_use]
@@ -181,6 +181,12 @@ mod tests {
         assert!(s.windows_enabled);
     }
 
+    #[test]
+    fn settings_serialize_queue_naming() {
+        let text = serde_json::to_string(&Settings::default()).unwrap();
+        assert!(text.contains("queue_wait_max_secs"));
+    }
+
     #[test]
     fn corrupt_file_falls_back_to_default() {
         let dir = tempdir().unwrap();

crates/core/src/sso.rs

@@ -0,0 +1,420 @@
+//! SAML SSO configuration — FleetDM-shaped.
+//!
+//! The operator pastes their IdP's metadata XML (or its URL) and a
+//! human-readable label. As of v0.5.1 the SAML login flow is wired
+//! end-to-end (see [`crate::saml`]): SP-initiated AuthnRequest, the ACS
+//! endpoint, pure-Rust signature verification, and operator-session
+//! minting. This module owns only the persisted *configuration*.
+//!
+//! Shape borrowed from <https://github.com/fleetdm/fleet>'s app-config
+//! SSO block, minus the user-RBAC fields (OpenPXE is single-tier: any
+//! IdP-authenticated user the SP cryptographically verifies gets an
+//! operator session; there is no per-user role table). Entity ID is
+//! exposed (FleetDM-style) but defaults to the advertised public base
+//! URL when blank, which is what most IdPs expect anyway.
+
+use parking_lot::RwLock;
+use serde::{Deserialize, Serialize};
+use std::path::PathBuf;
+use std::sync::Arc;
+
+use crate::{Error, Result};
+
+/// The configurable surface. `metadata` and `metadata_url` are mutually
+/// exclusive at apply time (one or the other identifies the IdP); the
+/// store keeps both fields so an operator can switch between them
+/// without losing the inactive one.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+pub struct SsoConfig {
+    /// Master switch — when false, all SSO machinery (planned for a
+    /// later release) is skipped regardless of the rest of the fields.
+    #[serde(default)]
+    pub enabled: bool,
+    /// Display name shown on the WebUI's login screen as the "Sign in
+    /// with X" button label. Empty/whitespace falls back to "SSO".
+    #[serde(default)]
+    pub idp_name: String,
+    /// Optional HTTPS URL pointing at the IdP's brand logo. Rendered
+    /// next to `idp_name` on the WebUI's login screen (FleetDM-style).
+    /// Length-capped at [`MAX_URL_LEN`]; empty is fine.
+    #[serde(default)]
+    pub idp_logo_url: String,
+    /// Raw SAML metadata XML pasted by the operator. Mutually exclusive
+    /// with `metadata_url`; if both are set, the URL wins at apply time
+    /// (operators typically forget about a stale XML paste).
+    #[serde(default)]
+    pub metadata: String,
+    /// HTTPS URL where the IdP serves its metadata. Loaded lazily by the
+    /// future SAML flow; not validated here beyond a basic length cap.
+    #[serde(default)]
+    pub metadata_url: String,
+    /// SP Entity ID advertised to the IdP — mirrors FleetDM's "Entity ID".
+    /// Must exactly match the SP/Relying-Party entry configured on the IdP.
+    /// Empty falls back to the advertised public base URL at runtime, which
+    /// is what most IdPs expect. Length-capped at [`MAX_URL_LEN`].
+    #[serde(default)]
+    pub entity_id: String,
+    /// Allow IdP-initiated login — an unsolicited `<Response>` POSTed to the
+    /// ACS with no `InResponseTo`. Mirrors FleetDM's "Allow SSO login
+    /// initiated by identity provider". Default off; SP-initiated (the
+    /// "Sign in with X" button) is always allowed regardless.
+    #[serde(default)]
+    pub allow_idp_initiated: bool,
+}
+
+impl SsoConfig {
+    /// Returns `true` only when the config is *usable* — enabled, and
+    /// at least one of metadata/metadata_url is present. The future
+    /// login flow will key off this; for v0.4.5 the WebUI uses it to
+    /// surface a yellow "configured but not live yet" hint.
+    #[must_use]
+    pub fn is_usable(&self) -> bool {
+        self.enabled && (!self.metadata.trim().is_empty() || !self.metadata_url.trim().is_empty())
+    }
+}
+
+/// The minimal, non-sensitive slice of the SSO config that the **pre-auth**
+/// login screen needs to render the "Sign in with …" button. Carries only
+/// the display affordances — never the metadata XML/URL or entity ID, which
+/// stay behind the auth-gated `/api/sso`. Served as part of the public
+/// `/api/me` so the button renders reliably whether or not anyone is signed
+/// in (v0.5.9: fixes the button vanishing because `/api/sso` 401s pre-auth).
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+pub struct SsoLoginInfo {
+    /// True only when SSO is *usable* (enabled AND a metadata source is
+    /// present) — i.e. clicking the button will actually reach an IdP.
+    pub enabled: bool,
+    /// Button label, e.g. "STC AD". Empty falls back to "SSO" in the UI.
+    pub idp_name: String,
+    /// Optional IdP logo rendered on the button. Empty = no image.
+    pub idp_logo_url: String,
+}
+
+/// In-memory + on-disk SSO settings registry.
+#[derive(Debug, Clone)]
+pub struct SsoStore {
+    path: Arc<PathBuf>,
+    inner: Arc<RwLock<SsoConfig>>,
+}
+
+impl SsoStore {
+    /// Load from `<work_dir>/sso.json`, or start with the default empty
+    /// (`enabled = false`) config. A corrupt file falls back to default
+    /// rather than blocking startup.
+    #[must_use]
+    pub fn load_or_default(work_dir: &std::path::Path) -> Self {
+        let path = work_dir.join("sso.json");
+        let cfg = match std::fs::read_to_string(&path) {
+            Ok(text) => match serde_json::from_str::<SsoConfig>(&text) {
+                Ok(parsed) => parsed,
+                Err(e) => {
+                    tracing::warn!(
+                        target: "openpxe::sso",
+                        "sso.json present but unreadable ({e}); starting with default config"
+                    );
+                    SsoConfig::default()
+                }
+            },
+            Err(_) => SsoConfig::default(),
+        };
+        Self {
+            path: Arc::new(path),
+            inner: Arc::new(RwLock::new(cfg)),
+        }
+    }
+
+    #[must_use]
+    pub fn snapshot(&self) -> SsoConfig {
+        self.inner.read().clone()
+    }
+
+    /// Public, non-sensitive descriptor for the login screen. Safe to
+    /// expose pre-auth — it's exactly what the "Sign in with …" button
+    /// keys off, with no metadata/entity-ID leakage. v0.5.9.
+    #[must_use]
+    pub fn login_info(&self) -> SsoLoginInfo {
+        let cfg = self.inner.read();
+        SsoLoginInfo {
+            enabled: cfg.is_usable(),
+            idp_name: cfg.idp_name.clone(),
+            idp_logo_url: cfg.idp_logo_url.clone(),
+        }
+    }
+
+    /// Replace the whole config in one shot. Light validation: metadata
+    /// XML and URL are length-capped so an operator can't OOM us by
+    /// pasting a 10 GiB blob; the IdP UI tab clamps the input visually,
+    /// but the server enforces a hard ceiling regardless.
+    pub fn replace(&self, mut cfg: SsoConfig) -> Result<SsoConfig> {
+        cfg.idp_name = cfg.idp_name.trim().to_string();
+        cfg.idp_logo_url = cfg.idp_logo_url.trim().to_string();
+        cfg.metadata = cfg.metadata.trim().to_string();
+        cfg.metadata_url = cfg.metadata_url.trim().to_string();
+        cfg.entity_id = cfg.entity_id.trim().to_string();
+        if cfg.entity_id.len() > MAX_URL_LEN {
+            return Err(Error::Invalid(format!(
+                "entity_id exceeds {MAX_URL_LEN}-char cap"
+            )));
+        }
+        if cfg.metadata.len() > MAX_METADATA_BYTES {
+            return Err(Error::Invalid(format!(
+                "metadata XML exceeds {MAX_METADATA_BYTES}-byte cap"
+            )));
+        }
+        if cfg.metadata_url.len() > MAX_URL_LEN {
+            return Err(Error::Invalid(format!(
+                "metadata_url exceeds {MAX_URL_LEN}-char cap"
+            )));
+        }
+        if cfg.idp_logo_url.len() > MAX_URL_LEN {
+            return Err(Error::Invalid(format!(
+                "idp_logo_url exceeds {MAX_URL_LEN}-char cap"
+            )));
+        }
+        if !cfg.metadata_url.is_empty()
+            && !cfg.metadata_url.starts_with("http://")
+            && !cfg.metadata_url.starts_with("https://")
+        {
+            return Err(Error::Invalid(
+                "metadata_url must start with http:// or https://".into(),
+            ));
+        }
+        if !cfg.idp_logo_url.is_empty()
+            && !cfg.idp_logo_url.starts_with("http://")
+            && !cfg.idp_logo_url.starts_with("https://")
+        {
+            return Err(Error::Invalid(
+                "idp_logo_url must start with http:// or https://".into(),
+            ));
+        }
+        // If they're trying to *enable* the integration but haven't
+        // supplied either source, reject — saves a "configured but
+        // unusable" surprise later.
+        if cfg.enabled && cfg.metadata.is_empty() && cfg.metadata_url.is_empty() {
+            return Err(Error::Invalid(
+                "enable SSO requires either metadata XML or a metadata URL".into(),
+            ));
+        }
+        {
+            let mut g = self.inner.write();
+            *g = cfg.clone();
+        }
+        self.persist();
+        tracing::info!(
+            target: "openpxe::sso",
+            enabled = cfg.enabled,
+            idp = %cfg.idp_name,
+            has_xml = !cfg.metadata.is_empty(),
+            has_url = !cfg.metadata_url.is_empty(),
+            "sso configuration updated"
+        );
+        Ok(cfg)
+    }
+
+    fn persist(&self) {
+        let snap = self.inner.read().clone();
+        let body = match serde_json::to_vec_pretty(&snap) {
+            Ok(b) => b,
+            Err(e) => {
+                tracing::warn!(target: "openpxe::sso", "serialize sso.json: {e}");
+                return;
+            }
+        };
+        if let Some(parent) = self.path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        let tmp = self.path.with_extension("json.tmp");
+        if let Err(e) = std::fs::write(&tmp, body) {
+            tracing::warn!(target: "openpxe::sso", "write sso.json tmp: {e}");
+            return;
+        }
+        if let Err(e) = std::fs::rename(&tmp, self.path.as_path()) {
+            tracing::warn!(target: "openpxe::sso", "rename sso.json: {e}");
+        }
+    }
+}
+
+/// Saturation caps. The numbers are generous for any real IdP metadata
+/// document — Okta's largest is ~50 KB, Azure AD's ~30 KB.
+const MAX_METADATA_BYTES: usize = 1024 * 1024;
+const MAX_URL_LEN: usize = 2048;
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::tempdir;
+
+    #[test]
+    fn default_is_disabled_and_empty() {
+        let dir = tempdir().unwrap();
+        let s = SsoStore::load_or_default(dir.path());
+        let cfg = s.snapshot();
+        assert!(!cfg.enabled);
+        assert!(cfg.metadata.is_empty());
+        assert!(cfg.metadata_url.is_empty());
+        assert!(!cfg.is_usable());
+    }
+
+    #[test]
+    fn replace_metadata_url_round_trip_via_disk() {
+        let dir = tempdir().unwrap();
+        let s = SsoStore::load_or_default(dir.path());
+        s.replace(SsoConfig {
+            enabled: true,
+            idp_name: "Okta".into(),
+            metadata: String::new(),
+            metadata_url: "https://idp.example.com/metadata".into(),
+            idp_logo_url: String::new(),
+            entity_id: String::new(),
+            allow_idp_initiated: false,
+        })
+        .unwrap();
+        drop(s);
+        let s2 = SsoStore::load_or_default(dir.path());
+        let cfg = s2.snapshot();
+        assert!(cfg.enabled);
+        assert!(cfg.is_usable());
+        assert_eq!(cfg.idp_name, "Okta");
+        assert_eq!(cfg.metadata_url, "https://idp.example.com/metadata");
+    }
+
+    #[test]
+    fn replace_xml_paste_is_accepted() {
+        let dir = tempdir().unwrap();
+        let s = SsoStore::load_or_default(dir.path());
+        let xml = r#"<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata">test</EntityDescriptor>"#;
+        s.replace(SsoConfig {
+            enabled: true,
+            idp_name: "Test IdP".into(),
+            metadata: xml.into(),
+            metadata_url: String::new(),
+            idp_logo_url: String::new(),
+            entity_id: String::new(),
+            allow_idp_initiated: false,
+        })
+        .unwrap();
+        assert!(s.snapshot().is_usable());
+    }
+
+    #[test]
+    fn enable_without_source_is_rejected() {
+        let dir = tempdir().unwrap();
+        let s = SsoStore::load_or_default(dir.path());
+        let r = s.replace(SsoConfig {
+            enabled: true,
+            idp_name: "Okta".into(),
+            metadata: String::new(),
+            metadata_url: String::new(),
+            idp_logo_url: String::new(),
+            entity_id: String::new(),
+            allow_idp_initiated: false,
+        });
+        assert!(matches!(r, Err(Error::Invalid(_))));
+        // …and a disabled blank config is fine.
+        s.replace(SsoConfig::default()).unwrap();
+    }
+
+    #[test]
+    fn metadata_url_must_be_http_scheme() {
+        let dir = tempdir().unwrap();
+        let s = SsoStore::load_or_default(dir.path());
+        let r = s.replace(SsoConfig {
+            enabled: false,
+            idp_name: String::new(),
+            metadata: String::new(),
+            metadata_url: "ftp://idp.example.com/metadata".into(),
+            idp_logo_url: String::new(),
+            entity_id: String::new(),
+            allow_idp_initiated: false,
+        });
+        assert!(matches!(r, Err(Error::Invalid(_))));
+    }
+
+    #[test]
+    fn idp_logo_url_must_be_http_scheme() {
+        // v0.4.6: SSO settings learned an idp_logo_url so the login
+        // screen can render the FleetDM-style "Sign in with <IdP-logo>"
+        // affordance. Same scheme rule as metadata_url.
+        let dir = tempdir().unwrap();
+        let s = SsoStore::load_or_default(dir.path());
+        let r = s.replace(SsoConfig {
+            enabled: false,
+            idp_name: "Okta".into(),
+            metadata: String::new(),
+            metadata_url: String::new(),
+            idp_logo_url: "data:image/png;base64,...".into(),
+            entity_id: String::new(),
+            allow_idp_initiated: false,
+        });
+        assert!(matches!(r, Err(Error::Invalid(_))));
+        // Real HTTPS URL is fine.
+        s.replace(SsoConfig {
+            enabled: false,
+            idp_name: "Okta".into(),
+            metadata: String::new(),
+            metadata_url: String::new(),
+            idp_logo_url: "https://idp.example.com/logo.png".into(),
+            entity_id: String::new(),
+            allow_idp_initiated: false,
+        })
+        .unwrap();
+        assert_eq!(
+            s.snapshot().idp_logo_url,
+            "https://idp.example.com/logo.png"
+        );
+    }
+
+    #[test]
+    fn entity_id_and_idp_initiated_round_trip() {
+        // v0.5.1: SP Entity ID + IdP-initiated toggle persist across reload.
+        let dir = tempdir().unwrap();
+        let s = SsoStore::load_or_default(dir.path());
+        s.replace(SsoConfig {
+            enabled: true,
+            idp_name: "Keycloak".into(),
+            metadata: String::new(),
+            metadata_url: "https://idp.example.com/metadata".into(),
+            idp_logo_url: String::new(),
+            entity_id: "https://pxe.example.com".into(),
+            allow_idp_initiated: true,
+        })
+        .unwrap();
+        drop(s);
+        let cfg = SsoStore::load_or_default(dir.path()).snapshot();
+        assert_eq!(cfg.entity_id, "https://pxe.example.com");
+        assert!(cfg.allow_idp_initiated);
+    }
+
+    #[test]
+    fn entity_id_cap_enforced() {
+        let dir = tempdir().unwrap();
+        let s = SsoStore::load_or_default(dir.path());
+        let r = s.replace(SsoConfig {
+            enabled: false,
+            idp_name: String::new(),
+            metadata: String::new(),
+            metadata_url: String::new(),
+            idp_logo_url: String::new(),
+            entity_id: "x".repeat(MAX_URL_LEN + 1),
+            allow_idp_initiated: false,
+        });
+        assert!(matches!(r, Err(Error::Invalid(_))));
+    }
+
+    #[test]
+    fn metadata_size_cap_enforced() {
+        let dir = tempdir().unwrap();
+        let s = SsoStore::load_or_default(dir.path());
+        let oversize = "a".repeat(MAX_METADATA_BYTES + 1);
+        let r = s.replace(SsoConfig {
+            enabled: false,
+            idp_name: String::new(),
+            metadata: oversize,
+            metadata_url: String::new(),
+            idp_logo_url: String::new(),
+            entity_id: String::new(),
+            allow_idp_initiated: false,
+        });
+        assert!(matches!(r, Err(Error::Invalid(_))));
+    }
+}

crates/core/src/wol.rs

@@ -0,0 +1,208 @@
+//! Wake-on-LAN.
+//!
+//! v0.5.0: from the Hosts tab, an operator can wake a bound machine.
+//! WoL is a "magic packet" — six `0xFF` bytes followed by the target
+//! MAC repeated sixteen times (102 bytes total) — broadcast on the
+//! local segment. The NIC's WoL logic matches the repeated MAC and
+//! powers the board on.
+//!
+//! ## Why this is trivial and safe in our container
+//!
+//! - It's a single UDP datagram to a broadcast address. No privileged
+//!   *local* port is needed (we bind an ephemeral source port); the
+//!   destination port is conventionally 9 (discard) or 7 (echo), and
+//!   nothing actually listens there — the magic is in the payload, not
+//!   the port. So WoL works without any extra capability.
+//! - We send to the limited broadcast `255.255.255.255` (stays on the
+//!   local link) and, when the caller knows the server's own subnet
+//!   broadcast, to that too — directed broadcast reaches the right VLAN
+//!   even when the host bridges multiple segments.
+//!
+//! ## Limits
+//!
+//! WoL only crosses L2. If the target is on a different subnet than the
+//! OpenPXE host, the intervening router must be configured to forward
+//! directed broadcasts (most aren't, by design). For the common case —
+//! OpenPXE and its PXE clients on the same VLAN — the limited broadcast
+//! is enough.
+
+use crate::{Error, Result};
+use std::net::{Ipv4Addr, SocketAddrV4, UdpSocket};
+
+/// Conventional WoL destination port. 9 (discard) is the de-facto
+/// default; the port is immaterial since the match is on the payload.
+const WOL_PORT: u16 = 9;
+
+/// Parse a MAC string in any common form (`aa:bb:cc:dd:ee:ff`,
+/// `aa-bb-...`, `aabb.ccdd.eeff`, or bare hex) into six octets.
+///
+/// Returns `Error::Invalid` if it doesn't resolve to exactly six bytes.
+pub fn parse_mac(mac: &str) -> Result<[u8; 6]> {
+    // Strip every non-hex-digit, then expect exactly 12 hex chars.
+    let hex: String = mac.chars().filter(char::is_ascii_hexdigit).collect();
+    if hex.len() != 12 {
+        return Err(Error::Invalid(format!(
+            "invalid MAC '{mac}': expected 6 octets (12 hex digits), got {}",
+            hex.len()
+        )));
+    }
+    let mut out = [0u8; 6];
+    for (i, byte) in out.iter_mut().enumerate() {
+        // Each octet is two hex chars; unwrap is safe — we validated
+        // the length and that every char is a hex digit above.
+        *byte = u8::from_str_radix(&hex[i * 2..i * 2 + 2], 16)
+            .map_err(|e| Error::Invalid(format!("invalid MAC '{mac}': {e}")))?;
+    }
+    Ok(out)
+}
+
+/// Build the 102-byte magic packet for `mac`.
+#[must_use]
+pub fn magic_packet(mac: [u8; 6]) -> [u8; 102] {
+    let mut pkt = [0u8; 102];
+    // 6 bytes of 0xFF.
+    for b in &mut pkt[..6] {
+        *b = 0xFF;
+    }
+    // MAC repeated 16 times.
+    for rep in 0..16 {
+        let start = 6 + rep * 6;
+        pkt[start..start + 6].copy_from_slice(&mac);
+    }
+    pkt
+}
+
+/// Send a Wake-on-LAN magic packet for `mac` to every address in
+/// `broadcasts` (e.g. `255.255.255.255` plus the server's subnet
+/// broadcast). Returns the number of broadcast addresses the packet was
+/// successfully sent to; errors only if the MAC is malformed or the
+/// socket can't be opened at all.
+pub fn wake(mac: &str, broadcasts: &[Ipv4Addr]) -> Result<usize> {
+    let parsed = parse_mac(mac)?;
+    let packet = magic_packet(parsed);
+
+    // Always include the limited broadcast even if the caller didn't —
+    // it's the one that works with zero network configuration.
+    let mut targets: Vec<Ipv4Addr> = vec![Ipv4Addr::BROADCAST];
+    for b in broadcasts {
+        if !targets.contains(b) {
+            targets.push(*b);
+        }
+    }
+
+    let sent = send_magic(&packet, &targets, WOL_PORT)?;
+    tracing::info!(
+        target: "openpxe::wol",
+        mac = %mac, broadcasts = sent,
+        "Wake-on-LAN magic packet sent"
+    );
+    Ok(sent)
+}
+
+/// Open a broadcast-enabled UDP socket and send `packet` to every
+/// `target:port`. Returns how many sends succeeded. Errors if the
+/// socket can't be opened or if *no* target accepted the packet.
+fn send_magic(packet: &[u8], targets: &[Ipv4Addr], port: u16) -> Result<usize> {
+    // Bind an ephemeral local UDP port on all interfaces. SO_BROADCAST
+    // must be enabled to send to a broadcast address.
+    let sock = UdpSocket::bind(SocketAddrV4::new(Ipv4Addr::UNSPECIFIED, 0))
+        .map_err(|e| Error::Invalid(format!("could not open WoL socket: {e}")))?;
+    sock.set_broadcast(true)
+        .map_err(|e| Error::Invalid(format!("could not enable broadcast: {e}")))?;
+
+    let mut sent = 0usize;
+    for &addr in targets {
+        match sock.send_to(packet, SocketAddrV4::new(addr, port)) {
+            Ok(_) => sent += 1,
+            Err(e) => {
+                tracing::warn!(
+                    target: "openpxe::wol",
+                    broadcast = %addr,
+                    "WoL send failed: {e}"
+                );
+            }
+        }
+    }
+    if sent == 0 {
+        return Err(Error::Invalid(
+            "Wake-on-LAN: no broadcast address accepted the packet".into(),
+        ));
+    }
+    Ok(sent)
+}
+
+/// Compute the IPv4 broadcast address for `ip`/`mask`, if both parse.
+/// Used so the caller can include the server's own subnet broadcast
+/// alongside the limited broadcast.
+#[must_use]
+pub fn subnet_broadcast(ip: Ipv4Addr, mask: Ipv4Addr) -> Ipv4Addr {
+    let ip = u32::from(ip);
+    let mask = u32::from(mask);
+    Ipv4Addr::from(ip | !mask)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn parse_mac_accepts_common_forms() {
+        let want = [0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff];
+        assert_eq!(parse_mac("aa:bb:cc:dd:ee:ff").unwrap(), want);
+        assert_eq!(parse_mac("AA-BB-CC-DD-EE-FF").unwrap(), want);
+        assert_eq!(parse_mac("aabb.ccdd.eeff").unwrap(), want);
+        assert_eq!(parse_mac("aabbccddeeff").unwrap(), want);
+    }
+
+    #[test]
+    fn parse_mac_rejects_bad_length() {
+        assert!(parse_mac("aa:bb:cc").is_err());
+        assert!(parse_mac("").is_err());
+        assert!(parse_mac("zz:bb:cc:dd:ee:ff").is_err()); // non-hex stripped → too short
+    }
+
+    #[test]
+    fn magic_packet_shape() {
+        let pkt = magic_packet([0x01, 0x02, 0x03, 0x04, 0x05, 0x06]);
+        assert_eq!(&pkt[..6], &[0xFF; 6]);
+        // First MAC repetition.
+        assert_eq!(&pkt[6..12], &[0x01, 0x02, 0x03, 0x04, 0x05, 0x06]);
+        // Last (16th) repetition ends the packet.
+        assert_eq!(&pkt[96..102], &[0x01, 0x02, 0x03, 0x04, 0x05, 0x06]);
+    }
+
+    #[test]
+    fn subnet_broadcast_computes() {
+        assert_eq!(
+            subnet_broadcast(
+                Ipv4Addr::new(192, 168, 1, 49),
+                Ipv4Addr::new(255, 255, 255, 0)
+            ),
+            Ipv4Addr::new(192, 168, 1, 255)
+        );
+        assert_eq!(
+            subnet_broadcast(Ipv4Addr::new(10, 5, 3, 7), Ipv4Addr::new(255, 255, 0, 0)),
+            Ipv4Addr::new(10, 5, 255, 255)
+        );
+    }
+
+    #[test]
+    fn send_magic_delivers_intact_packet_over_loopback() {
+        // Deterministic round-trip that doesn't depend on the sandbox
+        // permitting a real L2 broadcast: bind a receiver on loopback
+        // and confirm send_magic transmits the exact 102-byte packet.
+        let rx = UdpSocket::bind(SocketAddrV4::new(Ipv4Addr::LOCALHOST, 0)).unwrap();
+        let port = rx.local_addr().unwrap().port();
+        rx.set_read_timeout(Some(std::time::Duration::from_secs(2)))
+            .unwrap();
+
+        let packet = magic_packet([0x0a, 0x1b, 0x2c, 0x3d, 0x4e, 0x5f]);
+        let sent = send_magic(&packet, &[Ipv4Addr::LOCALHOST], port).unwrap();
+        assert_eq!(sent, 1);
+
+        let mut buf = [0u8; 128];
+        let n = rx.recv(&mut buf).unwrap();
+        assert_eq!(n, 102, "magic packet should be 102 bytes");
+        assert_eq!(&buf[..102], &packet[..]);
+    }
+}

crates/dhcp-proxy/Cargo.toml

@@ -18,3 +18,9 @@ tracing.workspace = true
 thiserror.workspace = true
 anyhow.workspace = true
 bytes.workspace = true
+parking_lot.workspace = true
+# v0.7.1: learned driver modes persist to <work_dir>/driver_modes.json.
+serde_json.workspace = true
+
+[dev-dependencies]
+tempfile = "3.12"

crates/dhcp-proxy/src/escalation.rs

@@ -0,0 +1,494 @@
+//! Automatic per-MAC boot-binary escalation (v0.6.1, extended v0.7.x).
+//!
+//! OpenPXE serves the firmware-net iPXE build (`snponly`/`undionly`) by
+//! default — it's the most reliable choice for chainloading because the
+//! firmware just proved its network works by downloading the NBP. Two
+//! classes of machine can't run it:
+//!
+//! * a minority of NICs have a missing or buggy firmware UNDI/SNP stack —
+//!   they TFTP the binary fine but iPXE can't bring the link up;
+//! * Secure-Boot firmware downloads it fine but refuses to *execute* an
+//!   unsigned image.
+//!
+//! Both look identical from here: the tell-tale second DHCP DISCOVER
+//! carrying the `iPXE` user-class never arrives and the machine
+//! re-PXE-boots. So a fresh firmware DISCOVER from a MAC whose previous
+//! attempt was never confirmed climbs one rung:
+//! `Firmware → Builtin → Shim` (the signed shim+GRUB chain). The decision
+//! is sticky; there is no operator toggle; the default path is unchanged
+//! so hardware that already boots never regresses.
+//!
+//! v0.7.1 — **learned modes persist**. Walking the ladder costs one or
+//! two failed boot cycles, so a machine should pay it once *ever*, not
+//! once per idle window or server restart. Two events pin a MAC's mode
+//! to disk (`<work_dir>/driver_modes.json`):
+//!
+//! * a confirmed iPXE handoff at a non-default mode (Builtin proved to
+//!   work — also Shim, via the GRUB→iPXE same-boot chainload);
+//! * reaching the terminal Shim rung (Secure-Boot machines never produce
+//!   an iPXE handoff from the signed menu, so escalation itself is the
+//!   best knowledge we'll ever have).
+//!
+//! Pinned entries are immune to the TTL and reload at startup. The
+//! operator escape hatch is a rules-level driver-mode pin (which
+//! overrides this table entirely) or deleting `driver_modes.json`.
+
+use openpxe_core::DriverMode;
+use parking_lot::Mutex;
+use std::collections::HashMap;
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+use std::time::{Duration, Instant};
+
+/// Multiple DISCOVERs within this window belong to the *same* boot (DHCP
+/// retransmits, plus the :4011 PXE Boot Server query that follows the :67
+/// DISCOVER). They must not be mistaken for a failed-and-retried boot.
+const SAME_BOOT_DEBOUNCE: Duration = Duration::from_secs(8);
+
+/// Forget an *unpinned* MAC's state after this long with no activity, so
+/// a transient mid-walk state doesn't linger and the map stays bounded.
+/// Pinned (learned) entries are exempt — that's their whole point.
+const ENTRY_TTL: Duration = Duration::from_mins(30);
+
+/// Hard cap on tracked MACs. Past this we evict the least-recently-seen
+/// entry (unpinned first) — escalation is best-effort, never a
+/// memory-growth vector.
+const MAX_ENTRIES: usize = 4096;
+
+/// How often (at most) the whole map is swept for expired entries.
+/// Correctness doesn't depend on the sweep — a stale entry is also
+/// detected inline when its MAC next appears — so the sweep only bounds
+/// memory for MACs that never return, and amortizing it keeps the
+/// per-packet path O(1) instead of O(map).
+const PRUNE_INTERVAL: Duration = Duration::from_mins(1);
+
+#[derive(Debug, Clone, Copy)]
+struct Entry {
+    mode: DriverMode,
+    /// True once we've served `mode` and are waiting for the iPXE handoff to
+    /// confirm it worked. A *new* boot arriving while this is still true means
+    /// the previous attempt failed and we should escalate.
+    awaiting_confirm: bool,
+    /// Learned mode (v0.7.1): persisted to disk, exempt from the TTL.
+    pinned: bool,
+    last_seen: Instant,
+}
+
+#[derive(Debug)]
+struct Inner {
+    map: HashMap<String, Entry>,
+    /// When the last full TTL sweep ran — see [`PRUNE_INTERVAL`].
+    last_prune: Instant,
+}
+
+impl Default for Inner {
+    fn default() -> Self {
+        Self {
+            map: HashMap::new(),
+            last_prune: Instant::now(),
+        }
+    }
+}
+
+/// Tracks per-MAC driver-mode escalation. Cheap to share via `Arc`.
+#[derive(Debug, Default)]
+pub struct DriverEscalation {
+    inner: Mutex<Inner>,
+    /// Persistence target for learned modes; `None` = ephemeral (tests).
+    path: Option<Arc<PathBuf>>,
+}
+
+impl DriverEscalation {
+    /// Ephemeral instance (no persistence) — used by tests.
+    #[must_use]
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Instance backed by `<work_dir>/driver_modes.json`. Learned modes
+    /// from previous runs are reloaded as pinned entries; a missing or
+    /// corrupt file starts empty (same crash-cache policy as every other
+    /// store — a bad file must never block PXE).
+    #[must_use]
+    pub fn load_or_default(work_dir: &Path) -> Self {
+        let path = work_dir.join("driver_modes.json");
+        let mut map = HashMap::new();
+        if let Ok(text) = std::fs::read_to_string(&path) {
+            match serde_json::from_str::<HashMap<String, DriverMode>>(&text) {
+                Ok(loaded) => {
+                    let now = Instant::now();
+                    for (mac, mode) in loaded {
+                        // Firmware is the default — persisting it would be
+                        // noise; tolerate it in the file but don't track it.
+                        if mode == DriverMode::Firmware {
+                            continue;
+                        }
+                        map.insert(
+                            mac,
+                            Entry {
+                                mode,
+                                awaiting_confirm: false,
+                                pinned: true,
+                                last_seen: now,
+                            },
+                        );
+                    }
+                    tracing::info!(
+                        target: "openpxe::dhcp",
+                        learned = map.len(),
+                        "loaded learned driver modes"
+                    );
+                }
+                Err(e) => {
+                    tracing::warn!(
+                        target: "openpxe::dhcp",
+                        "driver_modes.json present but unreadable ({e}); starting empty"
+                    );
+                }
+            }
+        }
+        Self {
+            inner: Mutex::new(Inner {
+                map,
+                last_prune: Instant::now(),
+            }),
+            path: Some(Arc::new(path)),
+        }
+    }
+
+    /// Decide the driver mode for a firmware (PXEClient/HTTPClient) boot from
+    /// `mac`. `primary` is true for the main DHCP DISCOVER (:67) and false for
+    /// the PXE Boot Server query (:4011); only the primary path drives
+    /// escalation, and only when it's clearly a *new* boot (outside the
+    /// same-boot debounce). The :4011 path just echoes the current mode.
+    pub fn mode_for_firmware_attempt(&self, mac: &str, primary: bool) -> DriverMode {
+        self.decide_at(mac, primary, Instant::now())
+    }
+
+    /// Record that `mac` completed the iPXE handoff (a DISCOVER carrying the
+    /// `iPXE` user-class). The mode we last served worked, so stop awaiting
+    /// confirmation, keep it sticky, and — for non-default modes — pin it to
+    /// disk so the machine never re-walks the ladder (v0.7.1).
+    pub fn mark_ipxe_success(&self, mac: &str) {
+        self.confirm_at(mac, Instant::now());
+    }
+
+    fn decide_at(&self, mac: &str, primary: bool, now: Instant) -> DriverMode {
+        let (mode, snapshot) = {
+            let mut g = self.inner.lock();
+            if now.duration_since(g.last_prune) >= PRUNE_INTERVAL {
+                g.map
+                    .retain(|_, e| e.pinned || now.duration_since(e.last_seen) < ENTRY_TTL);
+                g.last_prune = now;
+            }
+            // Inline staleness check: an unpinned MAC whose entry outlived
+            // the TTL starts fresh even when the amortized sweep above
+            // hasn't caught it yet. Pinned entries never go stale.
+            if g.map
+                .get(mac)
+                .is_some_and(|e| !e.pinned && now.duration_since(e.last_seen) >= ENTRY_TTL)
+            {
+                g.map.remove(mac);
+            }
+
+            let mut newly_pinned = false;
+            let mode = match g.map.get_mut(mac) {
+                None => {
+                    g.map.insert(
+                        mac.to_owned(),
+                        Entry {
+                            mode: DriverMode::Firmware,
+                            // Only the primary DISCOVER opens a confirmation window.
+                            awaiting_confirm: primary,
+                            pinned: false,
+                            last_seen: now,
+                        },
+                    );
+                    if g.map.len() > MAX_ENTRIES {
+                        evict_oldest(&mut g.map);
+                    }
+                    DriverMode::Firmware
+                }
+                Some(entry) => {
+                    let recent = now.duration_since(entry.last_seen) < SAME_BOOT_DEBOUNCE;
+                    if primary && !recent {
+                        // A genuinely new boot. If the previous attempt was
+                        // never confirmed, the build we served failed → climb
+                        // one rung: Firmware (firmware NIC stack) → Builtin
+                        // (iPXE's own drivers) → Shim (signed shim+GRUB —
+                        // covers Secure Boot firmware that downloads our
+                        // unsigned iPXE but refuses to execute it). Shim is
+                        // terminal and pins to disk: SB machines never emit
+                        // an iPXE handoff from the signed menu, so reaching
+                        // the rung *is* the durable knowledge.
+                        if entry.awaiting_confirm {
+                            entry.mode = match entry.mode {
+                                DriverMode::Firmware => DriverMode::Builtin,
+                                DriverMode::Builtin | DriverMode::Shim => DriverMode::Shim,
+                            };
+                            if entry.mode == DriverMode::Shim && !entry.pinned {
+                                entry.pinned = true;
+                                newly_pinned = true;
+                            }
+                        }
+                        entry.awaiting_confirm = true;
+                    }
+                    entry.last_seen = now;
+                    entry.mode
+                }
+            };
+            (mode, newly_pinned.then(|| pinned_snapshot(&g.map)))
+        };
+        if let Some(s) = snapshot {
+            self.persist(&s);
+        }
+        mode
+    }
+
+    fn confirm_at(&self, mac: &str, now: Instant) {
+        let snapshot = {
+            let mut g = self.inner.lock();
+            let Some(e) = g.map.get_mut(mac) else {
+                return;
+            };
+            e.awaiting_confirm = false;
+            e.last_seen = now;
+            // A proven non-default mode is worth remembering forever —
+            // the machine demonstrably can't use the default path.
+            if e.mode != DriverMode::Firmware && !e.pinned {
+                e.pinned = true;
+                Some(pinned_snapshot(&g.map))
+            } else {
+                None
+            }
+        };
+        if let Some(s) = snapshot {
+            self.persist(&s);
+        }
+    }
+
+    /// Best-effort atomic write of the learned-mode table. No-op for
+    /// ephemeral instances. Failure logs and moves on — persistence is an
+    /// optimization, never a correctness requirement.
+    fn persist(&self, snapshot: &HashMap<String, DriverMode>) {
+        let Some(path) = &self.path else { return };
+        let body = match serde_json::to_vec_pretty(snapshot) {
+            Ok(b) => b,
+            Err(e) => {
+                tracing::warn!(target: "openpxe::dhcp", "serialize driver_modes.json: {e}");
+                return;
+            }
+        };
+        if let Some(parent) = path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        let tmp = path.with_extension("json.tmp");
+        if let Err(e) = std::fs::write(&tmp, body) {
+            tracing::warn!(target: "openpxe::dhcp", "write driver_modes.json tmp: {e}");
+            return;
+        }
+        if let Err(e) = std::fs::rename(&tmp, path.as_path()) {
+            tracing::warn!(target: "openpxe::dhcp", "rename driver_modes.json: {e}");
+        }
+    }
+}
+
+fn pinned_snapshot(map: &HashMap<String, Entry>) -> HashMap<String, DriverMode> {
+    map.iter()
+        .filter(|(_, e)| e.pinned)
+        .map(|(k, e)| (k.clone(), e.mode))
+        .collect()
+}
+
+fn evict_oldest(map: &mut HashMap<String, Entry>) {
+    // Prefer evicting an unpinned entry; only touch learned modes when
+    // the whole table is pinned (4096 learned machines — at that point
+    // the operator has bigger questions than our memory bound).
+    let pick = |pinned: bool| {
+        map.iter()
+            .filter(|(_, e)| e.pinned == pinned)
+            .min_by_key(|(_, e)| e.last_seen)
+            .map(|(k, _)| k.clone())
+    };
+    if let Some(oldest) = pick(false).or_else(|| pick(true)) {
+        map.remove(&oldest);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::tempdir;
+
+    #[test]
+    fn firmware_first_then_escalates_on_unconfirmed_retry() {
+        let e = DriverEscalation::new();
+        let t0 = Instant::now();
+        // Boot 1, primary DISCOVER: firmware.
+        assert_eq!(e.decide_at("aa", true, t0), DriverMode::Firmware);
+        // Same boot's :4011 query (+1s, within debounce): still firmware, no escalation.
+        assert_eq!(
+            e.decide_at("aa", false, t0 + Duration::from_secs(1)),
+            DriverMode::Firmware
+        );
+        // Firmware net failed → no iPXE handoff → machine re-PXE-boots much
+        // later: escalate to builtin drivers.
+        assert_eq!(
+            e.decide_at("aa", true, t0 + Duration::from_mins(1)),
+            DriverMode::Builtin
+        );
+    }
+
+    #[test]
+    fn builtin_is_sticky_after_success() {
+        let e = DriverEscalation::new();
+        let t0 = Instant::now();
+        assert_eq!(e.decide_at("bb", true, t0), DriverMode::Firmware);
+        assert_eq!(
+            e.decide_at("bb", true, t0 + Duration::from_mins(1)),
+            DriverMode::Builtin
+        );
+        // Builtin worked this time — confirm the handoff.
+        e.confirm_at("bb", t0 + Duration::from_secs(61));
+        // Next cold boot goes straight to builtin (no wasted firmware attempt).
+        assert_eq!(
+            e.decide_at("bb", true, t0 + Duration::from_mins(2)),
+            DriverMode::Builtin
+        );
+    }
+
+    #[test]
+    fn confirmed_firmware_never_escalates() {
+        let e = DriverEscalation::new();
+        let t0 = Instant::now();
+        assert_eq!(e.decide_at("cc", true, t0), DriverMode::Firmware);
+        // snponly worked: handoff confirmed.
+        e.confirm_at("cc", t0 + Duration::from_secs(2));
+        // A later boot stays on firmware — no spurious escalation.
+        assert_eq!(
+            e.decide_at("cc", true, t0 + Duration::from_mins(5)),
+            DriverMode::Firmware
+        );
+    }
+
+    #[test]
+    fn third_unconfirmed_attempt_escalates_to_shim_and_stays() {
+        // v0.7.0: a Secure-Boot client downloads-but-refuses both unsigned
+        // iPXE builds; the third boot gets the signed shim chain, and the
+        // MAC stays there for subsequent boots.
+        let e = DriverEscalation::new();
+        let t0 = Instant::now();
+        assert_eq!(e.decide_at("ee", true, t0), DriverMode::Firmware);
+        assert_eq!(
+            e.decide_at("ee", true, t0 + Duration::from_mins(1)),
+            DriverMode::Builtin
+        );
+        assert_eq!(
+            e.decide_at("ee", true, t0 + Duration::from_mins(2)),
+            DriverMode::Shim
+        );
+        // Shim is terminal — a fourth unconfirmed boot stays on Shim.
+        assert_eq!(
+            e.decide_at("ee", true, t0 + Duration::from_mins(3)),
+            DriverMode::Shim
+        );
+    }
+
+    #[test]
+    fn stale_unpinned_entry_is_forgotten_and_resets_to_firmware() {
+        let e = DriverEscalation::new();
+        let t0 = Instant::now();
+        assert_eq!(e.decide_at("dd", true, t0), DriverMode::Firmware);
+        assert_eq!(
+            e.decide_at("dd", true, t0 + Duration::from_mins(1)),
+            DriverMode::Builtin
+        );
+        // After the TTL with no activity the (unpinned) Builtin walk is
+        // pruned → fresh firmware. (A *confirmed* Builtin would be pinned
+        // and survive — see learned_builtin_survives_ttl.)
+        let later = t0 + Duration::from_mins(1) + ENTRY_TTL + Duration::from_secs(1);
+        assert_eq!(e.decide_at("dd", true, later), DriverMode::Firmware);
+    }
+
+    #[test]
+    fn shim_pin_survives_ttl() {
+        // v0.7.1: reaching the Shim rung is durable knowledge — the
+        // machine must NOT re-walk the ladder after an idle period.
+        let e = DriverEscalation::new();
+        let t0 = Instant::now();
+        let _ = e.decide_at("ff", true, t0);
+        let _ = e.decide_at("ff", true, t0 + Duration::from_mins(1));
+        assert_eq!(
+            e.decide_at("ff", true, t0 + Duration::from_mins(2)),
+            DriverMode::Shim
+        );
+        let much_later = t0 + Duration::from_mins(2) + ENTRY_TTL + Duration::from_mins(5);
+        assert_eq!(e.decide_at("ff", true, much_later), DriverMode::Shim);
+    }
+
+    #[test]
+    fn learned_builtin_survives_ttl() {
+        let e = DriverEscalation::new();
+        let t0 = Instant::now();
+        let _ = e.decide_at("gg", true, t0);
+        assert_eq!(
+            e.decide_at("gg", true, t0 + Duration::from_mins(1)),
+            DriverMode::Builtin
+        );
+        // The handoff confirms Builtin → pinned.
+        e.confirm_at("gg", t0 + Duration::from_secs(61));
+        let much_later = t0 + ENTRY_TTL + Duration::from_mins(10);
+        assert_eq!(e.decide_at("gg", true, much_later), DriverMode::Builtin);
+    }
+
+    #[test]
+    fn learned_modes_persist_across_restart() {
+        let dir = tempdir().unwrap();
+        let t0 = Instant::now();
+        {
+            let e = DriverEscalation::load_or_default(dir.path());
+            // Walk one MAC to Shim (pins on escalation)...
+            let _ = e.decide_at("aa:01", true, t0);
+            let _ = e.decide_at("aa:01", true, t0 + Duration::from_mins(1));
+            assert_eq!(
+                e.decide_at("aa:01", true, t0 + Duration::from_mins(2)),
+                DriverMode::Shim
+            );
+            // ...and another to a confirmed Builtin (pins on handoff).
+            let _ = e.decide_at("aa:02", true, t0);
+            let _ = e.decide_at("aa:02", true, t0 + Duration::from_mins(1));
+            e.confirm_at("aa:02", t0 + Duration::from_secs(61));
+        }
+        // "Restart": a fresh instance from the same work_dir knows both.
+        let e2 = DriverEscalation::load_or_default(dir.path());
+        assert_eq!(e2.decide_at("aa:01", true, t0), DriverMode::Shim);
+        assert_eq!(e2.decide_at("aa:02", true, t0), DriverMode::Builtin);
+        // Unlearned MACs still start at the default.
+        assert_eq!(e2.decide_at("aa:03", true, t0), DriverMode::Firmware);
+    }
+
+    #[test]
+    fn corrupt_persistence_file_starts_empty() {
+        let dir = tempdir().unwrap();
+        std::fs::write(dir.path().join("driver_modes.json"), b"{broken").unwrap();
+        let e = DriverEscalation::load_or_default(dir.path());
+        assert_eq!(
+            e.decide_at("aa:bb", true, Instant::now()),
+            DriverMode::Firmware
+        );
+    }
+
+    #[test]
+    fn confirmed_firmware_is_not_persisted() {
+        // The default mode is never written — the file only carries
+        // exceptions, so a healthy fleet leaves it absent/empty.
+        let dir = tempdir().unwrap();
+        let t0 = Instant::now();
+        {
+            let e = DriverEscalation::load_or_default(dir.path());
+            let _ = e.decide_at("aa:09", true, t0);
+            e.confirm_at("aa:09", t0 + Duration::from_secs(2));
+        }
+        assert!(!dir.path().join("driver_modes.json").exists());
+    }
+}

crates/dhcp-proxy/src/lib.rs

@@ -17,7 +17,9 @@
 //!   clients silently drop them.
 #![forbid(unsafe_code)]
 
+pub mod escalation;
 pub mod reply;
 pub mod server;
 
+pub use escalation::DriverEscalation;
 pub use server::DhcpProxyServer;

crates/dhcp-proxy/src/reply.rs

@@ -9,7 +9,7 @@
 //!     pass, or the HTTP URL of the boot script once iPXE has chained.
 
 use dhcproto::v4::{DhcpOption, Message, MessageType, Opcode, OptionCode};
-use openpxe_core::{ClientArch, FirmwareClass};
+use openpxe_core::{ClientArch, DriverMode, FirmwareClass};
 use std::net::Ipv4Addr;
 
 /// Where the reply directs the client next.
@@ -31,6 +31,11 @@ pub struct ReplyContext<'a> {
     pub our_ip: Ipv4Addr,
     pub arch: ClientArch,
     pub class: FirmwareClass,
+    /// Which iPXE network backend to advertise for this client. The DHCP
+    /// proxy fills this from the automatic per-MAC escalation state: normally
+    /// [`DriverMode::Firmware`], escalated to [`DriverMode::Builtin`] for a
+    /// MAC whose firmware-net boot failed to chainload (v0.6.1).
+    pub driver_mode: DriverMode,
     /// Public base URL (scheme://host[:port]) used in HTTP directives.
     pub public_base_url: &'a str,
 }
@@ -44,23 +49,39 @@ pub fn decide(ctx: &ReplyContext<'_>) -> BootDirective {
             // Pass the client's MAC in the query string so the HTTP
             // layer can short-circuit to a per-MAC binding when one
             // exists. iPXE substitutes `${mac}` literally before issuing
-            // the GET, so this stays static across firmwares.
+            // the GET, so this stays static across firmwares. The arch is
+            // known *here* from option 93, so it's baked in literally
+            // (v0.7.0) — it lets boot rules select on architecture.
             url: format!(
-                "{}/boot.ipxe?mac=${{mac}}",
+                "{}/boot.ipxe?mac=${{mac}}&arch={}",
-                ctx.public_base_url.trim_end_matches('/')
+                ctx.public_base_url.trim_end_matches('/'),
+                ctx.arch.as_str()
             ),
         },
         FirmwareClass::HttpClient => {
             // UEFI HTTP boot: client wants an http:// URL in option 67
-            // pointing at an EFI executable. We serve ipxe.efi over HTTP;
+            // pointing at an EFI executable. We serve the iPXE EFI build for
-            // it'll then do the same script-fetch the iPXE path does.
+            // the negotiated driver mode over HTTP; it'll then do the same
-            let name = ctx.arch.ipxe_bootfile().unwrap_or("snponly.efi");
+            // script-fetch the iPXE path does.
+            // `bootfile_with_fallback` (v0.7.0) walks back down the
+            // escalation ladder when the negotiated mode has no binary
+            // for this arch (e.g. Shim on an arch with no signed chain).
+            let name = ctx
+                .arch
+                .bootfile_with_fallback(ctx.driver_mode)
+                .unwrap_or("snponly.efi");
             BootDirective::HttpScript {
-                url: format!("{}/ipxe/{}", ctx.public_base_url.trim_end_matches('/'), name),
+                url: format!(
+                    "{}/ipxe/{}",
+                    ctx.public_base_url.trim_end_matches('/'),
+                    name
+                ),
             }
         }
-        FirmwareClass::PxeClient => match ctx.arch.ipxe_bootfile() {
+        FirmwareClass::PxeClient => match ctx.arch.bootfile_with_fallback(ctx.driver_mode) {
-            Some(name) => BootDirective::TftpIpxe { filename: name.to_string() },
+            Some(name) => BootDirective::TftpIpxe {
+                filename: name.to_string(),
+            },
             None => BootDirective::Ignore,
         },
         FirmwareClass::Other => BootDirective::Ignore,
@@ -107,12 +128,16 @@ pub fn build_reply(ctx: &ReplyContext<'_>, directive: &BootDirective) -> Option<
 
     match directive {
         BootDirective::TftpIpxe { filename } => {
-            opts.insert(DhcpOption::TFTPServerName(ctx.our_ip.to_string().into_bytes()));
+            opts.insert(DhcpOption::TFTPServerName(
+                ctx.our_ip.to_string().into_bytes(),
+            ));
             opts.insert(DhcpOption::BootfileName(filename.as_bytes().to_vec()));
         }
         BootDirective::HttpScript { url } => {
             opts.insert(DhcpOption::BootfileName(url.as_bytes().to_vec()));
-            opts.insert(DhcpOption::TFTPServerName(ctx.our_ip.to_string().into_bytes()));
+            opts.insert(DhcpOption::TFTPServerName(
+                ctx.our_ip.to_string().into_bytes(),
+            ));
         }
         BootDirective::Ignore => return None,
     }

crates/dhcp-proxy/src/server.rs

@@ -1,11 +1,12 @@
 //! UDP listener loop for the DHCP proxy. Accepts on :67 (and :4011 on a
 //! second socket) and dispatches each datagram through the pure reply logic.
 
+use crate::escalation::DriverEscalation;
 use crate::reply::{build_reply, decide, BootDirective, ReplyContext};
 use dhcproto::v4::{DhcpOption, Message, OptionCode};
 use dhcproto::{Decodable, Decoder, Encodable, Encoder};
 use openpxe_core::{
-    ClientArch, ClientEvent, ClientRegistry, FirmwareClass,
+    BootRulesStore, ClientArch, ClientEvent, ClientRegistry, DriverMode, FirmwareClass,
 };
 use socket2::{Domain, Protocol, Socket, Type};
 use std::net::{IpAddr, Ipv4Addr, SocketAddr, SocketAddrV4};
@@ -20,9 +21,19 @@ pub struct DhcpProxyServer {
     public_base_url: String,
     clients: Arc<ClientRegistry>,
     metrics: openpxe_core::Metrics,
+    /// Automatic per-MAC NIC driver-mode escalation (v0.6.1; persistent
+    /// learned modes since v0.7.1). Shared across the :67 and :4011
+    /// listener tasks via the server `Arc`. Built by the caller so the
+    /// persistence path comes from the configured work dir.
+    escalation: DriverEscalation,
+    /// v0.7.1: boot rules — consulted for an operator driver-mode pin
+    /// (e.g. "this OUI is all Secure Boot → serve shim immediately")
+    /// before the automatic escalation ladder.
+    rules: BootRulesStore,
 }
 
 impl DhcpProxyServer {
+    #[allow(clippy::too_many_arguments)]
     pub fn new(
         bind: IpAddr,
         dhcp_port: u16,
@@ -31,6 +42,8 @@ impl DhcpProxyServer {
         public_base_url: String,
         clients: Arc<ClientRegistry>,
         metrics: openpxe_core::Metrics,
+        escalation: DriverEscalation,
+        rules: BootRulesStore,
     ) -> Self {
         Self {
             bind,
@@ -40,6 +53,8 @@ impl DhcpProxyServer {
             public_base_url,
             clients,
             metrics,
+            escalation,
+            rules,
         }
     }
 
@@ -86,11 +101,22 @@ impl DhcpProxyServer {
     ) -> anyhow::Result<()> {
         let request = Message::decode(&mut Decoder::new(data))?;
 
-        let vendor_class = request.opts().get(OptionCode::ClassIdentifier).and_then(|o| {
+        let vendor_class = request
-            if let DhcpOption::ClassIdentifier(v) = o { Some(v.as_slice()) } else { None }
+            .opts()
-        });
+            .get(OptionCode::ClassIdentifier)
+            .and_then(|o| {
+                if let DhcpOption::ClassIdentifier(v) = o {
+                    Some(v.as_slice())
+                } else {
+                    None
+                }
+            });
         let user_class = request.opts().get(OptionCode::UserClass).and_then(|o| {
-            if let DhcpOption::UserClass(v) = o { Some(v.as_slice()) } else { None }
+            if let DhcpOption::UserClass(v) = o {
+                Some(v.as_slice())
+            } else {
+                None
+            }
         });
         let class = FirmwareClass::classify(vendor_class, user_class);
         if matches!(class, FirmwareClass::Other) {
@@ -117,11 +143,38 @@ impl DhcpProxyServer {
             },
         );
 
+        // Automatic NIC driver-mode selection (v0.6.1). The default is
+        // firmware-net (snponly/undionly). A successful iPXE handoff confirms
+        // the current mode works for this MAC; a fresh firmware boot whose
+        // predecessor never handed off escalates the MAC to iPXE's built-in
+        // NIC drivers. No operator toggle — the firmware path is unchanged so
+        // hardware that already boots never regresses.
+        let driver_mode = match class {
+            FirmwareClass::IpxeUserClass => {
+                self.escalation.mark_ipxe_success(&mac);
+                DriverMode::Firmware // unused: this path serves the HTTP script
+            }
+            FirmwareClass::PxeClient | FirmwareClass::HttpClient => {
+                // v0.7.1: an operator rule pin wins over (and bypasses)
+                // the automatic escalation ladder — known Secure-Boot
+                // fleets boot the signed chain on the very first cycle.
+                if let Some(pinned) = self.rules.driver_mode_hint(&mac, Some(arch.as_str())) {
+                    pinned
+                } else {
+                    self.escalation
+                        .mode_for_firmware_attempt(&mac, label == "67")
+                }
+            }
+            // Unreachable: FirmwareClass::Other returned above.
+            FirmwareClass::Other => DriverMode::Firmware,
+        };
+
         let ctx = ReplyContext {
             request: &request,
             our_ip: self.our_ip,
             arch,
             class,
+            driver_mode,
             public_base_url: &self.public_base_url,
         };
         let directive = decide(&ctx);
@@ -135,7 +188,9 @@ impl DhcpProxyServer {
         }
         self.metrics.record_dhcp_reply(arch.as_str());
 
-        let Some(reply) = build_reply(&ctx, &directive) else { return Ok(()); };
+        let Some(reply) = build_reply(&ctx, &directive) else {
+            return Ok(());
+        };
         let mut out = Vec::with_capacity(512);
         reply.encode(&mut Encoder::new(&mut out))?;
 
@@ -143,7 +198,7 @@ impl DhcpProxyServer {
         sock.send_to(&out, dest).await?;
         tracing::info!(
             target: "openpxe::dhcp",
-            mac=%mac, arch=arch.as_str(), class=?class, dest=%dest, directive=?directive,
+            mac=%mac, arch=arch.as_str(), class=?class, driver=?driver_mode, dest=%dest, directive=?directive,
             "PXE reply sent"
         );
         Ok(())
@@ -202,8 +257,16 @@ fn bind_udp(bind: IpAddr, port: u16, broadcast: bool) -> anyhow::Result<UdpSocke
 }
 
 fn format_mac(chaddr: &[u8]) -> String {
-    let take = chaddr.iter().take(6).copied().collect::<Vec<_>>();
+    use std::fmt::Write;
-    take.iter().map(|b| format!("{b:02x}")).collect::<Vec<_>>().join(":")
+    // One allocation — this runs for every PXE datagram we answer.
+    let mut s = String::with_capacity(17);
+    for (i, b) in chaddr.iter().take(6).enumerate() {
+        if i > 0 {
+            s.push(':');
+        }
+        let _ = write!(s, "{b:02x}");
+    }
+    s
 }
 
 /// Walk raw DHCP options looking for option 93 (Client System Architecture)
@@ -217,10 +280,17 @@ fn extract_raw_arch(packet: &[u8]) -> Option<u16> {
     let mut i = 0;
     while i < opts.len() {
         let code = opts[i];
-        if code == 0xff { return None; }     // END
+        if code == 0xff {
-        if code == 0x00 { i += 1; continue; } // PAD
+            return None;
+        } // END
+        if code == 0x00 {
+            i += 1;
+            continue;
+        } // PAD
         i += 1;
-        if i >= opts.len() { return None; }
+        if i >= opts.len() {
+            return None;
+        }
         let len = opts[i] as usize;
         i += 1;
         if code == 93 && len >= 2 && i + 2 <= opts.len() {
@@ -240,7 +310,7 @@ mod tests {
         // Minimal BOOTP header + magic cookie + option 93 (arch)=0x0007 + END.
         let mut pkt = vec![0u8; 240];
         pkt[236..240].copy_from_slice(&[99, 130, 83, 99]); // magic cookie
-        pkt.extend_from_slice(&[53, 1, 1]);  // option 53 DHCPDISCOVER
+        pkt.extend_from_slice(&[53, 1, 1]); // option 53 DHCPDISCOVER
         pkt.extend_from_slice(&[93, 2, 0x00, 0x07]);
         pkt.push(0xff);
         assert_eq!(extract_raw_arch(&pkt), Some(0x0007));

crates/http-api/Cargo.toml

@@ -4,6 +4,10 @@ version.workspace = true
 edition.workspace = true
 license.workspace = true
 authors.workspace = true
+# v0.5.0: inherit the workspace repository so CARGO_PKG_REPOSITORY is
+# populated at build time — the About-tab update check derives the
+# Gitea releases API URL from it.
+repository.workspace = true
 description = "HTTP server: ISO uploads, iPXE script generation, ISO streaming"
 
 [lints]
@@ -29,12 +33,39 @@ thiserror.workspace = true
 anyhow.workspace = true
 bytes.workspace = true
 futures.workspace = true
-mime.workspace = true
+uuid.workspace = true
-mime_guess.workspace = true
+# v0.4.5 Forms auth: lock-free session store and cookie helpers.
+parking_lot.workspace = true
+# v0.5.0: outbound HTTP for chat webhooks (Slack/Teams/Discord) and the
+# About-tab "check for updates" call to the Gitea releases API; SMTP for
+# email notifications. Both use rustls so the static musl binary stays
+# OpenSSL-free.
+reqwest.workspace = true
+lettre.workspace = true
+# v0.5.1: decode the base64 SAMLResponse at the ACS endpoint.
+base64.workspace = true
 
