v0.4.5: VMware UEFI fix, static musl binary, Forms auth + SSO config

VMware UEFI / Casper boot fix:
- Linux cmdline for Debian/Ubuntu/Mint/Pop!_OS/elementary now uses the
  canonical Casper `iso-url=` option and `ds=nocloud`, matching the
  fix Bootimus shipped in v0.1.67. The previous
  `boot=casper netboot=url url=… ip=dhcp ---` form booted fine on
  bare-metal UEFI but hung at "cloud-init running" on VMware guests
  because subiquity / cloud-init can't reach a metadata datasource
  through PXE.

Static binary (matches Bootimus v0.1.70):
- Dockerfile build stage now compiles against
  x86_64-unknown-linux-musl. The resulting /openpxe has no glibc
  dependency at all; the runtime stage still ships Debian slim for the
  samba/wimtools/nfs-common shellouts, but a future scratch/distroless
  variant is now a one-line swap. Cuts a class of "GLIBC_2.39 not
  found" surprises on older RHEL/Rocky hosts.

Forms auth (Sonarr/Radarr-style):
- New AdminStore in openpxe-core: single admin record persisted to
  <work_dir>/auth.json, bcrypt-hashed credentials, rotation requires
  current password.
- New SessionStore in openpxe-http-api: in-memory UUID-keyed sessions
  with 24h sliding TTL, openpxe_session HttpOnly cookie.
- Endpoints: POST /api/setup (first-run), POST /api/login, POST
  /api/logout, GET /api/me, PUT /api/me/credentials (rotates and
  revokes every other session).
- Auth middleware gates /api/* once the admin is configured;
  passes through entirely until then (tests + fresh installs ride this
  path). Allowlists PXE-essential paths (/boot.ipxe, /iso/*, /ipxe/*,
  /api/queue/join, /api/queue/poll/*) so iPXE clients still work
  without a cookie they can't send.
- WebUI: first-run setup card, login card, logout chip in the sidebar
  footer, Account card in Settings for rotating creds. Auth screen is
  