 [dev-dependencies]
 tokio = { workspace = true, features = ["macros", "rt", "rt-multi-thread", "time"] }
 tower = { workspace = true }
 tempfile = "3.12"
+# v0.7.4: probe-based introspection verifies kernel paths against the
+# real ISO9660 tree, so the full-flow tests synthesize images with the
+# shared test builder instead of label-only blobs.
+openpxe-iso-store = { workspace = true, features = ["test-image"] }
 serde_json = { workspace = true }
 time = { workspace = true }
+# v0.4.61: integration tests need to generate real PNG bytes for the
+# `/branding/pxe-logo` compositor; hand-rolled CRCs are too fragile.
+image = { version = "0.25", default-features = false, features = ["png"] }
+# v0.5.1: the SAML ACS integration tests mint a throwaway IdP keypair
+# (rcgen) and sign a SAMLResponse with bergshamra so the happy-path,
+# replay, and IdP-initiated-gating flows exercise real signatures.
+rcgen = "0.13"
+bergshamra = { workspace = true }
+# v0.5.4: snapshot the generated iPXE menu so any unintended drift (a
+# dropped line, reordered item) is caught and reviewed, not silently shipped.
+insta = "1.40"
+# v0.5.4: stand up a mock HTTP server to exercise the SAML metadata-URL
+# fetch path (previously untested because it did a real network GET).
+wiremock = "0.6"

crates/http-api/src/auth.rs

@@ -0,0 +1,556 @@
+//! Forms auth layer — sessions, login, setup, middleware.
+//!
+//! Three states:
+//!
+//! * **Unconfigured** (`AdminStore::is_configured() == false`). The
+//!   middleware passes every request through — there's no one to gate
+//!   against. The UI's `/api/me` returns `setup_required: true` and the
+//!   front-end pushes the operator into the first-run flow.
+//! * **Logged in**. The session cookie maps to an in-memory session
+//!   record with an idle expiry; `/api/me` returns the username.
+//! * **Logged out**. The middleware bounces `/api/*` (with the PXE
+//!   allowlist below) to `401 Unauthorized`; the front-end intercepts
+//!   that and shows `/login`.
+//!
+//! Allowlist for unauthenticated access *after* the admin is set up:
+//!
+//! * everything outside `/api/*` (the WebUI bundle, asset chrome, PXE
+//!   script endpoints, the bundled iPXE/wimboot binaries, ISO bytes,
+//!   liveness/readiness probes, the Prometheus scrape) — these are
+//!   read-only or PXE-essential and breaking them locks out booting
+//!   machines that have no way to authenticate;
+//! * `/api/setup`, `/api/login`, `/api/me` (the auth surface itself);
+//! * `/api/queue/join`, `/api/queue/poll/:entry_id` (iPXE long-poll for
+//!   Queued Deployment — the iPXE client can't send a session cookie).
+//!
+//! Everything else inside `/api/*` requires a valid session.
+
+use crate::state::AppState;
+use axum::{
+    body::Body,
+    extract::{Request, State},
+    http::{header, HeaderValue, StatusCode},
+    middleware::Next,
+    response::{IntoResponse, Response},
+    Json,
+};
+use openpxe_core::AdminPublic;
+use parking_lot::RwLock;
+use serde::{Deserialize, Serialize};
+use serde_json::json;
+use std::collections::HashMap;
+use std::sync::Arc;
+use std::time::{Duration, Instant};
+use uuid::Uuid;
+
+/// Idle session lifetime. Sliding — every authenticated request resets
+/// the expiry. 24h is the Sonarr default and matches what most operators
+/// expect for an on-prem admin console.
+const SESSION_TTL: Duration = Duration::from_hours(24);
+
+/// Name of the cookie we set/read. Distinct from a generic `session=`
+/// to avoid collisions with anything else sharing the host.
+pub const SESSION_COOKIE: &str = "openpxe_session";
+
+#[derive(Debug, Clone)]
+struct Session {
+    username: String,
+    expires_at: Instant,
+}
+
+/// In-memory session table. Cheap to clone (Arc-shared) and contention
+/// is rare — operators sign in once per browser session.
+#[derive(Debug, Clone, Default)]
+pub struct SessionStore {
+    inner: Arc<RwLock<HashMap<String, Session>>>,
+}
+
+impl SessionStore {
+    /// Mint a fresh session for `username` and return the opaque cookie
+    /// value. UUID v4 gives us 122 random bits — comfortably more than
+    /// the 64-128 bits typical for session IDs.
+    #[must_use]
+    pub fn create(&self, username: &str) -> String {
+        let id = Uuid::new_v4().simple().to_string();
+        let session = Session {
+            username: username.to_string(),
+            expires_at: Instant::now() + SESSION_TTL,
+        };
+        self.inner.write().insert(id.clone(), session);
+        id
+    }
+
+    /// Resolve a cookie value to the owning username, refreshing the
+    /// idle timer. Returns `None` for missing / expired sessions and
+    /// proactively evicts the expired entry so the map doesn't grow
+    /// unbounded across long-lived deployments.
+    pub fn touch(&self, id: &str) -> Option<String> {
+        let mut g = self.inner.write();
+        let s = g.get_mut(id)?;
+        if s.expires_at <= Instant::now() {
+            g.remove(id);
+            return None;
+        }
+        s.expires_at = Instant::now() + SESSION_TTL;
+        Some(s.username.clone())
+    }
+
+    /// Invalidate one session (the user's `/api/logout`).
+    pub fn revoke(&self, id: &str) {
+        self.inner.write().remove(id);
+    }
+
+    /// Invalidate every session — used after a credentials rotation so
+    /// stale cookies for the old password can't keep operating.
+    pub fn revoke_all(&self) {
+        self.inner.write().clear();
+    }
+
+    /// Periodic / opportunistic GC. Not currently scheduled (we evict
+    /// on touch), but exposed for a future janitor task.
+    pub fn gc(&self) {
+        let now = Instant::now();
+        self.inner.write().retain(|_, s| s.expires_at > now);
+    }
+
+    #[must_use]
+    pub fn len(&self) -> usize {
+        self.inner.read().len()
+    }
+
+    #[must_use]
+    pub fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+}
+
+// ── Cookie helpers ────────────────────────────────────────────────────────
+
+fn cookie_attrs(value: &str, max_age: Option<i64>) -> String {
+    // Same flags FleetDM and Sonarr ship by default:
+    //   - HttpOnly: blocks JS access (XSS containment)
+    //   - SameSite=Lax: allows top-level GET navigations from the IdP
+    //     to land authenticated when SSO arrives, but blocks
+    //     cross-site POST CSRF;
+    //   - Path=/: the cookie applies to the whole app;
+    //   - no Secure flag yet — many operators host on plain http://
+    //     LAN IPs (Unraid templates default to that); we'll add Secure
+    //     opportunistically when we add a TLS terminator option.
+    // SESSION_TTL fits in 32 bits comfortably (24h ≈ 86400 seconds); we
+    // never overflow i64, but clippy's `cast_possible_wrap` lint wants
+    // us to be explicit. `cast_signed` is the documented form.
+    let lifetime = max_age.unwrap_or_else(|| SESSION_TTL.as_secs().cast_signed());
+    format!("{SESSION_COOKIE}={value}; Path=/; HttpOnly; SameSite=Lax; Max-Age={lifetime}")
+}
+
+/// Build the `Set-Cookie` header value that establishes a fresh operator
+/// session with the default 24h TTL. Exposed so the SAML ACS handler can
+/// attach an operator session to its post-login redirect, exactly as the
+/// Forms-login path does via [`login_response`].
+#[must_use]
+pub fn session_cookie(session: &str) -> String {
+    cookie_attrs(session, None)
+}
+
+fn parse_cookie(headers: &axum::http::HeaderMap) -> Option<String> {
+    // `Cookie: a=b; c=d` parsing — small enough not to drag in a crate.
+    // Two-step strip (name, then '=') keeps this allocation-free per
+    // candidate and can't match a longer cookie name sharing the prefix.
+    let raw = headers.get(header::COOKIE)?.to_str().ok()?;
+    for part in raw.split(';') {
+        let part = part.trim();
+        if let Some(v) = part
+            .strip_prefix(SESSION_COOKIE)
+            .and_then(|rest| rest.strip_prefix('='))
+        {
+            return Some(v.to_string());
+        }
+    }
+    None
+}
+
+/// Does this request carry a live operator session? Used by endpoints
+/// outside the `/api/*` middleware that still want to honor a logged-in
+/// operator (e.g. browser-testing a token-gated answer file, v0.7.0).
+pub(crate) fn session_authenticated(state: &AppState, headers: &axum::http::HeaderMap) -> bool {
+    parse_cookie(headers).is_some_and(|t| state.sessions.touch(&t).is_some())
+}
+
+// ── Middleware ────────────────────────────────────────────────────────────
+
+/// Return `true` if `path` is on the allowlist and should bypass the
+/// session check. The middleware applies this rule only when the admin
+/// account is configured; before then everything is open.
+fn is_public_path(path: &str) -> bool {
+    // Non-API paths: WebUI bundle, PXE chain, ISO bytes, health probes,
+    // metrics. All read-only / PXE-essential.
+    if !path.starts_with("/api/") {
+        return true;
+    }
+    // Auth surface and iPXE long-poll endpoints (no cookie available).
+    // The SAML SP endpoints are pre-auth by nature — the operator hasn't a
+    // session yet when they start (or arrive from) the IdP. `/api/sso`
+    // (the config GET/PUT, no trailing slash) stays gated.
+    matches!(
+        path,
+        "/api/setup"
+            | "/api/login"
+            | "/api/logout"
+            | "/api/me"
+            | "/api/sso/login"
+            | "/api/sso/acs"
+            | "/api/sso/metadata"
+    ) || path.starts_with("/api/queue/join")
+        || path.starts_with("/api/queue/poll/")
+}
+
+/// Axum middleware: gate `/api/*` behind a valid session, with the
+/// allowlist above. `State<AppState>` reaches in for the admin store +
+/// session store.
+pub async fn require_auth(
+    State(state): State<AppState>,
+    req: Request<Body>,
+    next: Next,
+) -> Response {
+    // Bypass entirely while unconfigured. The /api/setup endpoint is
+    // the only one that can flip this back to "configured", and it
+    // refuses to run a second time. Tests + fresh installs ride this
+    // path.
+    if !state.admin.is_configured() {
+        return next.run(req).await;
+    }
+    let path = req.uri().path();
+    if is_public_path(path) {
+        return next.run(req).await;
+    }
+    // Authenticated path. The cookie must be present, map to a live
+    // session, and the TTL refresh happens as a side-effect.
+    let token = parse_cookie(req.headers());
+    if let Some(t) = token {
+        if state.sessions.touch(&t).is_some() {
+            return next.run(req).await;
+        }
+    }
+    (
+        StatusCode::UNAUTHORIZED,
+        Json(json!({ "error": "authentication required" })),
+    )
+        .into_response()
+}
+
+// ── Handlers ──────────────────────────────────────────────────────────────
+
+#[derive(Debug, Deserialize)]
+pub struct SetupBody {
+    pub username: String,
+    pub password: String,
+}
+
+/// First-run setup. Refuses to run once an admin already exists — that
+/// guards against a leaked WebUI being re-bootstrapped by an attacker
+/// who's seen the deployment URL. After bootstrap, the new session
+/// cookie is set so the operator goes straight to the dashboard.
+pub async fn api_setup(State(state): State<AppState>, Json(body): Json<SetupBody>) -> Response {
+    if state.admin.is_configured() {
+        return (
+            StatusCode::CONFLICT,
+            Json(json!({ "error": "admin account already configured" })),
+        )
+            .into_response();
+    }
+    // bcrypt hashing is ~100-200 ms of pure CPU (and `bootstrap` also
+    // persists to disk synchronously) — keep it off the async workers.
+    let admin = state.admin.clone();
+    let result =
+        tokio::task::spawn_blocking(move || admin.bootstrap(&body.username, &body.password))
+            .await
+            .unwrap_or_else(|e| Err(openpxe_core::Error::Other(e.into())));
+    match result {
+        Ok(pub_) => {
+            let session = state.sessions.create(&pub_.username);
+            login_response(StatusCode::CREATED, &pub_, &session)
+        }
+        Err(openpxe_core::Error::Invalid(msg)) => {
+            (StatusCode::BAD_REQUEST, Json(json!({ "error": msg }))).into_response()
+        }
+        Err(e) => (
+            StatusCode::INTERNAL_SERVER_ERROR,
+            Json(json!({ "error": format!("{e}") })),
+        )
+            .into_response(),
+    }
+}
+
+#[derive(Debug, Deserialize)]
+pub struct LoginBody {
+    pub username: String,
+    pub password: String,
+}
+
+pub async fn api_login(State(state): State<AppState>, Json(body): Json<LoginBody>) -> Response {
+    // Brief, deliberately vague — "invalid credentials" rather than
+    // "no such user" / "wrong password". Same anti-enumeration posture
+    // as Sonarr/Radarr. The bcrypt verify is ~100-200 ms of pure CPU on
+    // an unauthenticated endpoint, so it runs on the blocking pool.
+    let admin = state.admin.clone();
+    let verdict = tokio::task::spawn_blocking(move || admin.verify(&body.username, &body.password))
+        .await
+        .unwrap_or_else(|e| Err(openpxe_core::Error::Other(e.into())));
+    let pub_ = match verdict {
+        Ok(Some(u)) => u,
+        Ok(None) => {
+            return (
+                StatusCode::UNAUTHORIZED,
+                Json(json!({ "error": "invalid username or password" })),
+            )
+                .into_response();
+        }
+        Err(e) => {
+            return (
+                StatusCode::INTERNAL_SERVER_ERROR,
+                Json(json!({ "error": format!("{e}") })),
+            )
+                .into_response();
+        }
+    };
+    let session = state.sessions.create(&pub_.username);
+    login_response(StatusCode::OK, &pub_, &session)
+}
+
+pub async fn api_logout(State(state): State<AppState>, headers: axum::http::HeaderMap) -> Response {
+    if let Some(t) = parse_cookie(&headers) {
+        state.sessions.revoke(&t);
+    }
+    // Stomp the cookie unconditionally — even if the request didn't
+    // carry one, the browser shouldn't keep a stale value.
+    let mut resp = StatusCode::NO_CONTENT.into_response();
+    resp.headers_mut().insert(
+        header::SET_COOKIE,
+        HeaderValue::from_str(&cookie_attrs("", Some(0))).unwrap(),
+    );
+    resp
+}
+
+/// Status surface for the front-end shell. Returns four cases:
+///
+/// * `setup_required: true` — no admin yet; show first-run page.
+/// * `authenticated: false` — admin exists, no session; show login.
+/// * `authenticated: true` + `user` — let the dashboard load.
+pub async fn api_me(State(state): State<AppState>, headers: axum::http::HeaderMap) -> Response {
+    // v0.5.0: include branding bootstrap so the pre-auth login/setup
+    // screens can render the FleetDM-style full-width custom logo (and
+    // cache-bust it) without an extra round trip. `/api/me` is public,
+    // and the logo asset is public, so this leaks nothing sensitive.
+    let has_custom_logo = state.branding.has_any_web_logo();
+    let logo_rev = state.branding.logo_rev();
+    // v0.5.9: ship the non-sensitive SSO descriptor with every /api/me so
+    // the pre-auth login screen can render the "Sign in with …" button
+    // reliably. Previously the button keyed off the auth-gated /api/sso,
+    // which 401s when logged out — the button only survived on a stale
+    // in-memory config and vanished on any fresh login-page load.
+    let sso = state.sso.login_info();
+    if !state.admin.is_configured() {
+        return (
+            StatusCode::OK,
+            Json(json!({
+                "setup_required": true,
+                "authenticated": false,
+                "has_custom_logo": has_custom_logo,
+                "logo_rev": logo_rev,
+                "sso": sso,
+            })),
+        )
+            .into_response();
+    }
+    let token = parse_cookie(&headers);
+    let username = token.as_deref().and_then(|t| state.sessions.touch(t));
+    match username {
+        Some(u) => (
+            StatusCode::OK,
+            Json(json!({
+                "setup_required": false,
+                "authenticated": true,
+                "user": state.admin.snapshot(),
+                "session_user": u,
+                "has_custom_logo": has_custom_logo,
+                "logo_rev": logo_rev,
+                "sso": sso,
+            })),
+        )
+            .into_response(),
+        None => (
+            StatusCode::OK,
+            Json(json!({
+                "setup_required": false,
+                "authenticated": false,
+                "has_custom_logo": has_custom_logo,
+                "logo_rev": logo_rev,
+                "sso": sso,
+            })),
+        )
+            .into_response(),
+    }
+}
+
+#[derive(Debug, Deserialize)]
+pub struct UpdateCredentialsBody {
+    pub current_password: String,
+    #[serde(default)]
+    pub new_username: Option<String>,
+    #[serde(default)]
+    pub new_password: Option<String>,
+}
+
+/// Rotate the admin's username and/or password. Auth middleware has
+/// already proved the caller owns a session; we additionally require
+/// the *current* password to prove "person at the keyboard right now".
+/// On success we issue a fresh session cookie keyed to the (possibly
+/// new) username and revoke every prior session so a stolen cookie
+/// from before the rotation stops working.
+pub async fn api_update_credentials(
+    State(state): State<AppState>,
+    Json(body): Json<UpdateCredentialsBody>,
+) -> Response {
+    if !state.admin.is_configured() {
+        return (
+            StatusCode::CONFLICT,
+            Json(json!({ "error": "no admin configured" })),
+        )
+            .into_response();
+    }
+    // Two bcrypt operations (verify current + hash new) plus a sync disk
+    // persist — run the lot on the blocking pool.
+    let admin = state.admin.clone();
+    let result = tokio::task::spawn_blocking(move || {
+        admin.update_credentials(
+            &body.current_password,
+            body.new_username.as_deref(),
+            body.new_password.as_deref(),
+        )
+    })
+    .await
+    .unwrap_or_else(|e| Err(openpxe_core::Error::Other(e.into())));
+    match result {
+        Ok(pub_) => {
+            state.sessions.revoke_all();
+            let session = state.sessions.create(&pub_.username);
+            login_response(StatusCode::OK, &pub_, &session)
+        }
+        Err(openpxe_core::Error::Invalid(msg)) => {
+            (StatusCode::BAD_REQUEST, Json(json!({ "error": msg }))).into_response()
+        }
+        Err(e) => (
+            StatusCode::INTERNAL_SERVER_ERROR,
+            Json(json!({ "error": format!("{e}") })),
+        )
+            .into_response(),
+    }
+}
+
+#[derive(Debug, Serialize)]
+struct LoginPayload<'a> {
+    user: &'a AdminPublic,
+    authenticated: bool,
+}
+
+fn login_response(status: StatusCode, user: &AdminPublic, session: &str) -> Response {
+    let body = Json(LoginPayload {
+        user,
+        authenticated: true,
+    });
+    let mut resp = (status, body).into_response();
+    resp.headers_mut().insert(
+        header::SET_COOKIE,
+        HeaderValue::from_str(&cookie_attrs(session, None)).unwrap(),
+    );
+    resp
+}
+
+// ── Tests ─────────────────────────────────────────────────────────────────
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn session_create_touch_revoke() {
+        let s = SessionStore::default();
+        assert!(s.is_empty());
+        let t = s.create("admin");
+        assert_eq!(s.len(), 1);
+        assert_eq!(s.touch(&t).as_deref(), Some("admin"));
+        s.revoke(&t);
+        assert!(s.is_empty());
+        // Stale token doesn't error, just returns None.
+        assert!(s.touch(&t).is_none());
+    }
+
+    #[test]
+    fn session_revoke_all_clears() {
+        let s = SessionStore::default();
+        let _ = s.create("a");
+        let _ = s.create("b");
+        assert_eq!(s.len(), 2);
+        s.revoke_all();
+        assert!(s.is_empty());
+    }
+
+    #[test]
+    fn public_path_allowlist() {
+        // PXE + chrome paths bypass auth.
+        for p in [
+            "/",
+            "/assets/app.js",
+            "/boot.ipxe",
+            "/boot/fake.ipxe",
+            "/iso/fake.iso",
+            "/ipxe/snponly.efi",
+            "/healthz",
+            "/readyz",
+            "/metrics",
+            // v0.4.6: iPXE fetches this for `console --picture` before
+            // it can possibly have a session cookie.
+            "/branding/pxe-logo",
+        ] {
+            assert!(is_public_path(p), "expected {p} to be public");
+        }
+        // Auth surface itself is public.
+        for p in ["/api/setup", "/api/login", "/api/logout", "/api/me"] {
+            assert!(is_public_path(p), "expected {p} to be public");
+        }
+        // v0.5.1: SAML SP endpoints are pre-auth (no session yet).
+        for p in ["/api/sso/login", "/api/sso/acs", "/api/sso/metadata"] {
+            assert!(is_public_path(p), "expected {p} to be public");
+        }
+        // iPXE long-poll endpoints are public (no cookie available).
+        assert!(is_public_path("/api/queue/join"));
+        assert!(is_public_path("/api/queue/poll/abc"));
+        // Everything else under /api/* must auth.
+        for p in [
+            "/api/isos",
+            "/api/isos/x/category",
+            "/api/storage/disk",
+            "/api/branding/logo",
+            "/api/sso",
+            "/api/hosts",
+        ] {
+            assert!(!is_public_path(p), "expected {p} to require auth");
+        }
+    }
+
+    #[test]
+    fn cookie_parse_picks_session_value() {
+        let mut h = axum::http::HeaderMap::new();
+        h.insert(
+            header::COOKIE,
+            HeaderValue::from_str(&format!("foo=bar; {SESSION_COOKIE}=abc123; baz=qux")).unwrap(),
+        );
+        assert_eq!(parse_cookie(&h).as_deref(), Some("abc123"));
+        // Different name → None.
+        let mut h2 = axum::http::HeaderMap::new();
+        h2.insert(header::COOKIE, HeaderValue::from_str("foo=bar").unwrap());
+        assert!(parse_cookie(&h2).is_none());
+        // No cookie header at all → None.
+        assert!(parse_cookie(&axum::http::HeaderMap::new()).is_none());
+    }
+}

crates/http-api/src/error.rs

@@ -0,0 +1,92 @@
+//! Uniform HTTP error mapping for the API layer (v0.5.4).
+//!
+//! Before this, ~40 handlers in `app.rs` hand-wrote
+//! `match … { Err(e) => (StatusCode::…, format!("{e}")).into_response() }`,
+//! and the `openpxe_core::Error` → status mapping drifted between them
+//! (e.g. `Invalid` → 400 in most places, 404 in one). [`AppError`] wraps
+//! `openpxe_core::Error` so a handler can return `Result<T, AppError>` and
+//! `?` its way out, getting one consistent status + body. The body stays
+//! plain-text (matching the previous `(StatusCode, String)` responses) so
+//! existing clients and tests see no shape change; 5xx detail is logged
+//! and returned verbatim exactly as before.
+//!
+//! Handlers with *intentional* domain-specific statuses (e.g. a duplicate
+//! share → 409, a still-open chunked upload → 409) keep their explicit
+//! returns — `AppError` is for the common case, not a straitjacket.
+
+use axum::http::StatusCode;
+use axum::response::{IntoResponse, Response};
+use openpxe_core::Error as CoreError;
+
+/// Newtype over [`openpxe_core::Error`] with a uniform [`IntoResponse`].
+#[derive(Debug)]
+pub struct AppError(pub CoreError);
+
+impl From<CoreError> for AppError {
+    fn from(e: CoreError) -> Self {
+        AppError(e)
+    }
+}
+
+impl From<std::io::Error> for AppError {
+    fn from(e: std::io::Error) -> Self {
+        AppError(CoreError::Io(e))
+    }
+}
+
+impl AppError {
+    /// The HTTP status this error maps to. Public so handlers (and tests)
+    /// can reason about the mapping in one place.
+    #[must_use]
+    pub fn status(&self) -> StatusCode {
+        match self.0 {
+            CoreError::NotFound(_) => StatusCode::NOT_FOUND,
+            CoreError::Invalid(_) => StatusCode::BAD_REQUEST,
+            CoreError::Config(_) | CoreError::Io(_) | CoreError::Other(_) => {
+                StatusCode::INTERNAL_SERVER_ERROR
+            }
+        }
+    }
+}
+
+impl IntoResponse for AppError {
+    fn into_response(self) -> Response {
+        let status = self.status();
+        // Match the prior hand-written responses: the 4xx arms returned the
+        // bare inner message (not the `Display` prefix), so a UI showing
+        // `await r.text()` reads "metadata too long", not "invalid input:
+        // metadata too long". 5xx keeps the full `Display` string.
+        let body = match &self.0 {
+            CoreError::Invalid(m) | CoreError::NotFound(m) => m.clone(),
+            other => other.to_string(),
+        };
+        if status.is_server_error() {
+            // Log the full detail server-side; the body still carries it
+            // (unchanged from the prior `format!("{e}")` behaviour), but the
+            // log line is what an operator greps for.
+            tracing::error!(target: "openpxe::http", error = %self.0, "request failed");
+        }
+        (status, body).into_response()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn status_mapping_is_consistent() {
+        assert_eq!(
+            AppError(CoreError::NotFound("x".into())).status(),
+            StatusCode::NOT_FOUND
+        );
+        assert_eq!(
+            AppError(CoreError::Invalid("x".into())).status(),
+            StatusCode::BAD_REQUEST
+        );
+        assert_eq!(
+            AppError(CoreError::Config("x".into())).status(),
+            StatusCode::INTERNAL_SERVER_ERROR
+        );
+    }
+}

crates/http-api/src/grub_script.rs

@@ -0,0 +1,192 @@
+//! GRUB menu rendering for the Secure Boot chain (v0.7.0).
+//!
+//! Secure-Boot-enabled firmware refuses our unsigned iPXE, so those
+//! clients are automatically escalated (see `openpxe_dhcp_proxy::
+//! escalation`) to the Microsoft-signed Fedora `shim` → signed `grub`
+//! chain. GRUB then fetches `grub.cfg` from this server (TFTP `$prefix`
+//! resolution, or HTTP when the whole chain came over HTTP Boot) — and
+//! this module renders that config from the same boot-entry model that
+//! renders `boot.ipxe`.
+//!
+//! Scope: **Linux kernel entries only.** A signed GRUB will only execute
+//! kernels that pass shim verification — i.e. distro-signed kernels —
+//! which is exactly what `LinuxKernel` boot entries point at. `sanboot`
+//! ISO emulation and `wimboot` are iPXE mechanisms with no signed
+//! equivalent; those entries are omitted here, and the menu says so.
+//! (Windows deployment under Secure Boot has no legitimate unsigned
+//! path — per project policy we never ship test-signed binaries or touch
+//! client trust stores.)
+//!
+//! The kernel/initrd lines use GRUB's `(http,host:port)` device syntax;
+//! Fedora's signed netboot GRUB carries the `http`, `tftp` and `efinet`
+//! modules built in, so no unsigned module loading is required.
+
+use openpxe_iso_store::{BootKind, IsoMeta};
+use std::fmt::Write as _;
+
+/// Render the full `grub.cfg` for the signed-GRUB menu.
+///
+/// `base_url` is the public HTTP base (`http://10.0.0.5` or
+/// `http://10.0.0.5:8080`) — converted to GRUB's `(http,host:port)`
+/// device prefix for kernel/initrd fetches.
+#[must_use]
+pub fn render_grub_menu(isos: &[IsoMeta], base_url: &str) -> String {
+    let base = base_url.trim_end_matches('/');
+    let dev = grub_http_device(base);
+    let mut s = String::new();
+    let _ = writeln!(s, "# OpenPXE — Secure Boot menu (signed shim+GRUB chain)");
+    // v0.7.1: before showing the limited signed menu, try to hand the
+    // boot back to full iPXE *in this same boot cycle*. With Secure Boot
+    // OFF the chainload succeeds and the client gets the complete iPXE
+    // feature set (sanboot, wimboot, the full menu) despite having been
+    // escalated here. With Secure Boot ON, shim's verifier refuses the
+    // unsigned image INLINE — no reboot, no failed cycle — and execution
+    // falls through to the signed menu below. The all-drivers build is
+    // used because a MAC only lands here after the firmware-net build
+    // already failed once.
+    let _ = writeln!(s, "if [ \"$grub_cpu\" = \"arm64\" ]; then");
+    let _ = writeln!(s, "    set openpxe_ipxe=ipxe-arm64.efi");
+    let _ = writeln!(s, "else");
+    let _ = writeln!(s, "    set openpxe_ipxe=ipxe.efi");
+    let _ = writeln!(s, "fi");
+    let _ = writeln!(s, "if chainloader {dev}/ipxe/$openpxe_ipxe ; then");
+    let _ = writeln!(s, "    boot");
+    let _ = writeln!(s, "fi");
+    let _ = writeln!(s);
+    let _ = writeln!(s, "set timeout=30");
+    let _ = writeln!(s, "set default=0");
+    let _ = writeln!(s);
+
+    let mut entries = 0usize;
+    for iso in isos {
+        for entry in &iso.boot_entries {
+            let BootKind::LinuxKernel {
+                kernel_url,
+                initrd_urls,
+                args,
+            } = &entry.kind
+            else {
+                continue;
+            };
+            // GRUB menu titles: keep quotes out of the label.
+            let title = entry.title.replace('"', "'");
+            let cmdline = args.cmdline.replace("${base-url}", base);
+            let _ = writeln!(s, "menuentry \"{} — {title}\" {{", iso.filename);
+            let _ = writeln!(s, "    linux {dev}/{kernel_url} {cmdline}");
+            if !initrd_urls.is_empty() {
+                let _ = write!(s, "    initrd");
+                for u in initrd_urls {
+                    let _ = write!(s, " {dev}/{u}");
+                }
+                let _ = writeln!(s);
+            }
+            let _ = writeln!(s, "}}");
+            let _ = writeln!(s);
+            entries += 1;
+        }
+    }
+
+    if entries == 0 {
+        let _ = writeln!(
+            s,
+            "menuentry \"No Secure-Boot-bootable images on this server yet\" {{ true }}"
+        );
+        let _ = writeln!(s);
+    }
+    // Always give the operator a way off this screen.
+    let _ = writeln!(s, "menuentry \"Boot from local disk\" {{");
+    let _ = writeln!(s, "    exit");
+    let _ = writeln!(s, "}}");
+    s
+}
+
+/// `http://10.0.0.5:8080` → `(http,10.0.0.5:8080)`. GRUB wants the
+/// scheme as the device type and host[:port] as the device address.
+fn grub_http_device(base: &str) -> String {
+    let host = base
+        .trim_start_matches("http://")
+        .trim_start_matches("https://");
+    format!("(http,{host})")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use openpxe_iso_store::{BootEntry, IsoSource, KernelArgs};
+
+    fn linux_iso() -> IsoMeta {
+        IsoMeta {
+            id: "alp".into(),
+            filename: "alpine.iso".into(),
+            size_bytes: 1,
+            sha256_hex: None,
+            uploaded_at: time::OffsetDateTime::UNIX_EPOCH,
+            source: IsoSource::Local,
+            introspection: openpxe_iso_store::IntrospectionReport::default(),
+            boot_entries: vec![BootEntry {
+                id: "alp-linux".into(),
+                title: "Linux installer".into(),
+                kind: BootKind::LinuxKernel {
+                    kernel_url: "iso/alp/boot/vmlinuz".into(),
+                    initrd_urls: vec!["iso/alp/boot/initrd".into()],
+                    args: KernelArgs {
+                        cmdline: "quiet repo=${base-url}/iso/alp.iso".into(),
+                    },
+                },
+            }],
+            category: openpxe_iso_store::IsoCategory::default(),
+            password_hash: None,
+        }
+    }
+
+    #[test]
+    fn renders_linux_entries_with_http_device_urls() {
+        let cfg = render_grub_menu(&[linux_iso()], "http://10.0.0.5:8080/");
+        assert!(
+            cfg.contains("menuentry \"alpine.iso — Linux installer\""),
+            "{cfg}"
+        );
+        assert!(
+            cfg.contains("linux (http,10.0.0.5:8080)/iso/alp/boot/vmlinuz quiet repo=http://10.0.0.5:8080/iso/alp.iso"),
+            "{cfg}"
+        );
+        assert!(
+            cfg.contains("initrd (http,10.0.0.5:8080)/iso/alp/boot/initrd"),
+            "{cfg}"
+        );
+        assert!(cfg.contains("Boot from local disk"), "{cfg}");
+    }
+
+    #[test]
+    fn config_tries_ipxe_chainload_before_menu() {
+        // v0.7.1: SB-off machines recover full iPXE in the same boot;
+        // SB-on machines fail the chainload inline and reach the menu.
+        let cfg = render_grub_menu(&[linux_iso()], "http://10.0.0.5:8080");
+        let chain_pos = cfg
+            .find("if chainloader (http,10.0.0.5:8080)/ipxe/$openpxe_ipxe ; then")
+            .expect("chainload attempt missing");
+        let menu_pos = cfg.find("menuentry").expect("menu missing");
+        assert!(
+            chain_pos < menu_pos,
+            "chainload must precede the menu:\n{cfg}"
+        );
+        // Arch-conditional binary selection via GRUB's $grub_cpu.
+        assert!(cfg.contains("set openpxe_ipxe=ipxe-arm64.efi"), "{cfg}");
+        assert!(cfg.contains("set openpxe_ipxe=ipxe.efi"), "{cfg}");
+    }
+
+    #[test]
+    fn sanboot_and_wimboot_entries_are_omitted() {
+        let mut iso = linux_iso();
+        iso.boot_entries = vec![BootEntry {
+            id: "win".into(),
+            title: "Windows".into(),
+            kind: BootKind::SanBootIso {
+                iso_url: "iso/win.iso".into(),
+            },
+        }];
+        let cfg = render_grub_menu(&[iso], "http://10.0.0.5");
+        assert!(!cfg.contains("Windows"), "{cfg}");
+        assert!(cfg.contains("No Secure-Boot-bootable images"), "{cfg}");
+    }
+}

crates/http-api/src/ipxe_script.rs

@@ -23,12 +23,22 @@
 //! There is intentionally no UI path to upload a custom `.ipxe` script.
 
 use openpxe_core::{Settings, TimeoutAction};
-use openpxe_iso_store::{BootEntry, BootKind, IsoMeta};
 use openpxe_iso_store::introspect::DistroFamily;
+use openpxe_iso_store::{BootEntry, BootKind, IsoMeta};
 use std::fmt::Write as _;
 
 /// Top-level OpenPXE boot menu. Serialized identically for BIOS and UEFI
 /// clients because iPXE normalises the menu primitives across firmwares.
+///
+/// v0.4.69: rendered with an iVentoy-style graphical frame — a
+/// `console --picture` directive paints a full-screen PNG background
+/// (the operator's uploaded logo on a dark field, or the default
+/// OpenPXE mark) with the menu text overlaid below a reserved top
+/// margin, plus a footer carrying version + arch + firmware kind. On
+/// iPXE binaries built with `IMAGE_PNG` + `CONSOLE_FRAMEBUFFER` (our
+/// x86_64 UEFI binaries, compiled from source) the background paints;
+/// on binaries without PNG support the `|| console` fallback yields a
+/// clean text menu. The old ASCII wordmark has been removed.
 #[must_use]
 pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> String {
     let mut s = String::new();
@@ -47,45 +57,127 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
     let _ = writeln!(s, "set base-url {base}");
     let _ = writeln!(s, "set esc:hex 1b");
     let _ = writeln!(s, "set cls ${{esc:string}}[2J");
+    // v0.4.69: graphical background. `/branding/pxe-logo` always
+    // returns a full-screen 1024×768 PNG now — the operator's logo on a
+    // dark field, or a default OpenPXE mark when none is uploaded. The
+    // `--top 290` reserves the top band (where the logo paints) so the
+    // menu text lands below it.
+    //
+    // v0.5.7: gate the whole command behind `iseq ${platform} efi`.
+    // `console --picture` needs IMAGE_PNG + CONSOLE_FRAMEBUFFER, which
+    // only our from-source UEFI binaries carry (x86_64/arm64 UEFI — see
+    // deploy/docker/Dockerfile). The fetched BIOS `undionly.kpxe` has
+    // neither, and on legacy BIOS the `--picture` attempt misbehaves
+    // *before* the trailing `|| console` fallback can recover (it tries
+    // to set a framebuffer mode the BIOS console can't honour). Guarding
+    // on platform means BIOS clients never issue the command at all —
+    // they drop straight to the plain text menu — while UEFI clients
+    // still get the graphical background. A PNG-less UEFI build (e.g. the
+    // upstream i386-efi baseline) still falls back gracefully through the
+    // same `|| console`. No operator toggle needed; mixed BIOS+UEFI
+    // fleets each get the right treatment automatically.
+    let _ = writeln!(
+        s,
+        "iseq ${{platform}} efi && console --picture {base}/branding/pxe-logo --top 290 || console"
+    );
+    // Map iPXE's ${{buildarch}} + ${{platform}} into the human form the
+    // user asked for (e.g. "x86 BIOS", "x86_64 UEFI", "arm64 UEFI").
+    // iPXE evaluates `iseq` lazily, so we only set whichever line
+    // matches. Anything not on the allowlist falls through to a generic
+    // `<buildarch> <platform>` display.
+    let _ = writeln!(s, "set arch-label ${{buildarch}} ${{platform}}");
+    let _ = writeln!(
+        s,
+        "iseq ${{buildarch}} i386   && iseq ${{platform}} pcbios && set arch-label x86 BIOS         || iseq ${{buildarch}} x86_64 && iseq ${{platform}} efi    && set arch-label x86_64 UEFI      || iseq ${{buildarch}} arm64  && iseq ${{platform}} efi    && set arch-label arm64 UEFI       || true"
+    );
     let _ = writeln!(s, ":menu");
     let _ = writeln!(s, "menu OpenPXE - network boot menu");
-    let _ = writeln!(s, "item --gap -- ------------------------- Default -------------------------");
+    // v0.4.69: the ASCII wordmark is gone — the graphical background
+    // (set via `console --picture` above) carries the branding now.
+    let _ = writeln!(s, "item --gap");
+    let _ = writeln!(
+        s,
+        "item --gap -- ------------------------- Default -------------------------"
+    );
     let _ = writeln!(s, "item local            Boot from Local HDD");
-    let _ = writeln!(s, "item --gap -- ----------------------- Installers -----------------------");
+    let _ = writeln!(
+        s,
+        "item --gap -- ----------------------- Installers -----------------------"
+    );
     if has_family(isos, is_linux_family) {
         let _ = writeln!(s, "item linux            Linux Installers  >");
     } else {
         let _ = writeln!(s, "item --gap -- (no Linux ISOs uploaded)");
     }
-    if settings.windows_enabled && has_family(isos, is_windows_family) {
+    // v0.5.8: Windows just works — no Settings toggle. Show the Windows
+    // installers submenu whenever a Windows ISO is present; entries boot
+    // via HTTP sanboot of the raw ISO, so no SMB/extraction is required.
+    if has_family(isos, is_windows_family) {
         let _ = writeln!(s, "item windows          Windows Installers  >");
-    } else if settings.windows_enabled {
-        let _ = writeln!(s, "item --gap -- (no Windows ISOs uploaded)");
     } else {
-        let _ = writeln!(s, "item --gap -- (Windows support disabled in Settings)");
+        let _ = writeln!(s, "item --gap -- (no Windows ISOs uploaded)");
     }
-    let _ = writeln!(s, "item --gap -- -------------------------- Tools --------------------------");
+    let _ = writeln!(
+        s,
+        "item --gap -- -------------------------- Tools --------------------------"
+    );
     let _ = writeln!(s, "item tools            Tools  >");
-    let _ = writeln!(s, "item --gap -- ---------------------- Queued Deployment ---------------------");
+    let _ = writeln!(
+        s,
+        "item --gap -- ---------------------- Queued Deployment ---------------------"
+    );
     let _ = writeln!(s, "item queue            Queued Deployment  (join queue)");
     let _ = writeln!(s, "item --gap");
     let _ = writeln!(s, "item --key x exit     Exit iPXE");
+    // v0.4.6 footer line. Sits just above the `choose` line so it's
+    // always visible regardless of how the menu paginates. iPXE
+    // interpolates `${arch-label}` (set near the top of this script)
+    // and `${version}` is the binary-baked iPXE version — *not* the
+    // OpenPXE version — so we hard-code the OpenPXE version string
+    // here.
+    let openpxe_version = env!("CARGO_PKG_VERSION");
+    let _ = writeln!(s, "item --gap");
+    let _ = writeln!(
+        s,
+        "item --gap --                 OpenPXE v{openpxe_version}  -  ${{arch-label}}"
+    );
 
     if matches!(settings.timeout_action, TimeoutAction::Stay) {
         let _ = writeln!(s, "choose --default {default_item} target || goto menu");
     } else {
-        let _ = writeln!(s, "choose --default {default_item} --timeout {timeout_ms} target || goto menu");
+        let _ = writeln!(
+            s,
+            "choose --default {default_item} --timeout {timeout_ms} target || goto menu"
+        );
     }
 
     // iPXE's `||` is strict about what follows. Each test uses `goto menu`
     // as the fallthrough target so the parser never sees a bare `||` with
     // trailing whitespace — some iPXE builds reject that.
-    let _ = writeln!(s, "iseq ${{target}} local   && chain {base}/boot/_local.ipxe        || goto menu");
+    let _ = writeln!(
-    let _ = writeln!(s, "iseq ${{target}} linux   && chain {base}/boot/_linux_menu.ipxe   || goto menu");
+        s,
-    let _ = writeln!(s, "iseq ${{target}} windows && chain {base}/boot/_windows_menu.ipxe || goto menu");
+        "iseq ${{target}} local   && chain {base}/boot/_local.ipxe        || goto menu"
-    let _ = writeln!(s, "iseq ${{target}} tools   && chain {base}/boot/_tools_menu.ipxe   || goto menu");
+    );
-    let _ = writeln!(s, "iseq ${{target}} queue   && chain {base}/boot/_queue.ipxe         || goto menu");
+    let _ = writeln!(
-    let _ = writeln!(s, "iseq ${{target}} exit    && exit                                 || goto menu");
+        s,
+        "iseq ${{target}} linux   && chain {base}/boot/_linux_menu.ipxe   || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} windows && chain {base}/boot/_windows_menu.ipxe || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} tools   && chain {base}/boot/_tools_menu.ipxe   || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} queue   && chain {base}/boot/_queue.ipxe         || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} exit    && exit                                 || goto menu"
+    );
     let _ = writeln!(s, "goto menu");
     s
 }
@@ -95,27 +187,48 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
 #[must_use]
 pub fn render_family_menu(isos: &[IsoMeta], base_url: &str, is_windows: bool) -> String {
     let base = base_url.trim_end_matches('/');
-    let title = if is_windows { "Windows Installers" } else { "Linux Installers" };
+    let title = if is_windows {
+        "Windows Installers"
+    } else {
+        "Linux Installers"
+    };
     let label = if is_windows { "windows" } else { "linux" };
     let mut s = String::new();
     let _ = writeln!(s, "#!ipxe");
     let _ = writeln!(s, "set base-url {base}");
     let _ = writeln!(s, ":menu");
     let _ = writeln!(s, "menu OpenPXE - {title}");
-    let filter: fn(DistroFamily) -> bool =
+    let filter: fn(DistroFamily) -> bool = if is_windows {
-        if is_windows { is_windows_family } else { is_linux_family };
+        is_windows_family
+    } else {
+        is_linux_family
+    };
     let mut count = 0;
     for iso in isos {
-        if !filter(iso.introspection.family) { continue; }
+        if !filter(iso.introspection.family) {
+            continue;
+        }
+        // v0.4.4: ISOs the operator flipped to the Tools category move
+        // out of the OS installer submenus entirely — they only appear
+        // under Tools. Without this filter the operator would see the
+        // same ISO in both menus.
+        if matches!(iso.category, openpxe_iso_store::IsoCategory::Tools) {
+            continue;
+        }
         for entry in &iso.boot_entries {
             let size_label = fmt_size_mib(iso.size_bytes);
             let key = hotkey_for_index(count);
             // Visual hint: a leading `*` marks password-protected entries.
             // ASCII only — iPXE's menu console mangles non-ASCII on some
             // firmwares.
-            let lock = if iso.is_password_protected() { "*" } else { " " };
+            let lock = if iso.is_password_protected() {
+                "*"
+            } else {
+                " "
+            };
             let _ = writeln!(
-                s, "item {}{} {}[{:>6}] {}",
+                s,
+                "item {}{} {}[{:>6}] {}",
                 key,
                 entry.id,
                 lock,
@@ -131,8 +244,18 @@ pub fn render_family_menu(isos: &[IsoMeta], base_url: &str, is_windows: bool) ->
     let _ = writeln!(s, "item --gap");
     let _ = writeln!(s, "item --key b back   < Back to main menu");
     let _ = writeln!(s, "choose target || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} back && chain {base}/boot.ipxe || goto menu");
+    let _ = writeln!(
-    let _ = writeln!(s, "chain {base}/boot/${{target}}.ipxe || goto menu");
+        s,
+        "iseq ${{target}} back && chain {base}/boot.ipxe || goto menu"
+    );
+    // Pass `?mac=${mac}` so the per-entry handler can record the booting
+    // client into the Host log. iPXE substitutes `${mac}` before
+    // the HTTP fetch; if the firmware can't resolve it the literal
+    // `${mac}` is sent and the server treats it as "unknown".
+    let _ = writeln!(
+        s,
+        "chain {base}/boot/${{target}}.ipxe?mac=${{mac}} || goto menu"
+    );
     s
 }
 
@@ -153,15 +276,52 @@ fn hotkey_for_index(i: usize) -> String {
     }
 }
 
-/// Tools submenu — Utilities, Shell, NIC Info, Reboot, Exit to firmware.
+/// Tools submenu — Utilities, Shell, NIC Info, Reboot, Exit to firmware,
+/// plus any ISOs the operator flipped to [`IsoCategory::Tools`] in the
+/// Storage tab. The category-Tools ISOs render first so frequently used
+/// recovery / hardware tools are reachable with a single number key
+/// before the built-in shortcuts.
 #[must_use]
-pub fn render_tools_menu(base_url: &str) -> String {
+pub fn render_tools_menu(isos: &[IsoMeta], base_url: &str) -> String {
     let base = base_url.trim_end_matches('/');
     let mut s = String::new();
     let _ = writeln!(s, "#!ipxe");
     let _ = writeln!(s, "set base-url {base}");
     let _ = writeln!(s, ":menu");
     let _ = writeln!(s, "menu OpenPXE - Tools");
+
+    // Operator-categorized tool ISOs (hotkeys 1..9), each chained the
+    // same way as a per-family menu pick — through the boot-entry id
+    // route, carrying `?mac=${mac}` for Host log attribution.
+    let mut count = 0;
+    for iso in isos {
+        if !matches!(iso.category, openpxe_iso_store::IsoCategory::Tools) {
+            continue;
+        }
+        for entry in &iso.boot_entries {
+            let size_label = fmt_size_mib(iso.size_bytes);
+            let key = hotkey_for_index(count);
+            let lock = if iso.is_password_protected() {
+                "*"
+            } else {
+                " "
+            };
+            let _ = writeln!(
+                s,
+                "item {}{} {}[{:>6}] {}",
+                key,
+                entry.id,
+                lock,
+                size_label,
+                escape_label(&entry.title),
+            );
+            count += 1;
+        }
+    }
+    if count > 0 {
+        let _ = writeln!(s, "item --gap");
+    }
+
     let _ = writeln!(s, "item --key u util     Utilities  (memtest, ...)");
     let _ = writeln!(s, "item --key s shell    OpenPXE Shell");
     let _ = writeln!(s, "item --key n nic      Network Card Info");
@@ -171,13 +331,36 @@ pub fn render_tools_menu(base_url: &str) -> String {
     let _ = writeln!(s, "item --gap");
     let _ = writeln!(s, "item --key b back     < Back to main menu");
     let _ = writeln!(s, "choose target || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} util     && chain {base}/boot/_util.ipxe  || goto menu");
+    let _ = writeln!(
-    let _ = writeln!(s, "iseq ${{target}} shell    && chain {base}/boot/_shell.ipxe || goto menu");
+        s,
-    let _ = writeln!(s, "iseq ${{target}} nic      && chain {base}/boot/_nic.ipxe   || goto menu");
+        "iseq ${{target}} util     && chain {base}/boot/_util.ipxe  || goto menu"
-    let _ = writeln!(s, "iseq ${{target}} reboot   && reboot                        || goto menu");
+    );
-    let _ = writeln!(s, "iseq ${{target}} firmware && exit 0                        || goto menu");
+    let _ = writeln!(
-    let _ = writeln!(s, "iseq ${{target}} back     && chain {base}/boot.ipxe        || goto menu");
+        s,
-    let _ = writeln!(s, "goto menu");
+        "iseq ${{target}} shell    && chain {base}/boot/_shell.ipxe || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} nic      && chain {base}/boot/_nic.ipxe   || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} reboot   && reboot                        || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} firmware && exit 0                        || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} back     && chain {base}/boot.ipxe        || goto menu"
+    );
+    // Fall-through for category-Tools ISO ids — same as the family
+    // submenu, carrying `?mac=${mac}` for the boot log.
+    let _ = writeln!(
+        s,
+        "chain {base}/boot/${{target}}.ipxe?mac=${{mac}} || goto menu"
+    );
     s
 }
 
@@ -190,8 +373,15 @@ pub fn render_local_hdd(base_url: &str) -> String {
     let mut s = String::new();
     let _ = writeln!(s, "#!ipxe");
     let _ = writeln!(s, "# Boot from Local HDD - platform-sensitive");
-    let _ = writeln!(s, "iseq ${{platform}} pcbios && sanboot --no-describe --drive 0x80 || ");
+    let _ = writeln!(
-    let _ = writeln!(s, "# UEFI path: fall through to the firmware's next boot entry");
+        s,
+        "iseq ${{platform}} pcbios && sanboot --no-describe --drive 0x80 || goto uefi"
+    );
+    let _ = writeln!(s, ":uefi");
+    let _ = writeln!(
+        s,
+        "# UEFI path: fall through to the firmware's next boot entry"
+    );
     let _ = writeln!(s, "exit 0");
     let _ = writeln!(s, "# If the above exit returns, loop back to the main menu");
     let _ = writeln!(s, "chain {base}/boot.ipxe");
@@ -212,8 +402,14 @@ pub fn render_util(base_url: &str) -> String {
     let _ = writeln!(s, "item --gap");
     let _ = writeln!(s, "item back         < Back");
     let _ = writeln!(s, "choose target || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} memtest && chain {base}/ipxe/memtest.bin || ");
+    let _ = writeln!(
-    let _ = writeln!(s, "iseq ${{target}} back && chain {base}/boot/_tools_menu.ipxe || ");
+        s,
+        "iseq ${{target}} memtest && chain {base}/ipxe/memtest.bin || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} back && chain {base}/boot/_tools_menu.ipxe || goto menu"
+    );
     let _ = writeln!(s, "goto menu");
     s
 }
@@ -260,7 +456,10 @@ pub fn render_queue_entry(base_url: &str) -> String {
     let base = base_url.trim_end_matches('/');
     let mut s = String::new();
     let _ = writeln!(s, "#!ipxe");
-    let _ = writeln!(s, "# Queued Deployment - join the queue and wait for operator");
+    let _ = writeln!(
+        s,
+        "# Queued Deployment - join the queue and wait for operator"
+    );
     let _ = writeln!(s, "echo Joining deployment queue...");
     // imgfetch writes the body to a file in iPXE's transient FS; we read
     // the queue entry id out of the Location-style header by asking the server
@@ -270,19 +469,42 @@ pub fn render_queue_entry(base_url: &str) -> String {
 }
 
 /// Per-entry boot script (same as Phase 1, with extra_kernel_args appended).
+///
+/// `unattended_args` (v0.5.2) carries the per-host unattended-install
+/// kernel arguments (`inst.ks=…`, `auto=true … url=…`, or
+/// `autoinstall ds=nocloud-net;s=…`) when the requesting MAC has a
+/// deployment profile with an answer file selected. It's appended to the
+/// Linux kernel command line after the operator's global extra args, and
+/// ignored for Windows (wimboot) / sanboot entries which don't take a
+/// kernel cmdline.
 #[must_use]
-pub fn render_entry(entry: &BootEntry, settings: &Settings, base_url: &str) -> String {
+pub fn render_entry(
+    entry: &BootEntry,
+    settings: &Settings,
+    base_url: &str,
+    unattended_args: Option<&str>,
+) -> String {
     let mut s = String::new();
     let base = base_url.trim_end_matches('/');
     let _ = writeln!(s, "#!ipxe");
     let _ = writeln!(s, "set base-url {base}");
     match &entry.kind {
-        BootKind::LinuxKernel { kernel_url, initrd_urls, args } => {
+        BootKind::LinuxKernel {
+            kernel_url,
+            initrd_urls,
+            args,
+        } => {
             let mut cmdline = args.cmdline.replace("${base-url}", base);
             if !settings.extra_kernel_args.trim().is_empty() {
                 cmdline.push(' ');
                 cmdline.push_str(settings.extra_kernel_args.trim());
             }
+            if let Some(extra) = unattended_args {
+                if !extra.trim().is_empty() {
+                    cmdline.push(' ');
+                    cmdline.push_str(extra.trim());
+                }
+            }
             let _ = writeln!(s, "kernel {base}/{kernel_url} {cmdline}");
             for u in initrd_urls {
                 let _ = writeln!(s, "initrd {base}/{u}");
@@ -328,7 +550,12 @@ fn has_family(isos: &[IsoMeta], pred: fn(DistroFamily) -> bool) -> bool {
 }
 
 fn escape_label(s: &str) -> String {
-    s.chars().map(|c| match c { '\n' | '\r' => ' ', c => c }).collect()
+    s.chars()
+        .map(|c| match c {
+            '\n' | '\r' => ' ',
+            c => c,
+        })
+        .collect()
 }
 
 /// Render the password-prompt script for a protected boot entry.
@@ -362,12 +589,20 @@ pub fn render_password_prompt(entry_id: &str, iso_filename: &str, base_url: &str
     let _ = writeln!(s, "echo ==========================================");
     let _ = writeln!(s, "set password ");
     let _ = writeln!(s, "read --secret password");
-    let _ = writeln!(s, "iseq ${{password}} \"\" && chain {base}/boot.ipxe || goto submit");
-    let _ = writeln!(s, ":submit");
-    let _ = writeln!(s, "echo Verifying...");
     let _ = writeln!(
         s,
-        "chain {base}/boot/{entry_id}.ipxe?token=${{password:uristring}} || chain {base}/boot.ipxe"
+        "iseq ${{password}} \"\" && chain {base}/boot.ipxe || goto submit"
+    );
+    let _ = writeln!(s, ":submit");
+    let _ = writeln!(s, "echo Verifying...");
+    // Carry `mac=${mac}` alongside the token so a successful unlock
+    // records the actual client MAC into the Host log. On
+    // older iPXE that can't resolve `${mac}` the server just stores it
+    // as "unknown" rather than refusing to boot.
+    let _ = writeln!(
+        s,
+        "chain {base}/boot/{entry_id}.ipxe?token=${{password:uristring}}&mac=${{mac}} \
+         || chain {base}/boot.ipxe"
     );
     s
 }
@@ -384,7 +619,10 @@ pub fn render_password_failed(entry_id: &str, base_url: &str) -> String {
     let _ = writeln!(s, "echo");
     let _ = writeln!(s, "echo Wrong password.");
     let _ = writeln!(s, "sleep 2");
-    let _ = writeln!(s, "chain {base}/boot/{entry_id}.ipxe || chain {base}/boot.ipxe");
+    let _ = writeln!(
+        s,
+        "chain {base}/boot/{entry_id}.ipxe || chain {base}/boot.ipxe"
+    );
     s
 }
 
@@ -414,4 +652,92 @@ mod password_tests {
         // Re-target the entry so the prompt flow runs again.
         assert!(s.contains("chain http://10.0.0.5/boot/alpha-linux.ipxe"));
     }
+
+    #[test]
+    fn top_menu_has_polished_branding_and_arch_footer() {
+        // v0.4.69: the menu emits a `console --picture` line that paints
+        // a full-screen PNG background (the operator's logo, or the
+        // default OpenPXE mark) reserving a top margin for it, then
+        // falls back to a clean text console on iPXE builds without PNG
+        // support. The ASCII wordmark is gone — the graphical
+        // background carries the branding now. A single-line footer
+        // still carries the OpenPXE version + arch.
+        let settings = Settings::default();
+        let s = render_menu(&[], &settings, "http://10.0.0.5");
+        assert!(
+            s.contains("console --picture http://10.0.0.5/branding/pxe-logo"),
+            "missing console --picture line:\n{s}"
+        );
+        // The picture call reserves a top margin for the logo band.
+        assert!(s.contains("--top 290"), "missing --top margin:\n{s}");
+        // Picture-or-text-console must be a single statement so older
+        // iPXE parsers don't choke on the chain.
+        assert!(s.contains("|| console"), "missing graceful fallback:\n{s}");
+        // The ASCII wordmark must be GONE — its removal is the whole
+        // point of v0.4.69's graphical background.
+        assert!(
+            !s.contains("___                   ___  __  __ ___"),
+            "ASCII banner should have been removed:\n{s}"
+        );
+        // Footer with version + arch interpolation. The version comes
+        // from CARGO_PKG_VERSION at compile time.
+        let version = env!("CARGO_PKG_VERSION");
+        assert!(
+            s.contains(&format!("OpenPXE v{version}")),
+            "footer missing OpenPXE version:\n{s}"
+        );
+        assert!(
+            s.contains("${arch-label}"),
+            "footer missing arch-label interpolation:\n{s}"
+        );
+        // No website URL — the design brief calls that out as tacky.
+        assert!(
+            !s.to_ascii_lowercase().contains("openpxe.com"),
+            "footer should not advertise the website:\n{s}"
+        );
+        // Arch-label mapping covers the three labels from the brief:
+        // "x86 BIOS", "x86_64 UEFI", "arm64 UEFI".
+        assert!(s.contains("x86 BIOS"), "{s}");
+        assert!(s.contains("x86_64 UEFI"), "{s}");
+        assert!(s.contains("arm64 UEFI"), "{s}");
+    }
+
+    // v0.5.4: a full snapshot of the rendered top menu. The fragment
+    // `assert!`s above check specific invariants; this catches *any* other
+    // drift (a reordered item, a dropped line, changed spacing) so it's
+    // reviewed deliberately. The OpenPXE version is filtered out so the
+    // snapshot doesn't churn on every release bump.
+    #[test]
+    fn render_menu_snapshot() {
+        // Normalize the compile-time version so the snapshot doesn't churn
+        // on every release bump (no insta `filters` feature needed).
+        let rendered = render_menu(&[], &Settings::default(), "http://10.0.0.5").replace(
+            concat!("OpenPXE v", env!("CARGO_PKG_VERSION")),
+            "OpenPXE vX.Y.Z",
+        );
+        insta::assert_snapshot!(rendered);
+    }
+
+    #[test]
+    fn generated_scripts_do_not_emit_bare_or_trailing_fallbacks() {
+        let settings = Settings::default();
+        let scripts = [
+            render_menu(&[], &settings, "http://10.0.0.5"),
+            render_tools_menu(&[], "http://10.0.0.5"),
+            render_local_hdd("http://10.0.0.5"),
+            render_util("http://10.0.0.5"),
+            render_shell("http://10.0.0.5"),
+            render_nic_info("http://10.0.0.5"),
+            render_queue_entry("http://10.0.0.5"),
+            render_password_failed("alpha-linux", "http://10.0.0.5"),
+        ];
+        for script in scripts {
+            for line in script.lines() {
+                assert!(
+                    !line.trim_end().ends_with("||"),
+                    "bare iPXE fallback operator in line: {line}\nscript:\n{script}"
+                );
+            }
+        }
+    }
 }

crates/http-api/src/iso_fs.rs

@@ -1,112 +0,0 @@
-//! Minimal read-only ISO9660 lookup. Given an uploaded ISO file and an
-//! in-ISO path (e.g. `/casper/vmlinuz`), locate the file and return a
-//! `(start_byte, length_bytes)` pair so the HTTP handler can stream just
-//! that range from the on-disk ISO without full extraction.
-//!
-//! We only implement what we need: the Primary Volume Descriptor and Rock
-//! Ridge / Joliet extensions are ignored. Paths are matched case-insensitive
-//! against plain ISO9660 filenames (uppercase, `;1` version suffix stripped).
-//! This is sufficient for the kernel/initrd and wimboot files we serve;
-//! if a requested path isn't found, the handler returns 404 and the user
-//! can still download the whole ISO via `/iso/<id>.iso`.
-
-use std::io::{Read, Seek, SeekFrom};
-use std::path::Path;
-
-const SECTOR: u64 = 2048;
-
-#[derive(Debug, Clone)]
-pub struct FileLocation {
-    pub offset: u64,
-    pub length: u64,
-}
-
-/// Look up `in_iso_path` (leading slash optional, case-insensitive) in the
-/// ISO at `iso_path`. Returns None on any parsing or IO failure.
-pub fn lookup(iso_path: &Path, in_iso_path: &str) -> Option<FileLocation> {
-    let mut f = std::fs::File::open(iso_path).ok()?;
-    let root = read_root_directory(&mut f)?;
-    let components: Vec<&str> = in_iso_path
-        .trim_start_matches('/')
-        .split('/')
-        .filter(|c| !c.is_empty())
-        .collect();
-    if components.is_empty() { return None; }
-    walk(&mut f, root.offset, root.length, &components)
-}
-
-fn read_root_directory(f: &mut std::fs::File) -> Option<FileLocation> {
-    // Primary Volume Descriptor at LBA 16.
-    let mut pvd = [0u8; 2048];
-    f.seek(SeekFrom::Start(16 * SECTOR)).ok()?;
-    f.read_exact(&mut pvd).ok()?;
-    if pvd[0] != 0x01 || &pvd[1..6] != b"CD001" { return None; }
-    // Root directory record is at offset 156, length 34.
-    let rec = &pvd[156..156 + 34];
-    let (offset, length) = parse_dir_record_ext(rec)?;
-    Some(FileLocation { offset: offset * SECTOR, length })
-}
-
-/// Walk components down the directory tree starting at `dir_offset`.
-fn walk(
-    f: &mut std::fs::File,
-    dir_offset: u64,
-    dir_len: u64,
-    components: &[&str],
-) -> Option<FileLocation> {
-    let mut dir = vec![0u8; dir_len as usize];
-    f.seek(SeekFrom::Start(dir_offset)).ok()?;
-    f.read_exact(&mut dir).ok()?;
-
-    let target = components[0];
-    let rest = &components[1..];
-    let mut i = 0;
-    while i < dir.len() {
-        let len = dir[i] as usize;
-        if len == 0 {
-            // Padding to sector boundary.
-            let next = (i / SECTOR as usize + 1) * SECTOR as usize;
-            if next <= i { break; }
-            i = next;
-            continue;
-        }
-        if i + len > dir.len() { break; }
-        let rec = &dir[i..i + len];
-        let name = dir_record_name(rec);
-        let is_dir = (rec.get(25).copied().unwrap_or(0) & 0x02) != 0;
-        // Skip "." (0x00) and ".." (0x01) pseudo-entries.
-        let is_pseudo = matches!(rec.get(32).copied(), Some(1)) && rec.get(33).copied() == Some(0x00)
-            || matches!(rec.get(32).copied(), Some(1)) && rec.get(33).copied() == Some(0x01);
-        if !is_pseudo && name.eq_ignore_ascii_case(target) {
-            let (child_off, child_len) = parse_dir_record_ext(rec)?;
-            if rest.is_empty() && !is_dir {
-                return Some(FileLocation { offset: child_off * SECTOR, length: child_len });
-            } else if !rest.is_empty() && is_dir {
-                return walk(f, child_off * SECTOR, child_len, rest);
-            }
-        }
-        i += len;
-    }
-    None
-}
-
-/// Extract (extent LBA, data length in bytes) from a directory record.
-/// Layout per ISO9660: bytes 2..10 extent LBA (LE+BE duplicate), 10..18
-/// data length (LE+BE duplicate). We trust the little-endian copy.
-fn parse_dir_record_ext(rec: &[u8]) -> Option<(u64, u64)> {
-    if rec.len() < 34 { return None; }
-    let lba = u32::from_le_bytes(rec[2..6].try_into().ok()?) as u64;
-    let len = u32::from_le_bytes(rec[10..14].try_into().ok()?) as u64;
-    Some((lba, len))
-}
-
-/// Extract the identifier from a directory record, stripping ISO9660's
-/// `;1` version suffix.
-fn dir_record_name(rec: &[u8]) -> String {
-    let name_len = *rec.get(32).unwrap_or(&0) as usize;
-    if name_len == 0 || rec.len() < 33 + name_len { return String::new(); }
-    let raw = &rec[33..33 + name_len];
-    let s = String::from_utf8_lossy(raw).to_string();
-    // Strip `;N` version suffix.
-    if let Some(i) = s.rfind(';') { s[..i].to_string() } else { s }
-}

crates/http-api/src/lib.rs

@@ -9,16 +9,22 @@
 //!     and Linux kernel/initrd, without having to
 //!     re-extract on every request)
 //!
-//! The `<id>/<path>` handler uses a read-only ISO9660 shim (see `iso_fs`)
+//! The `<id>/<path>` handler uses the read-only ISO9660 walker from
-//! that lseeks into the ISO on disk — so we never keep extracted copies.
+//! `openpxe_iso_store::iso_fs` — seeking into the image wherever it
+//! lives (local disk, NFS, SFTP), so we never keep extracted copies.
 #![forbid(unsafe_code)]
 
 pub mod app;
+pub mod auth;
+pub mod error;
+pub mod grub_script;
 pub mod ipxe_script;
-pub mod iso_fs;
 pub mod log_stream;
+pub mod notify;
+pub mod saml_routes;
 pub mod state;
 pub mod terminal;
+pub mod uploads;
 
 pub use app::build_router;
 pub use state::AppState;

crates/http-api/src/log_stream.rs

@@ -36,9 +36,11 @@ pub async fn stream(
     let rx = state.log_bus.subscribe();
     let live = BroadcastStream::new(rx).map(|res| match res {
         Ok(line) => Ok(Event::default().data(line_json(&line))),
-        Err(tokio_stream::wrappers::errors::BroadcastStreamRecvError::Lagged(n)) => Ok(Event::default()
+        Err(tokio_stream::wrappers::errors::BroadcastStreamRecvError::Lagged(n)) => {
-            .event("lagged")
+            Ok(Event::default()
-            .data(json!({ "skipped": n }).to_string())),
+                .event("lagged")
+                .data(json!({ "skipped": n }).to_string()))
+        }
     });
 
     Sse::new(recent_stream.chain(live))
@@ -55,9 +57,11 @@ pub async fn recent(State(state): State<AppState>) -> Json<serde_json::Value> {
 /// keep streaming new lines as they arrive).
 pub async fn clear(State(state): State<AppState>) -> Json<serde_json::Value> {
     state.log_bus.clear();
-    state
+    state.log_bus.push(
-        .log_bus
+        "info",
-        .push("info", "openpxe::terminal", "log buffer cleared by operator");
+        "openpxe::terminal",
+        "log buffer cleared by operator",
+    );
     Json(json!({ "ok": true }))
 }
 

crates/http-api/src/notify.rs

@@ -0,0 +1,142 @@
+//! Notification *delivery* — the network half of the notify feature.
+//!
+//! `openpxe_core::notify` owns the config + persistence; this module
+//! turns a `NotifyConfig` + a message into an actual delivery:
+//!
+//!   - Slack / Discord / Teams → HTTP POST of a provider-shaped JSON
+//!     body to the operator's incoming-webhook URL (via `reqwest`).
+//!   - SMTP → a TLS email via `lettre`.
+//!
+//! Every send is best-effort and time-bounded: a flaky webhook must
+//! never wedge a PXE boot. Callers fire these from a detached task.
+
+use openpxe_core::{NotifyConfig, NotifyKind};
+use std::time::Duration;
+
+/// Hard ceiling on any single delivery so a hung endpoint can't pin a
+/// task forever.
+const SEND_TIMEOUT: Duration = Duration::from_secs(10);
+
+/// Deliver `body` (with an optional `subject`, used as the email
+/// subject / chat bold-line) using the active provider in `cfg`.
+/// Returns `Ok(())` on success, or a human-readable error suitable for
+/// surfacing in the "Send test" response.
+pub async fn send(cfg: &NotifyConfig, subject: &str, body: &str) -> Result<(), String> {
+    if !cfg.is_usable() {
+        return Err("notifications are not enabled / fully configured".into());
+    }
+    match cfg.kind {
+        NotifyKind::Slack | NotifyKind::Discord | NotifyKind::Teams => {
+            send_webhook(cfg, subject, body).await
+        }
+        NotifyKind::Smtp => send_email(cfg, subject, body).await,
+    }
+}
+
+async fn send_webhook(cfg: &NotifyConfig, subject: &str, body: &str) -> Result<(), String> {
+    // Each chat platform wants a different JSON shape for an incoming
+    // webhook. Keep the bodies minimal and plain-text-ish so they
+    // render cleanly everywhere.
+    let combined = if subject.is_empty() {
+        body.to_string()
+    } else {
+        format!("*{subject}*\n{body}")
+    };
+    let payload = match cfg.kind {
+        NotifyKind::Slack => serde_json::json!({ "text": combined }),
+        NotifyKind::Discord => serde_json::json!({ "content": combined }),
+        NotifyKind::Teams => serde_json::json!({
+            // Legacy MessageCard — the format every Teams "Incoming
+            // Webhook" connector still accepts.
+            "@type": "MessageCard",
+            "@context": "https://schema.org/extensions",
+            "summary": if subject.is_empty() { "OpenPXE" } else { subject },
+            "title": subject,
+            "text": body,
+        }),
+        NotifyKind::Smtp => unreachable!("smtp handled separately"),
+    };
+
+    let client = reqwest::Client::builder()
+        .timeout(SEND_TIMEOUT)
+        .build()
+        .map_err(|e| format!("could not build HTTP client: {e}"))?;
+    let resp = client
+        .post(&cfg.webhook_url)
+        .json(&payload)
+        .send()
+        .await
+        .map_err(|e| format!("webhook POST failed: {e}"))?;
+    let status = resp.status();
+    if status.is_success() {
+        Ok(())
+    } else {
+        let snippet = resp
+            .text()
+            .await
+            .unwrap_or_default()
+            .chars()
+            .take(200)
+            .collect::<String>();
+        Err(format!("webhook returned HTTP {status}: {snippet}"))
+    }
+}
+
+async fn send_email(cfg: &NotifyConfig, subject: &str, body: &str) -> Result<(), String> {
+    use lettre::transport::smtp::authentication::Credentials;
+    use lettre::{AsyncSmtpTransport, AsyncTransport, Message, Tokio1Executor};
+
+    let from = if cfg.smtp_from.trim().is_empty() {
+        cfg.smtp_username.trim()
+    } else {
+        cfg.smtp_from.trim()
+    };
+    if from.is_empty() {
+        return Err("SMTP requires a From address (or a username to fall back to)".into());
+    }
+
+    let email = Message::builder()
+        .from(
+            from.parse()
+                .map_err(|e| format!("invalid From address '{from}': {e}"))?,
+        )
+        .to(cfg
+            .smtp_to
+            .trim()
+            .parse()
+            .map_err(|e| format!("invalid To address '{}': {e}", cfg.smtp_to))?)
+        .subject(if subject.is_empty() {
+            "OpenPXE"
+        } else {
+            subject
+        })
+        .body(body.to_string())
+        .map_err(|e| format!("could not build email: {e}"))?;
+
+    // Implicit TLS (465) vs STARTTLS (587). We never send plaintext.
+    let mut builder = if cfg.smtp_implicit_tls {
+        AsyncSmtpTransport::<Tokio1Executor>::relay(&cfg.smtp_host)
+            .map_err(|e| format!("SMTP relay setup failed: {e}"))?
+    } else {
+        AsyncSmtpTransport::<Tokio1Executor>::starttls_relay(&cfg.smtp_host)
+            .map_err(|e| format!("SMTP STARTTLS setup failed: {e}"))?
+    }
+    .port(cfg.smtp_port)
+    .timeout(Some(SEND_TIMEOUT));
+
+    // Auth is optional — some internal relays accept unauthenticated
+    // mail from trusted hosts. Only attach credentials when a username
+    // is set.
+    if !cfg.smtp_username.trim().is_empty() {
+        builder = builder.credentials(Credentials::new(
+            cfg.smtp_username.trim().to_string(),
+            cfg.smtp_password.clone(),
+        ));
+    }
+    let mailer = builder.build();
+    mailer
+        .send(email)
+        .await
+        .map(|_| ())
+        .map_err(|e| format!("SMTP send failed: {e}"))
+}

crates/http-api/src/saml_routes.rs

@@ -0,0 +1,370 @@
+//! SAML 2.0 Service Provider HTTP endpoints (v0.5.1).
+//!
+//! * `GET  /api/sso/login`    — SP-initiated: build an AuthnRequest, record its
+//!   ID, and 302 the browser to the IdP.
+//! * `POST /api/sso/acs`      — Assertion Consumer Service: verify + validate
+//!   the IdP's `SAMLResponse`, perform the stateful checks (InResponseTo
+//!   correlation, IdP-initiated gating, assertion replay), mint an operator
+//!   session, and 302 to the dashboard. (Mirrors FleetDM's `/sso/callback`.)
+//! * `GET  /api/sso/metadata` — serve our SP metadata XML for IdP import.
+//!
+//! Stateless crypto + semantic validation live in `openpxe_core::saml`; this
+//! module owns only the HTTP glue and the in-memory state the SP needs.
+
+use std::collections::HashMap;
+use std::sync::Arc;
+use std::time::{Duration as StdDuration, Instant};
+
+use axum::{
+    body::Body,
+    extract::{Form, Query, State},
+    http::{header, StatusCode},
+    response::{IntoResponse, Response},
+};
+use base64::Engine;
+use parking_lot::Mutex;
+use serde::Deserialize;
+use time::{Duration, OffsetDateTime};
+
+use openpxe_core::saml::{self, metadata::IdpMetadata, SamlError, SpParams};
+use openpxe_core::SsoConfig;
+
+use crate::auth;
+use crate::state::AppState;
+
+/// Outstanding AuthnRequest IDs live at most this long before a matching
+/// response is considered stale (covers a slow human at the IdP login form).
+const REQUEST_TTL: StdDuration = StdDuration::from_mins(10);
+/// How long we fetch-cache IdP metadata loaded from a URL.
+const METADATA_FETCH_TIMEOUT: StdDuration = StdDuration::from_secs(10);
+
+/// In-memory SAML runtime state. Cheap to clone (Arc-shared).
+#[derive(Clone, Default)]
+pub struct SamlRuntime {
+    /// request_id → issued_at. Correlates a response's `InResponseTo` to a
+    /// request *we* actually sent (replay / CSRF defense for SP-initiated).
+    outstanding: Arc<Mutex<HashMap<String, Instant>>>,
+    /// assertion_id → expiry. A consumed assertion may not be replayed.
+    consumed: Arc<Mutex<HashMap<String, Instant>>>,
+    /// Cache of IdP metadata fetched from a URL: (url, parsed).
+    metadata_cache: Arc<Mutex<Option<(String, IdpMetadata)>>>,
+}
+
+impl SamlRuntime {
+    /// Record an AuthnRequest we just sent.
+    pub fn register_request(&self, id: &str) {
+        let mut g = self.outstanding.lock();
+        prune(&mut g);
+        g.insert(id.to_owned(), Instant::now());
+    }
+
+    /// Consume an outstanding request ID, returning `true` if it was present
+    /// and still fresh. A miss means the response doesn't correlate to any
+    /// live request we issued.
+    pub fn take_request(&self, id: &str) -> bool {
+        let mut g = self.outstanding.lock();
+        prune(&mut g);
+        g.remove(id).is_some()
+    }
+
+    /// Record a consumed assertion. Returns `false` if it was already
+    /// consumed (a replay) — in which case the caller must reject.
+    pub fn record_assertion(&self, id: &str, expiry: OffsetDateTime) -> bool {
+        let mut g = self.consumed.lock();
+        prune(&mut g);
+        if g.contains_key(id) {
+            return false;
+        }
+        let ttl = (expiry - OffsetDateTime::now_utc())
+            .max(Duration::ZERO)
+            .unsigned_abs();
+        g.insert(id.to_owned(), Instant::now() + ttl);
+        true
+    }
+
+    fn cached_metadata(&self, url: &str) -> Option<IdpMetadata> {
+        let g = self.metadata_cache.lock();
+        match &*g {
+            Some((cached_url, md)) if cached_url == url => Some(md.clone()),
+            _ => None,
+        }
+    }
+
+    fn cache_metadata(&self, url: String, md: IdpMetadata) {
+        *self.metadata_cache.lock() = Some((url, md));
+    }
+}
+
+/// Drop expired entries so neither map grows unbounded.
+fn prune(map: &mut HashMap<String, Instant>) {
+    let now = Instant::now();
+    // For the request map this over-prunes (entries store issued_at, not
+    // expiry), so cap by REQUEST_TTL; the consumed map stores absolute
+    // expiry instants. Using saturating logic keeps both correct: request
+    // entries older than REQUEST_TTL go, consumed entries past expiry go.
+    map.retain(|_, &mut t| now.saturating_duration_since(t) < REQUEST_TTL || t > now);
+}
+
+// ─── GET /api/sso/login ───────────────────────────────────────────────────
+
+#[derive(Debug, Deserialize)]
+pub struct LoginQuery {
+    /// Optional local path to return to after login (becomes RelayState).
+    #[serde(default)]
+    pub next: Option<String>,
+}
+
+pub async fn sso_login(State(state): State<AppState>, Query(q): Query<LoginQuery>) -> Response {
+    let cfg = state.sso.snapshot();
+    if !cfg.is_usable() {
+        return redirect("/?sso_error=unavailable");
+    }
+    let idp = match resolve_idp_metadata(&state, &cfg).await {
+        Ok(m) => m,
+        Err(e) => {
+            tracing::warn!(target: "openpxe::saml", "sso_login: metadata unavailable: {e}");
+            return redirect("/?sso_error=metadata");
+        }
+    };
+    let Some(dest) = idp.sso_destination().map(str::to_owned) else {
+        tracing::warn!(target: "openpxe::saml", "sso_login: IdP metadata has no SSO endpoint");
+        return redirect("/?sso_error=metadata");
+    };
+    let sp = sp_params(&state, &cfg);
+    let relay = safe_local_path(q.next.as_deref());
+    match saml::authn_request::build(&sp, &dest, Some(&relay)) {
+        Ok(req) => {
+            state.saml.register_request(&req.id);
+            redirect(&req.location)
+        }
+        Err(e) => {
+            tracing::warn!(target: "openpxe::saml", "sso_login: build AuthnRequest failed: {e}");
+            redirect("/?sso_error=request")
+        }
+    }
+}
+
+// ─── POST /api/sso/acs ──────────────────────────────────────────────────────
+
+#[derive(Debug, Deserialize)]
+pub struct AcsForm {
+    #[serde(rename = "SAMLResponse")]
+    pub saml_response: String,
+    #[serde(rename = "RelayState", default)]
+    pub relay_state: Option<String>,
+}
+
+pub async fn sso_acs(State(state): State<AppState>, Form(form): Form<AcsForm>) -> Response {
+    let cfg = state.sso.snapshot();
+    if !cfg.is_usable() {
+        return redirect("/?sso_error=unavailable");
+    }
+    let xml = match base64::engine::general_purpose::STANDARD.decode(form.saml_response.as_bytes())
+    {
+        Ok(bytes) => String::from_utf8_lossy(&bytes).into_owned(),
+        Err(e) => {
+            tracing::warn!(target: "openpxe::saml", "acs: base64 decode failed: {e}");
+            return redirect("/?sso_error=1");
+        }
+    };
+    let idp = match resolve_idp_metadata(&state, &cfg).await {
+        Ok(m) => m,
+        Err(e) => {
+            tracing::warn!(target: "openpxe::saml", "acs: metadata unavailable: {e}");
+            return redirect("/?sso_error=metadata");
+        }
+    };
+    let sp = sp_params(&state, &cfg);
+
+    // Signature verification + semantic checks are CPU-bound — keep them off
+    // the async executor.
+    let now = OffsetDateTime::now_utc();
+    let skew = Duration::seconds(saml::DEFAULT_CLOCK_SKEW_SECS);
+    let verify = {
+        let xml = xml.clone();
+        let sp = sp.clone();
+        tokio::task::spawn_blocking(move || saml::response::consume(&xml, &sp, &idp, now, skew))
+            .await
+    };
+    let verified = match verify {
+        Ok(Ok(v)) => v,
+        Ok(Err(e)) => {
+            // Never leak which specific check failed to the browser.
+            tracing::warn!(target: "openpxe::saml", "acs: response rejected: {e}");
+            return redirect("/?sso_error=1");
+        }
+        Err(join) => {
+            tracing::error!(target: "openpxe::saml", "acs: verify task panicked: {join}");
+            return redirect("/?sso_error=1");
+        }
+    };
+
+    // Stateful checks the core deliberately left to us.
+    match &verified.in_response_to {
+        Some(id) => {
+            if !state.saml.take_request(id) {
+                tracing::warn!(target: "openpxe::saml", "acs: InResponseTo matches no live request");
+                return redirect("/?sso_error=1");
+            }
+        }
+        None => {
+            if !cfg.allow_idp_initiated {
+                tracing::warn!(target: "openpxe::saml", "acs: IdP-initiated login is disabled");
+                return redirect("/?sso_error=idp_initiated");
+            }
+        }
+    }
+    if !state
+        .saml
+        .record_assertion(&verified.assertion_id, verified.assertion_expiry)
+    {
+        tracing::warn!(target: "openpxe::saml", "acs: assertion replay rejected");
+        return redirect("/?sso_error=1");
+    }
+
+    // Success → mint an operator session keyed to the verified email.
+    let session = state.sessions.create(&verified.principal.email);
+    tracing::info!(
+        target: "openpxe::saml",
+        email = %verified.principal.email,
+        idp_initiated = verified.in_response_to.is_none(),
+        "SAML SSO sign-in"
+    );
+    // safe_local_path already maps None / unsafe values to "/".
+    let relay = safe_local_path(form.relay_state.as_deref());
+    redirect_with_session(&relay, &session)
+}
+
+// ─── GET /api/sso/metadata ──────────────────────────────────────────────────
+
+pub async fn sso_metadata(State(state): State<AppState>) -> Response {
+    let cfg = state.sso.snapshot();
+    let sp = sp_params(&state, &cfg);
+    let xml = saml::metadata::build_sp_metadata(&sp);
+    (
+        StatusCode::OK,
+        [(header::CONTENT_TYPE, "application/samlmetadata+xml")],
+        xml,
+    )
+        .into_response()
+}
+
+// ─── helpers ────────────────────────────────────────────────────────────────
+
+/// Derive runtime SP parameters from config + the advertised public base URL.
+fn sp_params(state: &AppState, cfg: &SsoConfig) -> SpParams {
+    let base = state.public_base_url.trim_end_matches('/');
+    let entity_id = if cfg.entity_id.trim().is_empty() {
+        base.to_owned()
+    } else {
+        cfg.entity_id.trim().to_owned()
+    };
+    SpParams {
+        entity_id,
+        acs_url: format!("{base}/api/sso/acs"),
+    }
+}
+
+/// Resolve the IdP metadata: prefer the metadata URL (fetched + cached) per
+/// the "URL wins" rule, else parse the pasted XML.
+async fn resolve_idp_metadata(state: &AppState, cfg: &SsoConfig) -> Result<IdpMetadata, SamlError> {
+    let url = cfg.metadata_url.trim();
+    if !url.is_empty() {
+        if let Some(md) = state.saml.cached_metadata(url) {
+            return Ok(md);
+        }
+        let body = fetch_metadata(url).await?;
+        let md = IdpMetadata::parse(&body)?;
+        state.saml.cache_metadata(url.to_owned(), md.clone());
+        return Ok(md);
+    }
+    if !cfg.metadata.trim().is_empty() {
+        return IdpMetadata::parse(&cfg.metadata);
+    }
+    Err(SamlError::Metadata("no metadata source configured".into()))
+}
+
+async fn fetch_metadata(url: &str) -> Result<String, SamlError> {
+    let client = reqwest::Client::builder()
+        .timeout(METADATA_FETCH_TIMEOUT)
+        .build()
+        .map_err(|e| SamlError::Metadata(format!("http client: {e}")))?;
+    let resp = client
+        .get(url)
+        .send()
+        .await
+        .map_err(|e| SamlError::Metadata(format!("fetch {url}: {e}")))?;
+    if !resp.status().is_success() {
+        return Err(SamlError::Metadata(format!(
+            "fetch {url}: HTTP {}",
+            resp.status()
+        )));
+    }
+    resp.text()
+        .await
+        .map_err(|e| SamlError::Metadata(format!("read {url}: {e}")))
+}
+
+/// Only permit a same-site path (single leading slash) as a redirect target —
+/// blocks open-redirect / protocol-relative (`//evil.com`) abuse of RelayState.
+fn safe_local_path(p: Option<&str>) -> String {
+    match p {
+        Some(p) if p.starts_with('/') && !p.starts_with("//") => p.to_owned(),
+        _ => "/".to_owned(),
+    }
+}
+
+fn redirect(location: &str) -> Response {
+    Response::builder()
+        .status(StatusCode::FOUND)
+        .header(header::LOCATION, location)
+        .body(Body::empty())
+        .map_or_else(
+            |_| StatusCode::INTERNAL_SERVER_ERROR.into_response(),
+            IntoResponse::into_response,
+        )
+}
+
+fn redirect_with_session(location: &str, session: &str) -> Response {
+    Response::builder()
+        .status(StatusCode::FOUND)
+        .header(header::LOCATION, location)
+        .header(header::SET_COOKIE, auth::session_cookie(session))
+        .body(Body::empty())
+        .map_or_else(
+            |_| StatusCode::INTERNAL_SERVER_ERROR.into_response(),
+            IntoResponse::into_response,
+        )
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use wiremock::matchers::method;
+    use wiremock::{Mock, MockServer, ResponseTemplate};
+
+    // v0.5.4: exercise the SAML metadata-URL fetch against a mock server —
+    // previously this path did a real network GET and had no coverage.
+    #[tokio::test]
+    async fn fetch_metadata_returns_body_on_200() {
+        let server = MockServer::start().await;
+        let xml = "<EntityDescriptor>idp</EntityDescriptor>";
+        Mock::given(method("GET"))
+            .respond_with(ResponseTemplate::new(200).set_body_string(xml))
+            .mount(&server)
+            .await;
+        let got = fetch_metadata(&server.uri()).await.expect("fetch ok");
+        assert_eq!(got, xml);
+    }
+
+    #[tokio::test]
+    async fn fetch_metadata_errors_on_non_2xx() {
+        let server = MockServer::start().await;
+        Mock::given(method("GET"))
+            .respond_with(ResponseTemplate::new(503))
+            .mount(&server)
+            .await;
+        let err = fetch_metadata(&server.uri()).await.unwrap_err();
+        assert!(matches!(err, SamlError::Metadata(_)), "got {err:?}");
+    }
+}

crates/http-api/src/snapshots/openpxe_http_api__ipxe_script__password_tests__render_menu_snapshot.snap

@@ -0,0 +1,36 @@
+---
+source: crates/http-api/src/ipxe_script.rs
+expression: rendered
+---
+#!ipxe
+# OpenPXE top-level menu - auto-generated, do not edit
+set base-url http://10.0.0.5
+set esc:hex 1b
+set cls ${esc:string}[2J
+iseq ${platform} efi && console --picture http://10.0.0.5/branding/pxe-logo --top 290 || console
+set arch-label ${buildarch} ${platform}
+iseq ${buildarch} i386   && iseq ${platform} pcbios && set arch-label x86 BIOS         || iseq ${buildarch} x86_64 && iseq ${platform} efi    && set arch-label x86_64 UEFI      || iseq ${buildarch} arm64  && iseq ${platform} efi    && set arch-label arm64 UEFI       || true
+:menu
+menu OpenPXE - network boot menu
+item --gap
+item --gap -- ------------------------- Default -------------------------
+item local            Boot from Local HDD
+item --gap -- ----------------------- Installers -----------------------
+item --gap -- (no Linux ISOs uploaded)
+item --gap -- (no Windows ISOs uploaded)
+item --gap -- -------------------------- Tools --------------------------
+item tools            Tools  >
+item --gap -- ---------------------- Queued Deployment ---------------------
+item queue            Queued Deployment  (join queue)
+item --gap
+item --key x exit     Exit iPXE
+item --gap
+item --gap --                 OpenPXE vX.Y.Z  -  ${arch-label}
+choose --default queue --timeout 600000 target || goto menu
+iseq ${target} local   && chain http://10.0.0.5/boot/_local.ipxe        || goto menu
+iseq ${target} linux   && chain http://10.0.0.5/boot/_linux_menu.ipxe   || goto menu
+iseq ${target} windows && chain http://10.0.0.5/boot/_windows_menu.ipxe || goto menu
+iseq ${target} tools   && chain http://10.0.0.5/boot/_tools_menu.ipxe   || goto menu
+iseq ${target} queue   && chain http://10.0.0.5/boot/_queue.ipxe         || goto menu
+iseq ${target} exit    && exit                                 || goto menu
+goto menu

crates/http-api/src/state.rs

@@ -1,8 +1,20 @@
-use openpxe_core::{ClientRegistry, DeploymentQueue, HostBindings, LogBus, Metrics, SettingsStore};
+use crate::auth::SessionStore;
-use openpxe_iso_store::{IsoStore, NfsManager, SmbManager};
+use crate::saml_routes::SamlRuntime;
+use crate::uploads::UploadSessions;
+use openpxe_core::{
+    AdminStore, BootLog, BootRulesStore, BootTokens, BrandingStore, ClientRegistry,
+    DeploymentQueue, HostBindings, LogBus, Metrics, NotifyStore, SettingsStore, SsoStore,
+};
+use openpxe_iso_store::{
+    IsoStore, NfsShareManager, SftpShareManager, SmbManager, SmbShareManager, UnattendedStore,
+};
 use std::sync::Arc;
 use time::OffsetDateTime;
 
+/// Cached composited PXE boot-menu background: `(logo_rev, encoded PNG)`.
+/// See `AppState::pxe_bg_cache`.
+pub type PxeBgCache = Arc<parking_lot::Mutex<Option<(u64, bytes::Bytes)>>>;
+
 #[derive(Clone)]
 pub struct AppState {
     pub iso_store: IsoStore,
@@ -13,6 +25,47 @@ pub struct AppState {
     /// these MACs requests `/boot.ipxe`, we chain straight to the
     /// configured target instead of rendering the menu.
     pub hosts: HostBindings,
+    /// Persistent boot-event log surfaced under the Hosts tab. Records
+    /// every `/boot/<entry>.ipxe` chain that goes on to serve a script
+    /// (i.e. an image actually starting to install on a machine).
+    pub boot_log: BootLog,
+    /// v0.7.0: ordered label-based boot rules (MAC prefix / arch →
+    /// target) plus the optional boot-decision webhook. Consulted by the
+    /// top-level boot script after exact host bindings, before the menu.
+    pub boot_rules: BootRulesStore,
+    /// v0.7.0: short-lived access tokens for unattended answer files.
+    /// Minted into every generated answer-file URL; the serving endpoint
+    /// requires one (or an operator session) once an admin exists.
+    pub boot_tokens: BootTokens,
+    /// Operator-controlled UI overrides (custom logo). When the
+    /// operator hasn't uploaded anything, the WebUI serves the bundled
+    /// rainbow-horizon mark.
+    pub branding: BrandingStore,
+    /// v0.6.2: cache of the composited PXE boot-menu background PNG,
+    /// keyed on the branding logo revision. Composing costs ~50-200 ms
+    /// of image decode/encode and **every** booting client fetches it
+    /// for `console --picture` — caching makes that one compose per
+    /// logo change instead of one per boot.
+    pub pxe_bg_cache: PxeBgCache,
+    /// Forms-auth admin record + first-run bootstrap state. When
+    /// `admin.is_configured() == false`, the auth middleware passes
+    /// every request through and `/api/me` reports `setup_required`.
+    pub admin: AdminStore,
+    /// In-memory session table for active operator logins. Cleared on
+    /// process restart (sessions are tied to UI state, not persisted —
+    /// matches Sonarr/Radarr behaviour).
+    pub sessions: SessionStore,
+    /// SAML SSO configuration (persisted IdP metadata, Entity ID, toggles).
+    pub sso: SsoStore,
+    /// v0.5.1: in-memory SAML runtime state — outstanding AuthnRequest IDs
+    /// (for InResponseTo correlation), consumed-assertion replay guard, and
+    /// a cache of fetched IdP metadata. Tied to process lifetime, like
+    /// `sessions`; a restart simply invalidates any in-flight SSO login.
+    pub saml: SamlRuntime,
+    /// v0.5.0: webhook / email notification config (Slack/Teams/Discord/
+    /// SMTP). Drives the fire-and-forget pings on boot events and powers
+    /// the Advanced tab's config + "Send test" button.
+    pub notify: NotifyStore,
     /// Lock-free metrics counters surfaced at `/metrics` in Prometheus
     /// text format. Cheap to clone (handles to atomics).
     pub metrics: Metrics,
@@ -20,11 +73,36 @@ pub struct AppState {
     /// `smb_dir` at startup; `None` in pure-Linux-only deployments where
     /// Windows support is not wired in. Settings toggle drives start/stop.
     pub smb: Option<Arc<SmbManager>>,
-    /// NFS share manager. Always present (mounting is opt-in by the
+    /// v0.4.65: SMB share manager — userspace consumer of remote SMB
-    /// operator from the Storage tab); `add()` requires `mount.nfs` to be
+    /// shares via Samba's `smbclient` CLI. Replaces the kernel-mount
-    /// available in the runtime image. Surfaces errors per-mount rather
+    /// NFS path that v0.4.64 shipped; that path didn't work on hosts
-    /// than failing the global state.
+    /// (Unraid, etc.) whose kernel ships without the nfs/cifs client
-    pub nfs: NfsManager,
+    /// modules, and no container-side configuration could fix it.
+    /// `smbclient` does the SMB protocol over a plain TCP socket in
+    /// userspace — works in any container, no special caps required.
+    pub smb_shares: SmbShareManager,
+    /// v0.4.67: NFSv3 share manager — pure-Rust userspace consumer
+    /// via the `nfs3_client` crate. Ships alongside the SMB manager
+    /// so operators pick whichever protocol their NAS prefers.
+    /// In-process (no subprocess); supports HTTP Range requests on
+    /// NFS-sourced ISOs because NFSv3 READ3 takes an explicit offset.
+    pub nfs_shares: NfsShareManager,
+    /// v0.5.5: SFTP-over-SSH share manager — pure-Rust userspace
+    /// consumer via `russh` + `russh-sftp` (ring backend, no OpenSSL).
+    /// Ships alongside SMB/NFS as the third remote-library protocol.
+    /// In-process (no subprocess, no kernel mount); supports HTTP Range
+    /// requests because SFTP opens a seekable file handle. Authenticates
+    /// the server's SSH host key on a trust-on-first-use basis.
+    pub sftp_shares: SftpShareManager,
+    /// v0.5.2: uploaded unattended-install answer files (Kickstart /
+    /// Preseed / Autoinstall / Windows answer files). Served on demand to
+    /// booting clients with per-host hostname/IP/MAC templating; lives in
+    /// its own directory, never the ISO listing or PXE menu.
+    pub unattended: UnattendedStore,
+    /// Browser chunked upload state. Multipart uploads still go straight
+    /// through `IsoStore`, but the UI uses sessions so large ISO transfers
+    /// can show deterministic progress and leave visible partial files.
+    pub uploads: UploadSessions,
     /// Live log bus consumed by the Terminal tab via SSE. Operator-issued
     /// terminal commands also push synthetic lines onto it so the tail
     /// shows them inline.
@@ -38,6 +116,10 @@ pub struct AppState {
     /// `enp1s0`). Surfaced read-only on the Network tab. Empty if the
     /// interface couldn't be identified.
     pub nic_name: String,
+    /// v0.7.2: physical link summary for that NIC (operstate, speed,
+    /// duplex, port MAC) — read from sysfs at startup; empty where
+    /// unavailable. Helps confirm which port answers PXE.
+    pub nic_link: String,
     /// Subnet mask of the public interface in dotted-quad form.
     pub subnet_mask: String,
     /// Default gateway IPv4 address.

crates/http-api/src/terminal.rs

@@ -31,12 +31,17 @@ pub async fn run_command(
 ) -> impl IntoResponse {
     let line = req.command.trim();
     if line.is_empty() {
-        return (StatusCode::OK, Json(json!({ "output": HELP_TEXT, "ok": true })));
+        return (
+            StatusCode::OK,
+            Json(json!({ "output": HELP_TEXT, "ok": true })),
+        );
     }
 
     // Echo the typed command into the live log so the Terminal tab shows
     // operator activity in-band with server-emitted log lines.
-    state.log_bus.push("info", "openpxe::terminal", format!("> {line}"));
+    state
+        .log_bus
+        .push("info", "openpxe::terminal", format!("> {line}"));
 
     let argv = shell_split(line);
     if argv.is_empty() {
@@ -55,7 +60,11 @@ pub async fn run_command(
     // so reading the live tail tells the same story as scrolling the
     // terminal pane.
     let mirror = if output.len() > 1024 {
-        format!("{}\n... ({} bytes truncated)", &output[..1024], output.len() - 1024)
+        format!(
+            "{}\n... ({} bytes truncated)",
+            &output[..1024],
+            output.len() - 1024
+        )
     } else {
         output.clone()
     };
@@ -78,9 +87,17 @@ async fn dispatch(state: &AppState, argv: &[String]) -> Result<String, String> {
         "status" => Ok(status_text(state)),
         "isos" | "images" => Ok(isos_text(state)),
         "clients" => Ok(clients_text(state)),
-        "queue" => gate_command(state, tail).await,
+        "queue" => queue_command(state, tail).await,
-        "nfs" => nfs_command(state, tail).await,
+        // `smb` controls the outbound Samba server for Windows
+        // install media. `share` lists/manages remote SMB shares
+        // OpenPXE pulls ISOs from (v0.4.65). `nfs` is the parallel
+        // command for remote NFSv3 shares (v0.4.67, in-process via
+        // nfs3_client — not the v0.4.64 kernel-mount path).
+        "share" | "smb-share" => smb_share_command(state, tail).await,
         "smb" => smb_command(state, tail).await,
+        "nfs" => nfs_share_command(state, tail).await,
+        // v0.5.5: SFTP-over-SSH remote shares (in-process russh client).
+        "sftp" => sftp_share_command(state, tail).await,
         "log" => log_command(state, tail),
         "whoami" => Ok("operator".to_string()),
         "echo" => Ok(tail.join(" ")),
@@ -96,32 +113,62 @@ async fn dispatch(state: &AppState, argv: &[String]) -> Result<String, String> {
 fn status_text(s: &AppState) -> String {
     let isos = s.iso_store.list();
     let clients = s.clients.list();
-    let gates = s.queue.list();
+    let queue_entries = s.queue.list();
     let smb = s.smb.as_ref().map(|m| m.snapshot());
-    let nfs = s.nfs.list();
+    let smb_shares = s.smb_shares.list();
-    let nfs_active = nfs.iter().filter(|m| m.mounted).count();
+    let smb_reachable = smb_shares.iter().filter(|m| m.reachable).count();
+    // v0.4.67: NFSv3 sources too.
+    let nfs_shares = s.nfs_shares.list();
+    let nfs_reachable = nfs_shares.iter().filter(|m| m.reachable).count();
+    // v0.5.5: SFTP-over-SSH sources too.
+    let sftp_shares = s.sftp_shares.list();
+    let sftp_reachable = sftp_shares.iter().filter(|m| m.reachable).count();
     format!(
         "OpenPXE {ver}\n\
          base url:     {base}\n\
          interface:    {nic}\n\
          uptime:       {up}\n\
-         isos:         {n_isos}  (local: {n_local}, nfs: {n_nfs})\n\
+         isos:         {n_isos}  (local: {n_local}, smb: {n_smb}, nfs: {n_nfs}, sftp: {n_sftp})\n\
          clients:      {n_clients}\n\
          queue:        {n_entries}\n\
-         smb:          {smb}\n\
+         smb server:   {smb}\n\
-         nfs mounts:   {n_total} configured ({n_active} active)\n",
+         smb shares:   {n_smb_total} configured ({n_smb_active} reachable)\n\
+         nfs shares:   {n_nfs_total} configured ({n_nfs_active} reachable)\n\
+         sftp shares:  {n_sftp_total} configured ({n_sftp_active} reachable)\n",
         ver = env!("CARGO_PKG_VERSION"),
         base = s.public_base_url,
-        nic = if s.nic_name.is_empty() { "?" } else { s.nic_name.as_str() },
+        nic = if s.nic_name.is_empty() {
+            "?"
+        } else {
+            s.nic_name.as_str()
+        },
         up = uptime_string(s),
         n_isos = isos.len(),
-        n_local = isos.iter().filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Local)).count(),
+        n_local = isos
-        n_nfs = isos.iter().filter(|i| !matches!(i.source, openpxe_iso_store::IsoSource::Local)).count(),
+            .iter()
+            .filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Local))
+            .count(),
+        n_smb = isos
+            .iter()
+            .filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Smb { .. }))
+            .count(),
+        n_nfs = isos
+            .iter()
+            .filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Nfs { .. }))
+            .count(),
+        n_sftp = isos
+            .iter()
+            .filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Sftp { .. }))
+            .count(),
         n_clients = clients.len(),
-        n_entries = gates.len(),
+        n_entries = queue_entries.len(),
         smb = smb.map_or_else(|| "(disabled)".into(), |s| format!("{s:?}")),
-        n_total = nfs.len(),
+        n_smb_total = smb_shares.len(),
-        n_active = nfs_active,
+        n_smb_active = smb_reachable,
+        n_nfs_total = nfs_shares.len(),
+        n_nfs_active = nfs_reachable,
+        n_sftp_total = sftp_shares.len(),
+        n_sftp_active = sftp_reachable,
     )
 }
 
@@ -139,7 +186,11 @@ fn isos_text(s: &AppState) -> String {
     for i in isos {
         let src = match i.source {
             openpxe_iso_store::IsoSource::Local => "local".to_string(),
-            openpxe_iso_store::IsoSource::Nfs { mount_id, .. } => format!("nfs:{mount_id}"),
+            openpxe_iso_store::IsoSource::Smb { share_id, .. } => format!("smb:{share_id}"),
+            // v0.4.67: NFSv3 via in-process nfs3_client.
+            openpxe_iso_store::IsoSource::Nfs { share_id, .. } => format!("nfs:{share_id}"),
+            // v0.5.5: SFTP-over-SSH via in-process russh.
+            openpxe_iso_store::IsoSource::Sftp { share_id, .. } => format!("sftp:{share_id}"),
         };
         let _ = writeln!(
             out,
@@ -159,11 +210,7 @@ fn clients_text(s: &AppState) -> String {
         return "(no clients yet)".into();
     }
     let mut out = String::new();
-    let _ = writeln!(
+    let _ = writeln!(out, "{:<19} {:<16} {:<8} LAST SEEN", "MAC", "IP", "EVENTS");
-        out,
-        "{:<19} {:<16} {:<8} LAST SEEN",
-        "MAC", "IP", "EVENTS"
-    );
     for c in clients {
         let ip = c.last_ip.map_or_else(|| "-".into(), |i| i.to_string());
         let _ = writeln!(
@@ -180,35 +227,35 @@ fn clients_text(s: &AppState) -> String {
     out
 }
 
-// ── gate ───────────────────────────────────────────────────────────────
+// ── queue ──────────────────────────────────────────────────────────────
 
-// `async` for symmetry with the other dispatch helpers — gate operations
+// `async` for symmetry with the other dispatch helpers — queue operations
 // are sync today but might grow to await on a database in a future phase.
 #[allow(clippy::unused_async)]
-async fn gate_command(s: &AppState, args: &[String]) -> Result<String, String> {
+async fn queue_command(s: &AppState, args: &[String]) -> Result<String, String> {
     match args.first().map(String::as_str) {
         None | Some("list") => {
-            let gs = s.queue.list();
+            let entries = s.queue.list();
-            if gs.is_empty() {
+            if entries.is_empty() {
-                return Ok("(no gates)".into());
+                return Ok("(queue empty)".into());
             }
             let mut out = String::new();
-            for g in gs {
+            for entry in entries {
                 let _ = writeln!(
                     out,
                     "#{:<3} {:<19} {:<16} target={}",
-                    g.position,
+                    entry.position,
-                    g.mac,
+                    entry.mac,
-                    g.id,
+                    entry.id,
-                    g.assigned_target.unwrap_or_else(|| "-".into())
+                    entry.assigned_target.unwrap_or_else(|| "-".into())
                 );
             }
             Ok(out)
         }
         Some("assign-all") => {
-            let target = args.get(1).ok_or_else(|| {
+            let target = args
-                "usage: gate assign-all <iso_boot_entry_id>".to_string()
+                .get(1)
-            })?;
+                .ok_or_else(|| "usage: queue assign-all <iso_boot_entry_id>".to_string())?;
             let found = s
                 .iso_store
                 .list()
@@ -219,59 +266,160 @@ async fn gate_command(s: &AppState, args: &[String]) -> Result<String, String> {
             }
             let ids: Vec<_> = s.queue.list().into_iter().map(|g| g.id).collect();
             let n = s.queue.assign(&ids, target);
-            Ok(format!("assigned {n} gates -> {target}"))
+            Ok(format!("assigned {n} queue entries -> {target}"))
         }
         Some("assign") => {
             let entry_id = args
                 .get(1)
-                .ok_or_else(|| "usage: gate assign <entry_id> <iso_boot_entry_id>".to_string())?;
+                .ok_or_else(|| "usage: queue assign <entry_id> <iso_boot_entry_id>".to_string())?;
             let target = args
                 .get(2)
-                .ok_or_else(|| "usage: gate assign <entry_id> <iso_boot_entry_id>".to_string())?;
+                .ok_or_else(|| "usage: queue assign <entry_id> <iso_boot_entry_id>".to_string())?;
             let n = s.queue.assign(std::slice::from_ref(entry_id), target);
             if n == 0 {
-                return Err(format!("no such gate: {entry_id}"));
+                return Err(format!("no such queue entry: {entry_id}"));
             }
-            Ok(format!("assigned 1 gate -> {target}"))
+            Ok(format!("assigned 1 queue entry -> {target}"))
         }
         Some("release") => {
-            let entry_id = args.get(1).ok_or_else(|| "usage: gate release <entry_id>".to_string())?;
+            let entry_id = args
+                .get(1)
+                .ok_or_else(|| "usage: queue release <entry_id>".to_string())?;
             match s.queue.release(entry_id) {
                 Some(_) => Ok(format!("released {entry_id}")),
-                None => Err(format!("no such gate: {entry_id}")),
+                None => Err(format!("no such queue entry: {entry_id}")),
             }
         }
         Some(other) => Err(format!(
-            "unknown gate subcommand: {other}\ntry: gate [list|assign-all|assign|release]"
+            "unknown queue subcommand: {other}\ntry: queue [list|assign-all|assign|release]"
         )),
     }
 }
 
-// ── nfs ────────────────────────────────────────────────────────────────
+// ── share (v0.4.65: SMB shares) ─────────────────────────────────────────
 
-async fn nfs_command(s: &AppState, args: &[String]) -> Result<String, String> {
+async fn smb_share_command(s: &AppState, args: &[String]) -> Result<String, String> {
     match args.first().map(String::as_str) {
         None | Some("list") => {
-            let mounts = s.nfs.list();
+            let shares = s.smb_shares.list();
-            if mounts.is_empty() {
+            if shares.is_empty() {
-                return Ok("(no NFS mounts configured)".into());
+                return Ok("(no SMB shares configured)".into());
             }
             let mut out = String::new();
             let _ = writeln!(
                 out,
-                "{:<24} {:<6} {:<7} {:<6} TARGET",
+                "{:<24} {:<7} {:<6} {:<6} TARGET",
-                "ID", "VER", "STATUS", "ISOS"
+                "ID", "STATUS", "AUTH", "ISOS"
             );
-            for m in mounts {
+            for m in shares {
-                let status = if m.mounted { "ok" } else { "down" };
+                let status = if m.reachable { "ok" } else { "down" };
+                let auth = if m.guest { "guest" } else { "user" };
                 let _ = writeln!(
                     out,
-                    "{:<24} {:<6} {:<7} {:<6} {}:{}",
+                    "{:<24} {:<7} {:<6} {:<6} //{}/{}",
+                    truncate(&m.id, 24),
+                    status,
+                    auth,
+                    m.iso_count,
+                    m.server,
+                    m.share,
+                );
+                if let Some(e) = m.last_error {
+                    let _ = writeln!(out, "    error: {e}");
+                }
+                if let Some(h) = m.last_hint {
+                    let _ = writeln!(out, "    hint:  {h}");
+                }
+            }
+            Ok(out)
+        }
+        Some("add") => {
+            // share add //server/share [guest|user:password]
+            let target = args.get(1).ok_or_else(|| {
+                "usage: share add //server/share [guest|user:password]".to_string()
+            })?;
+            // Accept either `//server/share` (UNC-style) or
+            // `server:share` (shorter to type).
+            let stripped = target.trim_start_matches('/').trim_start_matches('\\');
+            let (server, share) = if let Some((s, p)) = stripped.split_once('/') {
+                (s, p)
+            } else if let Some((s, p)) = stripped.split_once(':') {
+                (s, p)
+            } else {
+                return Err("target must be '//server/share' or 'server:share'".into());
+            };
+
+            // Auth spec: "guest" or "user:password". Default: guest.
+            let auth = args.get(2).cloned().unwrap_or_else(|| "guest".into());
+            let (guest, username, password) = if auth == "guest" {
+                (true, None, None)
+            } else if let Some((u, p)) = auth.split_once(':') {
+                (false, Some(u.to_string()), Some(p.to_string()))
+            } else {
+                return Err("auth must be 'guest' or 'user:password'".into());
+            };
+
+            let req = openpxe_iso_store::SmbAddRequest {
+                server: server.to_string(),
+                share: share.to_string(),
+                username,
+                password,
+                guest,
+                port: None,
+            };
+            match s.smb_shares.add(req).await {
+                Ok(m) => Ok(format!("added {} ({} isos)", m.id, m.iso_count)),
+                Err(e) => {
+                    let mut out = format!("add failed: {}", e.error);
+                    if let Some(h) = e.hint {
+                        out.push_str("\nhint: ");
+                        out.push_str(&h);
+                    }
+                    Err(out)
+                }
+            }
+        }
+        Some("remove") => {
+            let id = args
+                .get(1)
+                .ok_or_else(|| "usage: share remove <id>".to_string())?;
+            match s.smb_shares.remove(id).await {
+                Ok(()) => Ok(format!("removed {id}")),
+                Err(e) => Err(format!("remove failed: {e}")),
+            }
+        }
+        Some("scan") => {
+            let id = args
+                .get(1)
+                .ok_or_else(|| "usage: share scan <id>".to_string())?;
+            match s.smb_shares.rescan(id).await {
+                Ok(n) => Ok(format!("re-scanned {id}: {n} isos")),
+                Err(e) => Err(format!("scan failed: {e}")),
+            }
+        }
+        Some(other) => Err(format!(
+            "unknown share subcommand: {other}\ntry: share [list|add|remove|scan]"
+        )),
+    }
+}
+
+// ── nfs (v0.4.67: in-process NFSv3 via nfs3_client) ────────────────────
+
+async fn nfs_share_command(s: &AppState, args: &[String]) -> Result<String, String> {
+    match args.first().map(String::as_str) {
+        None | Some("list") => {
+            let shares = s.nfs_shares.list();
+            if shares.is_empty() {
+                return Ok("(no NFS shares configured)".into());
+            }
+            let mut out = String::new();
+            let _ = writeln!(out, "{:<24} {:<7} {:<6} TARGET", "ID", "STATUS", "ISOS");
+            for m in shares {
+                let status = if m.reachable { "ok" } else { "down" };
+                let _ = writeln!(
+                    out,
+                    "{:<24} {:<7} {:<6} {}:{}",
                     truncate(&m.id, 24),
-                    match m.version {
-                        openpxe_iso_store::NfsVersion::V3 => "v3",
-                        openpxe_iso_store::NfsVersion::V41 => "v4.1",
-                    },
                     status,
                     m.iso_count,
                     m.server,
@@ -280,50 +428,156 @@ async fn nfs_command(s: &AppState, args: &[String]) -> Result<String, String> {
                 if let Some(e) = m.last_error {
                     let _ = writeln!(out, "    error: {e}");
                 }
+                if let Some(h) = m.last_hint {
+                    let _ = writeln!(out, "    hint:  {h}");
+                }
             }
             Ok(out)
         }
-        Some("mount") => {
+        Some("add") => {
-            // nfs mount <server>:<export> [v3|v41] [ro|rw]
+            // nfs add <server>:<export> [port]
             let target = args
                 .get(1)
-                .ok_or_else(|| "usage: nfs mount <server>:<export> [v3|v41] [ro|rw]".to_string())?;
+                .ok_or_else(|| "usage: nfs add <server>:<export> [port]".to_string())?;
             let (server, export) = target
                 .split_once(':')
                 .ok_or_else(|| "target must be 'server:/export'".to_string())?;
-            let version = match args.get(2).map(String::as_str) {
+            let port = args.get(2).and_then(|s| s.parse::<u16>().ok());
-                Some("v3") => openpxe_iso_store::NfsVersion::V3,
-                Some("v41") | None => openpxe_iso_store::NfsVersion::V41,
-                Some(other) => return Err(format!("unknown nfs version: {other} (expect v3 or v41)")),
-            };
-            let read_only = !matches!(args.get(3).map(String::as_str), Some("rw"));
             let req = openpxe_iso_store::NfsAddRequest {
                 server: server.to_string(),
                 export: export.to_string(),
-                version,
+                port,
-                read_only,
             };
-            match s.nfs.add(req).await {
+            match s.nfs_shares.add(req).await {
-                Ok(m) => Ok(format!("mounted {} ({} isos)", m.id, m.iso_count)),
+                Ok(m) => Ok(format!("added {} ({} isos)", m.id, m.iso_count)),
-                Err(e) => Err(format!("mount failed: {e}")),
+                Err(e) => {
+                    let mut out = format!("add failed: {}", e.error);
+                    if let Some(h) = e.hint {
+                        out.push_str("\nhint: ");
+                        out.push_str(&h);
+                    }
+                    Err(out)
+                }
             }
         }
-        Some("unmount") => {
+        Some("remove") => {
-            let id = args.get(1).ok_or_else(|| "usage: nfs unmount <id>".to_string())?;
+            let id = args
-            match s.nfs.remove(id).await {
+                .get(1)
-                Ok(()) => Ok(format!("unmounted {id}")),
+                .ok_or_else(|| "usage: nfs remove <id>".to_string())?;
-                Err(e) => Err(format!("unmount failed: {e}")),
+            match s.nfs_shares.remove(id).await {
+                Ok(()) => Ok(format!("removed {id}")),
+                Err(e) => Err(format!("remove failed: {e}")),
             }
         }
         Some("scan") => {
-            let id = args.get(1).ok_or_else(|| "usage: nfs scan <id>".to_string())?;
+            let id = args
-            match s.nfs.rescan(id).await {
+                .get(1)
+                .ok_or_else(|| "usage: nfs scan <id>".to_string())?;
+            match s.nfs_shares.rescan(id).await {
                 Ok(n) => Ok(format!("re-scanned {id}: {n} isos")),
                 Err(e) => Err(format!("scan failed: {e}")),
             }
         }
         Some(other) => Err(format!(
-            "unknown nfs subcommand: {other}\ntry: nfs [list|mount|unmount|scan]"
+            "unknown nfs subcommand: {other}\ntry: nfs [list|add|remove|scan]"
+        )),
+    }
+}
+
+// ── sftp (v0.5.5) ────────────────────────────────────────────────────────
+//
+// Parallel to nfs_share_command. The terminal `add` only supports
+// password auth — pasting a multiline PEM private key through the
+// terminal is impractical, so key-based shares are added via the WebUI.
+
+async fn sftp_share_command(s: &AppState, args: &[String]) -> Result<String, String> {
+    match args.first().map(String::as_str) {
+        None | Some("list") => {
+            let shares = s.sftp_shares.list();
+            if shares.is_empty() {
+                return Ok("(no SFTP shares configured)".into());
+            }
+            let mut out = String::new();
+            let _ = writeln!(out, "{:<24} {:<7} {:<6} TARGET", "ID", "STATUS", "ISOS");
+            for m in shares {
+                let status = if m.reachable { "ok" } else { "down" };
+                let _ = writeln!(
+                    out,
+                    "{:<24} {:<7} {:<6} {}@{}:{}",
+                    truncate(&m.id, 24),
+                    status,
+                    m.iso_count,
+                    m.username,
+                    m.server,
+                    m.export,
+                );
+                if let Some(e) = m.last_error {
+                    let _ = writeln!(out, "    error: {e}");
+                }
+                if let Some(h) = m.last_hint {
+                    let _ = writeln!(out, "    hint:  {h}");
+                }
+            }
+            Ok(out)
+        }
+        Some("add") => {
+            // sftp add <user>@<server>:<export> <password> [port]
+            let target = args.get(1).ok_or_else(|| {
+                "usage: sftp add <user>@<server>:<export> <password> [port] \
+                 (key auth: use the WebUI)"
+                    .to_string()
+            })?;
+            let password = args
+                .get(2)
+                .ok_or_else(|| "a password is required (key auth: use the WebUI)".to_string())?;
+            let (user, rest) = target
+                .split_once('@')
+                .ok_or_else(|| "target must be 'user@server:/export'".to_string())?;
+            let (server, export) = rest
+                .split_once(':')
+                .ok_or_else(|| "target must be 'user@server:/export'".to_string())?;
+            let port = args.get(3).and_then(|s| s.parse::<u16>().ok());
+            let req = openpxe_iso_store::SftpAddRequest {
+                server: server.to_string(),
+                export: export.to_string(),
+                username: Some(user.to_string()),
+                port,
+                password: Some(password.clone()),
+                private_key: None,
+                passphrase: None,
+            };
+            match s.sftp_shares.add(req).await {
+                Ok(m) => Ok(format!("added {} ({} isos)", m.id, m.iso_count)),
+                Err(e) => {
+                    let mut out = format!("add failed: {}", e.error);
+                    if let Some(h) = e.hint {
+                        out.push_str("\nhint: ");
+                        out.push_str(&h);
+                    }
+                    Err(out)
+                }
+            }
+        }
+        Some("remove") => {
+            let id = args
+                .get(1)
+                .ok_or_else(|| "usage: sftp remove <id>".to_string())?;
+            match s.sftp_shares.remove(id).await {
+                Ok(()) => Ok(format!("removed {id}")),
+                Err(e) => Err(format!("remove failed: {e}")),
+            }
+        }
+        Some("scan") => {
+            let id = args
+                .get(1)
+                .ok_or_else(|| "usage: sftp scan <id>".to_string())?;
+            match s.sftp_shares.rescan(id).await {
+                Ok(n) => Ok(format!("re-scanned {id}: {n} isos")),
+                Err(e) => Err(format!("scan failed: {e}")),
+            }
+        }
+        Some(other) => Err(format!(
+            "unknown sftp subcommand: {other}\ntry: sftp [list|add|remove|scan]"
         )),
     }
 }
@@ -368,10 +622,7 @@ fn log_command(s: &AppState, args: &[String]) -> Result<String, String> {
             Ok("log buffer cleared".into())
         }
         Some("tail") => {
-            let n: usize = args
+            let n: usize = args.get(1).and_then(|v| v.parse().ok()).unwrap_or(20);
-                .get(1)
-                .and_then(|v| v.parse().ok())
-                .unwrap_or(20);
             let lines = s.log_bus.recent();
             let start = lines.len().saturating_sub(n);
             let mut out = String::new();
@@ -462,18 +713,28 @@ OpenPXE terminal — available commands:
 
   isos                              list registered ISOs
   clients                           list PXE clients seen this session
-  gate list                         list gated-deployment queue
+  queue list                        list queued clients
-  gate assign <entry_id> <target>    assign one gate to a boot entry
+  queue assign <entry_id> <target>   assign one queued client to a boot entry
-  gate assign-all <target>          assign every waiting gate
+  queue assign-all <target>         assign every waiting client
-  gate release <entry_id>            release one gate
+  queue release <entry_id>           release one queued client
 
-  nfs list                          list NFS mounts
+  share list                        list configured SMB shares
-  nfs mount <s>:<e> [v3|v41] [ro|rw]  add and mount an NFS share
+  share add //srv/share [auth]      add an SMB share; auth = 'guest' or 'user:pass'
-  nfs unmount <id>                  unmount and forget a share
+  share remove <id>                 forget an SMB share
-  nfs scan <id>                     re-scan a share for new ISOs
+  share scan <id>                   re-list a share for new ISOs
 
-  smb status                        SMB (Samba) state
+  nfs list                          list configured NFSv3 shares
-  smb start | stop | reload         control smbd
+  nfs add <srv>:<export> [port]     add an NFSv3 share
+  nfs remove <id>                   forget an NFS share
+  nfs scan <id>                     re-list an NFS share for new ISOs
+
+  sftp list                         list configured SFTP-over-SSH shares
+  sftp add <user>@<srv>:<export> <pass> [port]   add an SFTP share (key auth: WebUI)
+  sftp remove <id>                  forget an SFTP share
+  sftp scan <id>                    re-list an SFTP share for new ISOs
+
+  smb status                        outbound Samba state (Windows install media)
+  smb start | stop | reload         control the outbound smbd
 
   log clear                         drop the in-memory log ring buffer
   log tail [n]                      show the last n buffered lines (default 20)
@@ -488,10 +749,10 @@ mod tests {
     #[test]
     fn shell_split_basic() {
         assert_eq!(shell_split(""), Vec::<String>::new());
-        assert_eq!(shell_split("nfs list"), vec!["nfs", "list"]);
+        assert_eq!(shell_split("share list"), vec!["share", "list"]);
         assert_eq!(
-            shell_split("nfs mount 10.0.0.5:/srv v41 ro"),
+            shell_split("share add //nas/isos guest"),
-            vec!["nfs", "mount", "10.0.0.5:/srv", "v41", "ro"]
+            vec!["share", "add", "//nas/isos", "guest"]
         );
     }
 
@@ -521,4 +782,10 @@ mod tests {
         assert_eq!(truncate("hi", 10), "hi");
         assert_eq!(truncate("longerthanfive", 5), "long…");
     }
+
+    #[test]
+    fn help_uses_queue_language() {
+        assert!(HELP_TEXT.contains("queue list"));
+        assert!(HELP_TEXT.contains("queued clients"));
+    }
 }

crates/http-api/src/uploads.rs

@@ -0,0 +1,184 @@
+//! Chunked upload sessions for browser-driven ISO uploads.
+//!
+//! The legacy multipart endpoint still exists for simple API clients, but
+//! browsers get a better failure mode with raw chunks: progress advances after
+//! each acknowledged write, partial files appear in the ISO directory
+//! immediately, and reverse proxies are less likely to buffer an entire DVD
+//! image before OpenPXE sees byte one.
+
+use bytes::Bytes;
+use openpxe_core::{Error, Result};
+use openpxe_iso_store::{IsoMeta, IsoStore, UploadHandle};
+use parking_lot::RwLock;
+use serde::Serialize;
+use std::collections::HashMap;
+use std::sync::Arc;
+use tokio::sync::Mutex;
+use uuid::Uuid;
+
+const DEFAULT_CHUNK_SIZE: u64 = 8 * 1024 * 1024;
+
+#[derive(Clone, Default)]
+pub struct UploadSessions {
+    // v0.5.4: the registry is a sync `parking_lot::RwLock` — it's only ever
+    // briefly read/inserted/removed to look up a session, never held across
+    // an `.await`. The per-session lock below stays a `tokio::sync::Mutex`
+    // because `write_chunk` / `finish` are awaited while it's held.
+    inner: Arc<RwLock<HashMap<String, Arc<Mutex<UploadSession>>>>>,
+}
+
+struct UploadSession {
+    filename: String,
+    expected_size: Option<u64>,
+    offset: u64,
+    handle: Option<UploadHandle>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct UploadStarted {
+    pub upload_id: String,
+    pub iso_id: String,
+    pub filename: String,
+    pub offset: u64,
+    pub chunk_size: u64,
+}
+
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum UploadAppend {
+    Progress { offset: u64 },
+    Complete { offset: u64, iso: Box<IsoMeta> },
+}
+
+impl UploadSessions {
+    pub async fn begin(
+        &self,
+        store: &IsoStore,
+        filename: &str,
+        expected_size: Option<u64>,
+    ) -> Result<UploadStarted> {
+        if !filename.to_ascii_lowercase().ends_with(".iso") {
+            return Err(Error::Invalid("only .iso uploads accepted".to_string()));
+        }
+
+        let handle = store.begin_upload(filename).await?;
+        let iso_id = handle.id.clone();
+        let upload_id = Uuid::new_v4().to_string();
+        let session = UploadSession {
+            filename: filename.to_string(),
+            expected_size,
+            offset: 0,
+            handle: Some(handle),
+        };
+
+        self.inner
+            .write()
+            .insert(upload_id.clone(), Arc::new(Mutex::new(session)));
+
+        Ok(UploadStarted {
+            upload_id,
+            iso_id,
+            filename: filename.to_string(),
+            offset: 0,
+            chunk_size: DEFAULT_CHUNK_SIZE,
+        })
+    }
+
+    pub async fn append(
+        &self,
+        store: &IsoStore,
+        upload_id: &str,
+        offset: u64,
+        chunk: Bytes,
+        complete: bool,
+    ) -> Result<UploadAppend> {
+        let Some(session_lock) = self.inner.read().get(upload_id).cloned() else {
+            return Err(Error::Invalid(format!("no such upload '{upload_id}'")));
+        };
+
+        let mut session = session_lock.lock().await;
+        if session.offset != offset {
+            return Err(Error::Invalid(format!(
+                "expected offset {}, got {offset}",
+                session.offset
+            )));
+        }
+
+        let new_offset = session
+            .offset
+            .checked_add(chunk.len() as u64)
+            .ok_or_else(|| Error::Invalid("upload offset overflow".to_string()))?;
+
+        if let Some(expected) = session.expected_size {
+            if new_offset > expected {
+                return Err(Error::Invalid(format!(
+                    "chunk exceeds declared upload size {expected}"
+                )));
+            }
+        }
+
+        let Some(handle) = session.handle.as_mut() else {
+            return Err(Error::Invalid("upload already completed".to_string()));
+        };
+        if let Err(e) = handle.write_chunk(&chunk).await {
+            let handle = session.handle.take();
+            drop(session);
+            self.inner.write().remove(upload_id);
+            if let Some(handle) = handle {
+                let _ = handle.abort().await;
+            }
+            return Err(e);
+        }
+
+        session.offset = new_offset;
+        if !complete {
+            return Ok(UploadAppend::Progress { offset: new_offset });
+        }
+
+        if let Some(expected) = session.expected_size {
+            if new_offset != expected {
+                return Err(Error::Invalid(format!(
+                    "final chunk ended at {new_offset}, expected {expected}"
+                )));
+            }
+        }
+
+        let Some(handle) = session.handle.take() else {
+            return Err(Error::Invalid("upload already completed".to_string()));
+        };
+        let filename = session.filename.clone();
+        drop(session);
+
+        tracing::info!(
+            target: "openpxe::http::upload",
+            upload_id,
+            filename = %filename,
+            received_bytes = new_offset,
+            "chunked upload body complete; introspecting"
+        );
+
+        let meta = match handle.finish(store).await {
+            Ok(meta) => meta,
+            Err(e) => {
+                self.inner.write().remove(upload_id);
+                return Err(e);
+            }
+        };
+        self.inner.write().remove(upload_id);
+        Ok(UploadAppend::Complete {
+            offset: new_offset,
+            iso: Box::new(meta),
+        })
+    }
+
+    pub async fn abort(&self, upload_id: &str) -> Result<()> {
+        let Some(session_lock) = self.inner.write().remove(upload_id) else {
+            return Err(Error::Invalid(format!("no such upload '{upload_id}'")));
+        };
+        let mut session = session_lock.lock().await;
+        if let Some(handle) = session.handle.take() {
+            handle.abort().await?;
+        }
+        Ok(())
+    }
+}

crates/ipxe-assets/src/lib.rs

@@ -6,43 +6,40 @@
 //! missing, that architecture simply won't have PXE support — we log at
 //! startup and serve what we have.
 //!
-//! Filename convention (matches `ClientArch::ipxe_bootfile`):
+//! Filename convention (matches `ClientArch::ipxe_bootfile_mode`):
+//!
+//! DriverMode::Firmware (default — reuse the firmware UNDI/SNP NIC stack):
 //!   - `undionly.kpxe`       — Legacy x86 BIOS
 //!   - `snponly-i386.efi`    — IA32 UEFI
 //!   - `snponly.efi`         — x86_64 UEFI
-//!   - `snponly-arm32.efi`   — ARM32 UEFI
 //!   - `snponly-arm64.efi`   — ARM64 UEFI
-//!   - `ipxe.efi` (fallback) — UEFI with bundled drivers, if snponly fails on a NIC
+//!
+//! DriverMode::Builtin (v0.6.1 automatic fallback — iPXE's own NIC drivers,
+//! advertised when a firmware-net boot fails to chainload):
+//!   - `ipxe.pxe`            — Legacy x86 BIOS
+//!   - `ipxe-i386.efi`       — IA32 UEFI
+//!   - `ipxe.efi`            — x86_64 UEFI (built from source with PNG)
+//!   - `ipxe-arm64.efi`      — ARM64 UEFI
+//!
 //!   - `wimboot`             — Windows boot shim (fetched separately for WIM chains)
 #![forbid(unsafe_code)]
 
-use openpxe_core::ClientArch;
+use openpxe_core::{ClientArch, DriverMode};
 use rust_embed::Embed;
 
 #[derive(Embed)]
 #[folder = "../../assets/ipxe/"]
 #[include = "*.kpxe"]
 #[include = "*.efi"]
+#[include = "*.pxe"]
 #[include = "wimboot"]
 pub struct IpxeAssets;
 
-/// Return the embedded iPXE binary for `arch`, or `None` if we didn't bundle
+/// Return a named embedded asset (e.g. `snponly.efi`, `wimboot`) as a
-/// one for that architecture.
+/// `Cow` over the embedded bytes. In release builds the data is borrowed
-#[must_use]
+/// straight from the binary's rodata — **zero copy** — which matters
-pub fn bootfile_bytes(arch: ClientArch) -> Option<Vec<u8>> {
+/// because the TFTP and HTTP serving paths hit this for every boot
-    let name = arch.ipxe_bootfile()?;
+/// (`ipxe.efi` is ~1 MiB). Debug builds read from disk and return Owned.
-    IpxeAssets::get(name).map(|f| f.data.into_owned())
-}
-
-/// Return a named asset directly (e.g. `wimboot`, or a fallback `ipxe.efi`).
-#[must_use]
-pub fn asset_bytes(name: &str) -> Option<Vec<u8>> {
-    IpxeAssets::get(name).map(|f| f.data.into_owned())
-}
-
-/// Same as [`asset_bytes`] but returns the embedded slice directly,
-/// avoiding the heap copy when the caller only needs to read the
-/// payload. Falls back to None for unknown names.
 #[must_use]
 pub fn asset_slice(name: &str) -> Option<std::borrow::Cow<'static, [u8]>> {
     IpxeAssets::get(name).map(|f| f.data)
@@ -51,28 +48,53 @@ pub fn asset_slice(name: &str) -> Option<std::borrow::Cow<'static, [u8]>> {
 /// Enumerate embedded asset filenames. Useful for startup logging so the
 /// operator can immediately tell which architectures will work.
 pub fn list_assets() -> Vec<String> {
-    IpxeAssets::iter().map(std::borrow::Cow::into_owned).collect()
+    IpxeAssets::iter()
+        .map(std::borrow::Cow::into_owned)
+        .collect()
 }
 
-/// Log at startup which iPXE binaries are present and which are missing.
+/// Log at startup which iPXE binaries are present and which are missing, for
+/// both driver modes. The Firmware-mode binaries are required for PXE on each
+/// arch; the Builtin-mode binaries are the optional automatic NIC-driver
+/// fallback (v0.6.1) — without one, escalation simply can't help that arch.
 pub fn log_availability() {
     let have: std::collections::HashSet<String> = list_assets().into_iter().collect();
-    let needed = [
+    let arches = [
-        (ClientArch::LegacyX86, "undionly.kpxe"),
+        ClientArch::LegacyX86,
-        (ClientArch::Ia32Uefi, "snponly-i386.efi"),
+        ClientArch::Ia32Uefi,
-        (ClientArch::X64Uefi, "snponly.efi"),
+        ClientArch::X64Uefi,
-        // ARM32 UEFI deferred — no upstream snponly binary published.
+        // ARM32 UEFI deferred — no upstream binary published in either mode.
-        (ClientArch::Arm64Uefi, "snponly-arm64.efi"),
+        ClientArch::Arm64Uefi,
     ];
-    for (arch, name) in needed {
+    for arch in arches {
-        if have.contains(name) {
+        for mode in [DriverMode::Firmware, DriverMode::Builtin, DriverMode::Shim] {
-            tracing::info!(target: "openpxe::ipxe", "bundled iPXE for {}: {}", arch.as_str(), name);
+            let Some(name) = arch.ipxe_bootfile_mode(mode) else {
-        } else {
+                continue;
-            tracing::warn!(
+            };
-                target: "openpxe::ipxe",
+            if have.contains(name) {
-                "MISSING iPXE binary for {}: {} — clients of this arch will not PXE boot",
+                tracing::info!(
-                arch.as_str(), name
+                    target: "openpxe::ipxe",
-            );
+                    "bundled iPXE for {} [{mode:?}]: {name}", arch.as_str()
+                );
+            } else if mode == DriverMode::Firmware {
+                tracing::warn!(
+                    target: "openpxe::ipxe",
+                    "MISSING iPXE binary for {} [{mode:?}]: {name} — clients of this arch will not PXE boot",
+                    arch.as_str()
+                );
+            } else if mode == DriverMode::Builtin {
+                tracing::info!(
+                    target: "openpxe::ipxe",
+                    "no built-in-driver fallback for {} [{mode:?}]: {name} — auto NIC driver escalation unavailable for this arch",
+                    arch.as_str()
+                );
+            } else {
+                tracing::info!(
+                    target: "openpxe::ipxe",
+                    "no signed shim chain for {} [{mode:?}]: {name} — Secure Boot clients of this arch can't be served",
+                    arch.as_str()
+                );
+            }
         }
     }
 }

crates/iso-store/Cargo.toml

@@ -27,6 +27,33 @@ parking_lot.workspace = true
 bytes.workspace = true
 tempfile = "3.12"
 libc = "0.2"
+# v0.4.61: server-side compose of the operator's uploaded raster into a
+# fixed 1024x768 canvas so the PXE menu always gets a consistently-sized
+# PNG regardless of what the operator uploaded. We use the bare-bones
+# `image` crate (no default features) and explicitly enable only the
+# decoders we accept on upload (PNG/JPEG/WebP/GIF) plus the PNG
+# encoder. Keeps the build slim — no JPEG2000, TIFF, BMP, etc.
+image = { version = "0.25", default-features = false, features = ["png", "jpeg", "webp", "gif"] }
+
+# v0.4.67: pure-Rust NFSv3 client for reading remote ISOs without a
+# kernel mount. See crates/iso-store/src/nfs_share.rs for usage.
+nfs3_client = { workspace = true }
+nfs3_types = { workspace = true }
+# v0.5.5: pure-Rust SSH/SFTP client (ring backend) for the SFTP remote
+# share path. See crates/iso-store/src/sftp_share.rs for usage.
+russh = { workspace = true }
+russh-sftp = { workspace = true }
+# Needed for the Stream trait that wraps the mpsc receiver feeding
+# NFS read-loop bytes into axum's Body::from_stream.
+futures = { workspace = true }
 
 [dev-dependencies]
 tempfile = "3.12"
+
+[features]
+# v0.7.4: exposes the in-memory ISO9660 test-image builder
+# (`iso_fs::testiso`) to other crates' integration tests, so http-api's
+# full-flow tests can synthesize ISOs with real directory trees — the
+# probe-based introspection no longer classifies label-only blobs.
+# Never enabled in production builds.
+test-image = []

crates/iso-store/src/entry.rs

@@ -25,9 +25,11 @@ pub enum BootKind {
         wimboot_url: String,
         files: Vec<(String, String)>,
     },
-    /// Last-resort: SAN-boot the ISO as an emulated CD. Only works for small
+    /// SAN-boot the raw ISO as an emulated CD (iPXE `sanboot`). The emulated
-    /// ISOs (<~1 GiB) and older distros. Kept for completeness, not the
+    /// CD is backed by on-demand HTTP range reads, so ISO size is *not* a
-    /// default.
+    /// constraint — this is the primary path for Windows (v0.5.8) and for any
+    /// El Torito-bootable image we don't special-case: ESXi/VMvisor
+    /// installers, BSDs, firmware/diagnostic tools, custom spins (v0.6.0).
     SanBootIso { iso_url: String },
 }
 

crates/iso-store/src/introspect.rs

@@ -1,19 +1,36 @@
 //! ISO introspection — identify the distro family and locate kernel/initrd.
 //!
-//! We avoid a full ISO9660/Joliet/Rock-Ridge parser by reading a small number
+//! v0.7.4 rewrite: detection is **probe-based**. Instead of grepping raw
-//! of well-known files via `isoinfo` (from cdrtools/genisoimage) when it's on
+//! sectors for filename strings (which false-positived — any Linux ISO
-//! the path. As a pure-Rust fallback we do a crude scan: read the volume
+//! shipping GRUB/syslinux chainload modules contains the literal
-//! descriptor at offset 0x8000 to grab the volume label, and grep for known
+//! "bootmgr", so gparted-live classified as Windows), we walk the
-//! filenames by scanning raw sectors — good enough to tell Debian from RHEL
+//! ISO9660 directory tree via [`crate::iso_fs`] and check whether the
-//! most of the time, without shelling out.
+//! well-known boot files actually exist. The same probes run over local
+//! files and remote NFS/SFTP shares — remote ISOs finally classify
+//! instead of registering as `Unknown`.
 //!
-//! The returned `IntrospectionReport` is what `BootEntry`s get generated from.
+//! Layered, first-decisive-answer-wins:
+//!   1. PVD volume label → family hint.
+//!   2. El Torito boot-catalog presence (the "bootable at all" signal).
+//!   3. `/sources/boot.wim` directory probe → Windows install media.
+//!   4. Linux probe table → verified kernel+initrd paths. A probe match
+//!      both classifies the family and (for the families whose boot
+//!      arguments we render) yields kernel paths that are *known to
+//!      exist* — no more guessed paths that 404 at boot.
+//!   5. Bulk byte scan for UDF Windows markers — local images only
+//!      (modern Windows ISOs hide their tree from ISO9660; remote scans
+//!      skip this so a share rescan doesn't stream 16 MiB per ISO).
+//!   6. Filename tokens — the last-resort hint, and the only signal
+//!      available for SMB shares (smbclient cannot seek).
+//!
+//! The returned `IntrospectionReport` is what `BootEntry`s get generated
+//! from.
 
+use crate::iso_fs::{self, CachingReadAt, FileReadAt, IsoReadAt, SECTOR};
 use serde::{Deserialize, Serialize};
-use std::io::{Read, Seek, SeekFrom};
 use std::path::Path;
 
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, Default)]
 #[serde(rename_all = "snake_case")]
 pub enum DistroFamily {
     DebianUbuntu,
@@ -22,93 +39,283 @@ pub enum DistroFamily {
     Arch,
     Alpine,
     WindowsPe,
+    #[default]
     Unknown,
 }
 
-#[derive(Debug, Clone, Serialize, Deserialize)]
+/// Bumped whenever the introspection logic changes in a way that should
+/// re-classify already-uploaded ISOs. On startup the store re-runs
+/// `introspect` on any *local* ISO whose persisted report predates this
+/// revision (see `IsoStore::load_from_disk`), so an upgrade fixes stale
+/// metadata without the operator having to delete and re-upload.
+///
+/// rev 1 (v0.5.9): added El Torito boot-catalog detection + broadened
+/// Windows (UDF/UTF-16) detection.
+/// rev 2 (v0.7.4): probe-based detection. Fixes Linux live ISOs that
+/// classified as Windows via the raw "bootmgr" byte grep, verifies
+/// kernel/initrd paths exist before emitting them, and adds the Debian
+/// live / netinst / CoreOS shapes. Remote (NFS/SFTP) introspection
+/// caches key off this rev too, so the cache self-invalidates.
+pub const INTROSPECT_REV: u32 = 2;
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
 pub struct IntrospectionReport {
     pub family: DistroFamily,
     pub volume_label: Option<String>,
-    /// Kernel path inside the ISO (e.g. `/casper/vmlinuz`, `/isolinux/vmlinuz`).
+    /// Kernel path inside the ISO (e.g. `/casper/vmlinuz`). v0.7.4: only
+    /// set when the path was verified to exist *and* the family's boot
+    /// arguments are known-good for direct kernel boot; families we can
+    /// only classify (Debian live, CoreOS live) leave it `None` so the
+    /// entry generator falls back to sanboot instead of a broken boot.
     pub kernel_path: Option<String>,
     /// Initrd path(s) inside the ISO. May be multiple for multi-initrd setups.
     pub initrd_paths: Vec<String>,
     /// True if `sources/boot.wim` present — Windows install media.
     pub has_boot_wim: bool,
+    /// True if the ISO carries an El Torito boot catalog — i.e. it is
+    /// bootable by BIOS/UEFI firmware and therefore by iPXE `sanboot`
+    /// (emulated CD). This is the authoritative "can this boot at all?"
+    /// signal for ISOs we can't classify as Linux or Windows (BSDs, ESXi,
+    /// firmware tools, custom spins). A *data* ISO (e.g. a VMware vCenter
+    /// appliance bundle) has no boot catalog and reports `false`. v0.5.9.
+    #[serde(default)]
+    pub el_torito: bool,
+    /// Revision of the introspection logic that produced this report.
+    /// `0` means "never introspected" (pre-v0.5.9 metadata, or a remote
+    /// ISO whose probe hasn't run / can't run) — the entry generator
+    /// treats those optimistically (sanboot) and the UI labels them.
+    #[serde(default)]
+    pub introspect_rev: u32,
 }
 
-/// Probe an ISO file on disk. Never fails — on unrecoverable IO error we log
+/// One row of the Linux detection table.
-/// and return an `Unknown` family so the uploader still sees a record.
+///
+/// `emit_kernel` distinguishes "we can boot this directly" from "we can
+/// only classify it". Families marked `false` have boot protocols our
+/// cmdline renderer doesn't speak yet (Debian-live `boot=live fetch=`,
+/// d-i netinst, CoreOS `coreos.live.rootfs_url=`) — for those the probe
+/// sets the family for the UI/menu but leaves `kernel_path` unset so the
+/// ISO keeps its (working) sanboot entry instead of gaining a broken
+/// kernel one. Strictly fewer broken boots than guessing.
+struct LinuxProbe {
+    family: DistroFamily,
+    kernel: &'static str,
+    initrd_candidates: &'static [&'static str],
+    emit_kernel: bool,
+}
+
+const LINUX_PROBES: &[LinuxProbe] = &[
+    // Ubuntu and friends (casper) — the classic direct-boot shape.
+    LinuxProbe {
+        family: DistroFamily::DebianUbuntu,
+        kernel: "/casper/vmlinuz",
+        initrd_candidates: &["/casper/initrd", "/casper/initrd.lz", "/casper/initrd.gz"],
+        emit_kernel: true,
+    },
+    // Debian-live derivatives: gparted-live, Clonezilla, Kali live, tails.
+    // Classification only — live-boot needs `boot=live fetch=<squashfs>`
+    // which we don't render yet; sanboot of these images works today.
+    LinuxProbe {
+        family: DistroFamily::DebianUbuntu,
+        kernel: "/live/vmlinuz",
+        initrd_candidates: &["/live/initrd.img", "/live/initrd"],
+        emit_kernel: false,
+    },
+    // Debian installer (netinst/DVD). Classification only for the same
+    // reason — d-i sanboots fine.
+    LinuxProbe {
+        family: DistroFamily::DebianUbuntu,
+        kernel: "/install.amd/vmlinuz",
+        initrd_candidates: &["/install.amd/initrd.gz"],
+        emit_kernel: false,
+    },
+    // Anaconda family: RHEL, CentOS, Alma, Rocky, Fedora — and their
+    // many derivatives (Cisco ISE, Nagios appliances, …). The CoreOS
+    // variant of this shape is special-cased after the table.
+    LinuxProbe {
+        family: DistroFamily::RhelFedora,
+        kernel: "/images/pxeboot/vmlinuz",
+        initrd_candidates: &["/images/pxeboot/initrd.img"],
+        emit_kernel: true,
+    },
+    LinuxProbe {
+        family: DistroFamily::OpenSuse,
+        kernel: "/boot/x86_64/loader/linux",
+        initrd_candidates: &["/boot/x86_64/loader/initrd"],
+        emit_kernel: true,
+    },
+    LinuxProbe {
+        family: DistroFamily::Arch,
+        kernel: "/arch/boot/x86_64/vmlinuz-linux",
+        initrd_candidates: &["/arch/boot/x86_64/initramfs-linux.img"],
+        emit_kernel: true,
+    },
+    LinuxProbe {
+        family: DistroFamily::Alpine,
+        kernel: "/boot/vmlinuz-lts",
+        initrd_candidates: &["/boot/initramfs-lts"],
+        emit_kernel: true,
+    },
+];
+
+/// CoreOS-style live images (RHCOS, FCOS, OpenShift agent ISOs) carry
+/// the anaconda pxeboot layout *plus* a rootfs image. Direct kernel boot
+/// of those requires `coreos.live.rootfs_url=` (and for agent ISOs, the
+/// ignition config embedded in the ISO device) — neither of which a
+/// plain `inst.repo=` cmdline provides. Their sanboot path works, so
+/// they classify as RHEL-family but keep the sanboot entry.
+const COREOS_ROOTFS: &str = "/images/pxeboot/rootfs.img";
+
+/// Probe an ISO file on disk. Never fails — on unrecoverable IO error we
+/// log and return an `Unknown` family so the uploader still sees a record.
 pub fn introspect(path: &Path) -> IntrospectionReport {
-    let mut report = IntrospectionReport {
+    let filename = path
-        family: DistroFamily::Unknown,
+        .file_name()
-        volume_label: None,
+        .map(|s| s.to_string_lossy().into_owned())
-        kernel_path: None,
+        .unwrap_or_default();
-        initrd_paths: Vec::new(),
+    let Ok(f) = std::fs::File::open(path) else {
-        has_boot_wim: false,
-    };
-
-    let Ok(mut f) = std::fs::File::open(path) else {
         tracing::warn!(target: "openpxe::iso", "cannot open ISO for introspection: {}", path.display());
-        return report;
+        return IntrospectionReport {
+            introspect_rev: INTROSPECT_REV,
+            ..Default::default()
+        };
+    };
+    let len = f.metadata().map_or(0, |m| m.len());
+    // `FileReadAt` completes every read inline (no real awaits), so this
+    // light-weight block_on never parks; callers already run us on the
+    // blocking pool.
+    futures::executor::block_on(introspect_reader(
+        &mut FileReadAt::new(f),
+        len,
+        &filename,
+        true,
+    ))
+}
+
+/// The detection core, generic over any random-access source. `total_len`
+/// is the image size (every caller knows it — file metadata locally, the
+/// share listing remotely) and bounds the bulk scan, since `IsoReadAt`
+/// reads are exact-or-error. `filename` feeds the last-resort token
+/// heuristics; `allow_bulk_scan` gates the 16 MiB UDF-Windows byte scan
+/// (local files only — remote shares would stream that much per ISO per
+/// rescan).
+pub async fn introspect_reader<R: IsoReadAt + Send>(
+    r: &mut R,
+    total_len: u64,
+    filename: &str,
+    allow_bulk_scan: bool,
+) -> IntrospectionReport {
+    let mut report = IntrospectionReport {
+        introspect_rev: INTROSPECT_REV,
+        ..Default::default()
     };
 
-    // ISO9660 Primary Volume Descriptor at LBA 16 (offset 0x8000), 2048 bytes.
+    // ISO9660 Primary Volume Descriptor at LBA 16. Bytes 40..72 are the
-    // Bytes 40..72 are the Volume Identifier (space-padded, d-characters).
+    // volume identifier (space-padded).
-    let mut pvd = [0u8; 2048];
+    if let Ok(pvd) = r.read_at(16 * SECTOR, 2048).await {
-    if f.seek(SeekFrom::Start(0x8000)).is_ok() && f.read_exact(&mut pvd).is_ok() {
-        // Byte 0 must be 0x01 (primary descriptor), bytes 1..6 = "CD001".
         if pvd[0] == 0x01 && &pvd[1..6] == b"CD001" {
-            let label_raw = &pvd[40..72];
+            let label = String::from_utf8_lossy(&pvd[40..72]).trim().to_string();
-            let label = String::from_utf8_lossy(label_raw).trim().to_string();
             if !label.is_empty() {
-                report.volume_label = Some(label.clone());
                 report.family = family_from_label(&label);
+                report.volume_label = Some(label);
             }
         }
     }
 
-    // Cheap content scan: read the first ~64 MiB, look for signature filenames.
+    report.el_torito = detect_el_torito(r).await;
-    // This is enough to identify `sources/boot.wim` (Windows) and common
-    // kernel/initrd paths for the major Linux distros.
-    let _ = f.seek(SeekFrom::Start(0));
-    let scan_bytes = 64 * 1024 * 1024;
-    let mut buf = vec![0u8; 1024 * 1024];
-    let mut read_total = 0usize;
-    let mut haystack = Vec::with_capacity(scan_bytes.min(32 * 1024 * 1024));
-    while read_total < scan_bytes {
-        let n = f.read(&mut buf).unwrap_or(0);
-        if n == 0 { break; }
-        haystack.extend_from_slice(&buf[..n]);
-        read_total += n;
-    }
 
-    if contains_ascii(&haystack, b"sources/boot.wim")
+    // Directory-tree probes. The caching wrapper collapses the repeated
-        || contains_ascii(&haystack, b"SOURCES/BOOT.WIM")
+    // root/subdirectory reads the probe table would otherwise issue —
-        || contains_ascii(&haystack, b"SOURCES\\BOOT.WIM")
+    // over NFS/SFTP that's the difference between ~6 and ~60 round-trips.
     {
-        report.has_boot_wim = true;
+        let mut cr = CachingReadAt::new(r);
-        if report.family == DistroFamily::Unknown {
+
+        if iso_fs::exists(&mut cr, "/sources/boot.wim").await {
+            report.has_boot_wim = true;
             report.family = DistroFamily::WindowsPe;
+        } else {
+            for probe in LINUX_PROBES {
+                if !iso_fs::exists(&mut cr, probe.kernel).await {
+                    continue;
+                }
+                let mut initrd = None;
+                for cand in probe.initrd_candidates {
+                    if iso_fs::exists(&mut cr, cand).await {
+                        initrd = Some((*cand).to_string());
+                        break;
+                    }
+                }
+                let Some(initrd) = initrd else { continue };
+                // Content beats label: a rebadged derivative (volume
+                // label "ISE-3.2") with the anaconda layout is
+                // RHEL-family no matter what the label says.
+                report.family = probe.family;
+                let coreos = probe.family == DistroFamily::RhelFedora
+                    && iso_fs::exists(&mut cr, COREOS_ROOTFS).await;
+                if probe.emit_kernel && !coreos {
+                    report.kernel_path = Some(probe.kernel.to_string());
+                    report.initrd_paths = vec![initrd];
+                }
+                break;
+            }
         }
     }
 
-    // Best-effort kernel/initrd path guess from family. These paths are what
+    // Modern Windows 10/11 ISOs are UDF — their tree is invisible to the
-    // distro ISOs conventionally ship at — we don't verify extraction here;
+    // ISO9660 walk and the volume label is a cryptic Microsoft string.
-    // that happens in the store after introspection.
+    // Scan the first 16 MiB for well-known markers, ASCII and UTF-16LE.
-    let (k, i) = guess_kernel_initrd(report.family);
+    // Runs after the Linux probes so a Linux ISO that *contains* the
-    report.kernel_path = k.map(str::to_string);
+    // string "bootmgr" (GRUB/syslinux chainload modules do) has already
-    report.initrd_paths = i.iter().map(std::string::ToString::to_string).collect();
+    // classified and never reaches this — that ordering is the v0.7.4
+    // gparted-misdetection fix.
+    if report.family == DistroFamily::Unknown && allow_bulk_scan {
+        if let Some(win) = bulk_windows_scan(r, total_len).await {
+            report.family = DistroFamily::WindowsPe;
+            report.has_boot_wim = win;
+        }
+    }
+
+    // Last resort: filename tokens. The only signal for SMB-sourced ISOs
+    // and renamed/UDF images that defeated everything above.
+    if report.family == DistroFamily::Unknown {
+        report.family = family_from_filename(filename);
+    }
 
     report
 }
 
+/// Provisional report for a remote ISO that hasn't been (or can't be)
+/// content-probed yet: family from the filename, `introspect_rev` left
+/// at 0 so the entry generator keeps the optimistic sanboot entry and
+/// the UI shows it as awaiting introspection. Used by all three share
+/// managers at registration; NFS/SFTP upgrade it in the background.
+#[must_use]
+pub fn provisional_report(filename: &str) -> IntrospectionReport {
+    IntrospectionReport {
+        family: family_from_filename(filename),
+        ..Default::default()
+    }
+}
+
 fn family_from_label(label: &str) -> DistroFamily {
     let l = label.to_ascii_lowercase();
-    if l.contains("ubuntu") || l.contains("debian") || l.contains("mint") {
+    if l.contains("ubuntu")
+        || l.contains("debian")
+        || l.contains("mint")
+        || l.contains("kali")
+        || l.contains("gparted")
+        || l.contains("clonezilla")
+    {
         DistroFamily::DebianUbuntu
-    } else if l.contains("rhel") || l.contains("centos") || l.contains("fedora")
+    } else if l.contains("rhel")
-        || l.contains("rocky") || l.contains("alma")
+        || l.contains("centos")
+        || l.contains("fedora")
+        || l.contains("rocky")
+        || l.contains("alma")
+        || l.contains("rhcos")
+        || l.contains("coreos")
+        || l.contains("openshift")
+        || l.contains("okd")
     {
         DistroFamily::RhelFedora
     } else if l.contains("suse") || l.contains("opensuse") {
@@ -124,32 +331,395 @@ fn family_from_label(label: &str) -> DistroFamily {
     }
 }
 
-fn guess_kernel_initrd(family: DistroFamily) -> (Option<&'static str>, Vec<&'static str>) {
+/// Filename token heuristic — `AlmaLinux-9.5-x86_64-dvd.iso` says what
-    match family {
+/// it is even when we can't read a byte of it. Tokens are the filename
-        DistroFamily::DebianUbuntu => (Some("/casper/vmlinuz"), vec!["/casper/initrd"]),
+/// split on every non-alphanumeric character, so "almalinux", "rhel",
-        DistroFamily::RhelFedora => (Some("/images/pxeboot/vmlinuz"), vec!["/images/pxeboot/initrd.img"]),
+/// "win11" match without "search" tripping the "arch" token.
-        DistroFamily::OpenSuse => (Some("/boot/x86_64/loader/linux"), vec!["/boot/x86_64/loader/initrd"]),
+pub fn family_from_filename(filename: &str) -> DistroFamily {
-        DistroFamily::Arch => (Some("/arch/boot/x86_64/vmlinuz-linux"), vec!["/arch/boot/x86_64/initramfs-linux.img"]),
+    if filename_looks_windows(filename) {
-        DistroFamily::Alpine => (Some("/boot/vmlinuz-lts"), vec!["/boot/initramfs-lts"]),
+        return DistroFamily::WindowsPe;
-        DistroFamily::WindowsPe | DistroFamily::Unknown => (None, Vec::new()),
+    }
+    let lower = filename.to_ascii_lowercase();
+    let tokens: Vec<&str> = lower
+        .split(|c: char| !c.is_ascii_alphanumeric())
+        .filter(|t| !t.is_empty())
+        .collect();
+    let has = |t: &str| tokens.contains(&t);
+    if has("ubuntu")
+        || has("debian")
+        || has("mint")
+        || has("kali")
+        || has("gparted")
+        || has("clonezilla")
+        || has("tails")
+    {
+        DistroFamily::DebianUbuntu
+    } else if has("rhel")
+        || has("centos")
+        || has("almalinux")
+        || has("alma")
+        || has("rocky")
+        || has("rockylinux")
+        || has("fedora")
+        || has("rhcos")
+        || has("coreos")
+        || has("openshift")
+        || has("okd")
+    {
+        DistroFamily::RhelFedora
+    } else if has("opensuse") || has("suse") || has("sles") {
+        DistroFamily::OpenSuse
+    } else if has("arch") || has("archlinux") || has("manjaro") {
+        DistroFamily::Arch
+    } else if has("alpine") {
+        DistroFamily::Alpine
+    } else {
+        DistroFamily::Unknown
+    }
+}
+
+/// Scan the first 16 MiB (or the whole image when smaller) for Windows
+/// markers. Returns `Some(has_boot_wim)` on a hit, `None` when nothing
+/// Windows-shaped is found.
+async fn bulk_windows_scan<R: IsoReadAt + Send>(r: &mut R, total_len: u64) -> Option<bool> {
+    const SCAN_BYTES: u64 = 16 * 1024 * 1024;
+    const CHUNK: u64 = 1024 * 1024;
+    let budget = SCAN_BYTES.min(total_len);
+    let mut haystack = Vec::with_capacity(usize::try_from(budget).unwrap_or(0));
+    let mut offset = 0u64;
+    while offset < budget {
+        // Reads are exact-or-error, so clamp the final chunk to what the
+        // image actually has — netboot.xyz is 2.3 MB, not 16.
+        let want = u32::try_from(CHUNK.min(budget - offset)).unwrap_or(u32::MAX);
+        let Ok(chunk) = r.read_at(offset, want).await else {
+            break; // read error: scan what we have
+        };
+        offset += chunk.len() as u64;
+        haystack.extend_from_slice(&chunk);
+    }
+    if haystack.is_empty() {
+        return None;
+    }
+    let boot_wim = contains_ascii(&haystack, b"sources/boot.wim")
+        || contains_ascii(&haystack, b"sources\\boot.wim")
+        || contains_utf16le_ci(&haystack, "boot.wim");
+    if boot_wim {
+        return Some(true);
+    }
+    let ascii_markers: [&[u8]; 3] = [b"bootmgr", b"sources/install.wim", b"sources/install.esd"];
+    let utf16_markers = ["bootmgr", "install.wim", "microsoft"];
+    let hit = ascii_markers.iter().any(|m| contains_ascii(&haystack, m))
+        || utf16_markers
+            .iter()
+            .any(|m| contains_utf16le_ci(&haystack, m));
+    if hit {
+        Some(false)
+    } else {
+        None
     }
 }
 
 fn contains_ascii(haystack: &[u8], needle: &[u8]) -> bool {
-    if needle.is_empty() || haystack.len() < needle.len() { return false; }
+    if needle.is_empty() || haystack.len() < needle.len() {
-    haystack.windows(needle.len()).any(|w| w.eq_ignore_ascii_case(needle))
+        return false;
+    }
+    haystack
+        .windows(needle.len())
+        .any(|w| w.eq_ignore_ascii_case(needle))
+}
+
+/// Case-insensitive search for an ASCII string encoded as UTF-16LE — the
+/// way UDF (and thus modern Windows ISOs) store filenames. Each character
+/// is two bytes: the ASCII low byte (compared case-insensitively) followed
+/// by a 0 high byte. v0.5.8.
+fn contains_utf16le_ci(haystack: &[u8], ascii: &str) -> bool {
+    let n = ascii.len();
+    if n == 0 || haystack.len() < n * 2 {
+        return false;
+    }
+    let lower: Vec<u8> = ascii.bytes().map(|b| b.to_ascii_lowercase()).collect();
+    haystack.windows(n * 2).any(|w| {
+        lower
+            .iter()
+            .enumerate()
+            .all(|(i, &c)| w[i * 2 + 1] == 0 && w[i * 2].to_ascii_lowercase() == c)
+    })
+}
+
+/// Filename heuristic: a stock Windows ISO almost always carries an obvious
+/// token in its name (e.g. `..._windows_11_...`, `Win10`, `winserver`).
+/// v0.7.4: takes the bare filename instead of a `Path` so the same check
+/// runs against remote share listings.
+fn filename_looks_windows(filename: &str) -> bool {
+    let name = filename.to_ascii_lowercase();
+    const TOKENS: [&str; 6] = [
+        "windows",
+        "winpe",
+        "win10",
+        "win11",
+        "winserver",
+        "win-server",
+    ];
+    TOKENS.iter().any(|t| name.contains(t))
+}
+
+/// The boot-system identifier string in an El Torito Boot Record Volume
+/// Descriptor (offset 7, NUL-padded to 32 bytes).
+const EL_TORITO_ID: &[u8] = b"EL TORITO SPECIFICATION";
+
+/// Detect an El Torito boot catalog — the marker that an ISO is bootable
+/// by BIOS/UEFI firmware (and thus by iPXE `sanboot`).
+///
+/// The ISO9660 Volume Descriptor Set starts at LBA 16 and runs one
+/// 2048-byte descriptor per sector until a Set Terminator (type 0xFF).
+/// A Boot Record descriptor (type 0x00) whose 32-byte boot system
+/// identifier reads "EL TORITO SPECIFICATION" means the image declares a
+/// boot catalog. We only confirm its presence — we don't parse the
+/// catalog (sanboot/the firmware does that). The walk is capped so a
+/// malformed image can't spin us. v0.5.9; reader-generic since v0.7.4.
+async fn detect_el_torito<R: IsoReadAt + Send>(r: &mut R) -> bool {
+    for lba in 16u64..32 {
+        let Ok(vd) = r.read_at(lba * SECTOR, 2048).await else {
+            return false;
+        };
+        // Every descriptor in the set carries the "CD001" magic; once it's
+        // missing we've walked off the end of a valid set.
+        if &vd[1..6] != b"CD001" {
+            return false;
+        }
+        match vd[0] {
+            // Boot Record descriptor carrying the El Torito signature.
+            0x00 if vd[7..7 + EL_TORITO_ID.len()] == *EL_TORITO_ID => return true,
+            // Volume Descriptor Set Terminator — nothing bootable found.
+            0xFF => return false,
+            // Any other descriptor (incl. a non-El-Torito boot record) —
+            // keep walking the set.
+            _ => {}
+        }
+    }
+    false
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::iso_fs::testiso::{MemReadAt, TestIsoBuilder};
+
+    fn introspect_mem(img: Vec<u8>, filename: &str, bulk: bool) -> IntrospectionReport {
+        let len = img.len() as u64;
+        futures::executor::block_on(introspect_reader(&mut MemReadAt(img), len, filename, bulk))
+    }
 
     #[test]
     fn label_matching() {
-        assert_eq!(family_from_label("Ubuntu 24.04"), DistroFamily::DebianUbuntu);
+        assert_eq!(
-        assert_eq!(family_from_label("Rocky-9-x86_64-dvd"), DistroFamily::RhelFedora);
+            family_from_label("Ubuntu 24.04"),
-        assert_eq!(family_from_label("openSUSE-Leap-15.6"), DistroFamily::OpenSuse);
+            DistroFamily::DebianUbuntu
+        );
+        assert_eq!(
+            family_from_label("Rocky-9-x86_64-dvd"),
+            DistroFamily::RhelFedora
+        );
+        assert_eq!(
+            family_from_label("openSUSE-Leap-15.6"),
+            DistroFamily::OpenSuse
+        );
         assert_eq!(family_from_label("ARCH_202604"), DistroFamily::Arch);
+        assert_eq!(
+            family_from_label("GParted-live"),
+            DistroFamily::DebianUbuntu
+        );
+        assert_eq!(family_from_label("rhcos-417"), DistroFamily::RhelFedora);
         assert_eq!(family_from_label("weird-custom"), DistroFamily::Unknown);
     }
+
+    #[test]
+    fn gparted_shape_is_not_windows() {
+        // The v0.7.4 regression test: a Debian-live image whose payload
+        // contains the literal string "bootmgr" (as GRUB/syslinux
+        // chainload modules do). The old byte-grep classified this as
+        // WindowsPe; the probe order must classify Debian first.
+        let img = TestIsoBuilder::new("GParted-live")
+            .el_torito(true)
+            .file("/live/vmlinuz", b"KERNEL")
+            .file("/live/initrd.img", b"INITRD")
+            .file("/boot/grub/chain.mod", b"xxx bootmgr xxx")
+            .build();
+        let r = introspect_mem(img, "gparted-live-1.8.1-3-amd64.iso", true);
+        assert_eq!(r.family, DistroFamily::DebianUbuntu);
+        // Classification only — live-boot args aren't rendered yet, so no
+        // kernel entry; sanboot (via el_torito) keeps working.
+        assert!(r.kernel_path.is_none());
+        assert!(r.el_torito);
+        assert_eq!(r.introspect_rev, INTROSPECT_REV);
+    }
+
+    #[test]
+    fn casper_shape_verifies_kernel_and_initrd() {
+        let img = TestIsoBuilder::new("Ubuntu-Server 24.04.1 LTS amd64")
+            .el_torito(true)
+            .file("/casper/vmlinuz", b"K")
+            .file("/casper/initrd", b"I")
+            .build();
+        let r = introspect_mem(img, "ubuntu-24.04.1-live-server-amd64.iso", true);
+        assert_eq!(r.family, DistroFamily::DebianUbuntu);
+        assert_eq!(r.kernel_path.as_deref(), Some("/casper/vmlinuz"));
+        assert_eq!(r.initrd_paths, vec!["/casper/initrd".to_string()]);
+    }
+
+    #[test]
+    fn anaconda_shape_emits_verified_paths() {
+        let img = TestIsoBuilder::new("AlmaLinux-9-5-x86_64-dvd")
+            .el_torito(true)
+            .file("/images/pxeboot/vmlinuz", b"K")
+            .file("/images/pxeboot/initrd.img", b"I")
+            .build();
+        let r = introspect_mem(img, "AlmaLinux-9.5-x86_64-dvd.iso", true);
+        assert_eq!(r.family, DistroFamily::RhelFedora);
+        assert_eq!(r.kernel_path.as_deref(), Some("/images/pxeboot/vmlinuz"));
+    }
+
+    #[test]
+    fn coreos_shape_classifies_but_keeps_sanboot() {
+        // RHCOS / OpenShift agent ISOs: anaconda layout + rootfs.img.
+        // Direct kernel boot needs coreos.live.rootfs_url (and agent
+        // ISOs their embedded ignition), so kernel_path must stay None.
+        let img = TestIsoBuilder::new("rhcos-417.94.202501")
+            .el_torito(true)
+            .file("/images/pxeboot/vmlinuz", b"K")
+            .file("/images/pxeboot/initrd.img", b"I")
+            .file("/images/pxeboot/rootfs.img", b"R")
+            .build();
+        let r = introspect_mem(img, "rhcos-live.x86_64.iso", true);
+        assert_eq!(r.family, DistroFamily::RhelFedora);
+        assert!(
+            r.kernel_path.is_none(),
+            "CoreOS must not get a kernel entry"
+        );
+        assert!(r.el_torito);
+    }
+
+    #[test]
+    fn boot_wim_probe_classifies_windows() {
+        let img = TestIsoBuilder::new("CCCOMA_X64FRE_EN-US_DV9")
+            .el_torito(true)
+            .file("/sources/boot.wim", b"MSWIMMSWIM")
+            .build();
+        let r = introspect_mem(img, "whatever.iso", false);
+        assert_eq!(r.family, DistroFamily::WindowsPe);
+        assert!(r.has_boot_wim);
+    }
+
+    #[test]
+    fn label_only_linux_without_verified_kernel_gets_no_kernel_path() {
+        // Label says RHEL but the tree has no pxeboot files — the old
+        // code guessed `/images/pxeboot/vmlinuz` and emitted an entry
+        // that 404'd at boot. Now: family yes, kernel paths no.
+        let img = TestIsoBuilder::new("RHEL-9-5-CUSTOM")
+            .el_torito(true)
+            .file("/readme.txt", b"hi")
+            .build();
+        let r = introspect_mem(img, "rhel-custom.iso", true);
+        assert_eq!(r.family, DistroFamily::RhelFedora);
+        assert!(r.kernel_path.is_none());
+        assert!(r.initrd_paths.is_empty());
+    }
+
+    #[test]
+    fn remote_skips_bulk_scan_but_filename_still_hints() {
+        // No ISO9660 signatures at all (e.g. pure-UDF image read over a
+        // share), bulk scan off: filename is the only signal.
+        let img = vec![0u8; 64 * 1024];
+        let r = introspect_mem(img.clone(), "Win11_24H2_English_x64.iso", false);
+        assert_eq!(r.family, DistroFamily::WindowsPe);
+        let r2 = introspect_mem(img, "mystery.iso", false);
+        assert_eq!(r2.family, DistroFamily::Unknown);
+    }
+
+    #[test]
+    fn filename_family_table() {
+        use DistroFamily::*;
+        let cases = [
+            ("AlmaLinux-9.5-x86_64-dvd.iso", RhelFedora),
+            ("CentOS-Stream-10-latest-x86_64-dvd1.iso", RhelFedora),
+            ("rhel-9.0-x86_64-boot.iso", RhelFedora),
+            ("rhcos-live.x86_64.iso", RhelFedora),
+            ("openshift-4-21-9.agent.x86_64.iso", RhelFedora),
+            ("ubuntu-24.04-desktop.iso", DebianUbuntu),
+            ("gparted-live-1.8.1-3-amd64.iso", DebianUbuntu),
+            ("archlinux-2026.05.01-x86_64.iso", Arch),
+            ("arch-2026.05.01.iso", Arch),
+            ("alpine-standard-3.21.0-x86_64.iso", Alpine),
+            ("openSUSE-Leap-15.6-DVD-x86_64.iso", OpenSuse),
+            ("en-us_windows_11_iot_enterprise.iso", WindowsPe),
+            ("Win10_22H2_English_x64.iso", WindowsPe),
+            ("netboot.xyz.iso", Unknown),
+            ("ise-3.2.0.542a.SPA.x86_64.iso", Unknown),
+            ("Macrium_5860_v2.iso", Unknown),
+            // "search" must not trip the "arch" token.
+            ("research-data.iso", Unknown),
+        ];
+        for (name, want) in cases {
+            assert_eq!(family_from_filename(name), want, "{name}");
+        }
+    }
+
+    #[test]
+    fn provisional_report_keeps_rev_zero() {
+        let r = provisional_report("rhel-9.0-x86_64-dvd.iso");
+        assert_eq!(r.family, DistroFamily::RhelFedora);
+        assert_eq!(
+            r.introspect_rev, 0,
+            "provisional must keep optimistic sanboot"
+        );
+        assert!(!r.el_torito);
+    }
+
+    #[test]
+    fn utf16le_marker_matches_case_insensitively() {
+        let s = "BOOT.WIM";
+        let utf16: Vec<u8> = s.bytes().flat_map(|b| [b, 0]).collect();
+        let mut hay = vec![0u8; 8];
+        hay.extend_from_slice(&utf16);
+        hay.extend_from_slice(&[1, 2, 3]);
+        assert!(contains_utf16le_ci(&hay, "boot.wim"));
+        assert!(contains_utf16le_ci(&hay, "Boot.Wim"));
+        assert!(!contains_utf16le_ci(&hay, "install.wim"));
+        assert!(!contains_utf16le_ci(b"boot.wim plain ascii", "boot.wim"));
+    }
+
+    #[test]
+    fn el_torito_detected_through_reader() {
+        let with = TestIsoBuilder::new("BOOTABLE").el_torito(true).build();
+        let without = TestIsoBuilder::new("DATA").build();
+        assert!(futures::executor::block_on(detect_el_torito(
+            &mut MemReadAt(with)
+        )));
+        assert!(!futures::executor::block_on(detect_el_torito(
+            &mut MemReadAt(without)
+        )));
+    }
+
+    #[test]
+    fn filename_hint_catches_windows_isos() {
+        assert!(filename_looks_windows(
+            "en-us_windows_11_iot_enterprise_ltsc_2024_x64_dvd.iso"
+        ));
+        assert!(filename_looks_windows("Win10_22H2_English_x64.iso"));
+        assert!(filename_looks_windows("winserver2022.iso"));
+        assert!(!filename_looks_windows("ubuntu-24.04-desktop.iso"));
+        assert!(!filename_looks_windows("Rocky-9.4-x86_64-dvd.iso"));
+    }
+
+    #[test]
+    fn bulk_scan_catches_udf_windows_markers() {
+        // A blob with no ISO9660 tree but a UTF-16 "install.wim" — the
+        // UDF Windows shape after every probe missed.
+        let mut img = vec![0u8; 256 * 1024];
+        let marker: Vec<u8> = "install.wim".bytes().flat_map(|b| [b, 0]).collect();
+        img[100_000..100_000 + marker.len()].copy_from_slice(&marker);
+        let r = introspect_mem(img, "renamed.iso", true);
+        assert_eq!(r.family, DistroFamily::WindowsPe);
+        assert!(!r.has_boot_wim);
+    }
 }

crates/iso-store/src/iso_fs.rs

@@ -0,0 +1,568 @@
+//! Read-only ISO9660 lookup over any random-access byte source.
+//!
+//! v0.7.4: generalized from the http-api crate's local-file-only walker so
+//! the same directory walk drives three consumers:
+//!
+//!   1. `iso_file` HTTP serving — locate `/casper/vmlinuz` inside a local
+//!      *or remote* (NFS/SFTP) ISO and stream just that byte range.
+//!   2. Introspection — probe for well-known kernel/initrd/boot.wim paths
+//!      instead of grepping raw sectors for filename strings (which
+//!      false-positived: any Linux ISO shipping GRUB/syslinux chainload
+//!      modules contains the literal "bootmgr" and used to classify as
+//!      Windows).
+//!   3. Remote introspection — the same probes over an NFSv3 READ3 /
+//!      SFTP seek-read connection, which is what finally classifies
+//!      share-sourced ISOs instead of registering them all as `Unknown`.
+//!
+//! We parse only the Primary Volume Descriptor namespace. Joliet and Rock
+//! Ridge are deliberately ignored — matching is case-insensitive against
+//! plain ISO9660 identifiers (`;1` version suffix and the trailing dot of
+//! extension-less strict-mastered names stripped), which is how the local
+//! serving path has always behaved in production.
+
+use std::collections::HashMap;
+use std::future::Future;
+use std::io::{Read, Seek, SeekFrom};
+use std::path::Path;
+
+pub const SECTOR: u64 = 2048;
+
+/// Upper bound on a single directory extent we'll buffer. Real distro ISO
+/// directories are a handful of KiB; the cap keeps a malformed or hostile
+/// image from asking us to allocate gigabytes.
+const MAX_DIR_BYTES: u64 = 4 * 1024 * 1024;
+
+/// Byte range of one file inside the ISO image.
+#[derive(Debug, Clone)]
+pub struct FileLocation {
+    pub offset: u64,
+    pub length: u64,
+}
+
+/// Random-access reads into an ISO image. Implemented by a local
+/// `std::fs::File`, the NFS and SFTP share readers, and the in-memory
+/// test image.
+///
+/// The contract is `read_exact`-like: the returned buffer is exactly
+/// `len` bytes or the call errors. The future must be `Send` because
+/// remote introspection runs inside spawned tokio tasks.
+pub trait IsoReadAt {
+    fn read_at(
+        &mut self,
+        offset: u64,
+        len: u32,
+    ) -> impl Future<Output = std::io::Result<Vec<u8>>> + Send;
+}
+
+/// Local-file reader. The reads are synchronous inside an async fn —
+/// callers run it either on the blocking pool (introspection at upload)
+/// or through [`lookup_local`]'s `block_on`, never on a hot runtime
+/// worker with real awaits pending.
+pub struct FileReadAt(std::fs::File);
+
+impl FileReadAt {
+    #[must_use]
+    pub fn new(f: std::fs::File) -> Self {
+        Self(f)
+    }
+}
+
+impl IsoReadAt for FileReadAt {
+    async fn read_at(&mut self, offset: u64, len: u32) -> std::io::Result<Vec<u8>> {
+        self.0.seek(SeekFrom::Start(offset))?;
+        let mut buf = vec![0u8; len as usize];
+        self.0.read_exact(&mut buf)?;
+        Ok(buf)
+    }
+}
+
+/// Exact-key read cache for the probe phase of introspection. The probe
+/// table looks up ~20 paths and every one of them re-reads the root
+/// directory (and usually one shared subdirectory); over NFS/SFTP that
+/// would be 20 identical round-trips. Directory reads repeat with the
+/// exact same `(offset, len)`, so a plain map keyed on the pair hits
+/// every time. Large data reads bypass the cache.
+pub struct CachingReadAt<'a, R: IsoReadAt + Send> {
+    inner: &'a mut R,
+    cache: HashMap<(u64, u32), Vec<u8>>,
+}
+
+/// Don't cache reads bigger than this (file payloads, bulk scans).
+const CACHE_MAX_READ: u32 = 256 * 1024;
+/// Bound the cache so a pathological image can't grow it unbounded.
+const CACHE_MAX_ENTRIES: usize = 256;
+
+impl<'a, R: IsoReadAt + Send> CachingReadAt<'a, R> {
+    pub fn new(inner: &'a mut R) -> Self {
+        Self {
+            inner,
+            cache: HashMap::new(),
+        }
+    }
+}
+
+impl<R: IsoReadAt + Send> IsoReadAt for CachingReadAt<'_, R> {
+    async fn read_at(&mut self, offset: u64, len: u32) -> std::io::Result<Vec<u8>> {
+        let key = (offset, len);
+        if let Some(hit) = self.cache.get(&key) {
+            return Ok(hit.clone());
+        }
+        let buf = self.inner.read_at(offset, len).await?;
+        if len <= CACHE_MAX_READ && self.cache.len() < CACHE_MAX_ENTRIES {
+            self.cache.insert(key, buf.clone());
+        }
+        Ok(buf)
+    }
+}
+
+/// Look up `in_iso_path` (leading slash optional, case-insensitive) in
+/// the image behind `r`. Returns `None` on any parsing or IO failure —
+/// "not found" and "couldn't read" are the same answer to a prober.
+pub async fn lookup<R: IsoReadAt + Send>(r: &mut R, in_iso_path: &str) -> Option<FileLocation> {
+    let pvd = r.read_at(16 * SECTOR, 2048).await.ok()?;
+    if pvd[0] != 0x01 || &pvd[1..6] != b"CD001" {
+        return None;
+    }
+    // Root directory record at PVD offset 156, 34 bytes.
+    let (mut lba, mut len) = parse_dir_record_ext(&pvd[156..156 + 34])?;
+
+    let components: Vec<&str> = in_iso_path
+        .trim_start_matches('/')
+        .split('/')
+        .filter(|c| !c.is_empty())
+        .collect();
+    if components.is_empty() {
+        return None;
+    }
+
+    // The original walk was tail-recursive; iterate instead so the future
+    // stays a plain (non-boxed) state machine.
+    for (idx, comp) in components.iter().enumerate() {
+        if len == 0 || len > MAX_DIR_BYTES {
+            return None;
+        }
+        let dir = r.read_at(lba * SECTOR, len as u32).await.ok()?;
+        let hit = scan_dir(&dir, comp)?;
+        let last = idx + 1 == components.len();
+        match (last, hit.is_dir) {
+            (true, false) => {
+                return Some(FileLocation {
+                    offset: hit.lba * SECTOR,
+                    length: hit.len,
+                })
+            }
+            (false, true) => {
+                lba = hit.lba;
+                len = hit.len;
+            }
+            _ => return None,
+        }
+    }
+    None
+}
+
+/// Convenience probe: does `in_iso_path` exist as a file?
+pub async fn exists<R: IsoReadAt + Send>(r: &mut R, in_iso_path: &str) -> bool {
+    lookup(r, in_iso_path).await.is_some()
+}
+
+/// Synchronous wrapper for local files — the shape the HTTP handler's
+/// `spawn_blocking` call site wants. `block_on` is safe here because
+/// `FileReadAt`'s reads never actually await (they complete inline), so
+/// the executor never parks.
+#[must_use]
+pub fn lookup_local(iso_path: &Path, in_iso_path: &str) -> Option<FileLocation> {
+    let f = std::fs::File::open(iso_path).ok()?;
+    futures::executor::block_on(lookup(&mut FileReadAt::new(f), in_iso_path))
+}
+
+struct DirHit {
+    lba: u64,
+    len: u64,
+    is_dir: bool,
+}
+
+/// Scan one directory extent for an identifier. Pure function over the
+/// buffered extent — all protocol/IO concerns live in the caller.
+fn scan_dir(dir: &[u8], target: &str) -> Option<DirHit> {
+    let mut i = 0;
+    while i < dir.len() {
+        let len = dir[i] as usize;
+        if len == 0 {
+            // Records never span sectors; a zero length byte means the
+            // rest of this sector is padding. Hop to the next one.
+            let next = (i / SECTOR as usize + 1) * SECTOR as usize;
+            if next <= i {
+                break;
+            }
+            i = next;
+            continue;
+        }
+        if i + len > dir.len() {
+            break;
+        }
+        let rec = &dir[i..i + len];
+        let name = dir_record_name(rec);
+        let is_dir = (rec.get(25).copied().unwrap_or(0) & 0x02) != 0;
+        // Skip "." (0x00) and ".." (0x01) pseudo-entries.
+        let is_pseudo =
+            rec.get(32).copied() == Some(1) && matches!(rec.get(33).copied(), Some(0x00 | 0x01));
+        if !is_pseudo && name.eq_ignore_ascii_case(target) {
+            let (lba, dlen) = parse_dir_record_ext(rec)?;
+            return Some(DirHit {
+                lba,
+                len: dlen,
+                is_dir,
+            });
+        }
+        i += len;
+    }
+    None
+}
+
+/// Extract (extent LBA, data length in bytes) from a directory record.
+/// Layout per ISO9660: bytes 2..10 extent LBA (LE+BE duplicate), 10..18
+/// data length (LE+BE duplicate). We trust the little-endian copy.
+fn parse_dir_record_ext(rec: &[u8]) -> Option<(u64, u64)> {
+    if rec.len() < 34 {
+        return None;
+    }
+    let lba = u64::from(u32::from_le_bytes(rec[2..6].try_into().ok()?));
+    let len = u64::from(u32::from_le_bytes(rec[10..14].try_into().ok()?));
+    Some((lba, len))
+}
+
+/// Extract the identifier from a directory record, normalizing ISO9660
+/// quirks: the `;N` version suffix and the trailing dot that strict
+/// mastering appends to extension-less names (`VMLINUZ.;1`). Without the
+/// dot strip, level-1 images' kernels never matched `/casper/vmlinuz`.
+fn dir_record_name(rec: &[u8]) -> String {
+    let name_len = *rec.get(32).unwrap_or(&0) as usize;
+    if name_len == 0 || rec.len() < 33 + name_len {
+        return String::new();
+    }
+    let raw = &rec[33..33 + name_len];
+    let s = String::from_utf8_lossy(raw);
+    let s = s.rfind(';').map_or_else(|| s.as_ref(), |i| &s[..i]);
+    s.strip_suffix('.').unwrap_or(s).to_string()
+}
+
+// ── test support ─────────────────────────────────────────────────────
+//
+// A tiny ISO9660 image builder used by this module's tests, the
+// introspection tests, and (behind the `test-image` feature) other
+// crates' integration tests. Lays out: PVD @ LBA 16, optional El Torito
+// boot record @ 17, set terminator @ 18, directories from LBA 20, file
+// data after. Only what `lookup`/introspection read is populated.
+
+#[cfg(any(test, feature = "test-image"))]
+#[doc(hidden)]
+pub mod testiso {
+    use super::SECTOR;
+    use std::collections::BTreeMap;
+
+    #[derive(Default)]
+    struct Node {
+        children: BTreeMap<String, Node>,
+        content: Option<Vec<u8>>,
+    }
+
+    pub struct TestIsoBuilder {
+        root: Node,
+        volume_label: String,
+        el_torito: bool,
+    }
+
+    impl TestIsoBuilder {
+        pub fn new(volume_label: &str) -> Self {
+            Self {
+                root: Node::default(),
+                volume_label: volume_label.to_string(),
+                el_torito: false,
+            }
+        }
+
+        #[must_use]
+        pub fn el_torito(mut self, on: bool) -> Self {
+            self.el_torito = on;
+            self
+        }
+
+        /// Add a file at `path` (e.g. "/casper/vmlinuz") with `content`.
+        #[must_use]
+        pub fn file(mut self, path: &str, content: &[u8]) -> Self {
+            let mut node = &mut self.root;
+            let comps: Vec<&str> = path
+                .trim_start_matches('/')
+                .split('/')
+                .filter(|c| !c.is_empty())
+                .collect();
+            for (i, c) in comps.iter().enumerate() {
+                node = node.children.entry((*c).to_string()).or_default();
+                if i + 1 == comps.len() {
+                    node.content = Some(content.to_vec());
+                }
+            }
+            self
+        }
+
+        pub fn build(self) -> Vec<u8> {
+            // Pass 1: allocate extents. Directories first (1 sector each),
+            // then file contents.
+            let mut next_lba: u64 = 20;
+            let mut dirs: Vec<(*const Node, u64)> = Vec::new();
+            fn alloc_dirs(n: &Node, next: &mut u64, out: &mut Vec<(*const Node, u64)>) {
+                out.push((std::ptr::from_ref(n), *next));
+                *next += 1;
+                for child in n.children.values() {
+                    if child.content.is_none() {
+                        alloc_dirs(child, next, out);
+                    }
+                }
+            }
+            alloc_dirs(&self.root, &mut next_lba, &mut dirs);
+            let lba_of = |n: &Node| -> u64 {
+                dirs.iter()
+                    .find(|(p, _)| std::ptr::eq(*p, n))
+                    .map(|(_, l)| *l)
+                    .expect("dir allocated")
+            };
+            let mut file_lbas: Vec<(*const Node, u64, usize)> = Vec::new();
+            fn alloc_files(n: &Node, next: &mut u64, out: &mut Vec<(*const Node, u64, usize)>) {
+                for child in n.children.values() {
+                    if let Some(c) = &child.content {
+                        out.push((std::ptr::from_ref(child), *next, c.len()));
+                        *next += c.len().div_ceil(SECTOR as usize).max(1) as u64;
+                    } else {
+                        alloc_files(child, next, out);
+                    }
+                }
+            }
+            alloc_files(&self.root, &mut next_lba, &mut file_lbas);
+            let file_lba_of = |n: &Node| -> u64 {
+                file_lbas
+                    .iter()
+                    .find(|(p, _, _)| std::ptr::eq(*p, n))
+                    .map(|(_, l, _)| *l)
+                    .expect("file allocated")
+            };
+
+            let total = next_lba as usize * SECTOR as usize;
+            let mut img = vec![0u8; total];
+
+            // Directory record encoder.
+            fn record(name_bytes: &[u8], lba: u64, len: u64, is_dir: bool) -> Vec<u8> {
+                let mut rec_len = 33 + name_bytes.len();
+                if rec_len % 2 == 1 {
+                    rec_len += 1; // pad to even
+                }
+                let rec_len = rec_len.max(34);
+                let mut r = vec![0u8; rec_len];
+                r[0] = rec_len as u8;
+                r[2..6].copy_from_slice(&(lba as u32).to_le_bytes());
+                r[6..10].copy_from_slice(&(lba as u32).to_be_bytes());
+                r[10..14].copy_from_slice(&(len as u32).to_le_bytes());
+                r[14..18].copy_from_slice(&(len as u32).to_be_bytes());
+                if is_dir {
+                    r[25] = 0x02;
+                }
+                r[32] = name_bytes.len() as u8;
+                r[33..33 + name_bytes.len()].copy_from_slice(name_bytes);
+                r
+            }
+
+            // Pass 2: write each directory extent.
+            fn write_dir(
+                img: &mut [u8],
+                n: &Node,
+                self_lba: u64,
+                parent_lba: u64,
+                lba_of: &dyn Fn(&Node) -> u64,
+                file_lba_of: &dyn Fn(&Node) -> u64,
+            ) {
+                let base = self_lba as usize * SECTOR as usize;
+                let mut off = 0usize;
+                let mut put = |rec: Vec<u8>, off: &mut usize| {
+                    img[base + *off..base + *off + rec.len()].copy_from_slice(&rec);
+                    *off += rec.len();
+                };
+                put(record(&[0x00], self_lba, SECTOR, true), &mut off);
+                put(record(&[0x01], parent_lba, SECTOR, true), &mut off);
+                for (name, child) in &n.children {
+                    if let Some(c) = &child.content {
+                        // Files get the ISO9660 uppercase `;1` treatment so
+                        // the case-insensitive + version-strip matching is
+                        // what the tests actually exercise.
+                        let stored = format!("{};1", name.to_ascii_uppercase());
+                        put(
+                            record(stored.as_bytes(), file_lba_of(child), c.len() as u64, false),
+                            &mut off,
+                        );
+                    } else {
+                        let stored = name.to_ascii_uppercase();
+                        put(
+                            record(stored.as_bytes(), lba_of(child), SECTOR, true),
+                            &mut off,
+                        );
+                    }
+                }
+                for (name, child) in &n.children {
+                    if child.content.is_none() {
+                        write_dir(img, child, lba_of(child), self_lba, lba_of, file_lba_of);
+                    } else if let Some(c) = &child.content {
+                        let b = file_lba_of(child) as usize * SECTOR as usize;
+                        img[b..b + c.len()].copy_from_slice(c);
+                    }
+                    let _ = name;
+                }
+            }
+            let root_lba = lba_of(&self.root);
+            write_dir(
+                &mut img,
+                &self.root,
+                root_lba,
+                root_lba,
+                &lba_of,
+                &file_lba_of,
+            );
+
+            // PVD @ 16.
+            let pvd = 16 * SECTOR as usize;
+            img[pvd] = 0x01;
+            img[pvd + 1..pvd + 6].copy_from_slice(b"CD001");
+            let label = self.volume_label.as_bytes();
+            let label_field = &mut img[pvd + 40..pvd + 72];
+            label_field.fill(b' ');
+            label_field[..label.len().min(32)].copy_from_slice(&label[..label.len().min(32)]);
+            let root_rec = record(&[0x00], root_lba, SECTOR, true);
+            img[pvd + 156..pvd + 156 + 34].copy_from_slice(&root_rec[..34]);
+
+            // Optional El Torito boot record @ 17, terminator after.
+            let mut vd = 17 * SECTOR as usize;
+            if self.el_torito {
+                img[vd] = 0x00;
+                img[vd + 1..vd + 6].copy_from_slice(b"CD001");
+                let id = b"EL TORITO SPECIFICATION";
+                img[vd + 7..vd + 7 + id.len()].copy_from_slice(id);
+                vd += SECTOR as usize;
+            }
+            img[vd] = 0xFF;
+            img[vd + 1..vd + 6].copy_from_slice(b"CD001");
+
+            img
+        }
+    }
+
+    /// In-memory `IsoReadAt` over a built test image.
+    pub struct MemReadAt(pub Vec<u8>);
+
+    impl super::IsoReadAt for MemReadAt {
+        async fn read_at(&mut self, offset: u64, len: u32) -> std::io::Result<Vec<u8>> {
+            let start = usize::try_from(offset).unwrap_or(usize::MAX);
+            let end = start.saturating_add(len as usize);
+            if end > self.0.len() {
+                return Err(std::io::Error::new(
+                    std::io::ErrorKind::UnexpectedEof,
+                    "read past end of test image",
+                ));
+            }
+            Ok(self.0[start..end].to_vec())
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::testiso::{MemReadAt, TestIsoBuilder};
+    use super::*;
+
+    fn block_on<T>(f: impl Future<Output = T>) -> T {
+        futures::executor::block_on(f)
+    }
+
+    #[test]
+    fn lookup_finds_nested_file_case_insensitively() {
+        let img = TestIsoBuilder::new("UBUNTU 24.04")
+            .file("/casper/vmlinuz", b"KERNELDATA")
+            .file("/casper/initrd", b"INITRDDATA")
+            .build();
+        let mut r = MemReadAt(img);
+        let loc = block_on(lookup(&mut r, "/CASPER/VMLINUZ")).expect("found");
+        assert_eq!(loc.length, 10);
+        let bytes = block_on(r.read_at(loc.offset, 10)).unwrap();
+        assert_eq!(&bytes, b"KERNELDATA");
+        // Missing file and missing dir both miss cleanly.
+        assert!(block_on(lookup(&mut r, "/casper/missing")).is_none());
+        assert!(block_on(lookup(&mut r, "/nodir/vmlinuz")).is_none());
+        // A directory path that resolves to a directory is not a file hit.
+        assert!(block_on(lookup(&mut r, "/casper")).is_none());
+    }
+
+    #[test]
+    fn strict_mastered_extensionless_names_match() {
+        // Strict level-1 mastering stores "VMLINUZ" as "VMLINUZ.;1" — the
+        // trailing dot must be normalized away or kernels never match.
+        let img = TestIsoBuilder::new("STRICT")
+            .file("/boot/vmlinuz.", b"K") // builder stores "VMLINUZ.;1"
+            .build();
+        let mut r = MemReadAt(img);
+        assert!(
+            block_on(lookup(&mut r, "/boot/vmlinuz")).is_some(),
+            "trailing-dot ISO9660 name must match the dotless path"
+        );
+    }
+
+    #[test]
+    fn lookup_three_levels_deep() {
+        let img = TestIsoBuilder::new("DEEP")
+            .file("/images/pxeboot/vmlinuz", b"ANACONDA")
+            .build();
+        let mut r = MemReadAt(img);
+        let loc = block_on(lookup(&mut r, "images/pxeboot/vmlinuz")).expect("no leading slash ok");
+        assert_eq!(loc.length, 8);
+    }
+
+    #[test]
+    fn caching_reader_dedupes_repeated_directory_reads() {
+        struct Counting<'a> {
+            inner: &'a mut MemReadAt,
+            calls: usize,
+        }
+        impl IsoReadAt for Counting<'_> {
+            async fn read_at(&mut self, offset: u64, len: u32) -> std::io::Result<Vec<u8>> {
+                self.calls += 1;
+                self.inner.read_at(offset, len).await
+            }
+        }
+        let img = TestIsoBuilder::new("CACHE")
+            .file("/a/one", b"1")
+            .file("/a/two", b"2")
+            .build();
+        let mut mem = MemReadAt(img);
+        let mut counting = Counting {
+            inner: &mut mem,
+            calls: 0,
+        };
+        let mut cr = CachingReadAt::new(&mut counting);
+        assert!(block_on(exists(&mut cr, "/a/one")));
+        assert!(block_on(exists(&mut cr, "/a/two")));
+        assert!(!block_on(exists(&mut cr, "/a/three")));
+        drop(cr);
+        // 3 probes × (PVD + root dir + subdir) = 9 uncached; the cache
+        // collapses the repeats to the 3 distinct extents.
+        assert_eq!(counting.calls, 3, "all repeat reads must hit the cache");
+    }
+
+    #[test]
+    fn lookup_local_reads_a_real_file() {
+        let dir = tempfile::tempdir().unwrap();
+        let p = dir.path().join("t.iso");
+        let img = TestIsoBuilder::new("LOCAL")
+            .file("/sources/boot.wim", b"WIMWIM")
+            .build();
+        std::fs::write(&p, &img).unwrap();
+        let loc = lookup_local(&p, "/sources/boot.wim").expect("found");
+        assert_eq!(loc.length, 6);
+        assert!(lookup_local(&p, "/sources/none").is_none());
+    }
+}

crates/iso-store/src/lib.rs

@@ -18,14 +18,49 @@
 
 pub mod entry;
 pub mod introspect;
-pub mod nfs;
+// v0.7.4: read-only ISO9660 walker generic over any random-access byte
+// source (local file, NFS READ3, SFTP seek-read). Powers both in-ISO
+// HTTP serving and the probe-based introspection.
+pub mod iso_fs;
+pub mod nfs_share;
+pub mod pxe_logo;
+// v0.7.4: persisted cache of remote-share introspection results so a
+// container restart doesn't re-probe an unchanged 40-ISO library.
+pub mod remote_cache;
+pub mod sftp_share;
 pub mod smb;
+pub mod smb_share;
 pub mod store;
+pub mod unattended;
 pub mod windows;
 
 pub use entry::{BootEntry, BootKind, KernelArgs};
 pub use introspect::{DistroFamily, IntrospectionReport};
-pub use nfs::{NfsAddRequest, NfsManager, NfsMount, NfsVersion};
+pub use iso_fs::FileLocation;
+// v0.4.65: kernel-mount NFS is gone. SMB shares via Samba's userspace
+// `smbclient` CLI replaced it — works in any container (no
+// CAP_SYS_ADMIN, no host kernel modules), matching how Bootimus and
+// every other PXE/imaging tool that supports network storage handles
+// it.
 pub use smb::{extract_windows_iso, SmbManager, SmbState};
-pub use store::{generate_boot_entries_for, slugify_str, IsoMeta, IsoSource, IsoStore, UploadHandle};
+pub use smb_share::{SmbAddRequest, SmbShare, SmbShareError, SmbShareManager, SmbStream};
+// v0.4.67: NFS is back — this time as an in-process userspace NFSv3
+// client (the `nfs3_client` crate) rather than a kernel mount. Same
+// "works in any container" property as SMB, plus support for HTTP
+// Range requests because NFSv3 READ3 takes an explicit offset.
+pub use nfs_share::{NfsAddRequest, NfsShare, NfsShareError, NfsShareManager, NfsStream};
+// v0.5.5: SFTP-over-SSH remote shares via the pure-Rust `russh` +
+// `russh-sftp` crates (ring backend — no OpenSSL, no new C deps). Like
+// NFS, supports HTTP Range requests because SFTP opens a seekable file
+// handle. See crates/iso-store/src/sftp_share.rs.
+pub use sftp_share::{
+    SftpAddRequest, SftpAuthKind, SftpShare, SftpShareError, SftpShareManager, SftpStream,
+};
+pub use store::{
+    generate_boot_entries_for, slugify_str, IsoCategory, IsoMeta, IsoSource, IsoStore, UploadHandle,
+};
+pub use unattended::{
+    classify as classify_unattended, render_template, UnattendedKind, UnattendedMeta,
+    UnattendedStore, MAX_UNATTENDED_BYTES,
+};
 pub use windows::{WimPatcher, WinPatchState};

crates/iso-store/src/nfs.rs

@@ -1,564 +0,0 @@
-//! NFS share manager.
-//!
-//! Lets an operator mount a remote NFS export as an ISO source instead of
-//! uploading every ISO into the container's PVC. Supports NFSv3 and
-//! NFSv4.1 — the two versions the user explicitly asked for.
-//!
-//! ## How it works
-//!
-//! 1. Operator submits a mount spec via the Storage tab:
-//!    `{ server: "10.0.0.20", export: "/srv/isos", version: "v41" }`.
-//! 2. We slugify a stable id, mkdir `<work_dir>/nfs/<id>/`, then shell out
-//!    to `/bin/mount -t nfs -o vers=...,ro,nolock server:export local`.
-//! 3. On success we walk the mount point looking for `*.iso` files and
-//!    register each one with the `IsoStore` as an external source — same
-//!    introspection pipeline as a web upload, but no sha256 (the bytes
-//!    live on a remote machine; hashing them would suck them through the
-//!    network on every restart).
-//! 4. On failure we record `last_error` on the spec and persist anyway
-//!    so the UI can show a row in red rather than silently dropping it.
-//!
-//! ## Operational notes
-//!
-//! - Mounting NFS inside a container needs `CAP_SYS_ADMIN` and the
-//!   `nfs-common` package. The default image ships these (see Dockerfile).
-//! - On OpenShift, the SCC must allow `CAP_SYS_ADMIN`. The bundled SCC
-//!   doesn't — operators have to opt in by switching to a more privileged
-//!   SCC or running NFS mounts as a CSI driver outside the pod.
-//! - Mount commands are issued sequentially under a single mutex to avoid
-//!   `mount` racing on the same target dir.
-//!
-//! ## Persistence
-//!
-//! Mount specs (without runtime state) live at `<work_dir>/nfs.json`,
-//! re-mounted on startup. Mounts that fail to come back online keep their
-//! spec and their `last_error` so the operator sees what happened.
-
-use crate::introspect::{introspect, IntrospectionReport};
-use crate::store::{generate_boot_entries_for, slugify_str, IsoSource, IsoStore};
-use parking_lot::Mutex;
-use openpxe_core::{Error, Result};
-use serde::{Deserialize, Serialize};
-use std::collections::HashMap;
-use std::path::{Path, PathBuf};
-use std::sync::Arc;
-use time::OffsetDateTime;
-use tokio::process::Command;
-
-/// Wire-protocol versions we support. Keep this enum closed — silently
-/// accepting "auto" or letting the kernel negotiate would mean operators
-/// could never confirm which version is in use.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "lowercase")]
-pub enum NfsVersion {
-    /// NFSv3 — UDP/TCP, separate `mountd` protocol. Required for many
-    /// older NAS appliances.
-    V3,
-    /// NFSv4.1 — single TCP port (2049), session-based. Modern default.
-    V41,
-}
-
-impl NfsVersion {
-    fn vers_arg(self) -> &'static str {
-        match self {
-            Self::V3 => "vers=3",
-            Self::V41 => "vers=4.1",
-        }
-    }
-}
-
-/// One configured mount. The id is generated from server+export so the
-/// operator can re-add the same export idempotently.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct NfsMount {
-    pub id: String,
-    pub server: String,
-    pub export: String,
-    pub version: NfsVersion,
-    /// Read-only by default — most ISO libraries are. Operators that need
-    /// write can flip this off but OpenPXE itself never writes.
-    pub read_only: bool,
-    /// Local mount point under `<work_dir>/nfs/`.
-    pub local_path: PathBuf,
-    /// Whether the mount is currently active.
-    pub mounted: bool,
-    /// Last error encountered on a `mount` or `umount` attempt; cleared on
-    /// success.
-    pub last_error: Option<String>,
-    #[serde(with = "time::serde::rfc3339::option")]
-    pub last_attempt: Option<OffsetDateTime>,
-    /// Number of `.iso` files found on the share (re-counted on each scan).
-    pub iso_count: u32,
-}
-
-/// Spec submitted by the UI. Server and export are normalized before use.
-#[derive(Debug, Clone, Deserialize)]
-pub struct NfsAddRequest {
-    pub server: String,
-    pub export: String,
-    #[serde(default = "default_version")]
-    pub version: NfsVersion,
-    #[serde(default = "default_ro")]
-    pub read_only: bool,
-}
-
-fn default_version() -> NfsVersion {
-    NfsVersion::V41
-}
-fn default_ro() -> bool {
-    true
-}
-
-#[derive(Debug, Default)]
-struct Inner {
-    mounts: HashMap<String, NfsMount>,
-}
-
-/// Manages NFS mounts and surfaces them as ISO sources.
-///
-/// Cheap to clone — internal state is `Arc<Mutex<...>>`.
-#[derive(Debug, Clone)]
-pub struct NfsManager {
-    work_root: Arc<PathBuf>,
-    state_path: Arc<PathBuf>,
-    inner: Arc<Mutex<Inner>>,
-    iso_store: IsoStore,
-    /// Single-writer lock around the actual `mount`/`umount` shell-outs;
-    /// avoids racing on the same target directory.
-    mount_lock: Arc<tokio::sync::Mutex<()>>,
-}
-
-impl NfsManager {
-    /// Construct a manager rooted at `work_dir`. Mount points live under
-    /// `<work_dir>/nfs/<id>/`. State persists to `<work_dir>/nfs.json`.
-    #[must_use]
-    pub fn new(work_dir: &Path, iso_store: IsoStore) -> Self {
-        let work_root = work_dir.join("nfs");
-        let state_path = work_dir.join("nfs.json");
-        Self {
-            work_root: Arc::new(work_root),
-            state_path: Arc::new(state_path),
-            inner: Arc::new(Mutex::new(Inner::default())),
-            iso_store,
-            mount_lock: Arc::new(tokio::sync::Mutex::new(())),
-        }
-    }
-
-    /// Where this manager mounts shares. Used by `IsoStore` to resolve
-    /// NFS-backed `IsoMeta`s to their on-disk path.
-    #[must_use]
-    pub fn mount_root(&self) -> PathBuf {
-        self.work_root.as_ref().clone()
-    }
-
-    /// Load persisted state and re-attempt every mount. Errors are logged
-    /// per-mount but never fail the call — startup must not block on a
-    /// remote NFS server being slow.
-    pub async fn load_and_remount(&self) -> Result<()> {
-        tokio::fs::create_dir_all(self.work_root.as_path()).await?;
-        let mounts = match tokio::fs::read_to_string(self.state_path.as_path()).await {
-            Ok(text) => serde_json::from_str::<Vec<NfsMount>>(&text).unwrap_or_default(),
-            Err(_) => Vec::new(),
-        };
-        for mut m in mounts {
-            // Always start from "not mounted" — the kernel state was lost
-            // when the process died. We'll try to remount each one.
-            m.mounted = false;
-            m.last_error = None;
-            self.inner.lock().mounts.insert(m.id.clone(), m.clone());
-            if let Err(e) = self.try_mount(&m.id).await {
-                tracing::warn!(
-                    target: "openpxe::nfs",
-                    id = %m.id, error = %e,
-                    "could not remount NFS share on startup"
-                );
-            }
-        }
-        Ok(())
-    }
-
-    /// Add a new mount. Returns the resulting `NfsMount` (with `mounted`
-    /// reflecting reality) or an error if the spec was invalid.
-    pub async fn add(&self, req: NfsAddRequest) -> Result<NfsMount> {
-        let server = req.server.trim().to_string();
-        let export = req.export.trim().to_string();
-        if server.is_empty() {
-            return Err(Error::Invalid("server is required".into()));
-        }
-        if !export.starts_with('/') {
-            return Err(Error::Invalid("export path must start with '/'".into()));
-        }
-
-        let id = mount_id(&server, &export);
-        let local_path = self.work_root.join(&id);
-        tokio::fs::create_dir_all(&local_path).await?;
-
-        let mount = NfsMount {
-            id: id.clone(),
-            server,
-            export,
-            version: req.version,
-            read_only: req.read_only,
-            local_path,
-            mounted: false,
-            last_error: None,
-            last_attempt: None,
-            iso_count: 0,
-        };
-        self.inner.lock().mounts.insert(id.clone(), mount);
-        self.persist_locked();
-        self.try_mount(&id).await?;
-        Ok(self.get(&id).expect("mount just inserted"))
-    }
-
-    /// Unmount and forget a share. Removes any ISOs it contributed from
-    /// the IsoStore and deletes the local mount point. Idempotent.
-    pub async fn remove(&self, id: &str) -> Result<()> {
-        // Best-effort umount; even if it fails (e.g. server unreachable)
-        // we still want to drop the in-memory record.
-        let _ = self.umount_one(id).await;
-        let local_path = {
-            let mut g = self.inner.lock();
-            g.mounts.remove(id).map(|m| m.local_path)
-        };
-        self.persist_locked();
-        self.iso_store.drop_external_source(id);
-        if let Some(p) = local_path {
-            // rmdir only — never recurse, the mount could still be live
-            // on some kernel error path and we don't want to nuke a
-            // remote filesystem.
-            let _ = tokio::fs::remove_dir(&p).await;
-        }
-        Ok(())
-    }
-
-    /// Re-scan a mounted share for ISOs, refreshing the IsoStore.
-    pub async fn rescan(&self, id: &str) -> Result<u32> {
-        let mount = self
-            .get(id)
-            .ok_or_else(|| Error::Invalid(format!("no such mount '{id}'")))?;
-        if !mount.mounted {
-            return Err(Error::Invalid(format!("mount '{id}' is not active")));
-        }
-        let count = self.scan_and_register(&mount).await?;
-        if let Some(m) = self.inner.lock().mounts.get_mut(id) {
-            m.iso_count = count;
-        }
-        self.persist_locked();
-        Ok(count)
-    }
-
-    /// Snapshot of every configured mount.
-    #[must_use]
-    pub fn list(&self) -> Vec<NfsMount> {
-        let g = self.inner.lock();
-        let mut v: Vec<_> = g.mounts.values().cloned().collect();
-        v.sort_by(|a, b| a.id.cmp(&b.id));
-        v
-    }
-
-    /// Look up a single mount by id.
-    #[must_use]
-    pub fn get(&self, id: &str) -> Option<NfsMount> {
-        self.inner.lock().mounts.get(id).cloned()
-    }
-
-    // ── internals ─────────────────────────────────────────────────────
-
-    async fn try_mount(&self, id: &str) -> Result<()> {
-        let _g = self.mount_lock.lock().await;
-
-        let m = self
-            .get(id)
-            .ok_or_else(|| Error::Invalid(format!("no such mount '{id}'")))?;
-        let now = OffsetDateTime::now_utc();
-
-        // Already mounted? Skip — `mount` would error on a busy target
-        // and confuse the operator's UI status.
-        if is_mountpoint(&m.local_path).await {
-            self.update_status(id, true, None, now);
-            // Even though already mounted, we still want a fresh ISO count.
-            let count = self.scan_and_register(&m).await.unwrap_or(0);
-            self.update_iso_count(id, count);
-            return Ok(());
-        }
-
-        let opts = mount_options(&m);
-        let target = format!("{}:{}", m.server, m.export);
-
-        let output = Command::new("mount")
-            .arg("-t")
-            .arg("nfs")
-            .arg("-o")
-            .arg(&opts)
-            .arg(&target)
-            .arg(&m.local_path)
-            .output()
-            .await;
-
-        match output {
-            Ok(out) if out.status.success() => {
-                tracing::info!(
-                    target: "openpxe::nfs",
-                    id = %id, server = %m.server, export = %m.export,
-                    version = ?m.version,
-                    "NFS mount succeeded"
-                );
-                self.update_status(id, true, None, now);
-                let count = self.scan_and_register(&m).await.unwrap_or(0);
-                self.update_iso_count(id, count);
-                Ok(())
-            }
-            Ok(out) => {
-                let err = format!(
-                    "mount exit {}: {}",
-                    out.status.code().unwrap_or(-1),
-                    String::from_utf8_lossy(&out.stderr).trim()
-                );
-                tracing::warn!(target: "openpxe::nfs", id = %id, "{err}");
-                self.update_status(id, false, Some(err.clone()), now);
-                Err(Error::Invalid(err))
-            }
-            Err(e) => {
-                let err = format!("could not exec /bin/mount: {e}");
-                tracing::error!(target: "openpxe::nfs", id = %id, "{err}");
-                self.update_status(id, false, Some(err.clone()), now);
-                Err(Error::Invalid(err))
-            }
-        }
-    }
-
-    async fn umount_one(&self, id: &str) -> Result<()> {
-        let _g = self.mount_lock.lock().await;
-        let Some(m) = self.get(id) else { return Ok(()) };
-        if !is_mountpoint(&m.local_path).await {
-            self.update_status(id, false, None, OffsetDateTime::now_utc());
-            return Ok(());
-        }
-        // -l = lazy: detach immediately, finish when no process has a
-        // handle. Important if a stale ISO read is still in flight.
-        let out = Command::new("umount")
-            .arg("-l")
-            .arg(&m.local_path)
-            .output()
-            .await;
-        match out {
-            Ok(o) if o.status.success() => {
-                self.update_status(id, false, None, OffsetDateTime::now_utc());
-                Ok(())
-            }
-            Ok(o) => {
-                let e = format!(
-                    "umount exit {}: {}",
-                    o.status.code().unwrap_or(-1),
-                    String::from_utf8_lossy(&o.stderr).trim()
-                );
-                self.update_status(id, false, Some(e.clone()), OffsetDateTime::now_utc());
-                Err(Error::Invalid(e))
-            }
-            Err(e) => {
-                let e = format!("could not exec /bin/umount: {e}");
-                self.update_status(id, false, Some(e.clone()), OffsetDateTime::now_utc());
-                Err(Error::Invalid(e))
-            }
-        }
-    }
-
-    /// Walk the mount point for `*.iso` files, introspect each one, and
-    /// register it with the IsoStore as an NFS-sourced entry. Returns the
-    /// count of ISOs registered.
-    async fn scan_and_register(&self, m: &NfsMount) -> Result<u32> {
-        // Drop any prior entries from this mount before re-registering, so
-        // a removed file disappears from the store.
-        self.iso_store.drop_external_source(&m.id);
-
-        let mut walker = tokio::fs::read_dir(&m.local_path).await?;
-        let mut count = 0u32;
-        while let Some(entry) = walker.next_entry().await? {
-            let p = entry.path();
-            if p.extension()
-                .and_then(|e| e.to_str())
-                .map(str::to_ascii_lowercase)
-                .as_deref()
-                != Some("iso")
-            {
-                continue;
-            }
-            let filename = match p.file_name().and_then(|s| s.to_str()) {
-                Some(f) => f.to_string(),
-                None => continue,
-            };
-            let size = tokio::fs::metadata(&p).await?.len();
-            // Introspection is sync + IO-bound (reads ISO9660 PVD). Push
-            // it to a blocking thread so the runtime stays responsive on
-            // a slow share.
-            let p_owned = p.clone();
-            let report: IntrospectionReport =
-                tokio::task::spawn_blocking(move || introspect(&p_owned))
-                    .await
-                    .map_err(|e| Error::Other(e.into()))?;
-            let id = format!("nfs-{}-{}", m.id, slugify_str(&filename));
-            let boot_entries = generate_boot_entries_for(&id, &filename, &report);
-            let source = IsoSource::Nfs {
-                mount_id: m.id.clone(),
-                relative_path: filename.clone(),
-            };
-            self.iso_store.register_external(
-                id,
-                filename,
-                size,
-                report,
-                boot_entries,
-                source,
-            );
-            count += 1;
-        }
-        Ok(count)
-    }
-
-    fn update_status(&self, id: &str, mounted: bool, err: Option<String>, ts: OffsetDateTime) {
-        if let Some(m) = self.inner.lock().mounts.get_mut(id) {
-            m.mounted = mounted;
-            m.last_error = err;
-            m.last_attempt = Some(ts);
-        }
-        self.persist_locked();
-    }
-
-    fn update_iso_count(&self, id: &str, count: u32) {
-        if let Some(m) = self.inner.lock().mounts.get_mut(id) {
-            m.iso_count = count;
-        }
-        self.persist_locked();
-    }
-
-    /// Atomically replace the on-disk JSON with the current state.
-    /// Persistence errors are logged, never propagated — settings live in
-    /// memory authoritatively, matching the SettingsStore policy.
-    fn persist_locked(&self) {
-        let mounts: Vec<NfsMount> = self.inner.lock().mounts.values().cloned().collect();
-        let path = self.state_path.as_path();
-        let tmp = path.with_extension("json.tmp");
-        let body = match serde_json::to_vec_pretty(&mounts) {
-            Ok(b) => b,
-            Err(e) => {
-                tracing::warn!(target: "openpxe::nfs", "serialize NFS state: {e}");
-                return;
-            }
-        };
-        if let Some(parent) = path.parent() {
-            let _ = std::fs::create_dir_all(parent);
-        }
-        if let Err(e) = std::fs::write(&tmp, body) {
-            tracing::warn!(target: "openpxe::nfs", "write NFS state tmp: {e}");
-            return;
-        }
-        if let Err(e) = std::fs::rename(&tmp, path) {
-            tracing::warn!(target: "openpxe::nfs", "rename NFS state: {e}");
-        }
-    }
-}
-
-fn mount_options(m: &NfsMount) -> String {
-    let mut opts = vec![m.version.vers_arg().to_string()];
-    if m.read_only {
-        opts.push("ro".into());
-    } else {
-        opts.push("rw".into());
-    }
-    // `nolock` for v3 — many storage appliances disable lockd; we don't
-    // need locking for read-only ISO access anyway.
-    if matches!(m.version, NfsVersion::V3) {
-        opts.push("nolock".into());
-    }
-    // Soft mount with a generous timeout — better to surface a hung share
-    // as a user-visible error than to wedge the iPXE client forever on a
-    // dead NFS server.
-    opts.push("soft".into());
-    opts.push("timeo=100".into());
-    opts.push("retrans=3".into());
-    opts.join(",")
-}
-
-fn mount_id(server: &str, export: &str) -> String {
-    let raw = format!("{server}{export}");
-    slugify_str(&raw)
-}
-
-/// Detect whether `path` is currently a mount point. We don't have
-/// `is_mountpoint(2)`, so compare the parent's device id to the dir's;
-/// if they differ the dir is a mount.
-async fn is_mountpoint(path: &Path) -> bool {
-    let Some(parent) = path.parent() else {
-        return false;
-    };
-    let Ok(m1) = tokio::fs::metadata(path).await else {
-        return false;
-    };
-    let Ok(m2) = tokio::fs::metadata(parent).await else {
-        return false;
-    };
-    use std::os::unix::fs::MetadataExt;
-    m1.dev() != m2.dev()
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn version_arg() {
-        assert_eq!(NfsVersion::V3.vers_arg(), "vers=3");
-        assert_eq!(NfsVersion::V41.vers_arg(), "vers=4.1");
-    }
-
-    #[test]
-    fn mount_options_v3_includes_nolock() {
-        let m = NfsMount {
-            id: "x".into(),
-            server: "s".into(),
-            export: "/e".into(),
-            version: NfsVersion::V3,
-            read_only: true,
-            local_path: PathBuf::from("/tmp/x"),
-            mounted: false,
-            last_error: None,
-            last_attempt: None,
-            iso_count: 0,
-        };
-        let opts = mount_options(&m);
-        assert!(opts.contains("vers=3"));
-        assert!(opts.contains("ro"));
-        assert!(opts.contains("nolock"));
-        assert!(opts.contains("soft"));
-    }
-
-    #[test]
-    fn mount_options_v41_no_nolock() {
-        let m = NfsMount {
-            id: "x".into(),
-            server: "s".into(),
-            export: "/e".into(),
-            version: NfsVersion::V41,
-            read_only: false,
-            local_path: PathBuf::from("/tmp/x"),
-            mounted: false,
-            last_error: None,
-            last_attempt: None,
-            iso_count: 0,
-        };
-        let opts = mount_options(&m);
-        assert!(opts.contains("vers=4.1"));
-        assert!(opts.contains("rw"));
-        assert!(!opts.contains("nolock"));
-    }
-
-    #[test]
-    fn mount_id_is_stable_and_safe() {
-        let a = mount_id("10.0.0.5", "/srv/isos");
-        let b = mount_id("10.0.0.5", "/srv/isos");
-        assert_eq!(a, b);
-        assert!(!a.contains('/'));
-        assert!(!a.contains('.'));
-    }
-}

crates/iso-store/src/pxe_logo.rs

@@ -0,0 +1,264 @@
+//! PXE boot-menu background compositor.
+//!
+//! The brief (v0.4.69): match iVentoy's polished graphical PXE screen.
+//! iPXE built with `CONSOLE_FRAMEBUFFER` + `IMAGE_PNG` paints a PNG to
+//! the framebuffer via `console --picture`, then draws the text menu on
+//! top (the console's default background colour is rendered transparent
+//! so the picture shows through the menu's blank cells). So what we
+//! produce here is a **full-screen 1024×768 background**, not just a
+//! floating logo:
+//!
+//!   - a solid dark field (matches the WebUI dark theme so the product
+//!     feels consistent from browser to bare metal), with
+//!   - the operator's uploaded logo composited across the top, leaving
+//!     the lower ~two-thirds clear for the iPXE menu text.
+//!
+//! When no custom logo is uploaded we still return a designed
+//! background — a dark field with a centered "rainbow-horizon" disc
+//! echoing the bundled OpenPXE mark — so the boot screen is graphical
+//! out of the box. This replaces the old ASCII wordmark entirely.
+//!
+//! iPXE does **not** scale pictures (confirmed against the decoder
+//! source): the image is painted at native pixel size and the firmware
+//! picks the smallest video mode that fits. 1024×768 is the universal
+//! safe mode, so we pin the canvas there. Operators uploading a 4K logo
+//! get it downscaled to fit the top band; tiny icons paint at native
+//! size, centered.
+//!
+//! Input formats: anything the `image` crate decodes with our enabled
+//! features — PNG, JPEG, WebP, GIF. iPXE itself only consumes PNG, so
+//! we always *emit* PNG regardless of what the operator uploaded; a
+//! WebP logo is transcoded here transparently.
+
+use image::imageops::FilterType;
+use image::{DynamicImage, ImageError, ImageFormat, Rgba, RgbaImage};
+use std::io::Cursor;
+
+/// Canvas dimensions. Pinned to 1024×768 — the universal framebuffer
+/// mode every BIOS/UEFI console supports, and iPXE doesn't scale.
+pub const CANVAS_W: u32 = 1024;
+pub const CANVAS_H: u32 = 768;
+
+/// Bounding box for the operator's logo across the top band. Wider than
+/// the old floating-logo box because the logo now anchors a full
+/// background rather than sitting alone on transparency.
+const LOGO_MAX_W: u32 = 760;
+const LOGO_MAX_H: u32 = 200;
+
+/// Top margin from the canvas top to the logo's top edge.
+const LOGO_TOP_MARGIN: u32 = 72;
+
+/// Background fill — a near-black with a faint blue cast, matching the
+/// WebUI's dark theme surface so the product reads as one piece from
+/// browser to PXE screen.
+const BG: Rgba<u8> = Rgba([11, 14, 22, 255]);
+
+/// Compose the operator's uploaded raster (`Some`) — or the default
+/// OpenPXE mark (`None`) — into a full-screen 1024×768 PNG background
+/// and return the encoded bytes.
+///
+/// Errors only when a provided `src_bytes` can't be decoded; the
+/// `None` path and the PNG encode are infallible for our fixed canvas.
+pub fn compose_pxe_background(src_bytes: Option<&[u8]>) -> Result<Vec<u8>, ImageError> {
+    let mut canvas: RgbaImage = RgbaImage::from_pixel(CANVAS_W, CANVAS_H, BG);
+
+    match src_bytes {
+        Some(bytes) => {
+            let logo = image::load_from_memory(bytes)?;
+            let logo = downscale_to_fit(logo, LOGO_MAX_W, LOGO_MAX_H);
+            let logo_rgba = logo.to_rgba8();
+            let off_x = CANVAS_W.saturating_sub(logo_rgba.width()) / 2;
+            let off_y = LOGO_TOP_MARGIN.min(CANVAS_H.saturating_sub(logo_rgba.height()));
+            // `overlay` alpha-composites, so a transparent-background
+            // logo blends onto the dark field exactly as designed.
+            image::imageops::overlay(&mut canvas, &logo_rgba, off_x.into(), off_y.into());
+        }
+        None => draw_default_mark(&mut canvas),
+    }
+
+    let mut out = Vec::with_capacity(128 * 1024);
+    DynamicImage::ImageRgba8(canvas).write_to(&mut Cursor::new(&mut out), ImageFormat::Png)?;
+    Ok(out)
+}
+
+/// Back-compat shim for the old name — callers that pass a raw logo and
+/// want it composited get the same result as `compose_pxe_background`
+/// with `Some`.
+pub fn compose_pxe_logo(src_bytes: &[u8]) -> Result<Vec<u8>, ImageError> {
+    compose_pxe_background(Some(src_bytes))
+}
+
+/// Paint a centered "rainbow-horizon" disc onto the dark canvas as the
+/// default brand mark when no operator logo is set. Pure pixel math —
+/// no font, no SVG rasterizer, no extra deps. A filled circle with a
+/// left-to-right hue sweep echoes the bundled `logo.svg` motif.
+// Casts here are all bounded small-range geometry (radius ≤ 90, canvas
+// ≤ 1024) — precision loss / wrap is structurally impossible.
+#[allow(clippy::cast_precision_loss, clippy::cast_possible_wrap)]
+fn draw_default_mark(canvas: &mut RgbaImage) {
+    let radius: i32 = 90;
+    let cx = (CANVAS_W / 2) as i32;
+    let cy = (LOGO_TOP_MARGIN + 100) as i32;
+    // Four-stop horizontal sweep across the disc (teal → blue → violet
+    // → magenta) — the OpenPXE palette.
+    let stops = [
+        [0x22u8, 0xd3, 0xaa],
+        [0x3b, 0x82, 0xf6],
+        [0x8b, 0x5c, 0xf6],
+        [0xec, 0x48, 0x99],
+    ];
+    let r2 = radius * radius;
+    for dy in -radius..=radius {
+        for dx in -radius..=radius {
+            if dx * dx + dy * dy > r2 {
+                continue;
+            }
+            // Position across the disc in [0,1] left→right.
+            let t = (f32::from(i16::try_from(dx + radius).unwrap_or(0)))
+                / (f32::from(i16::try_from(2 * radius).unwrap_or(1)));
+            let color = gradient_at(&stops, t);
+            // Soft edge: fade alpha in the outer 3px ring.
+            let dist = ((dx * dx + dy * dy) as f32).sqrt();
+            let alpha = if dist > (radius as f32 - 3.0) {
+                let edge = (radius as f32 - dist).clamp(0.0, 3.0) / 3.0;
+                (edge * 255.0) as u8
+            } else {
+                255
+            };
+            let px = cx + dx;
+            let py = cy + dy;
+            if px >= 0 && py >= 0 && (px as u32) < CANVAS_W && (py as u32) < CANVAS_H {
+                blend_pixel(canvas, px as u32, py as u32, color, alpha);
+            }
+        }
+    }
+}
+
+/// Linear interpolate across an N-stop palette at position `t` in [0,1].
+// `segments`/`idx` are ≤ palette length (4) — f32 cast is exact.
+#[allow(clippy::cast_precision_loss)]
+fn gradient_at(stops: &[[u8; 3]], t: f32) -> [u8; 3] {
+    let t = t.clamp(0.0, 1.0);
+    let segments = stops.len() - 1;
+    let scaled = t * segments as f32;
+    let idx = (scaled.floor() as usize).min(segments - 1);
+    let frac = scaled - idx as f32;
+    let a = stops[idx];
+    let b = stops[idx + 1];
+    [
+        lerp(a[0], b[0], frac),
+        lerp(a[1], b[1], frac),
+        lerp(a[2], b[2], frac),
+    ]
+}
+
+fn lerp(a: u8, b: u8, t: f32) -> u8 {
+    (f32::from(a) + (f32::from(b) - f32::from(a)) * t).round() as u8
+}
+
+/// Alpha-blend `color` at `alpha` over the existing canvas pixel.
+fn blend_pixel(canvas: &mut RgbaImage, x: u32, y: u32, color: [u8; 3], alpha: u8) {
+    let bg = canvas.get_pixel(x, y).0;
+    let a = f32::from(alpha) / 255.0;
+    let out = Rgba([
+        lerp(bg[0], color[0], a),
+        lerp(bg[1], color[1], a),
+        lerp(bg[2], color[2], a),
+        255,
+    ]);
+    canvas.put_pixel(x, y, out);
+}
+
+fn downscale_to_fit(img: DynamicImage, max_w: u32, max_h: u32) -> DynamicImage {
+    let (w, h) = (img.width(), img.height());
+    if w <= max_w && h <= max_h {
+        return img;
+    }
+    img.resize(max_w, max_h, FilterType::Lanczos3)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use image::{ImageBuffer, Rgb};
+
+    fn solid_png(w: u32, h: u32, rgb: [u8; 3]) -> Vec<u8> {
+        let img: ImageBuffer<Rgb<u8>, Vec<u8>> = ImageBuffer::from_pixel(w, h, Rgb(rgb));
+        let mut out = Vec::with_capacity(4096);
+        DynamicImage::ImageRgb8(img)
+            .write_to(&mut Cursor::new(&mut out), ImageFormat::Png)
+            .unwrap();
+        out
+    }
+
+    #[test]
+    fn custom_logo_emits_canvas_sized_png_with_dark_field() {
+        let src = solid_png(120, 60, [200, 50, 50]);
+        let out = compose_pxe_background(Some(&src)).unwrap();
+        let img = image::load_from_memory(&out).unwrap().to_rgba8();
+        assert_eq!(img.width(), CANVAS_W);
+        assert_eq!(img.height(), CANVAS_H);
+        // A far corner should be the opaque dark background fill, not
+        // transparent — this is a full background now, not a floating
+        // logo on transparency.
+        let corner = img.get_pixel(CANVAS_W - 1, CANVAS_H - 1);
+        assert_eq!(corner.0, BG.0, "corner should be the dark fill");
+    }
+
+    #[test]
+    fn custom_logo_painted_in_top_band() {
+        let src = solid_png(100, 40, [10, 200, 10]);
+        let out = compose_pxe_background(Some(&src)).unwrap();
+        let canvas = image::load_from_memory(&out).unwrap().to_rgba8();
+        let cx = (CANVAS_W - 100) / 2;
+        let cy = LOGO_TOP_MARGIN;
+        let inside = canvas.get_pixel(cx + 10, cy + 10);
+        assert!(
+            inside.0[1] > 100 && inside.0[0] < 100,
+            "logo pixel color mismatch: {inside:?}"
+        );
+    }
+
+    #[test]
+    fn default_background_is_dark_with_a_painted_mark() {
+        let out = compose_pxe_background(None).unwrap();
+        let canvas = image::load_from_memory(&out).unwrap().to_rgba8();
+        assert_eq!(canvas.width(), CANVAS_W);
+        assert_eq!(canvas.height(), CANVAS_H);
+        // Corner is dark fill.
+        assert_eq!(canvas.get_pixel(2, CANVAS_H - 2).0, BG.0);
+        // Center of the disc is not the background fill (something was
+        // painted there).
+        let center = canvas.get_pixel(CANVAS_W / 2, LOGO_TOP_MARGIN + 100);
+        assert_ne!(center.0, BG.0, "default mark should paint over the field");
+    }
+
+    #[test]
+    fn webp_or_jpeg_input_is_accepted_and_transcoded_to_png() {
+        // Encode a JPEG and confirm the compositor decodes it and emits
+        // a valid PNG (iPXE only eats PNG, so transcoding is the point).
+        let img: ImageBuffer<Rgb<u8>, Vec<u8>> = ImageBuffer::from_pixel(80, 80, Rgb([90, 90, 90]));
+        let mut jpeg = Vec::new();
+        DynamicImage::ImageRgb8(img)
+            .write_to(&mut Cursor::new(&mut jpeg), ImageFormat::Jpeg)
+            .unwrap();
+        let out = compose_pxe_background(Some(&jpeg)).unwrap();
+        // Output must be a PNG (magic bytes) of canvas size.
+        assert_eq!(&out[..8], b"\x89PNG\r\n\x1a\n");
+        let img = image::load_from_memory(&out).unwrap();
+        assert_eq!(img.width(), CANVAS_W);
+    }
+
+    #[test]
+    fn unsupported_bytes_returns_error_not_panic() {
+        let r = compose_pxe_background(Some(b"\xde\xad\xbe\xef not an image"));
+        assert!(r.is_err());
+    }
+
+    #[test]
+    fn gradient_endpoints_match_stops() {
+        let stops = [[0, 0, 0], [255, 255, 255]];
+        assert_eq!(gradient_at(&stops, 0.0), [0, 0, 0]);
+        assert_eq!(gradient_at(&stops, 1.0), [255, 255, 255]);
+    }
+}

crates/iso-store/src/remote_cache.rs

@@ -0,0 +1,142 @@
+//! Persisted cache of remote-share introspection results.
+//!
+//! NFS/SFTP introspection costs a connection plus a few dozen small
+//! reads per ISO. Shares are rescanned on every startup and share-add,
+//! so without a cache a 40-ISO library would re-probe 40 ISOs on every
+//! container restart. The cache keys on `share/path@size` — a replaced
+//! file (new size) re-probes, an untouched one is free — and entries
+//! only count as hits when their `introspect_rev` matches the current
+//! logic, so an upgrade that changes detection re-probes everything
+//! exactly once.
+//!
+//! One file per protocol (`nfs_introspect_cache.json`,
+//! `sftp_introspect_cache.json`) so the two managers never contend over
+//! one writer.
+
+use crate::introspect::{IntrospectionReport, INTROSPECT_REV};
+use parking_lot::Mutex;
+use std::collections::HashMap;
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+
+/// Hard cap on cached entries; beyond it the cache resets rather than
+/// growing unbounded (a cache wipe only costs one re-probe pass).
+const MAX_ENTRIES: usize = 4096;
+
+#[derive(Clone, Debug)]
+pub struct RemoteIntrospectCache {
+    path: Arc<PathBuf>,
+    map: Arc<Mutex<HashMap<String, IntrospectionReport>>>,
+}
+
+impl RemoteIntrospectCache {
+    /// Open (or start empty) the cache at `<work_dir>/<file_name>`.
+    /// A corrupt or missing file is an empty cache, never an error.
+    #[must_use]
+    pub fn open(work_dir: &Path, file_name: &str) -> Self {
+        let path = work_dir.join(file_name);
+        let map = std::fs::read_to_string(&path)
+            .ok()
+            .and_then(|text| {
+                serde_json::from_str::<HashMap<String, IntrospectionReport>>(&text).ok()
+            })
+            .unwrap_or_default();
+        Self {
+            path: Arc::new(path),
+            map: Arc::new(Mutex::new(map)),
+        }
+    }
+
+    fn key(share_id: &str, relative_path: &str, size: u64) -> String {
+        format!("{share_id}/{relative_path}@{size}")
+    }
+
+    /// A hit requires the entry to have been produced by the *current*
+    /// introspection logic — stale-rev entries are misses, which is how
+    /// the cache self-invalidates across upgrades.
+    #[must_use]
+    pub fn get(
+        &self,
+        share_id: &str,
+        relative_path: &str,
+        size: u64,
+    ) -> Option<IntrospectionReport> {
+        self.map
+            .lock()
+            .get(&Self::key(share_id, relative_path, size))
+            .filter(|r| r.introspect_rev == INTROSPECT_REV)
+            .cloned()
+    }
+
+    pub fn put(&self, share_id: &str, relative_path: &str, size: u64, report: IntrospectionReport) {
+        let snapshot = {
+            let mut g = self.map.lock();
+            if g.len() >= MAX_ENTRIES {
+                g.clear();
+            }
+            g.insert(Self::key(share_id, relative_path, size), report);
+            g.clone()
+        };
+        // Persist outside the lock; tmp+rename so a crash mid-write
+        // leaves the previous cache intact.
+        let path = self.path.as_path();
+        let tmp = path.with_extension("json.tmp");
+        let Ok(body) = serde_json::to_vec_pretty(&snapshot) else {
+            return;
+        };
+        if let Some(parent) = path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        if std::fs::write(&tmp, body).is_ok() {
+            let _ = std::fs::rename(&tmp, path);
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::introspect::DistroFamily;
+
+    #[test]
+    fn round_trips_across_reopen_and_rev_gates() {
+        let dir = tempfile::tempdir().unwrap();
+        let cache = RemoteIntrospectCache::open(dir.path(), "t.json");
+        assert!(cache.get("s1", "a.iso", 100).is_none());
+
+        let fresh = IntrospectionReport {
+            family: DistroFamily::RhelFedora,
+            introspect_rev: INTROSPECT_REV,
+            el_torito: true,
+            ..Default::default()
+        };
+        cache.put("s1", "a.iso", 100, fresh.clone());
+        assert_eq!(
+            cache.get("s1", "a.iso", 100).unwrap().family,
+            DistroFamily::RhelFedora
+        );
+        // Different size = different file = miss.
+        assert!(cache.get("s1", "a.iso", 101).is_none());
+
+        // Survives a reopen.
+        let cache2 = RemoteIntrospectCache::open(dir.path(), "t.json");
+        assert!(cache2.get("s1", "a.iso", 100).is_some());
+
+        // Stale-rev entries never hit.
+        let stale = IntrospectionReport {
+            family: DistroFamily::Arch,
+            introspect_rev: INTROSPECT_REV - 1,
+            ..Default::default()
+        };
+        cache2.put("s1", "b.iso", 7, stale);
+        assert!(cache2.get("s1", "b.iso", 7).is_none());
+    }
+
+    #[test]
+    fn corrupt_cache_file_starts_empty() {
+        let dir = tempfile::tempdir().unwrap();
+        std::fs::write(dir.path().join("t.json"), b"{nope").unwrap();
+        let cache = RemoteIntrospectCache::open(dir.path(), "t.json");
+        assert!(cache.get("s", "x.iso", 1).is_none());
+    }
+}

crates/iso-store/src/smb.rs

@@ -25,11 +25,11 @@
 //!     Samba), we return `SmbState::SmbdMissing` and the UI surfaces the
 //!     gap. No panics, no retries, no silent failure.
 
+use parking_lot::Mutex;
 use serde::{Deserialize, Serialize};
 use std::path::{Path, PathBuf};
 use std::process::{Child, Command, Stdio};
 use std::sync::Arc;
-use parking_lot::Mutex;
 
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(rename_all = "snake_case", tag = "state")]
@@ -72,7 +72,9 @@ impl SmbManager {
     /// ISO under `smb_dir/<slug>/` becomes a share named `<slug>`. Returns
     /// the sorted list.
     pub fn discover_shares(&self) -> Vec<String> {
-        let Ok(rd) = std::fs::read_dir(&self.smb_dir) else { return vec![]; };
+        let Ok(rd) = std::fs::read_dir(&self.smb_dir) else {
+            return vec![];
+        };
         let mut out: Vec<String> = rd
             .flatten()
             .filter(|e| e.path().is_dir())
@@ -130,7 +132,9 @@ impl SmbManager {
         let shares = match self.write_conf() {
             Ok(v) => v,
             Err(e) => {
-                let s = SmbState::Failed { reason: format!("write smb.conf: {e}") };
+                let s = SmbState::Failed {
+                    reason: format!("write smb.conf: {e}"),
+                };
                 *self.state.lock() = s.clone();
                 return s;
             }
@@ -139,7 +143,8 @@ impl SmbManager {
             .args([
                 "--foreground",
                 "--no-process-group",
-                "--configfile", self.conf_path.to_str().unwrap_or(""),
+                "--configfile",
+                self.conf_path.to_str().unwrap_or(""),
                 "--log-stdout",
             ])
             .stdin(Stdio::null())
@@ -156,7 +161,9 @@ impl SmbManager {
                 s
             }
             Err(e) => {
-                let s = SmbState::Failed { reason: format!("spawn smbd: {e}") };
+                let s = SmbState::Failed {
+                    reason: format!("spawn smbd: {e}"),
+                };
                 *self.state.lock() = s.clone();
                 s
             }
@@ -168,11 +175,15 @@ impl SmbManager {
     #[allow(unsafe_code)]
     pub fn reconcile(&self) -> SmbState {
         let mut g = self.child.lock();
-        if g.is_none() { return self.state.lock().clone(); }
+        if g.is_none() {
+            return self.state.lock().clone();
+        }
         let shares = match self.write_conf() {
             Ok(v) => v,
             Err(e) => {
-                let s = SmbState::Failed { reason: format!("write smb.conf: {e}") };
+                let s = SmbState::Failed {
+                    reason: format!("write smb.conf: {e}"),
+                };
                 *self.state.lock() = s.clone();
                 return s;
             }
@@ -191,8 +202,13 @@ impl SmbManager {
             // covers this is `nix`, which pulls ~40 transitive deps for a
             // single signal send. One documented unsafe call is the better
             // tradeoff for a container-first project.
-            unsafe { libc::kill(pid, libc::SIGHUP); }
+            unsafe {
-            let s = SmbState::Running { pid: pid as u32, shares };
+                libc::kill(pid, libc::SIGHUP);
+            }
+            let s = SmbState::Running {
+                pid: pid as u32,
+                shares,
+            };
             *self.state.lock() = s.clone();
             s
         } else {
@@ -212,15 +228,19 @@ impl SmbManager {
 }
 
 fn smbd_present() -> bool {
-    let Ok(paths) = std::env::var("PATH") else { return false; };
+    let Ok(paths) = std::env::var("PATH") else {
+        return false;
+    };
     for dir in std::env::split_paths(&paths) {
-        if dir.join("smbd").is_file() { return true; }
+        if dir.join("smbd").is_file() {
+            return true;
+        }
     }
     false
 }
 
 const SMB_CONF_GLOBAL: &str = r"[global]
-workgroup = PXEFORGE
+workgroup = OPENPXE
 server min protocol = SMB2
 smb ports = 445
 log level = 1
@@ -235,6 +255,15 @@ lock directory = /tmp
 state directory = /tmp
 cache directory = /tmp
 pid directory = /tmp
+# WinPE reconnect hardening. Windows Setup can reboot mid-install and
+# reconnect from the same IP; stale sessions/oplocks otherwise cause
+# intermittent `net use` failures on the second stage.
+reset on zero vc = yes
+oplocks = no
+kernel oplocks = no
+level2 oplocks = no
+strict locking = no
+deadtime = 1
 ";
 
 /// Extract a Windows ISO at `iso_path` into `smb_dir/<slug>/`. Uses
@@ -245,7 +274,11 @@ pid directory = /tmp
 /// Idempotent: if the target dir already contains `sources/boot.wim`, we
 /// skip extraction. Callers who want a forced re-extract should remove the
 /// dir first.
-pub fn extract_windows_iso(iso_path: &Path, smb_dir: &Path, slug: &str) -> std::io::Result<PathBuf> {
+pub fn extract_windows_iso(
+    iso_path: &Path,
+    smb_dir: &Path,
+    slug: &str,
+) -> std::io::Result<PathBuf> {
     let target = smb_dir.join(slug);
     if target.join("sources").join("boot.wim").is_file() {
         tracing::debug!(target: "openpxe::smb", slug, "ISO already extracted, skipping");
@@ -263,7 +296,9 @@ pub fn extract_windows_iso(iso_path: &Path, smb_dir: &Path, slug: &str) -> std::
             .stdout(Stdio::null())
             .stderr(Stdio::piped())
             .output()?;
-        if out.status.success() { return Ok(target); }
+        if out.status.success() {
+            return Ok(target);
+        }
         tracing::warn!(
             target: "openpxe::smb",
             stderr=%String::from_utf8_lossy(&out.stderr),
@@ -278,7 +313,9 @@ pub fn extract_windows_iso(iso_path: &Path, smb_dir: &Path, slug: &str) -> std::
             .args(["-C"])
             .arg(&target)
             .output()?;
-        if out.status.success() { return Ok(target); }
+        if out.status.success() {
+            return Ok(target);
+        }
         return Err(std::io::Error::other(format!(
             "bsdtar failed: {}",
             String::from_utf8_lossy(&out.stderr)
@@ -294,7 +331,9 @@ fn which(cmd: &str) -> Option<PathBuf> {
     let paths = std::env::var_os("PATH")?;
     for dir in std::env::split_paths(&paths) {
         let p = dir.join(cmd);
-        if p.is_file() { return Some(p); }
+        if p.is_file() {
+            return Some(p);
+        }
     }
     None
 }
@@ -320,7 +359,9 @@ mod tests {
         let m = SmbManager::new(dir.path().into());
         let st = m.start();
         // Restore PATH before asserting so any subsequent failure is legible.
-        if let Some(p) = saved { std::env::set_var("PATH", p); }
+        if let Some(p) = saved {
+            std::env::set_var("PATH", p);
+        }
         assert_eq!(st, SmbState::SmbdMissing);
     }
 
@@ -347,5 +388,27 @@ mod tests {
         assert!(conf.contains("guest ok = yes"));
         assert!(conf.contains("read only = yes"));
         assert!(conf.contains("server min protocol = SMB2"));
+        assert!(conf.contains("workgroup = OPENPXE"));
+    }
+
+    #[test]
+    fn write_conf_includes_winpe_reconnect_tuning() {
+        let dir = tempdir().unwrap();
+        let m = SmbManager::new(dir.path().into());
+        m.write_conf().unwrap();
+        let conf = std::fs::read_to_string(dir.path().join("smb.conf")).unwrap();
+        for expected in [
+            "reset on zero vc = yes",
+            "oplocks = no",
+            "kernel oplocks = no",
+            "level2 oplocks = no",
+            "strict locking = no",
+            "deadtime = 1",
+        ] {
+            assert!(
+                conf.contains(expected),
+                "missing Windows reconnect Samba option {expected} in:\n{conf}"
+            );
+        }
     }
 }

crates/iso-store/src/smb_share.rs

@@ -0,0 +1,982 @@
+//! SMB share consumer — replaces the kernel-mount NFS path that v0.4.64
+//! shipped.
+//!
+//! ## Why SMB and not NFS
+//!
+//! v0.4.64 tried to make `mount -t nfs` work inside the OpenPXE
+//! container. With `CAP_SYS_ADMIN` + `--privileged` we still hit the
+//! same `mount.nfs: failed to apply fstab options` on Unraid because
+//! Unraid's base kernel ships without the `nfs` / `nfsv4` client
+//! modules loaded. No amount of container-side configuration can
+//! load a kernel module on the host.
+//!
+//! SMB has the same kernel-side problem (`mount -t cifs` needs the
+//! `cifs` kernel module) but unlike NFS it has a usable **userspace**
+//! client: Samba's `smbclient` CLI. It speaks the SMB protocol over a
+//! plain TCP socket, no kernel modules required. Bootimus uses the
+//! same approach.
+//!
+//! ## How it works
+//!
+//! 1. Operator submits a share spec via the Storage tab:
+//!    `{ server: "192.168.1.51", share: "isos",
+//!       username, password, guest }`.
+//! 2. We write credentials to a 0600-permission tempfile under
+//!    `<work_dir>/smb_creds/`. Passing them on the command line would
+//!    leak them through `ps` and the container's audit log.
+//! 3. We test the connection by listing the share's root with
+//!    `smbclient //server/share -A creds_file -c 'ls *.iso'`. If the
+//!    server is unreachable, the share doesn't exist, or auth fails,
+//!    we get a clean error before persisting anything.
+//! 4. We parse the `ls` output for `*.iso` filenames and sizes, and
+//!    register each one with the `IsoStore` as an
+//!    `IsoSource::Smb { share_id, relative_path }`.
+//! 5. When a PXE client requests the bytes, the HTTP handler asks this
+//!    manager for an async reader. We spawn
+//!    `smbclient //server/share -A creds_file -c 'get file -'` and
+//!    pipe its stdout straight into the response body. No double
+//!    storage, no temp files.
+//!
+//! ## Why subprocess and not a Rust library
+//!
+//! The Debian runtime image already ships the `samba` package
+//! (Dockerfile line 84) — `smbclient` is right there. Library options
+//! like `pavao` wrap `libsmbclient` so they still pull in the same C
+//! library at runtime. Subprocess is simpler, the API surface is
+//! whatever the operator can verify with `smbclient` at a shell, and
+//! debugging "what does smbclient see?" is trivial.
+//!
+//! ## Range request limitations (v0.4.65)
+//!
+//! `smbclient -c 'get file -'` is a sequential whole-file stream;
+//! there's no native seek in the CLI. We honor full GETs and reject
+//! HTTP Range requests with `416 Range Not Satisfiable` for
+//! SMB-sourced ISOs. PXE clients in practice request the whole file:
+//! iPXE chain loading, casper sanboot, wimboot all do sequential
+//! streaming. A follow-up release can add libsmbclient-based seek if
+//! a real workload needs it.
+
+use crate::introspect::provisional_report;
+use crate::store::{generate_boot_entries_for, slugify_str, IsoSource, IsoStore};
+use openpxe_core::{Error, Result};
+use parking_lot::Mutex;
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use std::io::Write;
+use std::path::{Path, PathBuf};
+use std::process::Stdio;
+use std::sync::Arc;
+use std::time::Duration;
+use time::OffsetDateTime;
+use tokio::process::Command;
+
+/// Default TCP port for SMB / CIFS. The wire protocol moved to 445
+/// years ago; 139 (NetBIOS) is legacy and we don't expose it as an
+/// option.
+const DEFAULT_SMB_PORT: u16 = 445;
+
+/// Maximum time we wait for a TCP connection to the SMB server during
+/// the pre-flight probe. Same shape as the v0.4.64 NFS probe — short
+/// enough that a wrong IP doesn't make the UI hang for 30s, long
+/// enough that a slow appliance can still answer.
+const PROBE_TIMEOUT: Duration = Duration::from_secs(4);
+
+/// One configured SMB share. The id is derived from server+share so an
+/// operator pasting the same coordinates twice gets idempotent
+/// behaviour rather than a duplicate row.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SmbShare {
+    pub id: String,
+    pub server: String,
+    pub share: String,
+    /// Username used for the SMB connection. Empty when `guest` is
+    /// true. Stored so the UI can echo it back; the password lives in
+    /// the separate credentials file (see `creds_path`).
+    pub username: String,
+    /// True when we're connecting with `-N` (anonymous / guest mode).
+    /// Most NAS appliances that expose ISO libraries do so as
+    /// guest-readable; this is the common case.
+    pub guest: bool,
+    /// TCP port — 445 unless the operator overrode it. Persisted so
+    /// the UI can echo it back.
+    #[serde(default = "default_port")]
+    pub port: u16,
+    /// Most recent error encountered talking to the share, or `None`
+    /// on success. Cleared every successful operation.
+    pub last_error: Option<String>,
+    /// Operator-friendly translation of `last_error`. None when we
+    /// don't have a friendlier rendition.
+    pub last_hint: Option<String>,
+    #[serde(with = "time::serde::rfc3339::option")]
+    pub last_scan: Option<OffsetDateTime>,
+    /// Number of `*.iso` files we know about on the share as of the
+    /// most recent scan.
+    pub iso_count: u32,
+    /// Whether the connection's currently working. `true` after a
+    /// successful scan, `false` after a failure. Drives the UI dot.
+    pub reachable: bool,
+    /// Path to the credentials file on disk. Internal — not surfaced
+    /// in the API JSON; we serialize it for restart-survival but the
+    /// UI doesn't render it.
+    #[serde(default)]
+    #[serde(skip_serializing)]
+    pub(crate) creds_path: Option<PathBuf>,
+}
+
+/// Submission from the UI / API.
+#[derive(Debug, Clone, Deserialize)]
+pub struct SmbAddRequest {
+    pub server: String,
+    pub share: String,
+    #[serde(default)]
+    pub username: Option<String>,
+    #[serde(default)]
+    pub password: Option<String>,
+    #[serde(default)]
+    pub guest: bool,
+    #[serde(default)]
+    pub port: Option<u16>,
+}
+
+fn default_port() -> u16 {
+    DEFAULT_SMB_PORT
+}
+
+/// Structured error surfaced to the API and rendered in the UI as two
+/// lines: the raw `error` from smbclient + an actionable `hint`.
+/// Mirrors the v0.4.64 NFS error shape so the storage tab can use a
+/// single rendering path.
+#[derive(Debug, Clone, Serialize)]
+pub struct SmbShareError {
+    pub error: String,
+    pub stderr: String,
+    pub hint: Option<String>,
+}
+
+impl SmbShareError {
+    fn from_raw(error: impl Into<String>, stderr: impl Into<String>) -> Self {
+        let stderr = stderr.into();
+        let error = error.into();
+        let hint = hint_for(&stderr).or_else(|| hint_for(&error));
+        Self {
+            error,
+            stderr,
+            hint,
+        }
+    }
+}
+
+#[derive(Debug, Default)]
+struct Inner {
+    shares: HashMap<String, SmbShare>,
+}
+
+/// Manages SMB shares and surfaces their ISOs through the IsoStore.
+///
+/// Cheap to clone — internal state is `Arc<Mutex<...>>`.
+#[derive(Debug, Clone)]
+pub struct SmbShareManager {
+    creds_root: Arc<PathBuf>,
+    state_path: Arc<PathBuf>,
+    inner: Arc<Mutex<Inner>>,
+    iso_store: IsoStore,
+    /// Serializes scan/list/get against the same share. smbclient
+    /// itself is fine concurrent across processes, but bundling
+    /// operations through a single lock makes test ordering and log
+    /// output predictable.
+    op_lock: Arc<tokio::sync::Mutex<()>>,
+}
+
+impl SmbShareManager {
+    /// Construct a manager rooted at `work_dir`. Credentials files
+    /// live under `<work_dir>/smb_creds/` with 0600 permissions; state
+    /// persists to `<work_dir>/smb_shares.json`.
+    #[must_use]
+    pub fn new(work_dir: &Path, iso_store: IsoStore) -> Self {
+        let creds_root = work_dir.join("smb_creds");
+        let state_path = work_dir.join("smb_shares.json");
+        Self {
+            creds_root: Arc::new(creds_root),
+            state_path: Arc::new(state_path),
+            inner: Arc::new(Mutex::new(Inner::default())),
+            iso_store,
+            op_lock: Arc::new(tokio::sync::Mutex::new(())),
+        }
+    }
+
+    /// Load persisted state and re-scan every share. Errors per share
+    /// are logged and surfaced on the spec; the call itself never
+    /// fails — startup must not block on a single offline server.
+    pub async fn load_and_rescan(&self) -> Result<()> {
+        tokio::fs::create_dir_all(self.creds_root.as_path()).await?;
+        let shares = match tokio::fs::read_to_string(self.state_path.as_path()).await {
+            Ok(text) => serde_json::from_str::<Vec<SmbShare>>(&text).unwrap_or_default(),
+            Err(_) => Vec::new(),
+        };
+        for mut s in shares {
+            s.last_error = None;
+            s.last_hint = None;
+            s.reachable = false;
+            self.inner.lock().shares.insert(s.id.clone(), s.clone());
+            if let Err(e) = self.rescan_inner(&s.id).await {
+                tracing::warn!(
+                    target: "openpxe::smb",
+                    id = %s.id, server = %s.server, share = %s.share,
+                    "rescan on startup failed: {e}"
+                );
+            }
+        }
+        Ok(())
+    }
+
+    /// Add or refresh a share. Validates the input, writes a creds
+    /// file, probes connectivity, and scans for ISOs.
+    pub async fn add(&self, req: SmbAddRequest) -> std::result::Result<SmbShare, SmbShareError> {
+        let server = normalize_server(&req.server);
+        let share = req.share.trim().trim_start_matches('/').to_string();
+        if server.is_empty() {
+            return Err(SmbShareError::from_raw("server is required", ""));
+        }
+        if share.is_empty() {
+            return Err(SmbShareError::from_raw("share name is required", ""));
+        }
+        if share.contains('/') {
+            return Err(SmbShareError::from_raw(
+                "share name should be the top-level share (e.g. 'isos'), not a path",
+                "",
+            ));
+        }
+        if server.contains('\0') || share.contains('\0') {
+            return Err(SmbShareError::from_raw("NUL bytes are not allowed", ""));
+        }
+
+        let guest = req.guest;
+        let username = req.username.unwrap_or_default().trim().to_string();
+        let password = req.password.unwrap_or_default();
+        if !guest && username.is_empty() {
+            return Err(SmbShareError::from_raw(
+                "username is required when 'guest' is unchecked",
+                "",
+            ));
+        }
+        let port = req.port.filter(|p| *p != 0).unwrap_or(DEFAULT_SMB_PORT);
+
+        let id = share_id(&server, &share);
+
+        // Pre-flight TCP probe so a wrong IP / firewall surfaces a
+        // clean error instead of one of smbclient's notoriously
+        // cryptic NT_STATUS codes.
+        if let Err((err, hint)) = tcp_probe(&server, port).await {
+            // No share is persisted yet; just return the error.
+            return Err(SmbShareError {
+                error: err,
+                stderr: String::new(),
+                hint: Some(hint),
+            });
+        }
+
+        // Write the creds file. Even guest mode gets a file (empty
+        // username/password) so the code path is uniform.
+        let creds_path = self.creds_root.join(format!("{id}.cred"));
+        if let Err(e) = self.write_creds(&creds_path, &username, &password).await {
+            return Err(SmbShareError::from_raw(
+                format!("could not write credentials file: {e}"),
+                "",
+            ));
+        }
+
+        let spec = SmbShare {
+            id: id.clone(),
+            server,
+            share,
+            username,
+            guest,
+            port,
+            last_error: None,
+            last_hint: None,
+            last_scan: None,
+            iso_count: 0,
+            reachable: false,
+            creds_path: Some(creds_path),
+        };
+        self.inner.lock().shares.insert(id.clone(), spec);
+        self.persist_locked();
+
+        // Now actually talk to the server.
+        if let Err(e) = self.rescan_inner(&id).await {
+            let m = self.get(&id);
+            return Err(SmbShareError {
+                error: m
+                    .as_ref()
+                    .and_then(|m| m.last_error.clone())
+                    .unwrap_or_else(|| e.to_string()),
+                stderr: String::new(),
+                hint: m.and_then(|m| m.last_hint),
+            });
+        }
+        Ok(self.get(&id).expect("just inserted"))
+    }
+
+    /// Remove a share: drops every ISO sourced from it, scrubs the
+    /// creds file, and forgets the spec. Idempotent.
+    pub async fn remove(&self, id: &str) -> Result<()> {
+        let creds_path = {
+            let mut g = self.inner.lock();
+            g.shares.remove(id).and_then(|s| s.creds_path)
+        };
+        self.iso_store.drop_external_source(id);
+        if let Some(p) = creds_path {
+            // Overwrite-then-unlink would be more thorough but the
+            // file is 0600 in a non-root-owned dir; rm is sufficient.
+            let _ = tokio::fs::remove_file(&p).await;
+        }
+        self.persist_locked();
+        Ok(())
+    }
+
+    /// Re-list the share and refresh the IsoStore entries.
+    pub async fn rescan(&self, id: &str) -> Result<u32> {
+        self.rescan_inner(id).await
+    }
+
+    /// Snapshot of every configured share, sorted by id for stable UI
+    /// rendering.
+    #[must_use]
+    pub fn list(&self) -> Vec<SmbShare> {
+        let g = self.inner.lock();
+        let mut v: Vec<_> = g.shares.values().cloned().collect();
+        v.sort_by(|a, b| a.id.cmp(&b.id));
+        v
+    }
+
+    /// Look up a share by id.
+    #[must_use]
+    pub fn get(&self, id: &str) -> Option<SmbShare> {
+        self.inner.lock().shares.get(id).cloned()
+    }
+
+    /// Open an async reader streaming an ISO out of the share. Used
+    /// by the HTTP ISO download handler.
+    ///
+    /// Kept `async` for symmetry with the other I/O entrypoints —
+    /// spawning the child is sync today (no `.await` inside) but a
+    /// future addition (e.g. probing the share before spawn or
+    /// throttling concurrent smbclients) would need to await without
+    /// changing the call sites.
+    #[allow(clippy::unused_async)]
+    pub async fn stream_iso(&self, share_id: &str, filename: &str) -> Result<SmbStream> {
+        let share = self
+            .get(share_id)
+            .ok_or_else(|| Error::Invalid(format!("no such SMB share '{share_id}'")))?;
+        // Defensive: reject any filename that tries to escape the
+        // share root. smbclient itself accepts only filenames at the
+        // share root in our `get` form, but belt-and-suspenders.
+        if filename.contains('/') || filename.contains('\\') || filename.contains("..") {
+            return Err(Error::Invalid(format!("invalid filename '{filename}'")));
+        }
+        let creds = share
+            .creds_path
+            .as_deref()
+            .ok_or_else(|| Error::Invalid("share has no credentials file".into()))?;
+        let target = format!("//{}/{}", share.server, share.share);
+        let mut cmd = Command::new("smbclient");
+        cmd.arg(&target)
+            .arg("-A")
+            .arg(creds)
+            .arg("-p")
+            .arg(share.port.to_string())
+            .arg("-c")
+            .arg(format!("get \"{filename}\" -"))
+            .stdout(Stdio::piped())
+            .stderr(Stdio::piped())
+            .stdin(Stdio::null());
+        if share.guest {
+            cmd.arg("-N");
+        }
+        // v0.4.66: surface a useful error if smbclient isn't on the
+        // PATH. Shouldn't happen on the stock image but custom
+        // builds may strip it.
+        let mut child = cmd.spawn().map_err(|e| {
+            if e.kind() == std::io::ErrorKind::NotFound {
+                Error::Invalid(
+                    "smbclient binary not found on $PATH — install the \
+                     Debian `smbclient` package or pull OpenPXE v0.4.66+"
+                        .into(),
+                )
+            } else {
+                Error::Other(e.into())
+            }
+        })?;
+        let stdout = child
+            .stdout
+            .take()
+            .ok_or_else(|| Error::Invalid("smbclient stdout missing".into()))?;
+        Ok(SmbStream { child, stdout })
+    }
+
+    // ── internals ─────────────────────────────────────────────────────
+
+    async fn rescan_inner(&self, id: &str) -> Result<u32> {
+        let _g = self.op_lock.lock().await;
+
+        let share = self
+            .get(id)
+            .ok_or_else(|| Error::Invalid(format!("no such share '{id}'")))?;
+        let now = OffsetDateTime::now_utc();
+
+        // Drop prior entries so a deleted file disappears from the
+        // store on the next scan.
+        self.iso_store.drop_external_source(id);
+
+        let listing = match self.list_isos(&share).await {
+            Ok(l) => l,
+            Err((err, stderr)) => {
+                let combined = if stderr.is_empty() {
+                    err.clone()
+                } else {
+                    format!("{err}: {stderr}")
+                };
+                let hint = hint_for(&stderr).or_else(|| hint_for(&err));
+                self.update_status(id, 0, false, Some(combined.clone()), hint, now);
+                return Err(Error::Invalid(combined));
+            }
+        };
+
+        // For each ISO we found, we still need its size + a quick
+        // introspection pass. The introspection pass needs random
+        // access into the ISO9660 PVD which lives at offset 0x8000.
+        // For SMB sources we can't seek without downloading the file
+        // first, so we use a degenerate "unknown family" introspection
+        // report for the listing pass. Operators can rescan after the
+        // first PXE boot has touched the file if they want a real
+        // family detection. (Better: a follow-up release adds a tiny
+        // `smbclient -c 'get file -'` bounded read to do introspection
+        // without storing the whole ISO.)
+        let mut count = 0u32;
+        for entry in listing {
+            let iso_id = format!("smb-{}-{}", share.id, slugify_str(&entry.filename));
+            // SMB sources can't get the content-probe pass NFS/SFTP got
+            // in v0.7.4 — the ISO9660 probes need seeks, and smbclient's
+            // CLI streaming doesn't seek. The provisional filename-token
+            // report is as far as SMB detection goes: family for the UI
+            // when the name says it ("rhel-9.0…", "Win11_…"), and
+            // `introspect_rev = 0` so the entry generator keeps the
+            // optimistic sanboot entry.
+            let report = provisional_report(&entry.filename);
+            let boot_entries = generate_boot_entries_for(&iso_id, &entry.filename, &report);
+            let source = IsoSource::Smb {
+                share_id: share.id.clone(),
+                relative_path: entry.filename.clone(),
+            };
+            self.iso_store.register_external(
+                iso_id,
+                entry.filename,
+                entry.size,
+                report,
+                boot_entries,
+                source,
+            );
+            count += 1;
+        }
+
+        self.update_status(id, count, true, None, None, now);
+        tracing::info!(
+            target: "openpxe::smb",
+            id = %id, server = %share.server, share = %share.share,
+            iso_count = count,
+            "SMB share scanned"
+        );
+        Ok(count)
+    }
+
+    /// Spawn `smbclient //server/share -A creds -c "ls *.iso"` and
+    /// parse the output. Returns `(error_text, stderr_text)` on
+    /// failure so the caller can surface both.
+    async fn list_isos(
+        &self,
+        share: &SmbShare,
+    ) -> std::result::Result<Vec<SmbListEntry>, (String, String)> {
+        let target = format!("//{}/{}", share.server, share.share);
+        let mut cmd = Command::new("smbclient");
+        cmd.arg(&target)
+            .arg("-A")
+            .arg(
+                share
+                    .creds_path
+                    .as_deref()
+                    .ok_or_else(|| ("no credentials file".to_string(), String::new()))?,
+            )
+            .arg("-p")
+            .arg(share.port.to_string())
+            .arg("-c")
+            .arg("ls *.iso");
+        if share.guest {
+            cmd.arg("-N");
+        }
+        let output = match cmd.output().await {
+            Ok(o) => o,
+            Err(e) => {
+                // v0.4.66: distinguish ENOENT (missing binary) from
+                // other exec failures and pre-fill the hint so the
+                // UI shows a clear remediation instead of the bare
+                // "No such file or directory (os error 2)". This
+                // shouldn't fire on the stock image — the Dockerfile
+                // installs the `smbclient` package — but is a useful
+                // breadcrumb for anyone running OpenPXE in a stripped
+                // base image.
+                let stderr = if e.kind() == std::io::ErrorKind::NotFound {
+                    "smbclient binary not found on $PATH".to_string()
+                } else {
+                    String::new()
+                };
+                return Err((format!("could not exec smbclient: {e}"), stderr));
+            }
+        };
+        if !output.status.success() {
+            let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
+            // smbclient writes most diagnostics to stdout too; merge
+            // them so we don't lose context.
+            let stdout = String::from_utf8_lossy(&output.stdout).trim().to_string();
+            let combined = if stderr.is_empty() { stdout } else { stderr };
+            return Err((
+                format!("smbclient exit {}", output.status.code().unwrap_or(-1)),
+                combined,
+            ));
+        }
+        let stdout = String::from_utf8_lossy(&output.stdout);
+        Ok(parse_ls_iso(&stdout))
+    }
+
+    async fn write_creds(
+        &self,
+        path: &Path,
+        username: &str,
+        password: &str,
+    ) -> std::io::Result<()> {
+        tokio::fs::create_dir_all(self.creds_root.as_path()).await?;
+        // Write the file with 0600 perms. `smbclient -A` accepts the
+        // standard pam_mount-style:
+        //   username = foo
+        //   password = bar
+        let body = format!(
+            "username = {}\npassword = {}\n",
+            username.replace('\n', ""),
+            password.replace('\n', ""),
+        );
+        // Synchronous file write to set perms atomically with the
+        // create — there's no async equivalent of OpenOptions+mode
+        // shared with the tokio API in std stable.
+        let path = path.to_path_buf();
+        tokio::task::spawn_blocking(move || -> std::io::Result<()> {
+            use std::os::unix::fs::OpenOptionsExt;
+            let mut f = std::fs::OpenOptions::new()
+                .write(true)
+                .create(true)
+                .truncate(true)
+                .mode(0o600)
+                .open(&path)?;
+            f.write_all(body.as_bytes())?;
+            Ok(())
+        })
+        .await
+        .map_err(std::io::Error::other)??;
+        Ok(())
+    }
+
+    fn update_status(
+        &self,
+        id: &str,
+        iso_count: u32,
+        reachable: bool,
+        err: Option<String>,
+        hint: Option<String>,
+        ts: OffsetDateTime,
+    ) {
+        if let Some(s) = self.inner.lock().shares.get_mut(id) {
+            s.iso_count = iso_count;
+            s.reachable = reachable;
+            s.last_error = err;
+            s.last_hint = hint;
+            s.last_scan = Some(ts);
+        }
+        self.persist_locked();
+    }
+
+    /// Atomically replace the on-disk JSON. Persistence errors are
+    /// logged, never propagated.
+    fn persist_locked(&self) {
+        let shares: Vec<SmbShare> = self.inner.lock().shares.values().cloned().collect();
+        let path = self.state_path.as_path();
+        let tmp = path.with_extension("json.tmp");
+        let body = match serde_json::to_vec_pretty(&shares) {
+            Ok(b) => b,
+            Err(e) => {
+                tracing::warn!(target: "openpxe::smb", "serialize: {e}");
+                return;
+            }
+        };
+        if let Some(parent) = path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        if let Err(e) = std::fs::write(&tmp, body) {
+            tracing::warn!(target: "openpxe::smb", "write tmp: {e}");
+            return;
+        }
+        if let Err(e) = std::fs::rename(&tmp, path) {
+            tracing::warn!(target: "openpxe::smb", "rename: {e}");
+        }
+    }
+}
+
+/// Async-reader handle for an in-flight `smbclient get file -` stream.
+/// Wraps the child process + its piped stdout; dropping it kills the
+/// child.
+#[derive(Debug)]
+pub struct SmbStream {
+    /// Kept alive so the child isn't reaped while we're reading. The
+    /// `Drop` impl on `tokio::process::Child` sends SIGKILL on drop
+    /// when `kill_on_drop` is set; we leave that to the default
+    /// (no-kill) so a slow client doesn't tear down the pipe before
+    /// the OS finishes the read. The child exits naturally when its
+    /// stdout closes.
+    #[allow(dead_code)]
+    child: tokio::process::Child,
+    pub stdout: tokio::process::ChildStdout,
+}
+
+#[derive(Debug, Clone)]
+struct SmbListEntry {
+    filename: String,
+    size: u64,
+}
+
+/// Parse `smbclient ls *.iso` output. The format is:
+///
+/// ```text
+///   .                                   D        0  Mon May 26 10:00:00 2026
+///   ..                                  D        0  Mon May 26 10:00:00 2026
+///   ubuntu-22.04-desktop.iso            A 3650912256  Mon May 26 11:00:00 2026
+///
+///         4096 blocks of size 1048576. 1234 blocks available
+/// ```
+///
+/// Each file line:
+///   - starts with whitespace
+///   - has the filename, then attribute flags (D=dir, A=archive, R=read-only,
+///     H=hidden, S=system, N=normal), then size, then date.
+///
+/// We accept any line where the attributes column doesn't contain `D`
+/// (i.e. not a directory) and the filename ends in `.iso` (case
+/// insensitive).
+fn parse_ls_iso(out: &str) -> Vec<SmbListEntry> {
+    let mut entries = Vec::new();
+    for raw in out.lines() {
+        let line = raw.trim();
+        // Skip blank lines, the connection-info banner, and the
+        // trailing "N blocks of size" summary. The actual filter for
+        // "is this a file listing?" is the attribute+size pattern
+        // detection below, which only matches real file rows.
+        if line.is_empty() || line.contains("blocks of size") {
+            continue;
+        }
+        // Find the attribute column: a short token of one or more of
+        // [DAHSRN] that follows a long-enough filename block.
+        // smbclient pads the filename to ~36 columns, so we can split
+        // on multiple consecutive spaces and then look for the
+        // attribute token.
+        let tokens: Vec<&str> = line.split_whitespace().collect();
+        if tokens.len() < 3 {
+            continue;
+        }
+        // The last 5 tokens are typically: ATTR SIZE Day Mon DD HH:MM:SS YYYY
+        // (sometimes Day is missing depending on locale). Walk
+        // backwards to find ATTR + SIZE: ATTR is 1-6 chars of [DAHSRN],
+        // SIZE is digits.
+        let attr_idx = tokens.iter().enumerate().rev().find_map(|(i, t)| {
+            if i == 0 {
+                return None;
+            }
+            let next = tokens.get(i + 1)?;
+            let is_attr = !t.is_empty() && t.chars().all(|c| "DAHSRN".contains(c));
+            let is_size = next.chars().all(|c| c.is_ascii_digit()) && !next.is_empty();
+            if is_attr && is_size {
+                Some(i)
+            } else {
+                None
+            }
+        });
+        let Some(attr_idx) = attr_idx else { continue };
+        let attr = tokens[attr_idx];
+        // Directories aren't ISO files.
+        if attr.contains('D') {
+            continue;
+        }
+        let size_tok = tokens[attr_idx + 1];
+        let Ok(size) = size_tok.parse::<u64>() else {
+            continue;
+        };
+        // The filename is everything before the attribute token in
+        // the original (un-tokenized) line — we need the original
+        // because filenames can contain spaces.
+        // Locate the attribute token's start column by counting
+        // characters in the prior tokens + separators. Simpler: find
+        // the index of the attribute in the trimmed line by joining
+        // and trimming again.
+        let joined_before: String = tokens[..attr_idx].join(" ");
+        let name = joined_before.trim().to_string();
+        if name.is_empty() || name == "." || name == ".." {
+            continue;
+        }
+        if !name.to_ascii_lowercase().ends_with(".iso") {
+            continue;
+        }
+        entries.push(SmbListEntry {
+            filename: name,
+            size,
+        });
+    }
+    entries
+}
+
+/// Pre-flight TCP probe to `server:port`. Format matches v0.4.64 NFS
+/// probe so the UI banner reads consistently.
+async fn tcp_probe(server: &str, port: u16) -> std::result::Result<(), (String, String)> {
+    use tokio::net::TcpStream;
+    let addr = format!("{server}:{port}");
+    match tokio::time::timeout(PROBE_TIMEOUT, TcpStream::connect(&addr)).await {
+        Ok(Ok(_)) => Ok(()),
+        Ok(Err(e)) => Err((
+            format!("cannot reach SMB port: {addr}: {e}"),
+            format!(
+                "verify the SMB service is running on {server} and that port {port} is open"
+            ),
+        )),
+        Err(_) => Err((
+            format!(
+                "cannot reach SMB port: {addr}: timed out after {}s",
+                PROBE_TIMEOUT.as_secs()
+            ),
+            format!(
+                "no TCP answer from {server}:{port} within {}s — check the IP and any firewall in between",
+                PROBE_TIMEOUT.as_secs()
+            ),
+        )),
+    }
+}
+
+/// Translate well-known smbclient stderr patterns into actionable
+/// hints. Returns `None` when we don't have a translation.
+fn hint_for(text: &str) -> Option<String> {
+    let s = text.to_ascii_lowercase();
+    if s.contains("smbclient binary not found")
+        || s.contains("smbclient: no such file")
+        || (s.contains("could not exec smbclient") && s.contains("os error 2"))
+    {
+        // v0.4.66: this only fires on a stripped / custom runtime
+        // image — the stock OpenPXE container ships `smbclient` from
+        // the Debian `smbclient` package. The error surfaced on
+        // v0.4.65 specifically because that release's Dockerfile
+        // installed `samba` (the server) but not `smbclient` (the
+        // client CLI). Operators on the stock image should never see
+        // this; if they do, the fix is to upgrade.
+        Some(
+            "smbclient isn't installed in this container. Pull the \
+             official OpenPXE image v0.4.66 or newer — the stock image \
+             ships smbclient. If you're running a custom build, add the \
+             Debian `smbclient` package to your runtime stage."
+                .into(),
+        )
+    } else if s.contains("nt_status_logon_failure") || s.contains("logon_failure") {
+        Some(
+            "the server rejected the credentials. Double-check the username \
+             and password — many NAS appliances use a separate SMB account \
+             rather than the system login."
+                .into(),
+        )
+    } else if s.contains("nt_status_access_denied") || s.contains("access_denied") {
+        Some(
+            "the credentials worked but the account doesn't have read \
+             access to this share. Check the share's permissions on the \
+             server."
+                .into(),
+        )
+    } else if s.contains("nt_status_bad_network_name")
+        || s.contains("nt_status_bad_network_path")
+        || s.contains("bad_network_name")
+    {
+        Some(
+            "the share name doesn't exist on this server. Enter just the \
+             share name (e.g. 'isos'), not a path. Use `smbclient -L \
+             //server` to list shares manually."
+                .into(),
+        )
+    } else if s.contains("connection refused") {
+        Some(
+            "the SMB service isn't accepting connections on this port. \
+             Verify smbd / Samba is running on the server."
+                .into(),
+        )
+    } else if s.contains("connection timed out") || s.contains("no route to host") {
+        Some(
+            "the server isn't reachable on this network. Check the IP and \
+             any firewall in between."
+                .into(),
+        )
+    } else if s.contains("nt_status_network_unreachable") {
+        Some(
+            "the server's network is unreachable from this container — \
+             check the host networking setup."
+                .into(),
+        )
+    } else if s.contains("does not exist") || s.contains("not a directory") {
+        Some(
+            "the listed path doesn't exist on the share. Make sure the \
+             share name is the top-level share, not a sub-path."
+                .into(),
+        )
+    } else if s.contains("session setup failed") {
+        Some(
+            "session setup failed — usually a protocol / dialect mismatch. \
+             Most modern servers speak SMB2/3; very old shares (XP) may \
+             need legacy support enabled on the server."
+                .into(),
+        )
+    } else {
+        None
+    }
+}
+
+fn share_id(server: &str, share: &str) -> String {
+    slugify_str(&format!("{server}-{share}"))
+}
+
+/// Normalize a server input: trim, strip scheme prefix the operator
+/// may have pasted, and drop trailing slashes. UNC-style `\\server`
+/// and `//server` prefixes are also accepted.
+fn normalize_server(raw: &str) -> String {
+    let s = raw.trim();
+    let s = s
+        .strip_prefix("smb://")
+        .or_else(|| s.strip_prefix("cifs://"))
+        .or_else(|| s.strip_prefix("\\\\"))
+        .or_else(|| s.strip_prefix("//"))
+        .unwrap_or(s);
+    s.trim_end_matches('/').trim_end_matches('\\').to_string()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn share_id_is_stable_and_safe() {
+        let a = share_id("10.0.0.5", "isos");
+        let b = share_id("10.0.0.5", "isos");
+        assert_eq!(a, b);
+        assert!(!a.contains('/'));
+        assert!(!a.contains('.'));
+    }
+
+    #[test]
+    fn normalize_server_strips_url_and_unc_prefixes() {
+        assert_eq!(normalize_server("  10.0.0.5  "), "10.0.0.5");
+        assert_eq!(normalize_server("smb://nas.lan/"), "nas.lan");
+        assert_eq!(normalize_server("cifs://192.168.1.51"), "192.168.1.51");
+        assert_eq!(normalize_server("\\\\192.168.1.51\\"), "192.168.1.51");
+        assert_eq!(normalize_server("//nas.lan//"), "nas.lan");
+        assert_eq!(normalize_server("nas.lan"), "nas.lan");
+    }
+
+    #[test]
+    fn hint_for_logon_failure_calls_out_credentials() {
+        let h = hint_for("session setup failed: NT_STATUS_LOGON_FAILURE").unwrap();
+        assert!(h.to_lowercase().contains("credentials"));
+    }
+
+    #[test]
+    fn hint_for_bad_share_name_calls_out_share_lookup() {
+        let h = hint_for("tree connect failed: NT_STATUS_BAD_NETWORK_NAME").unwrap();
+        assert!(h.to_lowercase().contains("share"));
+    }
+
+    #[test]
+    fn hint_for_unknown_is_none() {
+        assert!(hint_for("some unrelated error text").is_none());
+    }
+
+    #[test]
+    fn hint_for_missing_smbclient_calls_out_upgrade() {
+        // The exec-side path sets `stderr` to "smbclient binary not
+        // found on $PATH" when ENOENT lands.
+        let h = hint_for("smbclient binary not found on $PATH").unwrap();
+        assert!(
+            h.contains("smbclient") && h.to_lowercase().contains("install"),
+            "expected upgrade/install guidance, got: {h}"
+        );
+        // The raw error path on the API side passes the verbatim
+        // exec error in `error` plus an empty `stderr`. The
+        // SmbShareError constructor's hint_for fallback checks error
+        // too, so this pattern needs to translate as well.
+        let h2 =
+            hint_for("could not exec smbclient: No such file or directory (os error 2)").unwrap();
+        assert!(h2.contains("smbclient"));
+    }
+
+    #[test]
+    fn parse_ls_iso_finds_one_iso_and_skips_directories() {
+        let out = "\
+\tDomain=[WORKGROUP] OS=[Windows] Server=[Samba]\n\
+  .                                   D        0  Mon May 26 10:00:00 2026\n\
+  ..                                  D        0  Mon May 26 10:00:00 2026\n\
+  ubuntu-22.04-desktop.iso            A 3650912256  Mon May 26 11:00:00 2026\n\
+\n\
+\t\t4096 blocks of size 1048576. 1234 blocks available\n\
+";
+        let entries = parse_ls_iso(out);
+        assert_eq!(entries.len(), 1);
+        assert_eq!(entries[0].filename, "ubuntu-22.04-desktop.iso");
+        assert_eq!(entries[0].size, 3_650_912_256);
+    }
+
+    #[test]
+    fn parse_ls_iso_handles_filenames_with_spaces() {
+        let out = "\
+  Windows Server 2025.iso             A 5000000000  Tue May 27 09:00:00 2026\n\
+";
+        let entries = parse_ls_iso(out);
+        assert_eq!(entries.len(), 1);
+        assert_eq!(entries[0].filename, "Windows Server 2025.iso");
+        assert_eq!(entries[0].size, 5_000_000_000);
+    }
+
+    #[test]
+    fn parse_ls_iso_skips_non_iso_files() {
+        let out = "\
+  readme.txt                          A      100  Tue May 27 09:00:00 2026\n\
+  archive.zip                         A     5000  Tue May 27 09:00:00 2026\n\
+";
+        let entries = parse_ls_iso(out);
+        assert!(entries.is_empty());
+    }
+
+    #[test]
+    fn add_request_requires_username_when_not_guest() {
+        // We can't easily test the add() path against a real SMB
+        // server in unit tests, but we can confirm the validation
+        // logic at least serializes the request shape we expect. The
+        // actual auth check happens in add() itself which we cover in
+        // integration tests against a stub server.
+        let req = SmbAddRequest {
+            server: "10.0.0.5".into(),
+            share: "isos".into(),
+            username: None,
+            password: None,
+            guest: false,
+            port: None,
+        };
+        // No SmbShareManager here — we just check the field shape
+        // matches what UI submits.
+        assert!(!req.guest);
+        assert!(req.username.is_none());
+    }
+}

crates/iso-store/src/store.rs

@@ -3,8 +3,8 @@
 use crate::entry::{BootEntry, BootKind, KernelArgs};
 use crate::introspect::{introspect, DistroFamily, IntrospectionReport};
 use bytes::Bytes;
-use parking_lot::RwLock;
 use openpxe_core::{Error, Result};
+use parking_lot::RwLock;
 use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
 use std::collections::HashMap;
@@ -15,20 +15,68 @@ use tokio::io::AsyncWriteExt;
 
 /// Where the bytes for an ISO actually live.
 ///
-/// The default is `Local` — uploaded ISOs sit in `<iso_dir>/<id>.iso`.
+/// `Local` — uploaded ISO, sits at `<iso_dir>/<id>.iso`.
-/// `Nfs` entries point at a file inside a remote share that the
+/// `Smb` (v0.4.65) — remote SMB share, streamed via Samba's
-/// `NfsManager` is keeping mounted. We resolve the on-disk path lazily
+/// userspace `smbclient` CLI subprocess. No kernel mount, no local
-/// in [`IsoStore::iso_path_for`] using the `nfs_root` set at startup.
+/// cache. Sequential whole-file streaming; HTTP Range requests
+/// return 416.
+/// `Nfs` (v0.4.67) — remote NFSv3 share, streamed via the pure-Rust
+/// `nfs3_client` crate (in-process, no subprocess). Same "works in
+/// any container" property as SMB, plus Range requests work because
+/// NFSv3 READ3 takes an explicit offset.
+/// `Sftp` (v0.5.5) — remote SFTP-over-SSH share, streamed via the
+/// pure-Rust `russh` + `russh-sftp` crates (in-process). Like NFS it
+/// supports HTTP Range requests because SFTP opens a seekable file
+/// handle (`SSH_FXP_READ` at offset).
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(tag = "kind", rename_all = "snake_case")]
 pub enum IsoSource {
     #[default]
     Local,
-    Nfs {
+    /// v0.4.65: SMB via userspace `smbclient` works in any container.
-        mount_id: String,
+    Smb {
-        /// Path relative to the mount point — typically just the filename.
+        share_id: String,
+        /// Filename at the share root. We don't support nested paths
+        /// in v0.4.65; ISOs live at the top of the share.
         relative_path: String,
     },
+    /// v0.4.67: NFSv3 via the in-process `nfs3_client` crate.
+    Nfs {
+        share_id: String,
+        /// Filename at the export root.
+        relative_path: String,
+    },
+    /// v0.5.5: SFTP-over-SSH via the in-process `russh` + `russh-sftp`
+    /// crates.
+    Sftp {
+        share_id: String,
+        /// Filename at the export root.
+        relative_path: String,
+    },
+}
+
+/// Where the ISO lands in the PXE menu hierarchy.
+///
+/// Auto-detected family (Debian, Windows, …) still drives BIOS/UEFI
+/// behaviour and per-entry boot args, but the *menu placement* is
+/// operator-controlled — an operator who's uploaded a TinyCore live ISO
+/// to use as a recovery shim, or a SystemRescue image, can flip its
+/// category to `Tools` so it lands next to memtest/shell instead of
+/// under Linux Installers.
+///
+/// Old `meta.json` files without this field deserialize as `Os`, which
+/// matches v0.4.1 behaviour (everything goes under OS Installers).
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum IsoCategory {
+    /// "OS Installer" — routed via the auto-detected family into the
+    /// Linux / Windows installer submenus.
+    #[default]
+    Os,
+    /// "Tool" — surfaced under the Tools menu next to memtest, shell,
+    /// NIC info, etc. Family detection still decides BIOS/UEFI vs
+    /// wimboot vs sanboot at boot time.
+    Tools,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -56,6 +104,10 @@ pub struct IsoMeta {
     /// the common no-password case.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub password_hash: Option<String>,
+    /// Where the ISO sits in the PXE menu hierarchy — operator-controlled,
+    /// not driven by family detection. Defaults to [`IsoCategory::Os`].
+    #[serde(default)]
+    pub category: IsoCategory,
 }
 
 impl IsoMeta {
@@ -114,6 +166,7 @@ impl UploadHandle {
             boot_entries,
             source: IsoSource::Local,
             password_hash: None,
+            category: IsoCategory::default(),
         };
         store.persist_meta(&meta).await?;
         store.insert(meta.clone());
@@ -135,10 +188,6 @@ struct Inner {
 #[derive(Debug, Clone)]
 pub struct IsoStore {
     iso_dir: Arc<PathBuf>,
-    /// Where NFS mounts land on disk. Set at startup via
-    /// [`IsoStore::set_nfs_root`]; required for resolving any
-    /// `IsoSource::Nfs` entry.
-    nfs_root: Arc<RwLock<Option<PathBuf>>>,
     inner: Arc<RwLock<Inner>>,
 }
 
@@ -146,17 +195,10 @@ impl IsoStore {
     pub fn new(iso_dir: PathBuf) -> Self {
         Self {
             iso_dir: Arc::new(iso_dir),
-            nfs_root: Arc::new(RwLock::new(None)),
             inner: Arc::new(RwLock::new(Inner::default())),
         }
     }
 
-    /// Tell the store where NFS mounts live. Without this set,
-    /// `IsoSource::Nfs` entries cannot be resolved to a file path.
-    pub fn set_nfs_root(&self, root: PathBuf) {
-        *self.nfs_root.write() = Some(root);
-    }
-
     pub async fn ensure_dirs(&self) -> Result<()> {
         tokio::fs::create_dir_all(self.iso_dir.as_path()).await?;
         Ok(())
@@ -170,7 +212,9 @@ impl IsoStore {
         let mut entries = tokio::fs::read_dir(self.iso_dir.as_path()).await?;
         while let Some(e) = entries.next_entry().await? {
             let p = e.path();
-            if p.extension().and_then(|s| s.to_str()) != Some("json") { continue; }
+            if p.extension().and_then(|s| s.to_str()) != Some("json") {
+                continue;
+            }
             if !p
                 .file_name()
                 .and_then(|s| s.to_str())
@@ -179,7 +223,8 @@ impl IsoStore {
                 continue;
             }
             if let Ok(text) = tokio::fs::read_to_string(&p).await {
-                if let Ok(meta) = serde_json::from_str::<IsoMeta>(&text) {
+                if let Ok(mut meta) = serde_json::from_str::<IsoMeta>(&text) {
+                    self.reintrospect_if_stale(&mut meta).await;
                     self.insert(meta);
                 }
             }
@@ -187,6 +232,46 @@ impl IsoStore {
         Ok(())
     }
 
+    /// v0.5.9: re-run introspection on a *local* ISO whose persisted report
+    /// predates the current logic. ISOs uploaded by an older binary carry a
+    /// stale family/boot profile — most visibly a Windows 11 ISO tagged
+    /// `Unknown` before the UDF/El-Torito detection landed, which then shows
+    /// as "won't boot" forever. Re-probing on startup fixes them in place,
+    /// no delete-and-re-upload. Bounded: only `Local` sources (we have the
+    /// bytes locally) below [`introspect::INTROSPECT_REV`], so it runs at
+    /// most once per ISO per upgrade. The probe reads up to ~64 MiB, so we
+    /// push it onto the blocking pool to keep the async runtime responsive.
+    async fn reintrospect_if_stale(&self, meta: &mut IsoMeta) {
+        if !matches!(meta.source, IsoSource::Local)
+            || meta.introspection.introspect_rev >= crate::introspect::INTROSPECT_REV
+        {
+            return;
+        }
+        let path = self.iso_path(&meta.id);
+        if !path.exists() {
+            return;
+        }
+        let Ok(fresh) = tokio::task::spawn_blocking(move || introspect(&path)).await else {
+            tracing::warn!(target: "openpxe::iso", id = %meta.id, "re-introspect task failed");
+            return;
+        };
+        let before = meta.introspection.family;
+        meta.introspection = fresh;
+        meta.boot_entries = generate_boot_entries(&meta.id, &meta.filename, &meta.introspection);
+        if let Err(e) = self.persist_meta(meta).await {
+            tracing::warn!(target: "openpxe::iso", id = %meta.id, "re-introspect persist: {e}");
+            return;
+        }
+        tracing::info!(
+            target: "openpxe::iso",
+            id = %meta.id,
+            from = ?before,
+            to = ?meta.introspection.family,
+            el_torito = meta.introspection.el_torito,
+            "re-introspected stale ISO metadata"
+        );
+    }
+
     fn insert(&self, meta: IsoMeta) {
         self.inner.write().isos.insert(meta.id.clone(), meta);
     }
@@ -214,6 +299,9 @@ impl IsoStore {
             return Err(Error::Invalid(format!("iso '{id}' already exists")));
         }
         let partial_path = self.iso_dir.join(format!("{id}.partial"));
+        if partial_path.exists() {
+            return Err(Error::Invalid(format!("iso '{id}' is already uploading")));
+        }
         let file = tokio::fs::File::create(&partial_path).await?;
         Ok(UploadHandle {
             id,
@@ -247,36 +335,48 @@ impl IsoStore {
         self.inner.read().isos.get(id).cloned()
     }
 
-    /// Resolve an ISO id to its on-disk path, if any. For local entries
+    /// Resolve an ISO id to its on-disk path, if any. For local
-    /// this is `<iso_dir>/<id>.iso`; for NFS entries it's
+    /// (uploaded) ISOs this is `<iso_dir>/<id>.iso`. For SMB-sourced
-    /// `<nfs_root>/<mount_id>/<relative_path>`. Returns None if the file
+    /// ISOs there is no on-disk path — the HTTP handler must stream
-    /// is missing or the source isn't resolvable (e.g. NFS share
+    /// via `SmbShareManager::stream_iso` instead. Returns `None` for
-    /// unmounted).
+    /// SMB sources or when the file is missing.
     pub fn iso_path_for(&self, id: &str) -> Option<PathBuf> {
         let meta = self.get(id)?;
-        let path = match &meta.source {
+        self.local_path(&meta)
-            IsoSource::Local => self.iso_path(id),
+    }
-            IsoSource::Nfs {
+
-                mount_id,
+    /// Same resolution as [`Self::iso_path_for`], but for a meta the
-                relative_path,
+    /// caller already holds — skips the second registry lock + deep
-            } => {
+    /// clone, which matters on the per-range-request ISO serving path
-                let root = self.nfs_root.read().clone()?;
+    /// (a sanboot install issues hundreds of those).
-                root.join(mount_id).join(relative_path)
+    #[must_use]
+    pub fn local_path(&self, meta: &IsoMeta) -> Option<PathBuf> {
+        match &meta.source {
+            IsoSource::Local => {
+                let path = self.iso_path(&meta.id);
+                if path.exists() {
+                    Some(path)
+                } else {
+                    None
+                }
             }
-        };
+            // SMB, NFS, and SFTP sources have no local path — they're
-        if path.exists() {
+            // streamed in-process. Callers must inspect the source
-            Some(path)
+            // kind first and dispatch to the appropriate share
-        } else {
+            // manager.
-            None
+            IsoSource::Smb { .. } | IsoSource::Nfs { .. } | IsoSource::Sftp { .. } => None,
         }
     }
 
-    /// Delete an ISO and its sidecar metadata. Only acts on local ISOs;
+    /// Delete an ISO and its sidecar metadata. Only acts on local
-    /// for NFS-backed ISOs the operator must remove the file from the
+    /// (uploaded) ISOs; for SMB-backed ISOs the operator must remove
-    /// share or unmount the NFS share entirely.
+    /// the file from the share or unregister the share entirely.
     pub async fn delete(&self, id: &str) -> Result<()> {
         let meta = self.get(id);
-        let is_local = matches!(meta.as_ref().map(|m| &m.source), Some(IsoSource::Local) | None);
+        let is_local = matches!(
+            meta.as_ref().map(|m| &m.source),
+            Some(IsoSource::Local) | None
+        );
         if is_local {
             let iso = self.iso_path(id);
             let meta_path = self.meta_path(id);
@@ -287,10 +387,10 @@ impl IsoStore {
         Ok(())
     }
 
-    /// Register an externally-sourced ISO (e.g. NFS-mounted). Used by
+    /// Register an externally-sourced ISO (SMB share, etc.). Used by
-    /// `NfsManager` after walking a freshly-mounted share. We do **not**
+    /// `SmbShareManager` after listing a share. We do **not** persist
-    /// persist a `meta.json` on disk for these — the source of truth is
+    /// a `meta.json` on disk for these — the source of truth is the
-    /// the share itself, and the NFS manager re-scans on startup.
+    /// share itself, and the manager re-scans on startup.
     pub fn register_external(
         &self,
         id: String,
@@ -310,17 +410,46 @@ impl IsoStore {
             boot_entries,
             source,
             password_hash: None,
+            category: IsoCategory::default(),
         };
         self.inner.write().isos.insert(id, meta);
     }
 
-    /// Drop every entry that belongs to `mount_id`. Used by the NFS
+    /// v0.7.4: swap in a completed introspection for an external ISO and
-    /// manager when an operator removes a share, or before re-scanning
+    /// regenerate its boot entries. Used by the NFS/SFTP managers'
-    /// to clean out stale entries.
+    /// background probe pass — the scan registers a provisional
-    pub fn drop_external_source(&self, mount_id: &str) {
+    /// (filename-only) report immediately so startup and share-add stay
+    /// fast, then this upgrades each entry as its probe finishes.
+    /// Operator-set fields (category, password) are preserved; returns
+    /// `false` when the id is gone (share removed or re-scanned away
+    /// mid-probe), which callers treat as a benign no-op.
+    pub fn update_external_introspection(
+        &self,
+        id: &str,
+        introspection: IntrospectionReport,
+    ) -> bool {
         let mut g = self.inner.write();
-        g.isos.retain(|_, m| {
+        let Some(m) = g.isos.get_mut(id) else {
-            !matches!(&m.source, IsoSource::Nfs { mount_id: mid, .. } if mid == mount_id)
+            return false;
+        };
+        m.boot_entries = generate_boot_entries(&m.id, &m.filename, &introspection);
+        m.introspection = introspection;
+        true
+    }
+
+    /// Drop every entry that belongs to `share_id`. Used by the SMB
+    /// and NFS share managers when an operator removes a share, or
+    /// before re-scanning to clean out stale entries. The same id
+    /// space serves both protocols — share ids are slugified from
+    /// `server+share` (SMB) or `server+export` (NFS) and the
+    /// protocol-specific prefix prevents collisions.
+    pub fn drop_external_source(&self, share_id: &str) {
+        let mut g = self.inner.write();
+        g.isos.retain(|_, m| match &m.source {
+            IsoSource::Smb { share_id: sid, .. }
+            | IsoSource::Nfs { share_id: sid, .. }
+            | IsoSource::Sftp { share_id: sid, .. } => sid != share_id,
+            IsoSource::Local => true,
         });
     }
 
@@ -369,9 +498,50 @@ impl IsoStore {
         Ok(())
     }
 
+    /// Flip an ISO's menu category. Persists to `meta.json` for local
+    /// ISOs; NFS-sourced ISOs keep the change in memory only (the next
+    /// re-scan would overwrite it anyway).
+    pub async fn set_category(&self, id: &str, category: IsoCategory) -> Result<IsoMeta> {
+        let updated = {
+            let mut g = self.inner.write();
+            let m = g
+                .isos
+                .get_mut(id)
+                .ok_or_else(|| Error::Invalid(format!("no such iso '{id}'")))?;
+            m.category = category;
+            m.clone()
+        };
+        if matches!(updated.source, IsoSource::Local) {
+            self.persist_meta(&updated).await?;
+        }
+        Ok(updated)
+    }
+
+    /// Absolute path to the directory holding local ISO uploads. Used
+    /// by the HTTP layer for the disk-space endpoint — the volume that
+    /// hosts this directory is what runs out of room first.
+    #[must_use]
+    pub fn iso_dir(&self) -> PathBuf {
+        self.iso_dir.as_path().to_path_buf()
+    }
+
+    /// `(total_bytes, available_bytes)` for the filesystem hosting the
+    /// ISO directory. Returns `None` if `statvfs` fails (read-only
+    /// filesystem with no quota, mount disappeared, …) — callers
+    /// should treat that as "unknown" rather than zero.
+    ///
+    /// Lives here rather than the HTTP crate because `http-api`'s
+    /// `#![forbid(unsafe_code)]` rules out the libc FFI directly, and
+    /// because this is naturally an `IsoStore` question — the volume
+    /// of interest is whatever's hosting the iso dir.
+    #[must_use]
+    pub fn disk_usage(&self) -> Option<(u64, u64)> {
+        disk_usage_for(self.iso_dir.as_path())
+    }
+
     /// Verify a candidate password against the stored bcrypt hash.
     /// Returns:
-    /// - `Ok(true)`   — match (or the ISO has no password set; gate is open)
+    /// - `Ok(true)`   — match (or the ISO has no password set; boot is open)
     /// - `Ok(false)`  — mismatch
     /// - `Err(_)`     — id not found, or bcrypt error
     pub fn verify_password(&self, id: &str, candidate: &str) -> Result<bool> {
@@ -385,6 +555,33 @@ impl IsoStore {
     }
 }
 
+/// Resolve `(total, available)` bytes for the filesystem hosting `path`.
+/// Returns `None` if `statvfs` fails.
+#[allow(unsafe_code)]
+fn disk_usage_for(path: &std::path::Path) -> Option<(u64, u64)> {
+    use std::ffi::CString;
+    use std::os::unix::ffi::OsStrExt;
+    let c = CString::new(path.as_os_str().as_bytes()).ok()?;
+    // SAFETY: `statvfs` is repr(C); a zeroed value is a valid initial
+    // state per POSIX. The FFI call writes every field we then read.
+    let mut stat: libc::statvfs = unsafe { std::mem::zeroed() };
+    // SAFETY: `c` is a NUL-terminated C string pointing into a stack
+    // CString that outlives this call; `&mut stat` is a unique aligned
+    // pointer to a stack-local `statvfs`. The kernel writes through
+    // it but does not retain the pointer past return.
+    let rc = unsafe { libc::statvfs(c.as_ptr(), &raw mut stat) };
+    if rc != 0 {
+        return None;
+    }
+    // Use f_frsize (fundamental block size). f_bsize is "preferred I/O
+    // block" and doesn't always match the unit f_blocks is denominated
+    // in — on some BSDs it would over-report by a factor of 8.
+    let frsize = stat.f_frsize as u64;
+    let total = stat.f_blocks as u64 * frsize;
+    let avail = stat.f_bavail as u64 * frsize;
+    Some((total, avail))
+}
+
 fn slugify(filename: &str) -> String {
     let stem = Path::new(filename)
         .file_stem()
@@ -427,46 +624,79 @@ pub fn generate_boot_entries_for(
 /// Build `BootEntry`s from the introspection report. URLs are relative —
 /// the HTTP layer rewrites them with the public base URL per request.
 fn generate_boot_entries(id: &str, filename: &str, r: &IntrospectionReport) -> Vec<BootEntry> {
-    let title = r.volume_label.clone().unwrap_or_else(|| filename.to_string());
+    let title = r
+        .volume_label
+        .clone()
+        .unwrap_or_else(|| filename.to_string());
     match r.family {
-        DistroFamily::WindowsPe if r.has_boot_wim => {
+        DistroFamily::WindowsPe => {
-            // Standard wimboot chain. Paths are in-ISO; the HTTP layer maps
+            // v0.5.8: boot Windows directly via iPXE HTTP sanboot. iPXE
-            // `iso/<id>/<path>` to on-disk extraction via ISO9660 lookup.
+            // exposes the raw ISO as an emulated CD backed by on-demand
-            let base = format!("iso/{id}");
+            // HTTP range reads, and Windows Setup boots from it. This
+            // replaces the old wimboot+SMB chain, which (a) needed an SMB
+            // server the host often can't provide (port 445 collisions),
+            // (b) served in-ISO files via an ISO9660 lookup that failed on
+            // UDF-only Windows 11 ISOs, and (c) required an operator
+            // toggle. sanboot needs none of that — just the HTTP port,
+            // which works in any environment. The unmodified, stock ISO is
+            // served at iso/<id>.iso; nothing is injected into Windows.
             vec![BootEntry {
-                id: format!("{id}-winpe"),
+                id: format!("{id}-windows"),
-                title: format!("{title} (Windows / wimboot)"),
+                title: format!("{title} (Windows)"),
-                kind: BootKind::Wimboot {
+                kind: BootKind::SanBootIso {
-                    wimboot_url: "ipxe/wimboot".to_string(),
+                    iso_url: format!("iso/{id}.iso"),
-                    files: vec![
-                        ("bootmgr".into(), format!("{base}/bootmgr")),
-                        ("bootmgr.efi".into(), format!("{base}/bootmgr.efi")),
-                        ("bcd".into(), format!("{base}/boot/bcd")),
-                        ("boot.sdi".into(), format!("{base}/boot/boot.sdi")),
-                        ("boot.wim".into(), format!("{base}/sources/boot.wim")),
-                    ],
                 },
             }]
         }
         fam if r.kernel_path.is_some() => {
             let base = format!("iso/{id}");
             let kernel_url = format!("{base}{}", r.kernel_path.as_deref().unwrap_or(""));
-            let initrd_urls = r.initrd_paths.iter().map(|p| format!("{base}{p}")).collect();
+            let initrd_urls = r
-            let args = KernelArgs { cmdline: linux_cmdline(fam, id) };
+                .initrd_paths
+                .iter()
+                .map(|p| format!("{base}{p}"))
+                .collect();
+            let args = KernelArgs {
+                cmdline: linux_cmdline(fam, id),
+            };
             vec![BootEntry {
                 id: format!("{id}-linux"),
                 title,
-                kind: BootKind::LinuxKernel { kernel_url, initrd_urls, args },
+                kind: BootKind::LinuxKernel {
+                    kernel_url,
+                    initrd_urls,
+                    args,
+                },
             }]
         }
         _ => {
-            // Last-resort SAN boot. Won't work for large modern ISOs, but
+            // No Windows-install media and no Linux kernel/initrd. Decide
-            // lets the ISO at least appear in the menu.
+            // whether the ISO is bootable at all (v0.6.0):
-            vec![BootEntry {
+            //   * `el_torito` — it carries a boot catalog, so iPXE sanboots
-                id: format!("{id}-sanboot"),
+            //     the raw image as an emulated CD: BSDs, ESXi/VMvisor
-                title: format!("{title} (SAN boot — may fail for >1GiB ISOs)"),
+            //     installers, firmware tools, custom spins. The emulated CD
-                kind: BootKind::SanBootIso { iso_url: format!("iso/{id}.iso") },
+            //     is backed by HTTP range reads, so ISO size is a non-issue
-            }]
+            //     (this is the same path Windows uses since v0.5.8) — hence
+            //     no more "may fail for >1GiB ISOs" disclaimer.
+            //   * `introspect_rev == 0` — a remote-share ISO we couldn't
+            //     introspect (SMB/NFS/SFTP listings don't seek into the ISO).
+            //     Offer sanboot optimistically rather than hide a
+            //     likely-bootable installer.
+            // Otherwise it's a local image we *did* introspect and found to
+            // carry no boot catalog — a data/appliance ISO (e.g. a VMware
+            // vCenter Server Appliance bundle). It genuinely cannot boot, so
+            // we expose no menu entry; the dashboard flags it instead.
+            if r.el_torito || r.introspect_rev == 0 {
+                vec![BootEntry {
+                    id: format!("{id}-sanboot"),
+                    title,
+                    kind: BootKind::SanBootIso {
+                        iso_url: format!("iso/{id}.iso"),
+                    },
+                }]
+            } else {
+                Vec::new()
+            }
         }
     }
 }
@@ -475,8 +705,17 @@ fn linux_cmdline(family: DistroFamily, id: &str) -> String {
     // The HTTP layer resolves `${base-url}` at render time.
     let iso_url = format!("${{base-url}}/iso/{id}.iso");
     match family {
+        // VMware-UEFI fix (v0.4.5, matching Bootimus v0.1.67's Casper
+        // patch): drop `netboot=url url=… ---` in favour of the
+        // canonical Casper option `iso-url=` and add `ds=nocloud` so
+        // cloud-init / subiquity (live-server) doesn't stall waiting on
+        // a metadata datasource that doesn't exist in PXE. Without
+        // `ds=nocloud`, Ubuntu live-server / Mint / Pop!_OS / elementary
+        // ISOs would boot fine on bare-metal UEFI but hang at "cloud-init
+        // running" on VMware-UEFI guests because the vmxnet3 driver's
+        // late-init upsets cloud-init's network probe.
         DistroFamily::DebianUbuntu => format!(
-            "boot=casper netboot=url url={iso_url} ip=dhcp ---"
+            "boot=casper initrd=initrd ds=nocloud ip=dhcp iso-url={iso_url}"
         ),
         DistroFamily::RhelFedora => format!(
             "inst.repo={iso_url} inst.stage2={iso_url} ip=dhcp"
@@ -511,6 +750,69 @@ mod tests {
         assert_eq!(slugify("/etc/passwd"), "passwd");
     }
 
+    #[test]
+    fn casper_cmdline_vmware_uefi_safe() {
+        // v0.4.5 regression guard: the Debian/Ubuntu cmdline must use
+        // the canonical Casper `iso-url=` option and include
+        // `ds=nocloud` so VMware-UEFI guests don't hang at "cloud-init
+        // running" waiting on a metadata datasource that PXE can't
+        // provide. The legacy `netboot=url url=… ---` form is gone for
+        // good.
+        let s = linux_cmdline(DistroFamily::DebianUbuntu, "ubuntu-24-04");
+        assert!(s.contains("boot=casper"), "{s}");
+        assert!(
+            s.contains("iso-url=${base-url}/iso/ubuntu-24-04.iso"),
+            "{s}"
+        );
+        assert!(s.contains("ds=nocloud"), "{s}");
+        assert!(s.contains("ip=dhcp"), "{s}");
+        assert!(!s.contains("netboot=url"), "legacy option leaked: {s}");
+        assert!(!s.contains(" --- "), "stray ---: {s}");
+    }
+
+    #[test]
+    fn boot_entries_respect_el_torito_and_source() {
+        use crate::introspect::INTROSPECT_REV;
+
+        // ESXi / VMvisor installer shape: bootable (carries an El Torito
+        // catalog) but not classifiable as Windows or Linux. Must yield a
+        // single sanboot entry so it's selectable + boots via emulated CD.
+        let esxi = IntrospectionReport {
+            family: DistroFamily::Unknown,
+            volume_label: Some("ESXI-7.0U3".into()),
+            el_torito: true,
+            introspect_rev: INTROSPECT_REV,
+            ..Default::default()
+        };
+        let e = generate_boot_entries("esxi", "VMware-VMvisor-Installer-7.0U3n.iso", &esxi);
+        assert_eq!(e.len(), 1, "ESXi should get exactly one boot entry");
+        assert!(matches!(e[0].kind, BootKind::SanBootIso { .. }));
+        // Clean title — no stale ">1GiB may fail" disclaimer.
+        assert!(!e[0].title.contains("may fail"), "title: {}", e[0].title);
+
+        // VCSA / data-appliance shape: locally introspected (rev set), no
+        // boot catalog, not Windows/Linux. Genuinely unbootable → no entry,
+        // so it stays out of the iPXE menu (the dashboard flags it instead).
+        let vcsa = IntrospectionReport {
+            family: DistroFamily::Unknown,
+            el_torito: false,
+            introspect_rev: INTROSPECT_REV,
+            ..Default::default()
+        };
+        assert!(
+            generate_boot_entries("vcsa", "VMware-VCSA-all-8.0.iso", &vcsa).is_empty(),
+            "data/appliance ISO must produce no boot entry"
+        );
+
+        // Remote-share ISO: never introspected (rev 0, no random access over
+        // SMB/NFS/SFTP). Assume bootable and offer sanboot rather than hide a
+        // likely-bootable installer.
+        let remote = IntrospectionReport::default();
+        let r = generate_boot_entries("remote", "unknown-remote.iso", &remote);
+        assert_eq!(r.len(), 1, "remote (uninspected) ISO keeps a sanboot entry");
+        assert!(matches!(r[0].kind, BootKind::SanBootIso { .. }));
+    }
+
     fn fake_meta(id: &str) -> IsoMeta {
         IsoMeta {
             id: id.into(),
@@ -518,16 +820,11 @@ mod tests {
             size_bytes: 0,
             sha256_hex: None,
             uploaded_at: OffsetDateTime::now_utc(),
-            introspection: IntrospectionReport {
+            introspection: IntrospectionReport::default(),
-                family: DistroFamily::Unknown,
-                volume_label: None,
-                kernel_path: None,
-                initrd_paths: vec![],
-                has_boot_wim: false,
-            },
             boot_entries: vec![],
             source: IsoSource::Local,
             password_hash: None,
+            category: IsoCategory::default(),
         }
     }
 
@@ -536,7 +833,11 @@ mod tests {
         let dir = tempdir().unwrap();
         let store = IsoStore::new(dir.path().to_path_buf());
         store.ensure_dirs().await.unwrap();
-        store.inner.write().isos.insert("alpha".into(), fake_meta("alpha"));
+        store
+            .inner
+            .write()
+            .isos
+            .insert("alpha".into(), fake_meta("alpha"));
 
         // No password set — verify_password returns Ok(true) for any input.
         assert!(store.verify_password("alpha", "anything").unwrap());
@@ -570,6 +871,19 @@ mod tests {
         assert!(matches!(r, Err(Error::Invalid(_))));
     }
 
+    #[tokio::test]
+    async fn begin_upload_rejects_existing_partial_file() {
+        let dir = tempdir().unwrap();
+        let store = IsoStore::new(dir.path().to_path_buf());
+        store.ensure_dirs().await.unwrap();
+        tokio::fs::write(dir.path().join("ubuntu.partial"), b"in-flight")
+            .await
+            .unwrap();
+
+        let r = store.begin_upload("ubuntu.iso").await;
+        assert!(matches!(r, Err(Error::Invalid(_))));
+    }
+
     #[tokio::test]
     async fn password_persists_via_meta_json_for_local_isos() {
         // Hash makes it onto disk so it survives a restart.

crates/iso-store/src/unattended.rs

@@ -0,0 +1,412 @@
+//! Unattended-install answer-file store (v0.5.2).
+//!
+//! Operators upload the answer file their installer expects — a RHEL/
+//! Fedora **Kickstart**, a Debian **Preseed**, an Ubuntu **Autoinstall**
+//! cloud-init user-data, or a Windows **answer file** (`autounattend.xml`)
+//! — and OpenPXE serves it on demand to the booting machine. Files live
+//! in their own directory (`<unattended_dir>/`), deliberately *not* under
+//! `iso_dir`, so they never appear in the ISO listing or the PXE menu.
+//!
+//! Storage mirrors [`crate::store::IsoStore`]: in-memory map authoritative
+//! for the process, sidecar `*.meta.json` on disk is the source of truth on
+//! restart. The raw answer file sits beside it as `<id>.file`.
+//!
+//! Templating is applied at *serve* time, not store time — see
+//! [`render_template`]. The stored bytes are exactly what the operator
+//! uploaded; per-host hostname/IP/MAC values are substituted into a copy
+//! when the file is fetched for a specific client.
+
+use crate::store::slugify_str;
+use openpxe_core::{Error, Result};
+use parking_lot::RwLock;
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use std::path::PathBuf;
+use std::sync::Arc;
+use time::OffsetDateTime;
+
+/// Disk + memory cap for one answer file. Kickstarts/preseeds/cloud-init
+/// configs are a few KB; 1 MiB is a comfortable ceiling that still bounds
+/// abuse.
+pub const MAX_UNATTENDED_BYTES: usize = 1024 * 1024;
+
+/// Which installer the answer file targets. Drives the kernel-argument
+/// injection in the boot chain.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum UnattendedKind {
+    /// RHEL / Fedora / CentOS / AlmaLinux / Rocky — `inst.ks=<url>`.
+    Kickstart,
+    /// Debian / older Ubuntu — `auto=true priority=critical url=<url>`.
+    Preseed,
+    /// Ubuntu 20.04+ Subiquity autoinstall — cloud-init NoCloud:
+    /// `autoinstall ds=nocloud-net;s=<url>/`.
+    Autoinstall,
+    /// Windows Setup answer file (`autounattend.xml`). Served, not
+    /// auto-injected (Windows reads it from media/USB, not a kernel arg).
+    AnswerFile,
+    /// Couldn't classify — stored + served, no auto-injection.
+    #[default]
+    Unknown,
+}
+
+impl UnattendedKind {
+    #[must_use]
+    pub fn label(self) -> &'static str {
+        match self {
+            UnattendedKind::Kickstart => "Kickstart",
+            UnattendedKind::Preseed => "Preseed",
+            UnattendedKind::Autoinstall => "Autoinstall",
+            UnattendedKind::AnswerFile => "Answer file",
+            UnattendedKind::Unknown => "Unknown",
+        }
+    }
+}
+
+/// Lowercase file extension (no dot), or `None` if there isn't one.
+fn ext_lower(filename: &str) -> Option<String> {
+    std::path::Path::new(filename)
+        .extension()
+        .and_then(|e| e.to_str())
+        .map(str::to_ascii_lowercase)
+}
+
+/// Classify an upload from its filename + a peek at its content. Best
+/// effort: extension first, then a content sniff to disambiguate the
+/// `.cfg` case (both Kickstart and Preseed use it).
+#[must_use]
+pub fn classify(filename: &str, content: &[u8]) -> UnattendedKind {
+    let lower_name = filename.to_ascii_lowercase();
+    let ext = ext_lower(filename);
+    let text = String::from_utf8_lossy(&content[..content.len().min(8192)]);
+    let looks_preseed = text.contains("d-i ") || text.contains("preseed/");
+    let looks_kickstart = text.contains("%packages")
+        || text.contains("\nlang ")
+        || text.contains("\nkeyboard ")
+        || text.contains("bootloader --")
+        || text.starts_with("install");
+    let looks_cloud_init = text.contains("autoinstall")
+        || text.contains("#cloud-config")
+        || text.contains("version: 1");
+
+    match ext.as_deref() {
+        Some("ks") => return UnattendedKind::Kickstart,
+        Some("seed") => return UnattendedKind::Preseed,
+        Some("xml") => return UnattendedKind::AnswerFile,
+        Some("yaml" | "yml") => return UnattendedKind::Autoinstall,
+        Some("cfg") => {
+            return if looks_kickstart && !looks_preseed {
+                UnattendedKind::Kickstart
+            } else {
+                UnattendedKind::Preseed
+            };
+        }
+        _ => {}
+    }
+    if lower_name == "user-data" {
+        return UnattendedKind::Autoinstall;
+    }
+    // No recognised extension — fall back to content sniffing.
+    if looks_cloud_init {
+        UnattendedKind::Autoinstall
+    } else if looks_kickstart {
+        UnattendedKind::Kickstart
+    } else if looks_preseed {
+        UnattendedKind::Preseed
+    } else {
+        UnattendedKind::Unknown
+    }
+}
+
+/// True if the filename carries an extension we accept for upload. We
+/// also accept the bare `user-data` name (cloud-init NoCloud convention).
+#[must_use]
+pub fn is_accepted_filename(filename: &str) -> bool {
+    if filename.trim().eq_ignore_ascii_case("user-data") {
+        return true;
+    }
+    matches!(
+        ext_lower(filename).as_deref(),
+        Some("ks" | "cfg" | "seed" | "yaml" | "yml" | "xml")
+    )
+}
+
+/// Sidecar metadata for a stored answer file.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct UnattendedMeta {
+    /// URL-safe slug, unique within the store.
+    pub id: String,
+    /// Original upload filename, shown in the UI.
+    pub filename: String,
+    pub kind: UnattendedKind,
+    pub size_bytes: u64,
+    #[serde(with = "time::serde::rfc3339")]
+    pub uploaded_at: OffsetDateTime,
+}
+
+#[derive(Debug, Default)]
+struct Inner {
+    files: HashMap<String, UnattendedMeta>,
+}
+
+/// In-memory + on-disk answer-file registry. Cheap to clone.
+#[derive(Debug, Clone)]
+pub struct UnattendedStore {
+    dir: Arc<PathBuf>,
+    inner: Arc<RwLock<Inner>>,
+}
+
+impl UnattendedStore {
+    #[must_use]
+    pub fn new(dir: PathBuf) -> Self {
+        Self {
+            dir: Arc::new(dir),
+            inner: Arc::new(RwLock::new(Inner::default())),
+        }
+    }
+
+    pub async fn ensure_dir(&self) -> Result<()> {
+        tokio::fs::create_dir_all(self.dir.as_path()).await?;
+        Ok(())
+    }
+
+    /// Scan the directory on startup, loading every `*.meta.json` sidecar.
+    pub async fn load_from_disk(&self) -> Result<()> {
+        self.ensure_dir().await?;
+        let mut entries = tokio::fs::read_dir(self.dir.as_path()).await?;
+        while let Some(e) = entries.next_entry().await? {
+            let p = e.path();
+            let is_meta = p
+                .file_name()
+                .and_then(|s| s.to_str())
+                .is_some_and(|n| n.ends_with(".meta.json"));
+            if !is_meta {
+                continue;
+            }
+            if let Ok(text) = tokio::fs::read_to_string(&p).await {
+                if let Ok(meta) = serde_json::from_str::<UnattendedMeta>(&text) {
+                    self.inner.write().files.insert(meta.id.clone(), meta);
+                }
+            }
+        }
+        Ok(())
+    }
+
+    fn data_path(&self, id: &str) -> PathBuf {
+        self.dir.join(format!("{id}.file"))
+    }
+
+    fn meta_path(&self, id: &str) -> PathBuf {
+        self.dir.join(format!("{id}.meta.json"))
+    }
+
+    /// Mint a unique slug from the upload filename's stem.
+    fn unique_id(&self, filename: &str) -> String {
+        let stem = filename.rsplit_once('.').map_or(filename, |(s, _)| s);
+        let base = {
+            let s = slugify_str(stem);
+            if s.is_empty() {
+                "unattended".to_string()
+            } else {
+                s
+            }
+        };
+        let g = self.inner.read();
+        if !g.files.contains_key(&base) {
+            return base;
+        }
+        for n in 1.. {
+            let candidate = format!("{base}-{n}");
+            if !g.files.contains_key(&candidate) {
+                return candidate;
+            }
+        }
+        unreachable!("u64 ids exhausted")
+    }
+
+    /// Store an uploaded answer file. Validates type + size, classifies,
+    /// writes the bytes + a sidecar, and returns the new metadata.
+    pub async fn add(&self, filename: &str, bytes: &[u8]) -> Result<UnattendedMeta> {
+        if !is_accepted_filename(filename) {
+            return Err(Error::Invalid(format!(
+                "unsupported answer-file type '{filename}'. Accepted: .ks, .cfg, .seed, .yaml, .yml, .xml, user-data"
+            )));
+        }
+        if bytes.len() > MAX_UNATTENDED_BYTES {
+            return Err(Error::Invalid(format!(
+                "answer file too large ({} bytes, max {MAX_UNATTENDED_BYTES})",
+                bytes.len()
+            )));
+        }
+        self.ensure_dir().await?;
+        let kind = classify(filename, bytes);
+        let id = self.unique_id(filename);
+        let meta = UnattendedMeta {
+            id: id.clone(),
+            filename: filename.to_string(),
+            kind,
+            size_bytes: bytes.len() as u64,
+            uploaded_at: OffsetDateTime::now_utc(),
+        };
+        // Atomic data write: tmp -> rename.
+        let data = self.data_path(&id);
+        let tmp = data.with_extension("file.tmp");
+        tokio::fs::write(&tmp, bytes).await?;
+        tokio::fs::rename(&tmp, &data).await?;
+        let meta_text = serde_json::to_string_pretty(&meta).map_err(|e| Error::Other(e.into()))?;
+        tokio::fs::write(self.meta_path(&id), meta_text).await?;
+        self.inner.write().files.insert(id.clone(), meta.clone());
+        tracing::info!(
+            target: "openpxe::unattended",
+            id = %id, file = %filename, kind = ?kind, size = bytes.len(),
+            "unattended answer file stored"
+        );
+        Ok(meta)
+    }
+
+    #[must_use]
+    pub fn list(&self) -> Vec<UnattendedMeta> {
+        let g = self.inner.read();
+        let mut v: Vec<_> = g.files.values().cloned().collect();
+        v.sort_by_key(|m| std::cmp::Reverse(m.uploaded_at));
+        v
+    }
+
+    #[must_use]
+    pub fn get(&self, id: &str) -> Option<UnattendedMeta> {
+        self.inner.read().files.get(id).cloned()
+    }
+
+    /// Read the raw stored bytes for `id`.
+    pub async fn read(&self, id: &str) -> Result<Vec<u8>> {
+        if !self.inner.read().files.contains_key(id) {
+            return Err(Error::NotFound(format!("no unattended file '{id}'")));
+        }
+        let bytes = tokio::fs::read(self.data_path(id)).await?;
+        Ok(bytes)
+    }
+
+    /// Remove a file + its sidecar. Returns true if something was removed.
+    pub async fn remove(&self, id: &str) -> bool {
+        let existed = self.inner.write().files.remove(id).is_some();
+        if existed {
+            let _ = tokio::fs::remove_file(self.data_path(id)).await;
+            let _ = tokio::fs::remove_file(self.meta_path(id)).await;
+        }
+        existed
+    }
+
+    #[must_use]
+    pub fn len(&self) -> usize {
+        self.inner.read().files.len()
+    }
+
+    #[must_use]
+    pub fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+}
+
+/// Substitute the per-host template tokens into an answer file at serve
+/// time. Recognised tokens (case-sensitive, double-brace): `{{HOSTNAME}}`,
+/// `{{IP}}`, `{{MAC}}`. Unset values render as an empty string so a
+/// half-filled profile never leaves a literal `{{IP}}` in the file.
+#[must_use]
+pub fn render_template(
+    content: &str,
+    mac: Option<&str>,
+    hostname: Option<&str>,
+    ip: Option<&str>,
+) -> String {
+    content
+        .replace("{{HOSTNAME}}", hostname.unwrap_or(""))
+        .replace("{{IP}}", ip.unwrap_or(""))
+        .replace("{{MAC}}", mac.unwrap_or(""))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::tempdir;
+
+    #[test]
+    fn classify_by_extension() {
+        assert_eq!(
+            classify(" subiquity.yaml", b""),
+            UnattendedKind::Autoinstall
+        );
+        assert_eq!(classify("ks.ks", b""), UnattendedKind::Kickstart);
+        assert_eq!(classify("preseed.seed", b""), UnattendedKind::Preseed);
+        assert_eq!(
+            classify("autounattend.xml", b"<xml/>"),
+            UnattendedKind::AnswerFile
+        );
+        assert_eq!(classify("user-data", b""), UnattendedKind::Autoinstall);
+    }
+
+    #[test]
+    fn classify_cfg_by_content() {
+        assert_eq!(
+            classify("answer.cfg", b"d-i debian-installer/locale string en_US"),
+            UnattendedKind::Preseed
+        );
+        assert_eq!(
+            classify("answer.cfg", b"install\n%packages\n@core\n%end\n"),
+            UnattendedKind::Kickstart
+        );
+    }
+
+    #[test]
+    fn accepted_filenames() {
+        assert!(is_accepted_filename("a.ks"));
+        assert!(is_accepted_filename("USER-DATA".to_lowercase().as_str()));
+        assert!(is_accepted_filename("autounattend.XML"));
+        assert!(!is_accepted_filename("evil.sh"));
+        assert!(!is_accepted_filename("image.iso"));
+    }
+
+    #[test]
+    fn template_substitutes_and_blanks_unset() {
+        let body = "ip={{IP}} host={{HOSTNAME}} mac={{MAC}}";
+        let out = render_template(body, Some("aa:bb"), Some("node1"), None);
+        assert_eq!(out, "ip= host=node1 mac=aa:bb");
+    }
+
+    #[tokio::test]
+    async fn add_list_read_remove_round_trip() {
+        let dir = tempdir().unwrap();
+        let s = UnattendedStore::new(dir.path().join("unattended"));
+        let meta = s
+            .add("rocky.ks", b"install\n%packages\n@core\n%end\n")
+            .await
+            .unwrap();
+        assert_eq!(meta.kind, UnattendedKind::Kickstart);
+        assert_eq!(s.len(), 1);
+        let got = s.read(&meta.id).await.unwrap();
+        assert!(got.starts_with(b"install"));
+        // Survives a reload.
+        let s2 = UnattendedStore::new(dir.path().join("unattended"));
+        s2.load_from_disk().await.unwrap();
+        assert!(s2.get(&meta.id).is_some());
+        assert!(s2.remove(&meta.id).await);
+        assert!(s2.get(&meta.id).is_none());
+    }
+
+    #[tokio::test]
+    async fn rejects_bad_type_and_oversize() {
+        let dir = tempdir().unwrap();
+        let s = UnattendedStore::new(dir.path().join("unattended"));
+        assert!(s.add("evil.sh", b"#!/bin/sh").await.is_err());
+        let big = vec![b'x'; MAX_UNATTENDED_BYTES + 1];
+        assert!(s.add("big.ks", &big).await.is_err());
+    }
+
+    #[tokio::test]
+    async fn ids_are_unique() {
+        let dir = tempdir().unwrap();
+        let s = UnattendedStore::new(dir.path().join("unattended"));
+        let a = s.add("ks.ks", b"install").await.unwrap();
+        let b = s.add("ks.ks", b"install").await.unwrap();
+        assert_ne!(a.id, b.id);
+    }
+}

crates/iso-store/src/windows.rs

@@ -54,7 +54,10 @@ pub struct WimPatcher {
 impl WimPatcher {
     #[must_use]
     pub fn new(smb_host: String, smb_share: String) -> Self {
-        Self { smb_host, smb_share }
+        Self {
+            smb_host,
+            smb_share,
+        }
     }
 
     /// Apply WinPE patches to `boot.wim` inside `extracted_iso_dir`. Returns
@@ -72,31 +75,40 @@ impl WimPatcher {
 
         let work = match tempfile::tempdir() {
             Ok(d) => d,
-            Err(e) => return WinPatchState::Failed { reason: format!("tempdir: {e}") },
+            Err(e) => {
+                return WinPatchState::Failed {
+                    reason: format!("tempdir: {e}"),
+                }
+            }
         };
 
         // Stage the two files we want present at /Windows/System32/.
         let staging = work.path().join("stage/Windows/System32");
         if let Err(e) = std::fs::create_dir_all(&staging) {
-            return WinPatchState::Failed { reason: format!("staging mkdir: {e}") };
+            return WinPatchState::Failed {
+                reason: format!("staging mkdir: {e}"),
+            };
         }
         if let Err(e) = std::fs::write(staging.join("winpeshl.ini"), WINPESHL_INI) {
-            return WinPatchState::Failed { reason: format!("write winpeshl.ini: {e}") };
+            return WinPatchState::Failed {
+                reason: format!("write winpeshl.ini: {e}"),
+            };
         }
         let startnet = render_startnet(&self.smb_host, &self.smb_share);
         if let Err(e) = std::fs::write(staging.join("startnet.cmd"), startnet) {
-            return WinPatchState::Failed { reason: format!("write startnet.cmd: {e}") };
+            return WinPatchState::Failed {
+                reason: format!("write startnet.cmd: {e}"),
+            };
         }
 
         // Build a wimlib update command file:
         //   add <stage>/Windows/System32 /Windows/System32
         let update_file = work.path().join("update.cmd");
-        let update_cmd = format!(
+        let update_cmd = format!("add \"{}\" \"/Windows/System32\"\n", staging.display());
-            "add \"{}\" \"/Windows/System32\"\n",
-            staging.display()
-        );
         if let Err(e) = std::fs::write(&update_file, update_cmd) {
-            return WinPatchState::Failed { reason: format!("write update.cmd: {e}") };
+            return WinPatchState::Failed {
+                reason: format!("write update.cmd: {e}"),
+            };
         }
 
         // Run wimlib-imagex update against image index 2 (WinPE).
@@ -120,7 +132,9 @@ impl WimPatcher {
                     String::from_utf8_lossy(&o.stderr)
                 ),
             },
-            Err(e) => WinPatchState::Failed { reason: format!("spawn wimlib-imagex: {e}") },
+            Err(e) => WinPatchState::Failed {
+                reason: format!("spawn wimlib-imagex: {e}"),
+            },
         }
     }
 }
@@ -133,7 +147,9 @@ fn which(cmd: &str) -> Option<PathBuf> {
     let paths = std::env::var_os("PATH")?;
     for dir in std::env::split_paths(&paths) {
         let p = dir.join(cmd);
-        if p.is_file() { return Some(p); }
+        if p.is_file() {
+            return Some(p);
+        }
     }
     None
 }
@@ -174,7 +190,11 @@ fn render_startnet(host: &str, share: &str) -> String {
     )
     .unwrap();
     s.push_str(":havenet\r\n");
-    writeln!(s, "echo Mapping install media from \\\\{host}\\{share}...\r").unwrap();
+    writeln!(
+        s,
+        "echo Mapping install media from \\\\{host}\\{share}...\r"
+    )
+    .unwrap();
     writeln!(
         s,
         ":mapshare\r\nnet use Z: \\\\{host}\\{share} /user:guest \"\" /persistent:no && goto mapped\r\n\
@@ -205,6 +225,23 @@ mod tests {
         assert!(s.contains("setup.exe"));
     }
 
+    #[test]
+    fn startnet_primes_workstation_and_surfaces_mapping_errors() {
+        let s = render_startnet("10.0.0.5", "win11");
+        assert!(
+            s.contains("net start Workstation"),
+            "WinPE should explicitly start the SMB client before net use:\n{s}"
+        );
+        let net_use_line = s
+            .lines()
+            .find(|line| line.contains("net use Z:"))
+            .expect("net use line");
+        assert!(
+            !net_use_line.contains(">nul"),
+            "net use errors must remain visible in WinPE console: {net_use_line}"
+        );
+    }
+
     #[test]
     fn patcher_reports_wimlib_missing_gracefully() {
         // We don't assume wimlib is present in CI; this checks the missing

crates/openpxe/src/main.rs

@@ -4,16 +4,16 @@
 
 use clap::{Parser, Subcommand};
 use openpxe_core::{
-    ClientRegistry, Config, DhcpMode, DeploymentQueue, HostBindings, LogBus, LogBusLayer, Metrics,
+    ClientRegistry, Config, DeploymentQueue, DhcpMode, HostBindings, LogBus, LogBusLayer, Metrics,
     SettingsStore,
 };
 use openpxe_dhcp_proxy::DhcpProxyServer;
 use openpxe_http_api::{build_router, AppState};
-use openpxe_iso_store::{IsoStore, NfsManager, SmbManager};
+use openpxe_iso_store::{IsoStore, NfsShareManager, SftpShareManager, SmbManager, SmbShareManager};
-use std::sync::Arc;
 use openpxe_tftp::TftpServer;
 use std::net::{Ipv4Addr, SocketAddr};
 use std::path::PathBuf;
+use std::sync::Arc;
 use tokio::io::AsyncReadExt;
 
 #[derive(Debug, Parser)]
@@ -39,7 +39,7 @@ enum Command {
     ///   docker run --rm \
     ///     -v /my/isos:/seed:ro \
     ///     -v openpxe-data:/var/lib/openpxe/isos \
-    ///     openpxe:0.1.0 seed --from /seed
+    ///     openpxe:0.4.1 seed --from /seed
     Seed {
         /// Source directory containing one or more `.iso` files.
         #[arg(long)]
@@ -59,11 +59,10 @@ async fn main() -> anyhow::Result<()> {
     init_tracing(log_bus.clone());
 
     let cli = Cli::parse();
-    let mut config = match &cli.config {
+    // v0.5.4: layered load via figment — defaults → optional TOML → env.
-        Some(p) if p.exists() => Config::from_toml_file(p)?,
+    // The OPENPXE_* env layer keeps the historical flat names (see
-        _ => Config::default(),
+    // `Config::load`), so existing deployments are unaffected.
-    };
+    let config = Config::load(cli.config.as_deref())?;
-    config.apply_env();
 
     // Dispatch subcommands before bringing up the server.
     if let Some(cmd) = cli.command {
@@ -95,14 +94,35 @@ async fn main() -> anyhow::Result<()> {
             }
         },
     };
-    let public_base_url = format!("http://{our_ip}");
+    // v0.5.6: the advertised base URL must carry the HTTP port. Every
+    // client-facing URL (the DHCP-proxy iPXE filename, UEFI HTTP boot,
+    // and the menu's kernel/initrd/ISO links) is derived from this one
+    // string, so omitting the port silently pointed PXE clients at :80 —
+    // breaking every non-80 deployment (e.g. the Unraid template's 4200,
+    // chosen to dodge the webGUI). See `build_public_base_url`.
+    let public_base_url = build_public_base_url(our_ip, config.server.http_port);
 
     let iso_store = IsoStore::new(config.paths.iso_dir.clone());
     iso_store.load_from_disk().await?;
+    // v0.5.2: unattended answer-file store (Kickstart/Preseed/Autoinstall/
+    // Windows answer files). Separate directory from the ISO store.
+    let unattended = openpxe_iso_store::UnattendedStore::new(config.paths.unattended_dir.clone());
+    if let Err(e) = unattended.load_from_disk().await {
+        tracing::warn!(
+            target: "openpxe::unattended",
+            "could not load unattended files on startup: {e}"
+        );
+    }
     let clients = ClientRegistry::new();
-    let gates = DeploymentQueue::new();
+    let queue = DeploymentQueue::new();
     let settings = SettingsStore::load_or_default(&config.paths.work_dir);
     let hosts = HostBindings::load_or_default(&config.paths.work_dir);
+    let boot_log = openpxe_core::BootLog::load_or_default(&config.paths.work_dir);
+    let branding = openpxe_core::BrandingStore::load_or_default(&config.paths.work_dir);
+    let admin = openpxe_core::AdminStore::load_or_default(&config.paths.work_dir);
+    let sso = openpxe_core::SsoStore::load_or_default(&config.paths.work_dir);
+    let notify = openpxe_core::NotifyStore::load_or_default(&config.paths.work_dir);
+    let sessions = openpxe_http_api::auth::SessionStore::default();
     let metrics = Metrics::new();
 
     // Build the SMB manager unconditionally — it starts/stops on the
@@ -114,13 +134,43 @@ async fn main() -> anyhow::Result<()> {
         let _ = smb.start();
     }
 
-    // NFS manager. The mount root has to be set on the IsoStore *before*
+    // v0.4.65: SMB share manager — Samba `smbclient` userspace
-    // we replay any persisted mounts, otherwise an in-memory IsoMeta
+    // consumer. Replaces the kernel-mount NFS path that v0.4.64
-    // pointing at an NFS source can't resolve to a path.
+    // shipped; that didn't work on hosts whose kernel lacked the nfs
-    let nfs = NfsManager::new(&config.paths.work_dir, iso_store.clone());
+    // client modules (Unraid is the dominant case). `smbclient` does
-    iso_store.set_nfs_root(nfs.mount_root());
+    // the SMB protocol entirely in userspace over TCP and works in
-    if let Err(e) = nfs.load_and_remount().await {
+    // any container regardless of capabilities or kernel modules.
-        tracing::warn!(target: "openpxe::nfs", "could not reload NFS mounts: {e}");
+    let smb_shares = SmbShareManager::new(&config.paths.work_dir, iso_store.clone());
+    if let Err(e) = smb_shares.load_and_rescan().await {
+        tracing::warn!(
+            target: "openpxe::smb",
+            "could not reload SMB shares on startup: {e}"
+        );
+    }
+
+    // v0.4.67: NFSv3 share manager — pure-Rust in-process consumer
+    // via the `nfs3_client` crate. Sits alongside the SMB manager;
+    // operators pick whichever protocol their NAS prefers, or use
+    // both. No subprocess, no kernel mount, works in any container.
+    let nfs_shares = NfsShareManager::new(&config.paths.work_dir, iso_store.clone());
+    if let Err(e) = nfs_shares.load_and_rescan().await {
+        tracing::warn!(
+            target: "openpxe::nfs",
+            "could not reload NFS shares on startup: {e}"
+        );
+    }
+
+    // v0.5.5: SFTP-over-SSH share manager — pure-Rust in-process
+    // consumer via `russh` + `russh-sftp` (ring backend, no OpenSSL).
+    // The third remote-library protocol alongside SMB/NFS; like NFS it
+    // works in any container (no subprocess, no kernel mount) and
+    // supports HTTP Range requests because SFTP file handles seek.
+    let sftp_shares = SftpShareManager::new(&config.paths.work_dir, iso_store.clone());
+    if let Err(e) = sftp_shares.load_and_rescan().await {
+        tracing::warn!(
+            target: "openpxe::sftp",
+            "could not reload SFTP shares on startup: {e}"
+        );
     }
 
     // Sniff network details for the Network tab. None of these are
@@ -134,19 +184,38 @@ async fn main() -> anyhow::Result<()> {
         "network info"
     );
 
+    // v0.7.1: boot rules are shared between the HTTP layer (target rules,
+    // webhook, the editor API) and the DHCP proxy (driver-mode pins).
+    let boot_rules = openpxe_core::BootRulesStore::load_or_default(&config.paths.work_dir);
+
     let state = AppState {
         iso_store: iso_store.clone(),
         clients: clients.clone(),
         settings: settings.clone(),
-        queue: gates.clone(),
+        queue: queue.clone(),
         hosts: hosts.clone(),
+        boot_log: boot_log.clone(),
+        boot_rules: boot_rules.clone(),
+        boot_tokens: openpxe_core::BootTokens::new(),
+        branding: branding.clone(),
+        pxe_bg_cache: openpxe_http_api::state::PxeBgCache::default(),
+        admin: admin.clone(),
+        sessions: sessions.clone(),
+        sso: sso.clone(),
+        saml: openpxe_http_api::saml_routes::SamlRuntime::default(),
+        notify: notify.clone(),
         metrics: metrics.clone(),
         smb: Some(smb.clone()),
-        nfs: nfs.clone(),
+        smb_shares: smb_shares.clone(),
+        nfs_shares: nfs_shares.clone(),
+        sftp_shares: sftp_shares.clone(),
+        unattended: unattended.clone(),
+        uploads: openpxe_http_api::uploads::UploadSessions::default(),
         log_bus: log_bus.clone(),
         started_at: time::OffsetDateTime::now_utc(),
         public_base_url: public_base_url.clone(),
         nic_name: net.nic_name,
+        nic_link: net.nic_link,
         subnet_mask: net.subnet_mask,
         gateway: net.gateway,
     };
@@ -156,15 +225,40 @@ async fn main() -> anyhow::Result<()> {
     let http_task = tokio::spawn(async move {
         let listener = tokio::net::TcpListener::bind(http_addr).await?;
         tracing::info!(target: "openpxe::http", "HTTP listening on {http_addr}");
-        axum::serve(listener, router).await?;
+        // `into_make_service_with_connect_info` is required so per-request
+        // `ConnectInfo<SocketAddr>` extractors can resolve the peer IP —
+        // used by `/boot/<entry>.ipxe` to record the booting client's
+        // address into the Host log. Without this the extractor 500s.
+        axum::serve(
+            listener,
+            router.into_make_service_with_connect_info::<std::net::SocketAddr>(),
+        )
+        .await?;
         Ok::<_, anyhow::Error>(())
     });
 
+    // v0.7.0: TFTP names that aren't embedded assets get a dynamic
+    // renderer — `grub.cfg` for the Secure Boot shim+GRUB chain is
+    // generated from the live boot-entry list on every fetch, so menu
+    // changes apply without restart.
+    let grub_isos = iso_store.clone();
+    let grub_base = public_base_url.clone();
+    let tftp_dynamic: openpxe_tftp::DynamicAsset = std::sync::Arc::new(move |name: &str| {
+        if name == "grub.cfg" || name.starts_with("grub.cfg-") {
+            Some(
+                openpxe_http_api::grub_script::render_grub_menu(&grub_isos.list(), &grub_base)
+                    .into_bytes(),
+            )
+        } else {
+            None
+        }
+    });
     let tftp = TftpServer::new(
         config.server.tftp_bind,
         config.server.tftp_port,
         clients.clone(),
         metrics.clone(),
+        Some(tftp_dynamic),
     );
     let tftp_task = tokio::spawn(tftp.run());
 
@@ -178,6 +272,10 @@ async fn main() -> anyhow::Result<()> {
                 public_base_url.clone(),
                 clients.clone(),
                 metrics.clone(),
+                // v0.7.1: learned driver modes persist next to the other
+                // state files, so a machine walks the ladder once *ever*.
+                openpxe_dhcp_proxy::DriverEscalation::load_or_default(&config.paths.work_dir),
+                boot_rules.clone(),
             );
             tokio::spawn(s.run())
         }
@@ -210,7 +308,11 @@ async fn run_command(cmd: Command, config: Config) -> anyhow::Result<()> {
 /// Reuses `IsoStore::begin_upload` / `finish` so the resulting meta on disk
 /// is identical to a web upload — same slug rules, same introspection, same
 /// sha256.
-async fn seed_from_dir(src: &std::path::Path, config: &Config, dry_run: bool) -> anyhow::Result<()> {
+async fn seed_from_dir(
+    src: &std::path::Path,
+    config: &Config,
+    dry_run: bool,
+) -> anyhow::Result<()> {
     let store = IsoStore::new(config.paths.iso_dir.clone());
     store.load_from_disk().await?;
     let mut entries = tokio::fs::read_dir(src).await?;
@@ -218,7 +320,12 @@ async fn seed_from_dir(src: &std::path::Path, config: &Config, dry_run: bool) ->
     let mut skipped = 0u32;
     while let Some(entry) = entries.next_entry().await? {
         let p = entry.path();
-        if p.extension().and_then(|e| e.to_str()).map(str::to_ascii_lowercase).as_deref() != Some("iso") {
+        if p.extension()
+            .and_then(|e| e.to_str())
+            .map(str::to_ascii_lowercase)
+            .as_deref()
+            != Some("iso")
+        {
             continue;
         }
         let filename = p
@@ -226,8 +333,14 @@ async fn seed_from_dir(src: &std::path::Path, config: &Config, dry_run: bool) ->
             .and_then(|s| s.to_str())
             .ok_or_else(|| anyhow::anyhow!("non-utf8 filename: {}", p.display()))?
             .to_string();
-        println!("  {} ({} bytes)", filename, tokio::fs::metadata(&p).await?.len());
+        println!(
-        if dry_run { continue; }
+            "  {} ({} bytes)",
+            filename,
+            tokio::fs::metadata(&p).await?.len()
+        );
+        if dry_run {
+            continue;
+        }
 
         let mut handle = match store.begin_upload(&filename).await {
             Ok(h) => h,
@@ -242,15 +355,23 @@ async fn seed_from_dir(src: &std::path::Path, config: &Config, dry_run: bool) ->
         let mut buf = vec![0u8; 1024 * 1024];
         loop {
             let n = file.read(&mut buf).await?;
-            if n == 0 { break; }
+            if n == 0 {
+                break;
+            }
             let chunk: bytes::Bytes = buf[..n].to_vec().into();
             handle.write_chunk(&chunk).await?;
         }
         let meta = handle.finish(&store).await?;
-        println!("    -> id={} family={:?}", meta.id, meta.introspection.family);
+        println!(
+            "    -> id={} family={:?}",
+            meta.id, meta.introspection.family
+        );
         imported += 1;
     }
-    println!("\nimported={imported}  skipped={skipped}  {}", if dry_run { "(dry run)" } else { "" });
+    println!(
+        "\nimported={imported}  skipped={skipped}  {}",
+        if dry_run { "(dry run)" } else { "" }
+    );
     Ok(())
 }
 
@@ -259,6 +380,20 @@ async fn seed_from_dir(src: &std::path::Path, config: &Config, dry_run: bool) ->
 /// a loopback address (which would give every PXE client an unreachable
 /// `http://127.0.0.1/...`). Users in multi-homed setups should set
 /// `OPENPXE_PUBLIC_IP` explicitly.
+/// Build the base URL advertised to PXE clients. The port is included
+/// unless it's the HTTP default (80), keeping the common case clean
+/// (`http://10.0.0.5`) while a remapped port (`http://10.0.0.5:4200`)
+/// stays reachable. This is the single source of truth for every
+/// client-facing URL — the DHCP-proxy iPXE filename, UEFI HTTP boot, and
+/// the boot menu's kernel/initrd/ISO links all derive from it.
+fn build_public_base_url(ip: Ipv4Addr, http_port: u16) -> String {
+    if http_port == 80 {
+        format!("http://{ip}")
+    } else {
+        format!("http://{ip}:{http_port}")
+    }
+}
+
 fn detect_primary_ipv4() -> Option<Ipv4Addr> {
     // First try: route to the public internet. `UdpSocket::connect` to a
     // well-known external address causes the OS to populate `local_addr`
@@ -294,9 +429,8 @@ fn hostname() -> std::io::Result<String> {
     if let Ok(h) = std::fs::read_to_string("/proc/sys/kernel/hostname") {
         return Ok(h.trim().to_string());
     }
-    std::env::var("HOSTNAME").map_err(|_| std::io::Error::new(
+    std::env::var("HOSTNAME")
-        std::io::ErrorKind::NotFound, "no hostname",
+        .map_err(|_| std::io::Error::new(std::io::ErrorKind::NotFound, "no hostname"))
-    ))
 }
 
 fn init_tracing(bus: Arc<LogBus>) {
@@ -315,6 +449,12 @@ struct NetworkInfo {
     nic_name: String,
     subnet_mask: String,
     gateway: String,
+    /// v0.7.2: physical link summary for the Network tab — operstate,
+    /// negotiated speed/duplex, and the port's own MAC. Helps operators
+    /// in multi-NIC / trunked environments confirm *which* port the PXE
+    /// server actually answers on. Empty when sysfs isn't available
+    /// (non-Linux dev builds) or the NIC wasn't identified.
+    nic_link: String,
 }
 
 /// Best-effort population of the Network tab's read-only fields. We shell
@@ -328,7 +468,10 @@ fn detect_network_info(our_ip: Ipv4Addr) -> NetworkInfo {
 
     // `ip -o -f inet addr show` lists every interface with its
     // `inet a.b.c.d/mask`. We match the line that mentions our IP.
-    if let Ok(out) = Command::new("ip").args(["-o", "-f", "inet", "addr", "show"]).output() {
+    if let Ok(out) = Command::new("ip")
+        .args(["-o", "-f", "inet", "addr", "show"])
+        .output()
+    {
         if let Ok(text) = String::from_utf8(out.stdout) {
             for line in text.lines() {
                 if !line.contains(&our_ip.to_string()) {
@@ -353,7 +496,10 @@ fn detect_network_info(our_ip: Ipv4Addr) -> NetworkInfo {
     }
 
     // `ip route show default` -> "default via 10.0.0.1 dev enp1s0 ..."
-    if let Ok(out) = Command::new("ip").args(["route", "show", "default"]).output() {
+    if let Ok(out) = Command::new("ip")
+        .args(["route", "show", "default"])
+        .output()
+    {
         if let Ok(text) = String::from_utf8(out.stdout) {
             if let Some(line) = text.lines().next() {
                 let mut parts = line.split_whitespace();
@@ -369,12 +515,51 @@ fn detect_network_info(our_ip: Ipv4Addr) -> NetworkInfo {
         }
     }
 
+    info.nic_link = detect_link_info(&info.nic_name);
+
     info
 }
 
+/// v0.7.2: read the NIC's physical link details from sysfs. Every field
+/// is optional — virtual NICs report no speed (`-1` or absent), and
+/// non-Linux dev machines have no `/sys/class/net` at all — so the
+/// result is whatever could be read, joined human-readably, or empty.
+fn detect_link_info(nic: &str) -> String {
+    if nic.is_empty() {
+        return String::new();
+    }
+    let read = |file: &str| {
+        std::fs::read_to_string(format!("/sys/class/net/{nic}/{file}"))
+            .map(|s| s.trim().to_string())
+            .unwrap_or_default()
+    };
+    let mut parts: Vec<String> = Vec::new();
+    let state = read("operstate");
+    if !state.is_empty() {
+        parts.push(format!("link {state}"));
+    }
+    let speed = read("speed");
+    if !speed.is_empty() && speed != "-1" {
+        parts.push(format!("{speed} Mb/s"));
+    }
+    let duplex = read("duplex");
+    if !duplex.is_empty() && duplex != "unknown" {
+        parts.push(format!("{duplex} duplex"));
+    }
+    let mac = read("address");
+    if !mac.is_empty() {
+        parts.push(format!("port {mac}"));
+    }
+    parts.join(" · ")
+}
+
 fn prefix_to_dotted(prefix: u8) -> String {
     let prefix = prefix.min(32);
-    let mask: u32 = if prefix == 0 { 0 } else { u32::MAX << (32 - prefix) };
+    let mask: u32 = if prefix == 0 {
+        0
+    } else {
+        u32::MAX << (32 - prefix)
+    };
     format!(
         "{}.{}.{}.{}",
         (mask >> 24) & 0xff,
@@ -383,3 +568,26 @@ fn prefix_to_dotted(prefix: u8) -> String {
         mask & 0xff
     )
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn public_base_url_includes_non_default_port() {
+        // The v0.5.6 regression guard: a remapped HTTP port (e.g. the
+        // Unraid template's 4200) MUST appear in the advertised URL, or
+        // PXE clients fetch :80 — the wrong service — and boot fails.
+        let ip: Ipv4Addr = "192.168.1.49".parse().unwrap();
+        assert_eq!(build_public_base_url(ip, 4200), "http://192.168.1.49:4200");
+        assert_eq!(build_public_base_url(ip, 8080), "http://192.168.1.49:8080");
+    }
+
+    #[test]
+    fn public_base_url_omits_default_port() {
+        // Port 80 stays clean (no `:80`) so the common case reads nicely
+        // and matches what every browser/iPXE assumes by default.
+        let ip: Ipv4Addr = "10.0.0.5".parse().unwrap();
+        assert_eq!(build_public_base_url(ip, 80), "http://10.0.0.5");
+    }
+}

crates/tftp/src/lib.rs

@@ -14,4 +14,4 @@
 
 pub mod server;
 
-pub use server::TftpServer;
+pub use server::{DynamicAsset, TftpServer};

crates/tftp/src/server.rs

@@ -7,12 +7,12 @@
 //! `tftpd`/`in.tftpd` works and is why TFTP is awkward behind stateful NAT:
 //! the ephemeral ports must be reachable from the client.
 //!
-//! We only serve files from `openpxe_ipxe_assets::asset_bytes` — that is,
+//! We only serve files from `openpxe_ipxe_assets::asset_slice` — that is,
 //! the bundled iPXE binaries and wimboot. No filesystem is ever opened, so
 //! `../` path traversal attempts simply return ENOENT.
 
 use openpxe_core::{ClientEvent, ClientRegistry};
-use openpxe_ipxe_assets::asset_bytes;
+use openpxe_ipxe_assets::asset_slice;
 use socket2::{Domain, Protocol, Socket, Type};
 use std::net::{IpAddr, SocketAddr};
 use std::sync::Arc;
@@ -21,6 +21,7 @@ use tokio::net::UdpSocket;
 
 // TFTP opcodes.
 const OP_RRQ: u16 = 1;
+const OP_WRQ: u16 = 2;
 const OP_DATA: u16 = 3;
 const OP_ACK: u16 = 4;
 const OP_ERROR: u16 = 5;
@@ -31,11 +32,19 @@ const ERR_NOT_DEFINED: u16 = 0;
 const ERR_FILE_NOT_FOUND: u16 = 1;
 const ERR_ILLEGAL_OP: u16 = 4;
 
+/// Server-rendered TFTP content for names that aren't embedded assets —
+/// e.g. `grub.cfg` for the signed shim+GRUB Secure Boot chain (v0.7.0),
+/// which is generated from the live boot-entry list per fetch. Kept as a
+/// closure so this crate stays decoupled from the ISO store; the binary
+/// wires it up in `main`.
+pub type DynamicAsset = Arc<dyn Fn(&str) -> Option<Vec<u8>> + Send + Sync>;
+
 pub struct TftpServer {
     bind: IpAddr,
     port: u16,
     clients: Arc<ClientRegistry>,
     metrics: openpxe_core::Metrics,
+    dynamic: Option<DynamicAsset>,
 }
 
 impl TftpServer {
@@ -44,8 +53,15 @@ impl TftpServer {
         port: u16,
         clients: Arc<ClientRegistry>,
         metrics: openpxe_core::Metrics,
+        dynamic: Option<DynamicAsset>,
     ) -> Self {
-        Self { bind, port, clients, metrics }
+        Self {
+            bind,
+            port,
+            clients,
+            metrics,
+            dynamic,
+        }
     }
 
     pub async fn run(self) -> anyhow::Result<()> {
@@ -66,8 +82,11 @@ impl TftpServer {
             let clients = clients.clone();
             let metrics = metrics.clone();
             let bind_ip = self.bind;
+            let dynamic = self.dynamic.clone();
             tokio::spawn(async move {
-                if let Err(e) = handle_rrq(data, from, bind_ip, clients, metrics.clone()).await {
+                if let Err(e) =
+                    handle_rrq(data, from, bind_ip, clients, metrics.clone(), dynamic).await
+                {
                     metrics.record_tftp_err();
                     tracing::warn!(target: "openpxe::tftp", peer=%from, "handler error: {e}");
                 }
@@ -82,23 +101,54 @@ async fn handle_rrq(
     bind_ip: IpAddr,
     clients: Arc<ClientRegistry>,
     metrics: openpxe_core::Metrics,
+    dynamic: Option<DynamicAsset>,
 ) -> anyhow::Result<()> {
     let Some(req) = parse_rrq(&packet) else {
+        // Not a well-formed RRQ. A WRQ deserves an explicit refusal —
+        // legacy clients retry a silently-dropped write until they time
+        // out; an ERROR packet fails them fast with a readable reason.
+        if packet.len() >= 2 && u16::from_be_bytes([packet[0], packet[1]]) == OP_WRQ {
+            let sock = bind_udp(bind_ip, 0)?;
+            let _ = send_error(&sock, peer, ERR_ILLEGAL_OP, "writes not supported").await;
+        }
         return Ok(());
     };
-    let Request { filename, options, .. } = req;
+    let Request {
+        filename,
+        mode,
+        options,
+    } = req;
 
     // Per-transfer ephemeral socket.
     let sock = bind_udp(bind_ip, 0)?;
 
-    let Some(file_bytes) = asset_bytes(&filename) else {
+    // We serve binary boot artifacts; netascii line-ending translation
+    // would corrupt them. Refuse loudly instead of timing out silently —
+    // matters for legacy clients that default to netascii.
+    if !mode.eq_ignore_ascii_case("octet") {
+        let _ = send_error(&sock, peer, ERR_NOT_DEFINED, "only octet mode is supported").await;
+        tracing::info!(target: "openpxe::tftp", peer=%peer, %mode, "rejected non-octet transfer");
+        return Ok(());
+    }
+
+    // Embedded assets first; otherwise the dynamic renderer (server-
+    // generated content like the Secure Boot chain's grub.cfg, v0.7.0).
+    let resolved = asset_slice(&filename).or_else(|| {
+        dynamic
+            .as_ref()
+            .and_then(|f| f(&filename))
+            .map(std::borrow::Cow::Owned)
+    });
+    let Some(file_bytes) = resolved else {
         let _ = send_error(&sock, peer, ERR_FILE_NOT_FOUND, "no such file").await;
         tracing::info!(target: "openpxe::tftp", peer=%peer, file=%filename, "404");
         clients.record(
             &peer.ip().to_string(),
             Some(peer.ip()),
             None,
-            ClientEvent::TftpRead { file: filename.clone() },
+            ClientEvent::TftpRead {
+                file: filename.clone(),
+            },
         );
         return Ok(());
     };
@@ -112,7 +162,9 @@ async fn handle_rrq(
         &peer.ip().to_string(),
         Some(peer.ip()),
         None,
-        ClientEvent::TftpRead { file: filename.clone() },
+        ClientEvent::TftpRead {
+            file: filename.clone(),
+        },
     );
 
     // Negotiate options.
@@ -173,7 +225,9 @@ async fn handle_rrq(
 
         // Send one window worth of DATA.
         for _ in 0..window {
-            if offset >= total { break; }
+            if offset >= total {
+                break;
+            }
             let end = (offset + blksize).min(total);
             let chunk = &file_bytes[offset..end];
             let pkt = encode_data(block_no, chunk);
@@ -249,26 +303,35 @@ async fn handle_rrq(
 #[derive(Debug)]
 struct Request {
     filename: String,
-    #[allow(dead_code)]
     mode: String,
     options: Vec<(String, String)>,
 }
 
 fn parse_rrq(pkt: &[u8]) -> Option<Request> {
-    if pkt.len() < 4 { return None; }
+    if pkt.len() < 4 {
+        return None;
+    }
     let op = u16::from_be_bytes([pkt[0], pkt[1]]);
-    if op != OP_RRQ { return None; }
+    if op != OP_RRQ {
+        return None;
+    }
     let mut rest = &pkt[2..];
     let filename = read_cstr(&mut rest)?;
     let mode = read_cstr(&mut rest)?;
     let mut options = Vec::new();
     while !rest.is_empty() {
         let Some(k) = read_cstr(&mut rest) else { break };
-        if k.is_empty() { break; }
+        if k.is_empty() {
+            break;
+        }
         let v = read_cstr(&mut rest).unwrap_or_default();
         options.push((k.to_ascii_lowercase(), v));
     }
-    Some(Request { filename, mode, options })
+    Some(Request {
+        filename,
+        mode,
+        options,
+    })
 }
 
 fn read_cstr(buf: &mut &[u8]) -> Option<String> {
@@ -316,8 +379,12 @@ async fn recv_ack(sock: &UdpSocket, peer: SocketAddr) -> anyhow::Result<u16> {
     let mut buf = [0u8; 32];
     loop {
         let (n, from) = sock.recv_from(&mut buf).await?;
-        if from.ip() != peer.ip() { continue; }
+        if from.ip() != peer.ip() {
-        if n < 4 { continue; }
+            continue;
+        }
+        if n < 4 {
+            continue;
+        }
         let op = u16::from_be_bytes([buf[0], buf[1]]);
         match op {
             OP_ACK => return Ok(u16::from_be_bytes([buf[2], buf[3]])),
@@ -344,14 +411,19 @@ async fn wait_for_ack(
             Ok(Ok(_)) => {}
             Ok(Err(_)) | Err(_) => {
                 tries += 1;
-                if tries > 5 { return Ok(false); }
+                if tries > 5 {
+                    return Ok(false);
+                }
             }
         }
     }
 }
 
 fn bind_udp(bind: IpAddr, port: u16) -> anyhow::Result<UdpSocket> {
-    let domain = match bind { IpAddr::V4(_) => Domain::IPV4, IpAddr::V6(_) => Domain::IPV6 };
+    let domain = match bind {
+        IpAddr::V4(_) => Domain::IPV4,
+        IpAddr::V6(_) => Domain::IPV6,
+    };
     let sock = Socket::new(domain, Type::DGRAM, Some(Protocol::UDP))?;
     sock.set_reuse_address(true)?;
     sock.set_nonblocking(true)?;
@@ -361,17 +433,13 @@ fn bind_udp(bind: IpAddr, port: u16) -> anyhow::Result<UdpSocket> {
     Ok(UdpSocket::from_std(std_sock)?)
 }
 
-#[allow(dead_code)]
+/// Pure-logic mirror of `handle_rrq`'s windowing math, exercised by the
-const _UNUSED: (u16, u16) = (ERR_NOT_DEFINED, ERR_ILLEGAL_OP);
+/// unit tests below. Given a position in the file and the window, return
-
+/// the (block_no, chunk_len) list this window will emit — tested against
-/// Pure-logic helper used by the unit tests below and (in a refactor) by
+/// edge cases (exact-blksize tail, short tail, single-block window,
-/// `handle_rrq`. Given a position in the file and the window, return the
+/// block-number wraparound).
-/// (block_no, chunk_len) list this window will emit. Useful as a sanity
+#[cfg(test)]
-/// check that our windowing math matches the wire behavior the spec
+fn plan_window(
-/// requires — tested against edge cases (exact-blksize tail, short tail,
-/// single-block window).
-#[must_use]
-pub fn plan_window(
     total: usize,
     offset: usize,
     blksize: usize,
@@ -382,7 +450,9 @@ pub fn plan_window(
     let mut o = offset;
     let mut b = starting_block;
     for _ in 0..window {
-        if o >= total { break; }
+        if o >= total {
+            break;
+        }
         let end = (o + blksize).min(total);
         out.push((b, end - o));
         o = end;
@@ -453,7 +523,7 @@ mod tests {
         assert_eq!(p, vec![(65534, 1024), (65535, 1024)]);
         let p2 = plan_window(2048, 2048, 1024, 2, 0);
         assert!(p2.is_empty()); // nothing past EOF
-        // And a cross-boundary case:
+                                // And a cross-boundary case:
         let p3 = plan_window(3072, 0, 1024, 3, 65535);
         assert_eq!(p3, vec![(65535, 1024), (0, 1024), (1, 1024)]);
     }

crates/webui/src/app.css

@@ -8,37 +8,49 @@
  * CSS lands). */
 
 :root {
-  /* Dark palette (default). */
+  /* Jet-black dark palette (default). Modelled on Netbox Labs's
-  --bg:           #0b1018;
+     near-black product chrome, with surfaces stepping subtly upward
-  --bg-panel:    #121826;
+     rather than the previous blue-tinted ramp, so the UI reads as a
-  --bg-panel-2:  #1a2334;
+     genuine "dark" rather than "dim navy". */
-  --bg-elev:     #223047;
+  --bg:           #030303;
-  --fg:           #e4e8ef;
+  --bg-panel:    #0a0a0a;
-  --fg-dim:      #8a94a7;
+  --bg-panel-2:  #141414;
-  --fg-dimmer:   #5a6379;
+  --bg-elev:     #1c1c1c;
-  --accent:       #00d4b4;   /* Netbox-ish teal */
+  --fg:           #e8eaed;
+  --fg-dim:      #9aa0a6;
+  --fg-dimmer:   #6b7077;
+  --accent:       #00d4b4;   /* Netbox-ish teal — kept for brand */
   --accent-dim:  #07a38c;
   --warn:         #ffb347;
   --err:          #ef6e6e;
   --ok:           #4ade80;
-  --border:       #223047;
+  --border:       #1f1f1f;
-  --border-soft: #172033;
+  --border-soft: #141414;
-  --terminal-bg: #06090e;
+  --terminal-bg: #050505;
-  --shadow-card: 0 1px 0 rgba(255,255,255,0.02), 0 8px 24px rgba(0,0,0,0.25);
+  --shadow-card: 0 1px 0 rgba(255,255,255,0.02), 0 8px 24px rgba(0,0,0,0.55);
   --radius:      6px;
   --radius-lg:  10px;
   --sidebar-w:  240px;
   --topbar-h:   56px;
   --mono: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
   --sans: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, system-ui, sans-serif;
+  /* v0.4.63: tie native form-control rendering (checkboxes, scroll bars,
+     date pickers) to the active OpenPXE theme. Without this, the inline
+     `<meta name="color-scheme" content="dark light">` in index.html forces
+     dark form chrome in *both* themes — so the SSO "Enable single sign-on"
+     checkbox renders as an opaque black square against the light-mode
+     panel, ignoring our accent-color hint. CSS `color-scheme` overrides
+     the meta and tracks `data-theme` correctly. */
+  color-scheme: dark;
 }
 
 :root[data-theme="light"] {
+  color-scheme: light;
   /* Light palette — high-contrast neutral, accent unchanged for brand
      consistency. Designed against Netbox Labs's reference screenshot:
      near-white surfaces, soft grey dividers, dark text. */
   --bg:           #f6f8fb;
-  --bg-panel:    #ffffff;
+  --bg-panel:    #fbfcfe;
   --bg-panel-2:  #f0f3f8;
   --bg-elev:     #e6ebf2;
   --fg:           #1c2330;
@@ -51,7 +63,11 @@
   --ok:           #1f9b54;
   --border:       #d8dde6;
   --border-soft: #e7eaf0;
-  --terminal-bg: #0d1219; /* terminal stays dark even in light mode */
+  /* Light-mode terminal: the pane background and chrome track the rest
+     of the light theme. Per-level text colours below recolour-on-light
+     so log lines stay readable on a pale background — previously the
+     terminal was locked to dark and looked like a stuck panel. */
+  --terminal-bg: #ffffff;
   --shadow-card: 0 1px 0 rgba(0,0,0,0.02), 0 6px 18px rgba(20,28,52,0.06);
 }
 
@@ -84,14 +100,37 @@ code, kbd { font-family: var(--mono); font-size: 12.5px;
   border-right: 1px solid var(--border);
   display: flex; flex-direction: column;
 }
+/* The brand block sits flush with the topbar so the sidebar+topbar reads
+   as one continuous bar across the top of the app, rather than a chunky
+   2-line logo block plus a separate (smaller-typeface) page title. The
+   height/border-bottom match the topbar exactly so the divider runs
+   straight across without a step. */
 .sidebar .brand {
   display: flex; align-items: center; gap: 12px;
-  padding: 14px 18px;
+  padding: 0 18px;
+  height: var(--topbar-h);
   border-bottom: 1px solid var(--border);
 }
-.sidebar .brand img { width: 40px; height: auto; }
+.sidebar .brand img { width: 26px; height: 26px; flex: none; }
-.sidebar .brand strong { font-size: 16px; letter-spacing: 0.4px; }
+.sidebar .brand strong {
-.sidebar .brand .sub { color: var(--fg-dim); font-size: 11px; }
+  font-size: 15px; font-weight: 600;
+  letter-spacing: 0.2px;
+  color: var(--fg);
+}
+
+/* v0.4.69: FleetDM-style full-width custom logo. When the operator has
+   uploaded a custom brand mark, the sidebar header drops the bundled
+   26px mark + "OpenPXE" wordmark and instead lets the uploaded image
+   span the header — left-aligned, capped at 200x50, scaled to fit
+   without distortion. The wordmark is hidden so the operator's logo is
+   the sole brand element (their logo presumably already contains their
+   name). The bundled-default case keeps the mark + wordmark. */
+.sidebar .brand.has-custom-logo { gap: 0; }
+.sidebar .brand.has-custom-logo img {
+  width: auto; height: 50px; max-width: 200px;
+  object-fit: contain; object-position: left center; flex: none;
+}
+.sidebar .brand.has-custom-logo strong { display: none; }
 .sidebar nav { padding: 10px 0; flex: 1; overflow-y: auto; }
 .sidebar nav a {
   display: flex; align-items: center; gap: 10px;
@@ -113,10 +152,40 @@ code, kbd { font-family: var(--mono); font-size: 12.5px;
 }
 .sidebar nav a.active .count { background: var(--accent); color: #002923; }
 .sidebar .footer {
-  padding: 10px 18px; border-top: 1px solid var(--border);
+  padding: 12px 18px; border-top: 1px solid var(--border);
   color: var(--fg-dimmer); font-size: 11px;
+  display: flex; flex-direction: column; gap: 4px;
+}
+.sidebar .footer code { background: transparent; color: var(--fg-dim); padding: 0;
+  font-size: 11px; word-break: break-all; }
+.sidebar .footer .status-row {
+  display: flex; align-items: center; gap: 8px;
+  margin-bottom: 4px;
+}
+.sidebar .footer .status-row .dot {
+  width: 8px; height: 8px; border-radius: 50%; display: inline-block;
+  background: var(--fg-dimmer); flex: none;
+}
+.sidebar .footer .status-row .dot.ok   { background: var(--ok);
+  box-shadow: 0 0 6px color-mix(in srgb, var(--ok) 60%, transparent); }
+.sidebar .footer .status-row .dot.err  { background: var(--err); }
+.sidebar .footer .status-row .dot.warn { background: var(--warn); }
+.sidebar .footer .status-label { color: var(--fg-dim); }
+.sidebar .footer .status-value { color: var(--fg); font-weight: 600; }
+.sidebar .footer .status-value.ok   { color: var(--ok); }
+.sidebar .footer .status-value.err  { color: var(--err); }
+.sidebar .footer .status-value.warn { color: var(--warn); }
+.sidebar .footer .footer-sub { color: var(--fg-dimmer); margin-top: 2px; }
+/* Persistent backend identity. Sits below the advertised URL so even
+   when an operator has uploaded their own logo, "what is this" stays
+   answerable from the bottom-left of every page. */
+.sidebar .footer .footer-version {
+  margin-top: 8px; padding-top: 8px;
+  border-top: 1px dashed var(--border-soft);
+  color: var(--fg-dim);
+  font-variant-numeric: tabular-nums;
+  letter-spacing: 0.2px;
 }
-.sidebar .footer code { background: transparent; color: var(--fg-dim); padding: 0; }
 
 /* ── Top bar ───────────────────────────────────────────────────────── */
 
@@ -230,34 +299,102 @@ button, .btn {
   cursor: pointer;
   transition: background 0.12s ease;
 }
-button:hover, .btn:hover { background: var(--accent-dim); color: #fff; }
+button:hover, .btn:hover { background: var(--accent-dim); color: #f4fffd; }
 button.ghost { background: transparent; color: var(--fg); border: 1px solid var(--border); }
 button.ghost:hover { background: var(--bg-panel-2); color: var(--fg); }
 button.danger { background: transparent; color: var(--err); border: 1px solid color-mix(in srgb, var(--err) 35%, transparent); }
 button.danger:hover { background: color-mix(in srgb, var(--err) 14%, transparent); color: var(--err); }
+/* v0.5.3: unified spacing for a card's primary action button(s). Any
+   button that sits as a direct child of a card body (Save, Bind, Add,
+   Launch, …) gets the same gap above it so it never butts against the
+   form. Inline buttons inside table rows / toolbars / logo slots /
+   modal action bars are nested deeper, so the `>` keeps them untouched.
+   Adjacent action buttons on one row (e.g. Save + Send test) share the
+   margin and stay aligned. */
+.card .body > button { margin-top: 16px; }
 
 label.field {
   display: grid; gap: 4px; margin-bottom: 14px;
 }
 label.field .name { color: var(--fg-dim); font-size: 12px; }
 label.field .hint { color: var(--fg-dimmer); font-size: 11px; }
-label.field input[type="text"],
+/* All single-line inputs share one chrome rule. Pre-v0.4.6 we only
-label.field input[type="number"],
+   styled type=text/number, which left type=password fields rendering
+   with the default browser look — visibly off vs adjacent text fields
+   in the Account card. The negation list keeps `type=checkbox`,
+   `type=file`, and `type=range` (none of which we use inside
+   `label.field`) from picking up the padded-box look. */
+label.field input:not([type="checkbox"]):not([type="file"]):not([type="range"]),
 label.field select,
 label.field textarea {
   width: 100%; background: var(--bg); color: var(--fg);
   border: 1px solid var(--border); border-radius: var(--radius);
   padding: 7px 10px; font: inherit;
+  /* iOS/Safari shrinks password-field text by default; clamp it so
+     the password input matches the username input's metrics. */
+  font-size: 14px; line-height: 1.4;
+  box-shadow: none; -webkit-appearance: none; appearance: none;
+}
+/* v0.4.63: with `appearance: none`, the native <select> dropdown arrow
+   disappears, which makes the "Metadata source" pick-list look like a
+   plain (and slightly squished) text input. Paint our own chevron via
+   background-image so the control still reads as a dropdown, and reserve
+   right-padding for it. The data-URI SVG inherits currentColor via the
+   `stroke` attribute so the arrow follows light/dark theme without a
+   second declaration. */
+label.field select {
+  background-image: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 12 8' fill='none' stroke='%239aa0a6' stroke-width='1.6' stroke-linecap='round' stroke-linejoin='round'><polyline points='1.5,1.5 6,6 10.5,1.5'/></svg>");
+  background-repeat: no-repeat;
+  background-position: right 10px center;
+  background-size: 11px 7px;
+  padding-right: 30px;
+}
+:root[data-theme="light"] label.field select {
+  background-image: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 12 8' fill='none' stroke='%235a6377' stroke-width='1.6' stroke-linecap='round' stroke-linejoin='round'><polyline points='1.5,1.5 6,6 10.5,1.5'/></svg>");
 }
 label.field input:focus, label.field select:focus, label.field textarea:focus {
   outline: none; border-color: var(--accent);
+  box-shadow: 0 0 0 1px color-mix(in srgb, var(--accent) 35%, transparent);
 }
 label.check {
   display: flex; gap: 10px; align-items: center;
   padding: 8px 10px; margin-bottom: 6px;
   border: 1px solid var(--border-soft); border-radius: var(--radius);
 }
-label.check input { accent-color: var(--accent); }
+/* v0.4.63: native checkboxes used to render as opaque black squares in
+   light mode because the page meta declares `color-scheme: dark light`
+   and `accent-color` alone only repaints the *check mark* (not the
+   container). Take full control of the chrome so the box reads cleanly
+   on both palettes and the checked state lights up in our accent. */
+label.check input[type="checkbox"] {
+  appearance: none; -webkit-appearance: none;
+  width: 16px; height: 16px; flex: none;
+  background: var(--bg);
+  border: 1px solid var(--border);
+  border-radius: 3px;
+  display: inline-grid; place-content: center;
+  cursor: pointer; margin: 0;
+  transition: background 0.1s ease, border-color 0.1s ease;
+}
+label.check input[type="checkbox"]:hover { border-color: var(--accent); }
+label.check input[type="checkbox"]:checked {
+  background: var(--accent);
+  border-color: var(--accent);
+}
+label.check input[type="checkbox"]:checked::after {
+  /* Classic ✓ glyph built from a rotated rectangle border. Colour is
+     #002923 (the same near-black we use on solid-accent buttons) so the
+     tick stays legible against the teal fill in both themes. */
+  content: '';
+  width: 4px; height: 8px;
+  border: solid #002923;
+  border-width: 0 2px 2px 0;
+  transform: rotate(45deg) translate(-1px, -1px);
+}
+label.check input[type="checkbox"]:focus-visible {
+  outline: none;
+  box-shadow: 0 0 0 2px color-mix(in srgb, var(--accent) 35%, transparent);
+}
 
 /* ── Drop zone ────────────────────────────────────────────────────── */
 
@@ -281,8 +418,7 @@ label.check input { accent-color: var(--accent); }
 
 /* ── Imaging progress widget ───────────────────────────────────────
    Animated brand mark paired with a horizontal progress bar; surfaces
-   on Dashboard and the Queue tab. Renamed from `.forge-progress` in
+   on Dashboard and the Queue tab. */
-   v0.3.0 — the anvil-themed naming is gone with the rebrand. */
 .queue-progress {
   display: flex; align-items: center; gap: 16px;
   padding: 16px;
@@ -376,11 +512,23 @@ tr.unbootable td:first-child { border-left: 3px solid var(--warn); }
 .dot.err  { background: var(--err); }
 .dot.warn { background: var(--warn); }
 
-/* Inline form rows. */
+/* Inline form rows. The default is a 4-column grid sized for the
-.form-row { display: grid; grid-template-columns: repeat(4, 1fr); gap: 10px 14px; }
+   Account card's "Current / New username / New password / Confirm"
-@media (max-width: 900px) { .form-row { grid-template-columns: 1fr; } }
+   quartet; the `.cols-3` modifier swaps to a 3-column layout for the
+   SSO header strip (display name / logo URL / metadata source). All
+   `.form-row > label.field` children share the same baseline because
+   their inner inputs share metrics via the global rule above. */
+.form-row { display: grid; grid-template-columns: repeat(4, 1fr); gap: 10px 14px; align-items: end; }
+.form-row.cols-3 { grid-template-columns: repeat(3, 1fr); }
+.form-row.cols-2 { grid-template-columns: repeat(2, 1fr); }
+.form-row label.field { margin-bottom: 0; }
+@media (max-width: 900px) {
+  .form-row,
+  .form-row.cols-3,
+  .form-row.cols-2 { grid-template-columns: 1fr; }
+}
 
-/* ── Gate queue "horse race" visual ──────────────────────────────── */
+/* ── Queued deployment visual ────────────────────────────────────── */
 .queue-track {
   display: grid; gap: 6px;
   padding: 10px 0;
@@ -414,52 +562,378 @@ tr.unbootable td:first-child { border-left: 3px solid var(--warn); }
   min-height: 480px;
   box-shadow: var(--shadow-card);
 }
+/* Terminal pane colours follow the active theme. Hard-coded hexes
+   (#050505, #181818, #cfd6e2 etc.) were leaving the light-mode pane
+   looking dark; we keep palette-aware vars instead so the toggle works. */
 .terminal .pane {
   flex: 1; overflow: auto;
   padding: 10px 14px;
   font-family: var(--mono); font-size: 12.5px; line-height: 1.5;
-  color: #cfd6e2;
+  color: var(--fg);
   white-space: pre-wrap; word-break: break-word;
 }
 .terminal .pane .lvl-error { color: var(--err); }
 .terminal .pane .lvl-warn  { color: var(--warn); }
-.terminal .pane .lvl-info  { color: #cfd6e2; }
+.terminal .pane .lvl-info  { color: var(--fg); }
-.terminal .pane .lvl-debug { color: #8b94a8; }
+.terminal .pane .lvl-debug { color: var(--fg-dim); }
-.terminal .pane .lvl-trace { color: #5a6379; }
+.terminal .pane .lvl-trace { color: var(--fg-dimmer); }
-.terminal .pane .ts        { color: #5a6379; }
+.terminal .pane .ts        { color: var(--fg-dimmer); }
-.terminal .pane .tg        { color: #7cd3ff; }
+.terminal .pane .tg        { color: var(--accent); }
 .terminal .pane .echo      { color: var(--accent); }
 .terminal .input-row {
   display: flex; align-items: center; gap: 8px;
   padding: 8px 14px;
-  background: #0a0e15;
+  background: var(--bg-panel-2);
-  border-top: 1px solid #1d2330;
+  border-top: 1px solid var(--border);
 }
 .terminal .input-row .prompt { color: var(--accent); font-family: var(--mono); }
 .terminal .input-row input {
-  flex: 1; background: transparent; border: 0; color: #e4e8ef;
+  flex: 1; background: transparent; border: 0; color: var(--fg);
   font: inherit; font-family: var(--mono); font-size: 13px;
   outline: none; padding: 4px 0;
 }
 .terminal .toolbar {
   display: flex; gap: 8px; align-items: center;
   padding: 8px 14px;
-  background: #0a0e15;
+  background: var(--bg-panel-2);
-  border-bottom: 1px solid #1d2330;
+  border-bottom: 1px solid var(--border);
-  font-size: 12px; color: #8a94a7;
+  font-size: 12px; color: var(--fg-dim);
 }
 .terminal .toolbar .right { margin-left: auto; display: flex; gap: 6px; }
 .terminal .toolbar button {
   padding: 3px 9px; font-size: 11px;
-  background: transparent; color: #8a94a7; border: 1px solid #1d2330;
+  background: transparent; color: var(--fg-dim); border: 1px solid var(--border);
   font-weight: 500;
 }
-.terminal .toolbar button:hover { color: #e4e8ef; background: #1d2330; }
+.terminal .toolbar button:hover { color: var(--fg); background: var(--bg-elev); }
+
+/* ── Auth screen (first-run setup + login) ───────────────────────
+   Used when /api/me reports setup_required or !authenticated. The
+   regular .shell is hidden; this overlay takes the full viewport so
+   the operator never sees half-loaded dashboard chrome while the auth
+   state is unknown. Same palette as the rest of the UI — borrows the
+   Sonarr/Radarr layout (centered narrow card on the page background).
+*/
+.auth-screen {
+  position: fixed; inset: 0;
+  display: flex; align-items: center; justify-content: center;
+  background: var(--bg);
+  padding: 24px;
+  z-index: 100;
+}
+.auth-card {
+  width: 100%; max-width: 380px;
+  background: var(--bg-panel);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-lg);
+  box-shadow: var(--shadow-card);
+  padding: 28px 28px 22px;
+}
+.auth-card .brand-row {
+  display: flex; align-items: center; gap: 12px;
+  margin-bottom: 18px;
+}
+.auth-card .brand-row img { width: 32px; height: 32px; flex: none; }
+.auth-card .brand-row .name { font-size: 17px; font-weight: 600; letter-spacing: 0.2px; color: var(--fg); }
+/* v0.5.0: FleetDM-style custom logo on the login/setup card — the
+   uploaded logo spans the card header and the "OpenPXE" wordmark is
+   dropped (the logo is the brand). Matches the sidebar treatment. */
+.auth-card .brand-row.has-custom-logo { justify-content: center; gap: 0; margin-bottom: 22px; }
+.auth-card .brand-row.has-custom-logo img {
+  width: auto; height: 52px; max-width: 240px;
+  object-fit: contain; object-position: center;
+}
+.auth-card h2 {
+  margin: 0 0 6px; font-size: 16px; font-weight: 600; color: var(--fg);
+}
+.auth-card .lede {
+  color: var(--fg-dim); font-size: 13px; margin: 0 0 18px;
+  line-height: 1.5;
+}
+.auth-card .field { margin-bottom: 12px; }
+.auth-card input[type="text"],
+.auth-card input[type="password"] {
+  width: 100%; background: var(--bg); color: var(--fg);
+  border: 1px solid var(--border); border-radius: var(--radius);
+  padding: 9px 11px; font: inherit; font-size: 13.5px;
+}
+.auth-card input:focus { outline: none; border-color: var(--accent); }
+.auth-card .submit { width: 100%; padding: 9px 12px; margin-top: 6px; }
+.auth-card .auth-err {
+  margin-top: 12px; color: var(--err); font-size: 12.5px;
+}
+.auth-card .auth-foot {
+  margin-top: 14px; padding-top: 12px;
+  border-top: 1px solid var(--border-soft);
+  color: var(--fg-dimmer); font-size: 11.5px; text-align: center;
+}
+.auth-card .sso-btn {
+  width: 100%; margin-top: 10px;
+  background: transparent; color: var(--fg);
+  border: 1px solid var(--border);
+  padding: 9px 12px;
+}
+.auth-card .sso-btn:hover {
+  background: var(--bg-panel-2); border-color: var(--accent); color: var(--fg);
+}
+.auth-card .sso-btn .meta { color: var(--fg-dim); font-size: 11px; margin-top: 2px; }
+
+/* ── Top-right user menu (v0.4.6) ────────────────────────────
+   The "signed in as X" identity + sign-out moved out of the sidebar
+   footer in v0.4.6 — the sidebar footer is now reserved for the
+   service-state trio (Service status / Advertised URL / Backend
+   version). The button matches the theme toggle's size + chrome so
+   the top-right reads as a tidy two-icon strip. */
+.user-menu { position: relative; }
+.user-btn {
+  display: inline-flex; align-items: center; justify-content: center;
+  width: 36px; height: 32px;
+  background: transparent; color: var(--fg);
+  border: 1px solid var(--border); border-radius: 8px;
+  cursor: pointer; padding: 0;
+  transition: background 0.15s ease, border-color 0.15s ease;
+}
+.user-btn:hover { background: var(--bg-panel-2); border-color: var(--accent); }
+.user-pop {
+  position: absolute; right: 0; top: 38px;
+  min-width: 200px;
+  background: var(--bg-panel);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-lg);
+  box-shadow: var(--shadow-card);
+  padding: 6px;
+  z-index: 60;
+  display: flex; flex-direction: column; gap: 2px;
+}
+.user-pop[hidden] { display: none; }
+.user-pop .user-pop-name {
+  padding: 8px 10px 6px;
+  border-bottom: 1px solid var(--border-soft);
+  margin-bottom: 4px;
+  color: var(--fg); font-weight: 600; font-size: 13px;
+  overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
+}
+.user-pop .user-pop-item {
+  text-align: left; width: 100%;
+  background: transparent; color: var(--fg);
+  border: 0; border-radius: var(--radius);
+  padding: 7px 10px; font: inherit; font-size: 13px; font-weight: 500;
+  cursor: pointer;
+}
+.user-pop .user-pop-item:hover {
+  background: var(--bg-panel-2); color: var(--fg);
+}
+.user-pop .user-pop-danger { color: var(--err); }
+.user-pop .user-pop-danger:hover {
+  background: color-mix(in srgb, var(--err) 12%, transparent);
+  color: var(--err);
+}
 
 /* ── About card ─────────────────────────────────────────────────── */
 .about-hero { padding: 20px 24px; }
 .about-hero h2 { font-size: 22px; margin: 0 0 8px; color: var(--fg); }
-.about-hero .lead { color: var(--fg-dim); font-size: 14px; max-width: 60ch; }
+/* Span the full main column rather than capping at 60ch — the page is
+   read at typical desktop widths and the cap was leaving the right two
+   thirds of the panel awkwardly empty. */
+.about-hero .lead { color: var(--fg-dim); font-size: 14px; max-width: none; }
 .about-hero .who { margin-top: 18px; font-size: 13px; }
 .about-hero .who span { color: var(--fg-dim); }
 .about-hero .who strong { color: var(--accent); }
+.about-hero a { color: var(--accent); }
+
+/* ── API reference (Settings → bottom) ─────────────────────────── */
+.api-ref { display: grid; gap: 18px; padding: 16px; }
+.api-ref .group h3 {
+  margin: 0 0 8px; font-size: 13px; color: var(--fg-dim);
+  text-transform: uppercase; letter-spacing: 0.8px;
+}
+.api-ref .ep {
+  display: grid; grid-template-columns: 64px minmax(200px, 1fr) 2fr;
+  gap: 12px; align-items: baseline;
+  padding: 6px 0; border-top: 1px solid var(--border-soft);
+  font-size: 13px;
+}
+.api-ref .ep:first-child { border-top: 0; }
+.api-ref .ep .method {
+  font-family: var(--mono); font-weight: 600; font-size: 11px;
+  padding: 2px 6px; border-radius: 4px;
+  text-align: center; letter-spacing: 0.6px;
+}
+.api-ref .ep .method.get    { background: color-mix(in srgb, var(--ok) 22%, transparent);     color: var(--ok); }
+.api-ref .ep .method.post   { background: color-mix(in srgb, var(--accent) 22%, transparent); color: var(--accent); }
+.api-ref .ep .method.put    { background: color-mix(in srgb, var(--warn) 22%, transparent);   color: var(--warn); }
+.api-ref .ep .method.delete { background: color-mix(in srgb, var(--err) 22%, transparent);    color: var(--err); }
+.api-ref .ep .path { font-family: var(--mono); color: var(--fg); word-break: break-all; }
+.api-ref .ep .desc { color: var(--fg-dim); }
+@media (max-width: 900px) {
+  .api-ref .ep { grid-template-columns: 1fr; gap: 4px; }
+  .api-ref .ep .method { justify-self: start; }
+}
+
+/* ── Disk space card ───────────────────────────────────────────── */
+.diskbar {
+  height: 10px; border-radius: 5px;
+  background: var(--bg-elev);
+  overflow: hidden; margin-top: 8px;
+}
+.diskbar .fill {
+  height: 100%;
+  background: linear-gradient(90deg, var(--accent-dim), var(--accent));
+  transition: width 0.4s ease;
+}
+.diskbar.warn .fill { background: var(--warn); }
+.diskbar.full .fill { background: var(--err); }
+.disk-meta { display: flex; gap: 14px; font-size: 12px; color: var(--fg-dim); margin-top: 8px; flex-wrap: wrap; }
+.disk-meta strong { color: var(--fg); font-weight: 600; font-variant-numeric: tabular-nums; }
+
+/* ── Logo upload (Settings) ────────────────────────────────────── */
+.logo-preview {
+  display: flex; align-items: center; gap: 14px;
+  padding: 12px;
+  background: var(--bg-panel-2);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+}
+.logo-preview .swatch {
+  width: 56px; height: 56px;
+  display: flex; align-items: center; justify-content: center;
+  background: var(--bg); border: 1px solid var(--border);
+  border-radius: var(--radius);
+  flex: none;
+}
+.logo-preview .swatch img { max-width: 48px; max-height: 48px; }
+.logo-preview .info { flex: 1; min-width: 0; }
+.logo-preview .info .name { color: var(--fg); font-weight: 600; }
+.logo-preview .info .meta { color: var(--fg-dim); font-size: 12px; margin-top: 2px; }
+
+/* v0.5.1: collapsible "Advanced" disclosure at the bottom of Settings
+   (the former Advanced sidebar tab). A quiet, full-width toggle that
+   expands to reveal the notification + API-reference cards. */
+.advanced-disclosure { width: 100%; }
+.advanced-summary {
+  list-style: none;
+  cursor: pointer;
+  user-select: none;
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  padding: 10px 14px;
+  color: var(--fg-dim);
+  font-size: 13px;
+  font-weight: 600;
+  background: var(--bg-panel-2);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+}
+.advanced-summary:hover { color: var(--fg); }
+.advanced-summary::-webkit-details-marker { display: none; }
+.advanced-summary::before {
+  content: "▸";
+  font-size: 11px;
+  transition: transform 0.15s ease;
+}
+.advanced-disclosure[open] .advanced-summary::before { transform: rotate(90deg); }
+
+/* v0.5.1: protocol tag on a unified Remote-shares row (SMB / NFS). */
+.proto-badge {
+  display: inline-block;
+  font-size: 10px;
+  font-weight: 700;
+  letter-spacing: 0.04em;
+  padding: 1px 6px;
+  margin-right: 8px;
+  border-radius: 4px;
+  vertical-align: middle;
+  background: var(--bg-panel-2);
+  border: 1px solid var(--border);
+  color: var(--fg-dim);
+}
+
+/* ── v0.5.2: three-slot branding (light / dark / client) ─────────── */
+.logo-slots {
+  display: grid;
+  grid-template-columns: repeat(3, 1fr);
+  gap: 12px;
+}
+@media (max-width: 720px) { .logo-slots { grid-template-columns: 1fr; } }
+.logo-slot {
+  display: flex; flex-direction: column; gap: 8px;
+  padding: 12px;
+  background: var(--bg-panel-2);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+}
+.logo-slot-head { display: flex; align-items: center; justify-content: space-between; gap: 8px; }
+.logo-slot-head .name { color: var(--fg); font-weight: 600; font-size: 13px; }
+.logo-slot .swatch {
+  height: 64px;
+  display: flex; align-items: center; justify-content: center;
+  background: var(--bg); border: 1px solid var(--border);
+  border-radius: var(--radius);
+}
+.logo-slot .swatch img { max-width: 90%; max-height: 52px; object-fit: contain; }
+.logo-slot-hint { color: var(--fg-dim); font-size: 11.5px; }
+
+/* ── v0.5.2: login local/SSO separation ─────────────────────────── */
+.auth-card .auth-divider {
+  display: flex; align-items: center; text-align: center;
+  color: var(--fg-dimmer); font-size: 11px; text-transform: uppercase;
+  letter-spacing: 0.08em;
+  margin: 16px 0 12px;
+}
+.auth-card .auth-divider::before,
+.auth-card .auth-divider::after {
+  content: ""; flex: 1; height: 1px; background: var(--border-soft);
+}
+.auth-card .auth-divider span { padding: 0 10px; }
+.auth-card .sso-block .sso-btn { margin-top: 0; }
+.auth-card .sso-btn {
+  display: flex; align-items: center; justify-content: center; gap: 8px;
+}
+.auth-card .sso-btn .sso-logo { width: 16px; height: 16px; object-fit: contain; flex: none; }
+
+/* ── v0.5.2: modal (queue Profile editor) ───────────────────────── */
+.modal-overlay {
+  position: fixed; inset: 0; z-index: 200;
+  display: flex; align-items: center; justify-content: center;
+  background: rgba(0, 0, 0, 0.55);
+  padding: 24px;
+}
+.modal-box {
+  width: 100%; max-width: 520px;
+  background: var(--bg-panel);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-lg);
+  box-shadow: var(--shadow-card);
+  padding: 22px;
+}
+.modal-box h2 { margin: 0 0 14px; font-size: 16px; font-weight: 600; color: var(--fg); }
+.modal-actions {
+  display: flex; justify-content: flex-end; gap: 10px; margin-top: 18px;
+}
+.modal-actions .submit { width: auto; padding: 8px 18px; }
+
+/* v0.7.2: a label.field directly followed by the card's action button
+   stacked its own 14px bottom margin onto the button's 16px top margin
+   (30px total) — visible on Queue "Launch for all waiting" and the
+   Network "Save". Collapse the doubled gap so every primary action sits
+   the same 16px below its form. */
+.card .body > label.field:has(+ button) { margin-bottom: 0; }
+
+/* v0.7.2: inline list filter above a table (Available images). The input
+   is wrapped in a label.field so it borrows the standard text-field chrome
+   and matches every other input in the app; this wrapper just insets it
+   from the card edges so it lines up with the header text above. */
+.list-search { padding: 14px 16px; }
+
+/* v0.7.4: pager footer under the Available-images table — quiet status
+   text on the left, ghost Prev/Next on the right. */
+.list-pager {
+  display: flex; align-items: center; gap: 8px;
+  padding: 12px 16px;
+  color: var(--fg-dim); font-size: 12px;
+  font-variant-numeric: tabular-nums;
+}
+.list-pager .spacer { flex: 1; }
+.list-pager button { padding: 4px 12px; font-size: 12px; }
+.list-pager button:disabled { opacity: 0.45; cursor: default; }

crates/webui/src/index.html

@@ -5,8 +5,18 @@
   <meta name="viewport" content="width=device-width, initial-scale=1" />
   <meta name="color-scheme" content="dark light" />
   <title>OpenPXE</title>
-  <link rel="stylesheet" href="/assets/app.css" />
+  <!-- v0.4.61: the `?v=…` query string is replaced by the server at
-  <link rel="icon" type="image/svg+xml" href="/assets/logo.svg" />
+       request time with the running OpenPXE version. That guarantees a
+       fresh URL on every upgrade so browsers (and intermediary proxies)
+       can't keep serving stale JS / CSS / branding from before the
+       deploy. Combined with `Cache-Control: no-cache, must-revalidate`
+       on the asset handlers, the practical caching window is one
+       version. -->
+  <link rel="stylesheet" href="/assets/app.css?v={{ASSET_VERSION}}" />
+  <!-- v0.5.2: favicon is pinned to the bundled OpenPXE mark (its own
+       endpoint, decoupled from operator branding) for tab-icon
+       continuity regardless of any uploaded light/dark/client logo. -->
+  <link rel="icon" type="image/svg+xml" href="/assets/favicon.svg?v={{ASSET_VERSION}}" />
   <!-- Theme is read from localStorage *before* paint to avoid the
        dark→light flash on every navigation. Falls back to the OS
        preference and finally to dark. -->
@@ -25,12 +35,9 @@
 <body>
 <div class="shell">
   <aside class="sidebar">
-    <div class="brand">
+    <div class="{{BRAND_CLASS}}">
-      <img src="/assets/logo.svg" alt="" />
+      <img src="/assets/logo.svg?v={{ASSET_VERSION}}&r={{LOGO_REV}}" alt="OpenPXE" />
-      <div>
+      <strong>OpenPXE</strong>
-        <strong>OpenPXE</strong>
-        <div class="sub">v<span data-bind="version">0.3.1</span></div>
-      </div>
     </div>
     <nav>
       <a data-view="dashboard" class="active">Dashboard</a>
@@ -48,18 +55,27 @@
         <span class="count" data-bind="host_count">0</span>
       </a>
       <a data-view="terminal">Terminal</a>
+      <a data-view="settings">Settings</a>
       <a data-view="about">About</a>
     </nav>
     <div class="footer">
-      Advertised to clients<br/>
+      <div class="status-row">
+        <span class="dot" data-bind="ready_dot" title="Server readiness"></span>
+        <span class="status-label">Service status:</span>
+        <span class="status-value" data-bind="ready_label">checking…</span>
+      </div>
+      <div class="footer-sub">Advertised to clients</div>
       <code>{{BASE_URL}}</code>
+      <!-- The brand badge at the top can be overridden by operator-uploaded
+           logos; keep "OpenPXE v…" pinned in the footer so the backend
+           identity is always visible regardless of branding. -->
+      <div class="footer-version">OpenPXE&nbsp;v<span data-bind="version">0.4.63</span></div>
     </div>
   </aside>
 
   <header class="topbar">
     <h1 data-bind="view_title">Dashboard</h1>
     <div class="spacer"></div>
-    <span class="chip" data-bind="ready_chip" title="Server readiness">checking…</span>
     <span class="chip"><strong data-bind="iso_count2">0</strong>&nbsp;images</span>
     <span class="chip"><strong data-bind="client_count2">0</strong>&nbsp;clients</span>
     <span class="chip"><strong data-bind="queue_count2">0</strong>&nbsp;in queue</span>
@@ -83,11 +99,32 @@
         <path d="M20.5 14A8 8 0 0 1 10 3.5 a8 8 0 1 0 10.5 10.5z"/>
       </svg>
     </button>
+
+    <!-- v0.4.6: signed-in operator menu. Sits next to the theme toggle
+         in the top-right corner so the sidebar footer stays clean for
+         the "Service status / Advertised URL / Backend version" trio.
+         The whole block is hidden until /api/me confirms a session. -->
+    <div class="user-menu" data-bind="user_menu_wrap" style="display:none">
+      <button id="user-menu-btn" class="user-btn" type="button"
+              aria-label="Account menu" aria-haspopup="true" aria-expanded="false"
+              title="Account">
+        <svg viewBox="0 0 24 24" width="18" height="18" fill="none"
+             stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+          <circle cx="12" cy="8" r="3.6"/>
+          <path d="M4.5 20a7.5 7.5 0 0 1 15 0"/>
+        </svg>
+      </button>
+      <div id="user-menu-pop" class="user-pop" data-bind="user_menu_pop" hidden>
+        <div class="user-pop-name" data-bind="user_pop_name">—</div>
+        <button type="button" class="user-pop-item" data-bind="user_pop_edit">Edit account</button>
+        <button type="button" class="user-pop-item user-pop-danger" data-bind="user_pop_logout">Sign out</button>
+      </div>
+    </div>
   </header>
 
   <main class="main" id="view-root"></main>
 </div>
 
-<script src="/assets/app.js"></script>
+<script src="/assets/app.js?v={{ASSET_VERSION}}"></script>
 </body>
 </html>

crates/webui/src/lib.rs

@@ -7,30 +7,71 @@
 //! nav, top bar with secondary tabs, card-dense content panels.
 #![forbid(unsafe_code)]
 
-/// Render the top-level page. `base_url` is interpolated into the footer
+/// Render the top-level page.
-/// so operators can see at a glance what URL clients are PXE-booting from.
+///
+/// * `base_url` is interpolated into the footer so operators can see at
+///   a glance what URL clients are PXE-booting from.
+/// * `asset_version` is appended as `?v=…` to every asset URL so each
+///   release ships with brand-new asset URLs — browsers (and any
+///   intermediary proxy) can't keep serving last release's `app.js`
+///   when we know the new one is incompatible. Combined with
+///   `Cache-Control: no-cache, must-revalidate` on the asset handlers,
+///   the worst-case caching window is one version.
+/// * `logo_rev` is appended to the brand-mark and favicon URLs as an
+///   extra `&r=…` token. Unlike `asset_version` it changes every time
+///   the operator swaps the custom logo, so the top-left mark updates
+///   immediately on the next page load instead of being pinned to the
+///   release version (which only changes on upgrade). `index.html`
+///   itself is served `no-cache`, so the fresh token lands as soon as
+///   the operator reloads after an upload.
+/// * `has_custom_logo` switches the sidebar brand block between the
+///   bundled mark + "OpenPXE" wordmark (false) and a FleetDM-style
+///   full-width custom logo with the wordmark hidden (true). Rendered
+///   server-side so there's no flash of the default mark before JS runs.
 #[must_use]
-pub fn index_html(base_url: &str) -> String {
+pub fn index_html(
-    INDEX_HTML.replace("{{BASE_URL}}", base_url)
+    base_url: &str,
+    asset_version: &str,
+    logo_rev: u64,
+    has_custom_logo: bool,
+) -> String {
+    let brand_class = if has_custom_logo {
+        "brand has-custom-logo"
+    } else {
+        "brand"
+    };
+    INDEX_HTML
+        .replace("{{BASE_URL}}", base_url)
+        .replace("{{ASSET_VERSION}}", asset_version)
+        .replace("{{LOGO_REV}}", &logo_rev.to_string())
+        .replace("{{BRAND_CLASS}}", brand_class)
 }
 
 #[must_use]
-pub fn app_js() -> &'static str { APP_JS }
+pub fn app_js() -> &'static str {
+    APP_JS
+}
 
 #[must_use]
-pub fn app_css() -> &'static str { APP_CSS }
+pub fn app_css() -> &'static str {
+    APP_CSS
+}
 
 #[must_use]
-pub fn logo_svg() -> &'static str { LOGO_SVG }
+pub fn logo_svg() -> &'static str {
+    LOGO_SVG
+}
 
 /// Larger, faster-cycling rainbow disc — used for the page-load
 /// transition and the imaging-progress widget on Dashboard / Queue.
 /// Pure SVG + SMIL, no JS, no GIF.
 #[must_use]
-pub fn loader_svg() -> &'static str { LOADER_SVG }
+pub fn loader_svg() -> &'static str {
+    LOADER_SVG
+}
 
-const INDEX_HTML: &str  = include_str!("index.html");
+const INDEX_HTML: &str = include_str!("index.html");
-const APP_CSS: &str     = include_str!("app.css");
+const APP_CSS: &str = include_str!("app.css");
-const APP_JS: &str      = include_str!("app.js");
+const APP_JS: &str = include_str!("app.js");
-const LOGO_SVG: &str    = include_str!("logo.svg");
+const LOGO_SVG: &str = include_str!("logo.svg");
-const LOADER_SVG: &str  = include_str!("loader.svg");
+const LOADER_SVG: &str = include_str!("loader.svg");

deploy/docker/Dockerfile

@@ -14,37 +14,112 @@
 # Debian slim at ~75 MB + binary ~25 MB is fine for a PXE server that
 # spends most of its life idle.
 
-ARG RUST_VERSION=1.82
+ARG RUST_VERSION=1.95
 
-########## fetch iPXE binaries ##########
+########## fetch iPXE binaries + wimboot ##########
+# Pulls the upstream boot.ipxe.org pre-builds (no PNG support) plus
+# wimboot. These cover the arches we don't build from source here:
+# BIOS undionly.kpxe and i386-efi (which need a 32-bit x86 toolchain),
+# and serve as the baseline that the PNG-enabled x86_64/arm64 UEFI
+# binaries from the `ipxe-build` stage overlay on top of.
 FROM debian:12-slim AS fetch
-RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates \
+# rpm2cpio + cpio: extract Fedora's Microsoft-signed shim/GRUB RPMs for
+# the Secure Boot chain (v0.7.0, scripts/fetch-shim.sh).
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        curl ca-certificates rpm2cpio cpio \
  && rm -rf /var/lib/apt/lists/*
 WORKDIR /src
 COPY scripts/fetch-ipxe.sh scripts/fetch-ipxe.sh
+COPY scripts/fetch-shim.sh scripts/fetch-shim.sh
 RUN mkdir -p assets/ipxe && bash scripts/fetch-ipxe.sh
+# Signed shim+GRUB (Secure Boot escalation rung). Redistributed
+# unmodified from the official Fedora packages — see fetch-shim.sh for
+# the trust model.
+RUN bash scripts/fetch-shim.sh /src/assets/ipxe
+
+########## build PNG-enabled iPXE from source ##########
+# v0.4.69: THE graphical-boot-menu unlock. iVentoy paints a PNG
+# background on the PXE screen using stock iPXE built with
+# CONSOLE_FRAMEBUFFER + IMAGE_PNG + CONSOLE_CMD; the public iPXE
+# binaries omit those, so `console --picture` is a no-op on them.
+# We build our own from upstream with that thin config delta.
+#
+# The historical blocker was cc1 segfaulting when an amd64 gcc ran
+# under QEMU emulation on an arm64 host. The fix: pin this stage to
+# $BUILDPLATFORM (the NATIVE builder arch — arm64 on an Apple-Silicon
+# Mac, amd64 in x86 CI) and cross-compile with a real cross toolchain
+# (CROSS_COMPILE=x86_64-linux-gnu-). The compiler runs native and
+# emits x86_64 — no emulation, no segfault. arm64-efi builds natively.
+FROM --platform=$BUILDPLATFORM debian:12-slim AS ipxe-build
+# libc6-dev is REQUIRED and easy to miss under --no-install-recommends:
+# iPXE's host utilities (elf2efi, zbin) compile with the native gcc and
+# pull <stdint.h>; without the native libc headers gcc's #include_next
+# falls through to iPXE's freestanding headers and dies on bits/stdint.h.
+# The target (iPXE firmware) code is -ffreestanding/-nostdinc, so the
+# x86_64 cross toolchain needs NO cross libc headers.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        git make perl gcc binutils libc6-dev \
+        gcc-x86-64-linux-gnu binutils-x86-64-linux-gnu \
+        ca-certificates \
+ && rm -rf /var/lib/apt/lists/*
+WORKDIR /src
+COPY scripts/build-ipxe.sh scripts/build-ipxe.sh
+COPY deploy/ipxe/local/ deploy/ipxe/local/
+RUN mkdir -p assets/ipxe && bash scripts/build-ipxe.sh /src/assets/ipxe
 
 ########## build openpxe ##########
-FROM rust:${RUST_VERSION}-bookworm AS build
+# v0.5.2: cross-compile the Rust binary NATIVELY — no QEMU.
+#
+# This stage is pinned to $BUILDPLATFORM (the builder's native arch — arm64
+# on an Apple-Silicon Mac, amd64 in x86 CI), exactly like `ipxe-build`. The
+# Rust compiler therefore runs at full native speed and emits an
+# x86_64-unknown-linux-musl binary via `cargo-zigbuild`, which uses `zig cc`
+# as the cross-linker (it bundles the musl sysroot for every target, so
+# there's no fiddly cross-gcc toolchain to assemble).
+#
+# Why this replaced the old `FROM rust ... --platform=linux/amd64` build:
+# that ran the *entire* compiler under QEMU x86_64 emulation on the arm64
+# host. It was ~15x slower (a single crate took >20 min) and the emulated
+# gcc/linker intermittently SIGSEGV'd or hung mid-link. Cross-compiling
+# sidesteps emulation entirely — the build is minutes, not half an hour,
+# and is deterministic.
+#
+# The output is still a fully static musl binary with no glibc dependency,
+# so the runtime stage stays free to be any Linux distro.
+FROM --platform=$BUILDPLATFORM rust:${RUST_VERSION}-bookworm AS build
 WORKDIR /src
+# zig (via the `ziglang` pip package — cargo-zigbuild auto-discovers it as
+# `python3 -m ziglang`) supplies the x86_64 musl sysroot + linker.
+# cargo-zigbuild is the thin cargo wrapper that wires zig in as the linker.
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends python3 python3-pip \
+ && rm -rf /var/lib/apt/lists/* \
+ && rustup target add x86_64-unknown-linux-musl \
+ && pip3 install --no-cache-dir --break-system-packages ziglang \
+ && cargo install --locked cargo-zigbuild
 
-# Copy the whole workspace in one go. We used to do a two-pass "cache-prime
+# Do not copy rust-toolchain.toml into the image. The local workspace pins
-# with stubs, then real build" dance for dep-compile reuse; that turned out
+# developer tooling, but inside Docker we intentionally use the Rust version
-# to silently serve stale stub binaries when cargo's fingerprint didn't
+# selected by the base image. Copying rust-toolchain.toml with
-# notice the source swap. A single build is ~1.5 min longer on cold cache
+# `channel = "stable"` makes rustup download a second full toolchain during
-# but guarantees the binary reflects the sources we copied.
+# the build, which is slow and can exhaust small Colima/CI disks.
-COPY Cargo.toml rust-toolchain.toml ./
+COPY Cargo.toml Cargo.lock ./
 COPY crates/ crates/
+# Baseline binaries (BIOS / i386 / wimboot), then overlay the
+# PNG-enabled x86_64 + arm64 UEFI binaries built from source. The
+# overlay wins for snponly.efi / ipxe.efi / snponly-arm64.efi so the
+# common modern clients get the graphical background; the rest keep the
+# upstream no-PNG binaries and the menu's `|| console` text fallback.
 COPY --from=fetch /src/assets/ipxe /src/assets/ipxe
+COPY --from=ipxe-build /src/assets/ipxe/snponly.efi /src/assets/ipxe/snponly.efi
+COPY --from=ipxe-build /src/assets/ipxe/ipxe.efi /src/assets/ipxe/ipxe.efi
 
-# Cache cargo registry + target across builds. The `--no-edit` touch is
+# Cache cargo registry + target across builds. `cargo zigbuild` runs the
-# belt-and-suspenders: cargo occasionally misses mtime-only changes on
+# native rustc (fast) and links for x86_64-musl with zig — no emulation.
-# networked FS; this forces a fingerprint check.
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
     --mount=type=cache,target=/src/target,sharing=locked \
-    find crates -name '*.rs' -exec touch {} + && \
+    cargo zigbuild --release --target x86_64-unknown-linux-musl --bin openpxe && \
-    cargo build --release --bin openpxe && \
+    cp target/x86_64-unknown-linux-musl/release/openpxe /openpxe && \
-    cp target/release/openpxe /openpxe && \
     ls -l /openpxe
 
 ########## runtime ##########
@@ -52,27 +127,45 @@ FROM debian:12-slim AS runtime
 RUN apt-get update \
  && apt-get install -y --no-install-recommends \
         ca-certificates libcap2-bin tini gosu iproute2 \
-        wimtools samba nfs-common \
+        wimtools samba smbclient \
  && rm -rf /var/lib/apt/lists/* \
  && useradd --system --uid 10001 --home-dir /var/lib/openpxe --shell /usr/sbin/nologin openpxe \
  && mkdir -p /var/lib/openpxe/isos /var/lib/openpxe/work /var/lib/openpxe/smb \
  && chown -R openpxe:openpxe /var/lib/openpxe
-# Runtime deps explained:
+# v0.4.5: the openpxe binary itself is now built against musl and is
-#   wimtools  - provides `wimlib-imagex`, used to inject startnet.cmd into boot.wim.
+# fully static — no glibc dependency. The runtime stage still ships
-#   samba     - `smbd` serves extracted Windows install media on :445 for WinPE
+# Debian slim because OpenPXE shells out to the packages below for
-#               to `net use`. Guest read-only, scoped to /var/lib/openpxe/smb.
+# functionality we deliberately don't reimplement in-process:
-#   nfs-common - provides `mount.nfs` / `mount.nfs4` for the Storage tab's
+#
-#               NFS share manager. Mount also requires the container to run
+#   wimtools   - `wimlib-imagex`, used to inject startnet.cmd into boot.wim.
-#               with CAP_SYS_ADMIN — without it, mount(2) returns EPERM and
+#   samba      - `smbd` serves extracted Windows install media on :445 so
-#               the manager surfaces a clear error in the UI instead of
+#                WinPE can `net use`. Guest read-only, scoped to
-#               failing silently.
+#                /var/lib/openpxe/smb. This package provides the SERVER
-#   iproute2  - `ip addr` / `ip route` for the auto-detected Network tab
+#                side only; the client CLI is a separate package below.
-#               fields (NIC name, subnet mask, default gateway). Tiny,
+#   smbclient  - v0.4.66: Samba's `smbclient` userspace CLI, used by
-#               always available; we don't pull in netlink crates for
+#                the Storage tab's SMB shares manager to list and stream
-#               this one-shot startup probe.
+#                ISOs from remote SMB servers without ever mounting them
-#   gosu      - drops privileges cleanly from root after the entrypoint fixes
+#                in the kernel. In Debian 12 `smbclient` is NOT pulled
-#               bind-mount ownership (common OpenShift/Docker UX issue).
+#                in by the `samba` package — they're siblings, not
-# Windows-specific tools only activate when the WebUI toggle is on.
+#                parent/child. v0.4.65 shipped without this line and
+#                every "Add share" attempt surfaced
+#                `could not exec smbclient: No such file or directory`
+#                until this landed.
+#   iproute2   - `ip addr` / `ip route` for the auto-detected Network
+#                tab fields (NIC name, subnet mask, default gateway).
+#                Tiny, always available; we don't pull in netlink crates
+#                for this one-shot startup probe.
+#   gosu       - drops privileges cleanly from root after the entrypoint
+#                fixes bind-mount ownership (common OpenShift/Docker UX
+#                issue).
+#
+# v0.4.65 dropped `nfs-common` — kernel-mount NFS is gone. The SMB
+# shares replacement uses userspace `smbclient` and needs no kernel
+# helpers.
+#
+# A future "openpxe-static" variant could drop everything except the
+# binary onto distroless once we move the Windows + SMB legs to
+# in-process Rust crates.
 
 COPY --from=build /openpxe /usr/local/bin/openpxe
 COPY deploy/docker/entrypoint.sh /usr/local/bin/entrypoint.sh

deploy/ipxe/local/console.h

@@ -0,0 +1,14 @@
+/*
+ * OpenPXE iPXE build override — console options.
+ *
+ * Included at the end of config/console.h. CONSOLE_FRAMEBUFFER is the
+ * unified graphical framebuffer console (EFI GOP on UEFI, VESA on
+ * BIOS); it's what `console --picture` paints into. This is the same
+ * single flag iVentoy enables for its graphical PXE screen.
+ *
+ * We *add* the framebuffer console rather than replacing the default
+ * EFI/BIOS text consoles, so text output still works before/after the
+ * picture is set.
+ */
+
+#define CONSOLE_FRAMEBUFFER

deploy/ipxe/local/general.h

@@ -0,0 +1,23 @@
+/*
+ * OpenPXE iPXE build override — general options.
+ *
+ * iPXE includes <config/local/general.h> at the end of config/general.h,
+ * so anything defined here is layered on top of the stock defaults
+ * without editing upstream files. We enable exactly the features the
+ * graphical PXE boot menu needs:
+ *
+ *   IMAGE_PNG    - PNG decoder, so `console --picture <png>` can paint
+ *                  the operator's logo / OpenPXE background.
+ *   IMAGE_PNM    - Netpbm decoder (cheap; harmless belt-and-suspenders).
+ *   CONSOLE_CMD  - the `console` command itself. Without it you get
+ *                  "console: command not found" even with a framebuffer.
+ *
+ * (CONSOLE_FRAMEBUFFER lives in config/local/console.h.)
+ *
+ * Everything else stays at upstream defaults — we are intentionally a
+ * thin, auditable delta over stock iPXE so the UBDL/GPL story is simple.
+ */
+
+#define IMAGE_PNG
+#define IMAGE_PNM
+#define CONSOLE_CMD

deploy/openshift/30-deployment.yaml

@@ -34,7 +34,7 @@ spec:
         fsGroup: 10001
       containers:
         - name: openpxe
-          image: ghcr.io/casperadmin/openpxe:0.1.0
+          image: gitea.milesward.dev/mward4/openpxe:0.4.1
           imagePullPolicy: IfNotPresent
           ports:
             - name: dhcp

deploy/unraid/README.md

@@ -6,7 +6,7 @@ boot from OpenPXE". Pick the one that matches what you have.
 ## Path A — build on Unraid, push to Gitea registry, pull by tag
 
 Recommended once you've done it once. Image is published to
-`gitea.milesward.dev/mward4/openpxe:0.1.0` (or your equivalent) and
+`gitea.milesward.dev/mward4/openpxe:0.4.1` (or your equivalent) and
 every Unraid template / docker-compose just references the tag.
 
 Pre-flight:
@@ -40,14 +40,14 @@ What it does:
 3. `docker build` against `deploy/docker/Dockerfile`.
 4. `docker login gitea.milesward.dev:3000` using a temp `DOCKER_CONFIG`
    so the credential never lands in your real `~/.docker/config.json`.
-5. `docker push` both `:0.1.0` and `:latest`.
+5. `docker push` both `:0.4.1` and `:latest`.
 6. Logout, scrub the temp config, delete the workspace.
 
 After it finishes, in Unraid → Docker → Add Container, set:
 
 | Field      | Value                                           |
 |------------|-------------------------------------------------|
-| Repository | `gitea.milesward.dev/mward4/openpxe:0.1.0`     |
+| Repository | `gitea.milesward.dev/mward4/openpxe:0.4.1`     |
 | Network    | `host`                                          |
 | Extra args | `--cap-add=NET_BIND_SERVICE`                    |
 
@@ -88,14 +88,14 @@ then:
 
 ```bash
 # On the build host
-docker save openpxe:0.1.0 | gzip > openpxe-0.1.0.tar.gz
+docker save openpxe:0.4.1 | gzip > openpxe-0.4.1.tar.gz
 
 # Transfer (rsync / scp / SMB / ZFS-replicate / sneakernet)
-scp openpxe-0.1.0.tar.gz root@unraid:/tmp/
+scp openpxe-0.4.1.tar.gz root@unraid:/tmp/
 
 # On Unraid
-gunzip -c /tmp/openpxe-0.1.0.tar.gz | docker load
+gunzip -c /tmp/openpxe-0.4.1.tar.gz | docker load
-docker tag openpxe:0.1.0 gitea.milesward.dev/mward4/openpxe:0.1.0
+docker tag openpxe:0.4.1 gitea.milesward.dev/mward4/openpxe:0.4.1
 ```
 
 If you want it pullable by tag from other Unraid templates, push to

deploy/unraid/openpxe.xml

@@ -34,8 +34,8 @@
     Air-gapped network PXE boot server. Container-native Rust
     implementation — DHCP proxy + TFTP + iPXE chainload + HTTP ISO
     streaming, all in one process. Web UI for ISO upload, NFS share
-    mounting, and Queued Deployment ("horse-race" simultaneous launch
+    mounting, and Queued Deployment for coordinated launch of one ISO
-    of one ISO across many waiting clients).
+    across many waiting clients.
 
     NEVER touches the client OS trust store: no test-signed drivers,
     no testsigning toggle, no httpdisk.sys. Windows boot uses vanilla

docs/NEXT_PHASE.md

@@ -1,7 +1,7 @@
 # Phase 6 — recommendations
 
-The v0.2.0 cut leaves OpenPXE in a state where the entire protocol stack
+The v0.4.1 cut leaves OpenPXE in a state where the entire protocol stack
-and operator UI are exercised by 66 automated tests, the container is
+and operator UI are exercised by the automated test suite, the container is
 multi-arch buildable, and the image ships at ~97 MB. What's left before
 this looks and feels like a 1.0 product is mostly **real-hardware
 validation** plus a small batch of features that can only sensibly be

docs/architecture.md

@@ -265,10 +265,9 @@ tab is one click from the brand bar.
 - Persisted to `<work_dir>/hosts.json`. Like `SettingsStore`, in-memory
   is authoritative — disk corruption falls back to empty rather than
   failing startup.
-- Inspired by Tinkerbell `smee`'s MAC-prepended URL pattern. The DHCP
+- The DHCP reply embeds `?mac=${mac}` in the boot.ipxe URL; iPXE
-  reply now embeds `?mac=${mac}` in the boot.ipxe URL; iPXE substitutes
+  substitutes the literal MAC client-side, so the HTTP layer can
-  the literal MAC client-side, so the HTTP layer can short-circuit
+  short-circuit past the menu when a binding exists.
-  past the menu when a binding exists.
 - `/api/hosts` GET / POST / DELETE drives the **Hosts** tab.
 
 **Prometheus metrics** (`crates/core/src/metrics.rs`):
@@ -288,18 +287,17 @@ warning-free. Replaced `format!()`-into-`String` with
 `Reverse`, fixed `map_or(false, …)` → `is_some_and`, and a handful of
 other idiom fixes.
 
-**UI overhaul** for the v0.2.0 pre-beta milestone:
+**UI overhaul** for the pre-beta milestone:
 - Light + dark themes via `:root[data-theme=light]` token swap.
   Toggled by a top-right button or the `T` key. Persisted in
   localStorage; pre-paint inline script avoids dark→light flash.
-- New SVG logos: a refined anvil (`logo.svg`) and a SMIL-animated
+- New SVG logos: a refined OpenPXE mark (`logo.svg`) and a compact
-  `anvil-forge.svg` (rising sparks + pulsing underglow). Pure SVG —
+  SMIL-animated loader (`loader.svg`). Pure SVG, embedded in the binary.
-  no GIFs, no CSS keyframes for the sparks.
+- Deployment progress widget on the Dashboard and Queue: animated
-- "Forge progress" widget on the Dashboard and Queue: animated
+  OpenPXE mark paired with a `linear-gradient(warn → accent)` progress bar
-  anvil paired with a `linear-gradient(warn → accent)` progress bar
   with a moving sheen. Goes idle (greyscale, no sheen) at zero
   imaging load.
-- Loader replaced "Loading…" text with the same anvil.
+- Loader replaced "Loading..." text with the same OpenPXE mark.
 - Sidebar gains a **Hosts** tab.
 
 **Windows boot validation**:
@@ -317,7 +315,8 @@ other idiom fixes.
   fixes: explicit `net start Workstation` before `net use`, surfaces
   errors instead of blind retries.
 
-**Test count**: 66 → up from 56 in v0.1.0.
+**Test posture**: protocol, HTTP, ISO-store, Windows script, queue, metrics,
+and UI-offline checks all run in the workspace test suite.
 
 ## What's deferred to Phase 6
 

docs/openpxe-logo.svg

@@ -0,0 +1,21 @@
+<svg viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg" role="img" aria-label="OpenPXE">
+  <title>OpenPXE</title>
+  <!-- Static README mark: the "rainbow-horizon" medallion from the web UI,
+       with the SMIL animation removed so it renders reliably as an <img>
+       on Gitea/GitHub. -->
+  <defs>
+    <linearGradient id="opxRainbow" x1="0" y1="0" x2="1" y2="0">
+      <stop offset="0%"     stop-color="#330f1f"/>
+      <stop offset="12.56%" stop-color="#c83228"/>
+      <stop offset="25.06%" stop-color="#fb8841"/>
+      <stop offset="37.56%" stop-color="#d3dd92"/>
+      <stop offset="50.06%" stop-color="#59824f"/>
+      <stop offset="62.06%" stop-color="#002414"/>
+      <stop offset="74.06%" stop-color="#00143d"/>
+      <stop offset="86.06%" stop-color="#2874d7"/>
+      <stop offset="100%"   stop-color="#99c2ff"/>
+    </linearGradient>
+  </defs>
+  <circle cx="12" cy="12" r="10.5" fill="url(#opxRainbow)"
+          stroke="rgba(0,0,0,0.18)" stroke-width="0.6"/>
+</svg>

docs/queued/ipxe-pxe-menu-theme-research.md

@@ -0,0 +1,106 @@
+# PXE menu theme — research for next-release follow-up
+
+Status: queued. v0.4.63 keeps the ASCII-banner fallback + `console --picture`
+compositor wired; this note captures the design for the menu-theming work
+that lands once iPXE rebuilt with `IMAGE_PNG` is published.
+
+## How iVentoy actually does it
+
+iVentoy is closed-source for its menu, but the supporting bits are
+public at https://github.com/ventoy/PXE — a vanilla iPXE snapshot
+(`iPXE/ipxe-bd13697`) used to produce the loader binaries iVentoy
+serves over TFTP (`pxeboot.efi`, `iventoy_loader_16000`,
+`iventoy_loader_16000_uefi`).
+
+The graphical menu itself is rendered by iPXE's framebuffer console
+with a baked-in PNG background via `console --picture` — same
+primitive OpenPXE already uses in `crates/http-api/src/ipxe_script.rs`.
+Evidence:
+
+- The iPXE build in `ventoy/PXE` is configured with `CONSOLE_FRAMEBUFFER`
+  + `IMAGE_PNG` + `CONSOLE_CMD` (the three flags `console --picture`
+  needs).
+- iVentoy issue #11 confirms "iventoy using default 1024x768"; users
+  report 800x600 / 1024x768 / 1280x720 / 1280x1024 / 1920x1080 as
+  selectable resolutions from the iVentoy web UI **Configuration tab**,
+  not via EDID auto-detect. iPXE has no EDID parsing; the daemon writes
+  a resolution-tagged script per boot and serves the matching PNG.
+- iVentoy docs explicitly state both Free and Pro editions **do not
+  support** modifying the boot background/title — it's baked into the
+  shipped PNG assets.
+- Chrome is iPXE's native `menu` / `item` / `choose` widgets (single
+  highlight bar, no borders) painted on top of the PNG, with margins
+  set via `console --left/--right/--top/--bottom` to keep the text off
+  the logo. Not GRUB, not syslinux — UEFI iVentoy uses iPXE's
+  `snponly.efi` / `pxeboot.efi`, and `--picture` does work under UEFI
+  GOP despite older folklore.
+
+Do not conflate this with Ventoy-USB, which is a separate codebase and
+uses GRUB2 themes (`theme.txt`, `background_ventoy.png`, `select_c.png`).
+
+## Rust ingredients to replicate / surpass
+
+Most of these already exist in the workspace.
+
+1. **Compositor (extend, don't replace)** — extend
+   `crates/iso-store/src/pxe_logo.rs` to emit per-resolution PNGs
+   (1024x768, 1280x1024, 1920x1080 as the v1 set). `image` +
+   `imageproc` crates handle scaling; `ab_glyph` / `fontdue` for raster
+   text (subtitle, hostname, version). One source SVG/logo, three to
+   five rendered PNGs cached on disk.
+2. **Script generator** — `ipxe_script.rs` already emits
+   `console --picture … || console`. Add a `?res=` query param (or
+   per-MAC client hint persisted in `hosts.json`) and serve the matching
+   PNG plus matching `console --x --y` line. Keep the text-console
+   fallback already in place.
+3. **Resolution selection** — iPXE exposes `${vesa-x}` / `${vesa-y}` on
+   BIOS; UEFI side we can probe firmware vars at chain-time. The simpler
+   v1 is a "low-res / hi-res" toggle in Settings plus a per-host
+   override — mirrors iVentoy's UX, no kernel helper needed. True EDID
+   parsing is overkill for the first cut.
+4. **Chrome upgrades over iVentoy** — iPXE menus are limited (single
+   highlight, no borders). To look distinctly cooler without leaving
+   iPXE: paint border / title / footer **into the PNG**, leave a window
+   in the middle, then `console --left/--right/--top/--bottom` to inset
+   the iPXE menu exactly into that window. ASCII box-drawing inside the
+   menu remains fragile (iPXE mangles non-ASCII on some builds — already
+   noted in `ipxe_script.rs`).
+
+## Recommended architecture for the next OpenPXE release
+
+- Build a `pxe_theme` module beside `pxe_logo.rs`: takes operator logo
+  + theme tokens (accent colour, title, footer) and renders a layered
+  PNG (background gradient → framing chrome → logo → title bar → footer
+  with `${hostname}` / `${version}` / `${ip}`) at the three target
+  resolutions. Cache by hash of inputs.
+- Serve at `/branding/pxe-menu-{w}x{h}.png`. Default 1024x768; expose a
+  Settings dropdown.
+- In `ipxe_script.rs`, emit
+  `console --picture …/pxe-menu-1024x768.png --left 80 --right 80 --top 180 --bottom 60 || console`,
+  then the existing `menu` / `item` / `choose` block — text now lands
+  inside the framed window.
+- Compile iPXE with `CONSOLE_FRAMEBUFFER`, `IMAGE_PNG`, `CONSOLE_CMD`,
+  `CONSOLE_VESAFB` (BIOS) and `CONSOLE_EFIFB` (UEFI). The v0.4.61 image
+  attempted this in-Docker via QEMU emulation and hit `cc1` segfaults.
+  The follow-up will use a Gitea Actions runner pinned to native
+  `linux/amd64` (an Unraid host already exists for this).
+- Stretch goal: a second "theme pack" that ships a layered PNG with
+  subtle scanlines / grid — iPXE can't animate, but a well-designed
+  static composite beats iVentoy's plain centered logo handily.
+
+## Source URLs
+
+- https://github.com/ventoy/PXE
+- https://github.com/ventoy/PXE/tree/master/iPXE
+- https://github.com/ventoy/PXE/issues/11 — 1024x768 default
+- https://github.com/ventoy/PXE/issues/59 — iVentoy iPXE EFI loader
+- https://ipxe.org/cmd/console — `--picture` and compile flags
+- https://github.com/ipxe/ipxe/discussions/945 — background image how-to
+- https://github.com/ipxe/ipxe/discussions/802 — `CONSOLE_FRAMEBUFFER`
+  requirement
+- https://github.com/ipxe/ipxe/discussions/1006 — picture resolution
+  behaviour
+- https://www.iventoy.com/en/doc_edition.html — background / title not
+  user-customisable
+- https://kingtam.win/archives/iventoy.html — third-party iPXE-based
+  iVentoy alternative

docs/superpowers/specs/2026-05-31-saml-sso-and-ui-design.md

@@ -0,0 +1,199 @@
+# OpenPXE v0.5.1 — SAML SSO wiring + Settings/Storage UI consolidation
+
+**Date:** 2026-05-31
+**Author:** Miles Ward (with Claude)
+**Status:** Approved design → implementation
+
+## Summary
+
+Three workstreams for v0.5.1:
+
+1. **Wire SAML 2.0 SSO** end-to-end (currently config is persisted but no runtime
+   sign-in exists). Pure-Rust implementation that preserves the static-musl /
+   no-OpenSSL architecture, mirroring how FleetDM exposes and handles SAML.
+2. **Fold the Advanced sidebar tab into Settings** as a collapsible section.
+3. **Merge the Storage tab's SMB and NFS cards** into one "Remote shares" card
+   with a protocol dropdown.
+
+Then bump `0.5.0 → 0.5.1`, build the static musl image, push `:0.5.1` + `:latest`
+to Gitea, create the release, and scrub registry credentials.
+
+## Decisions (locked with the user)
+
+- **Crypto:** pure-Rust via `bergshamra` (XML-DSig + exclusive c14n, RustCrypto-based,
+  `#![forbid(unsafe_code)]`, ~99% xmlsec interop). `samael` is rejected — it
+  hard-requires OpenSSL/`xmlsec`/`libxml2` C deps, which would break the static
+  musl binary and the project's pure-Rust / no-OpenSSL architecture.
+- **Access model:** any SAML assertion the IdP successfully authenticates and that
+  we cryptographically verify mints a full operator session. No user table, no
+  roles, no domain allowlist. The local admin account remains a guaranteed
+  fallback owner regardless of SSO state.
+- **Flows:** SP-initiated (the "Sign in with <IdP>" button) is always on.
+  IdP-initiated is supported but gated behind an `allow_idp_initiated` toggle
+  (default off), mirroring FleetDM's "Allow SSO login initiated by identity
+  provider."
+
+## Scope boundaries (v0.5.1)
+
+In scope: SP-initiated + (gated) IdP-initiated login, signature verification on the
+SAML Response/Assertion, full SP-side semantic validation, SP metadata endpoint,
+login-page button wiring.
+
+Out of scope (note for later releases): EncryptedAssertion (assertions must be
+unencrypted), signed AuthnRequests (sent unsigned; Keycloak "client signature
+required" must be off), Single Logout (SLO), multi-user accounts / RBAC / JIT role
+mapping.
+
+---
+
+## Workstream 1 — SAML SP wiring (pure-Rust)
+
+### New dependencies (workspace)
+
+- `bergshamra` — XML-DSig verification + exclusive c14n (pure Rust).
+- `roxmltree` (read/navigate) and/or `quick-xml` (build/serialize) — parse IdP
+  metadata + SAMLResponse, build AuthnRequest and SP metadata.
+- `x509-parser` — extract the IdP signing certificate / public key from metadata.
+- `flate2` — raw DEFLATE for the HTTP-Redirect binding.
+- `base64` — encode/decode SAMLRequest/SAMLResponse.
+
+All pure-Rust → the `x86_64-unknown-linux-musl` static build stays OpenSSL-free.
+Exact `bergshamra` function signatures (`verify`, `DsigContext`, `KeysManager`,
+`Key`, `VerifiedReference`, `VerifyResult`) will be pinned against the installed
+crate source during implementation.
+
+### Module boundaries
+
+Pure protocol logic lives in `openpxe-core` (no axum dependency, unit-testable);
+HTTP wiring lives in `openpxe-http-api`.
+
+- `crates/core/src/saml/mod.rs` — public surface + shared types
+  (`VerifiedPrincipal { email, display_name, name_id, session_index }`, `SamlError`).
+- `crates/core/src/saml/metadata.rs` — parse IdP `EntityDescriptor`: IdP EntityID,
+  `SingleSignOnService` locations + bindings, and one or more X.509 signing
+  certificates. Also build **our** SP metadata XML.
+- `crates/core/src/saml/authn_request.rs` — build an AuthnRequest, return both the
+  request ID (to track) and the encoded HTTP-Redirect query value
+  (deflate → base64 → URL-encode).
+- `crates/core/src/saml/response.rs` — decode `SAMLResponse` (base64 → XML),
+  **verify the signature via bergshamra** against the IdP cert, then enforce SP
+  semantics, returning `VerifiedPrincipal` or a typed `SamlError`.
+
+### SP-side validation (response.rs)
+
+After a cryptographically valid signature over the Response and/or the Assertion:
+
+1. `Status` is `Success`.
+2. `Destination` (if present) equals our ACS URL.
+3. `Conditions/AudienceRestriction/Audience` equals our SP EntityID.
+4. `NotBefore` / `NotOnOrAfter` within bounds (allow small clock skew, e.g. ±60s).
+5. `InResponseTo` matches an outstanding request we issued (SP-initiated). Absent
+   for IdP-initiated, which is only accepted when `allow_idp_initiated` is true.
+6. Assertion-ID replay guard: reject a previously consumed assertion ID.
+7. NameID is the email (`nameid-format:emailAddress`). Display name read from
+   common attributes (`name`, `displayname`, `cn`, `urn:oid:2.5.4.3`).
+
+XML Signature Wrapping (XSW) defenses come from bergshamra (duplicate-ID rejection,
+strict positional verification); enable its strict verification options. We
+additionally confirm the verified `Reference` covers the element we read claims from.
+
+### State (in `openpxe-http-api`)
+
+Two small TTL-pruned in-memory stores (parking_lot `Mutex<HashMap<...>>`):
+
+- **Outstanding requests:** `request_id → issued_at`, TTL ≈ 5 min, for `InResponseTo`.
+- **Consumed assertions:** `assertion_id → expires_at`, TTL = assertion validity,
+  for replay protection.
+
+(In-memory is acceptable: a single-container app; a restart simply invalidates
+in-flight logins.)
+
+### Routes (all pre-auth; added to the public allowlist in the auth middleware)
+
+- `GET /api/sso/login` → build AuthnRequest, record its ID, 302 to the IdP SSO URL
+  (HTTP-Redirect binding) with `SAMLRequest` + `RelayState`.
+- `POST /api/sso/acs` → consume `SAMLResponse` (form-encoded). Verify + validate.
+  On success: `SessionStore::create(email)`, set the `openpxe_session` cookie
+  (same attributes as forms login), 302 to the dashboard. On failure: 302 back to
+  the login page with an error indicator. (Mirrors FleetDM's `/sso/callback`.)
+- `GET /api/sso/metadata` → serve our SP `EntityDescriptor` XML for IdP import.
+
+### Config changes (`crates/core/src/sso.rs`)
+
+Add to `SsoConfig` (preserve existing fields + validation):
+
+- `entity_id: String` — SP Entity ID (mirrors FleetDM's "Entity ID"); defaults to
+  the configured public base URL. The ACS URL is derived as
+  `<public_base_url>/api/sso/acs`.
+- `allow_idp_initiated: bool` — default `false`.
+
+`GET /api/sso` returns the new fields; `PUT /api/sso` validates and persists them.
+
+### Login page (`crates/webui/src/app.js`)
+
+Replace the "configured · runtime pending" message: the existing
+"Sign in with <IdP>" button navigates to `GET /api/sso/login`. Render the IdP logo
+(if `idp_logo_url` set) and use `idp_name` as the label. Keep the existing
+FleetDM-style login layout.
+
+### Testing
+
+- `core/saml` unit tests using a self-signed test keypair we control:
+  - Parse representative Keycloak IdP metadata → correct SSO URL + cert.
+  - Build an AuthnRequest → well-formed, deflate/base64 round-trips, ID recorded.
+  - A correctly signed Response → `VerifiedPrincipal { email, .. }`.
+  - Reject: tampered signature, expired (`NotOnOrAfter`), wrong audience,
+    replayed assertion ID, unsigned response, `Status != Success`.
+- `http-api` integration test: `GET /api/sso/login` returns a 302 with a
+  `SAMLRequest` query param; a crafted signed `SAMLResponse` POSTed to
+  `/api/sso/acs` (signed with the test key) sets an `openpxe_session` cookie.
+
+---
+
+## Workstream 2 — Advanced tab → Settings
+
+- Remove the `Advanced` sidebar entry (`crates/webui/src/index.html`) and its
+  `advanced` view route in `app.js`.
+- In the Settings view, append a **collapsible "Advanced" disclosure**
+  (default-collapsed) at the bottom containing the existing **Webhook
+  Notifications** card and the **API reference** block (moved out of the removed
+  Advanced view).
+- No backend changes; `/api/notify*` and `/api/docs` endpoints are unchanged.
+
+---
+
+## Workstream 3 — Storage: merge SMB + NFS → "Remote shares"
+
+- Replace the separate "SMB shares" and "NFS shares" cards with a single
+  **"Remote shares"** card:
+  - One add-form with a **protocol dropdown (SMB / NFS)**. Selecting the protocol
+    swaps the fields: SMB → server, share, guest checkbox, username, password;
+    NFS → server, export path.
+  - One unified table with a leading **Protocol** column (SMB/NFS badge), then
+    server/share-or-export, auth, ISO count, reachability, and Re-scan / Remove
+    actions.
+- **No backend changes.** The form dispatches to the existing
+  `POST /api/smb-shares` or `POST /api/nfs-shares`; the table merges
+  `GET /api/smb-shares` + `GET /api/nfs-shares`, tagging each row with its
+  protocol. Re-scan/Remove call the existing per-protocol endpoints.
+- Leaves the card pattern open for a future "Config files" card.
+
+---
+
+## Release
+
+1. Bump workspace version `0.5.0 → 0.5.1` (`Cargo.toml`).
+2. `cargo fmt`, `cargo clippy`, `cargo test` (all crates) green.
+3. Build the static musl binary + Docker image; verify SAML deps compile clean
+   under musl (no OpenSSL/C linkage).
+4. Push `openpxe:0.5.1` + `openpxe:latest` to Gitea via the established
+   temp-DOCKER_CONFIG pipeline; scrub credentials (logout + verify no token traces).
+5. Create the Gitea release `v0.5.1` with notes.
+
+## Risks
+
+- `bergshamra` is pre-1.0 and unaudited. Mitigation: pin the version, enable strict
+  verification, keep the local-admin fallback, and own the SP-semantic checks
+  carefully (audience/Conditions/replay/InResponseTo — where SP vulns usually live).
+- SAML is security-sensitive; negative tests (tamper/expiry/audience/replay/unsigned)
+  are part of the definition of done, not optional.

runbooks/linux-network-boot.md

@@ -115,7 +115,7 @@ Two options. Pick one.
 
 Big ISOs stream — there is no 2 GB limit, but expect upload to be
 throttled by your browser ↔ host link. The UI shows a progress bar; the
-animated anvil on the Dashboard tab fires up while imaging is in
+animated OpenPXE mark on the Dashboard tab fires up while imaging is in
 flight.
 
 ### 2b. Bulk seed from a directory (recommended for fresh deploys / CI)
@@ -290,7 +290,7 @@ INFO openpxe::http: GET /iso/ubuntu-…/casper/initrd  Range=bytes=0- 200 OK 75
 ```
 
 The **Terminal** tab in the web UI shows the same thing live, plus a
-short whitelisted command palette (`status`, `clients`, `gate`,
+short whitelisted command palette (`status`, `clients`, `queue`,
 `hosts`, `log`).
 
 ### 5d. Internet-side ISO sources
@@ -347,19 +347,19 @@ default for production hardware.
 ## 7. Re-imaging — the “Queued Deployment” flow
 
 Different scenario: you have **a rack of 30 servers** to image
-identically, all at once. Don’t bind 30 MACs by hand. Use the gate.
+identically, all at once. Don’t bind 30 MACs by hand. Use the queue.
 
 1. **Don’t** create host bindings.
 2. PXE-boot every machine. They land on the menu.
 3. On each: select **Queued Deployment**. They get position #1, #2,
    …, #30 and start long-polling.
-4. In the UI: **Forge Gate** tab shows all 30 lined up. Pick the
+4. In the UI: **Queue** tab shows all 30 lined up. Pick the
    ISO, click **Assign to all waiting**.
 5. Every client’s open long-poll wakes up at the same instant and
    chains the same boot script. They all start imaging
-   simultaneously — the “horse race gate” opens.
+   simultaneously.
 
-The animated anvil widget on the Dashboard runs while any client is
+The animated OpenPXE progress widget on the Dashboard runs while any client is
 still in the kernel-fetch phase.
 
 ---

scripts/build-ipxe.sh

@@ -0,0 +1,90 @@
+#!/usr/bin/env bash
+# Build PNG-enabled iPXE binaries from source.
+#
+# Why from source: the official boot.ipxe.org binaries (and the
+# Debian-packaged ones) are NOT built with CONSOLE_FRAMEBUFFER +
+# IMAGE_PNG + CONSOLE_CMD, so `console --picture` is a no-op on them —
+# you can't paint a graphical boot-menu background. iVentoy solves this
+# by shipping its own iPXE build with exactly those three flags; we do
+# the same, from upstream iPXE, with a thin auditable config delta
+# (deploy/ipxe/local/{general,console}.h).
+#
+# Why a real cross-compiler instead of QEMU: building amd64 iPXE by
+# emulating an amd64 gcc under QEMU on an arm64 host intermittently
+# segfaults cc1 (the reason this was stuck for ~8 releases). Running a
+# NATIVE arm64 gcc that cross-targets x86_64 (CROSS_COMPILE=
+# x86_64-linux-gnu-) sidesteps emulation entirely — the compiler is a
+# native binary, it just emits x86_64 objects. This stage is meant to
+# run on $BUILDPLATFORM (the native builder arch), NOT the emulated
+# target platform.
+#
+# Outputs (into $DEST), using the filenames OpenPXE's arch mapping
+# expects:
+#   snponly.efi   x86_64 UEFI, PNG-enabled
+#   ipxe.efi      x86_64 UEFI, PNG-enabled (bundled drivers)
+#
+# We build ONLY x86_64 UEFI, always via the x86_64 cross toolchain
+# (`x86_64-linux-gnu-gcc`). That's deliberately host-arch-agnostic: it
+# works whether this stage runs on an arm64 Mac builder or an amd64 CI
+# runner, because the cross compiler runs native and emits x86_64
+# either way. Building arm64-efi or BIOS here would re-introduce a
+# dependency on the host arch (native arm64 build) or a 32-bit multilib
+# toolchain — so those arches keep their upstream-fetched (no-PNG)
+# binaries and fall back to the menu's clean `|| console` text screen.
+# Modern PXE clients are overwhelmingly x86_64 UEFI, which get the full
+# graphical background.
+
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+DEST="${1:-$ROOT/assets/ipxe}"
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+
+# Pinned upstream iPXE. Rolling master is fine functionally, but a pin keeps
+# builds reproducible, protects against a transient master breakage, and —
+# crucially for the Docker image — busting this value invalidates the cached
+# ipxe-build layer so an "update iPXE" release actually recompiles from the
+# new upstream. Bump deliberately to a recent master commit.
+#
+# v0.6.1: ipxe/ipxe master @ 2026-06-09 (newer NIC drivers + EFI fixes;
+# mirrors iVentoy 1.0.35 "Update iPXE").
+IPXE_REPO="https://github.com/ipxe/ipxe.git"
+IPXE_REF="${IPXE_REF:-95ffbf4745553e8a207922389929e1943c0237c0}"
+
+echo ">> fetching iPXE ($IPXE_REF)"
+# Shallow-fetch the exact ref: works for a full commit SHA (GitHub allows
+# reachable-SHA1-in-want) and for branch/tag names. Fall back to a full
+# clone + checkout if the server refuses a direct fetch of this ref.
+git init -q "$WORK/ipxe"
+git -C "$WORK/ipxe" remote add origin "$IPXE_REPO"
+if git -C "$WORK/ipxe" fetch -q --depth 1 origin "$IPXE_REF"; then
+  git -C "$WORK/ipxe" checkout -q FETCH_HEAD
+else
+  echo "   direct fetch failed; falling back to full clone + checkout"
+  rm -rf "$WORK/ipxe"
+  git clone -q "$IPXE_REPO" "$WORK/ipxe"
+  git -C "$WORK/ipxe" checkout -q "$IPXE_REF"
+fi
+SRC="$WORK/ipxe/src"
+
+echo ">> applying OpenPXE config overrides (PNG + framebuffer + console cmd)"
+mkdir -p "$SRC/config/local"
+cp "$ROOT/deploy/ipxe/local/general.h" "$SRC/config/local/general.h"
+cp "$ROOT/deploy/ipxe/local/console.h" "$SRC/config/local/console.h"
+
+mkdir -p "$DEST"
+
+# x86_64 UEFI — cross-compiled with the native arm64 gcc targeting
+# x86_64. HOST_CC stays the native cc for iPXE's build-time utilities
+# (elf2efi, zbin, …); only the target objects use the cross compiler.
+echo ">> building x86_64 UEFI (snponly.efi, ipxe.efi)"
+make -C "$SRC" -j"$(nproc)" \
+  CROSS_COMPILE=x86_64-linux-gnu- \
+  bin-x86_64-efi/snponly.efi \
+  bin-x86_64-efi/ipxe.efi
+cp "$SRC/bin-x86_64-efi/snponly.efi" "$DEST/snponly.efi"
+cp "$SRC/bin-x86_64-efi/ipxe.efi"    "$DEST/ipxe.efi"
+
+echo ">> iPXE build complete:"
+ls -l "$DEST"/snponly.efi "$DEST"/ipxe.efi

scripts/fetch-ipxe.sh

@@ -29,11 +29,19 @@ mkdir -p "$DEST"
 # Upstream uses arch-scoped subdirectories; we flatten to the names our
 # ClientArch::ipxe_bootfile() expects.
 declare -a MAP=(
+  # DriverMode::Firmware (default) — reuse the firmware UNDI/SNP NIC stack.
   "undionly.kpxe=undionly.kpxe"
   "snponly.efi=x86_64-efi/snponly.efi"
   "snponly-i386.efi=i386-efi/snponly.efi"
   "snponly-arm64.efi=arm64-efi/snponly.efi"
-  "ipxe.efi=x86_64-efi/ipxe.efi"          # fallback with bundled drivers
+  # DriverMode::Builtin (v0.6.1 automatic fallback) — iPXE's own all-drivers
+  # builds, advertised by the DHCP proxy to a MAC whose firmware NIC stack
+  # failed to chainload. (x86_64 ipxe.efi is rebuilt from source with PNG in
+  # build-ipxe.sh and overlaid on top of this fetched baseline.)
+  "ipxe.efi=x86_64-efi/ipxe.efi"
+  "ipxe.pxe=ipxe.pxe"
+  "ipxe-i386.efi=i386-efi/ipxe.efi"
+  "ipxe-arm64.efi=arm64-efi/ipxe.efi"
 )
 
 BASE="https://boot.ipxe.org"

scripts/fetch-shim.sh

@@ -0,0 +1,96 @@
+#!/usr/bin/env bash
+# Fetch Fedora's Microsoft-signed Secure Boot chain — shim + GRUB — and
+# place the EFI binaries under assets/ipxe/ with the filenames OpenPXE's
+# DriverMode::Shim mapping expects:
+#
+#   shimx64.efi    x86_64: Microsoft-signed shim (first stage)
+#   grubx64.efi    x86_64: Fedora-signed GRUB (loaded by shim, fetches
+#                  the server-rendered grub.cfg over TFTP/HTTP)
+#   shimaa64.efi   arm64 equivalents (best-effort — see below)
+#   grubaa64.efi
+#
+# Why Fedora: a supply-chain decision made deliberately (v0.7.0) — one
+# vendor, fast security turnaround, and the same chain most netboot
+# projects redistribute. The binaries are extracted from the official
+# distro RPMs and shipped BYTE-FOR-BYTE UNMODIFIED; their signatures are
+# what make the chain work, and modifying them would break it. This is
+# the standard documented netboot path for Secure Boot (Red Hat
+# Satellite, SUSE HTTPBoot) and involves no test certificates and no
+# client trust-store changes.
+#
+# Trust model matches fetch-ipxe.sh: HTTPS to the official distribution
+# point, no sha pinning because we track the latest signed build (which
+# rotates on SBAT revocations — pinning would mean shipping revoked
+# shims). Mirror to your own artifact store for deterministic builds.
+
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+DEST="${1:-$ROOT/assets/ipxe}"
+mkdir -p "$DEST"
+
+FEDORA_RELEASE="${FEDORA_RELEASE:-43}"
+BASE="${FEDORA_MIRROR:-https://dl.fedoraproject.org/pub/fedora/linux/releases/$FEDORA_RELEASE/Everything}"
+
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+
+# Find the newest RPM in a repo directory whose name starts with
+# `$pattern` followed by a version digit (anchoring on the digit keeps
+# `grub2-efi-x64` from matching `grub2-efi-x64-cdboot`).
+latest_rpm() {
+  local dir_url="$1" pattern="$2"
+  curl -fsSL "$dir_url/" \
+    | grep -oE "href=\"${pattern}-[0-9][^\"]*\.rpm\"" \
+    | sed 's/^href="//; s/"$//' \
+    | sort -V | tail -1
+}
+
+# fetch_chain <repo-arch> <shim-pkg> <grub-pkg> <shim-out> <grub-out> <hard|soft>
+fetch_chain() {
+  local arch="$1" shim_pkg="$2" grub_pkg="$3" shim_out="$4" grub_out="$5" mode="$6"
+  local pkg_base="$BASE/$arch/os/Packages"
+  local sdir="$pkg_base/${shim_pkg:0:1}" gdir="$pkg_base/${grub_pkg:0:1}"
+
+  local shim_rpm grub_rpm
+  shim_rpm="$(latest_rpm "$sdir" "$shim_pkg" || true)"
+  grub_rpm="$(latest_rpm "$gdir" "$grub_pkg" || true)"
+  if [ -z "$shim_rpm" ] || [ -z "$grub_rpm" ]; then
+    echo "!! could not locate $shim_pkg/$grub_pkg RPMs under $pkg_base"
+    [ "$mode" = "hard" ] && exit 2
+    echo "   skipping $arch Secure Boot chain (best-effort)"
+    return 0
+  fi
+
+  echo ">> $arch: $shim_rpm + $grub_rpm"
+  local exdir="$WORK/$arch"
+  mkdir -p "$exdir"
+  curl -fsSL -o "$exdir/shim.rpm" "$sdir/$shim_rpm"
+  curl -fsSL -o "$exdir/grub.rpm" "$gdir/$grub_rpm"
+  ( cd "$exdir" \
+    && rpm2cpio shim.rpm | cpio -idm --quiet "./boot/efi/EFI/*/$shim_out" \
+    && rpm2cpio grub.rpm | cpio -idm --quiet "./boot/efi/EFI/*/$grub_out" )
+
+  local shim_path grub_path
+  shim_path="$(find "$exdir/boot" -name "$shim_out" | head -1)"
+  grub_path="$(find "$exdir/boot" -name "$grub_out" | head -1)"
+  if [ -z "$shim_path" ] || [ -z "$grub_path" ]; then
+    echo "!! RPM layout changed — $shim_out/$grub_out not found inside the packages"
+    [ "$mode" = "hard" ] && exit 2
+    return 0
+  fi
+  cp "$shim_path" "$DEST/$shim_out"
+  cp "$grub_path" "$DEST/$grub_out"
+  echo "   installed $shim_out + $grub_out"
+}
+
+# x86_64 is the headline Secure Boot audience — fail the build if it
+# can't be assembled so a regression is loud, not silent.
+fetch_chain x86_64 shim-x64 grub2-efi-x64 shimx64.efi grubx64.efi hard
+# arm64 is best-effort: skipping just means no Shim escalation rung for
+# that arch (logged at startup by ipxe-assets::log_availability).
+fetch_chain aarch64 shim-aa64 grub2-efi-aa64 shimaa64.efi grubaa64.efi soft
+
+echo
+echo "Secure Boot chain assets now in $DEST:"
+ls -lh "$DEST"/shim*.efi "$DEST"/grub*.efi 2>/dev/null || true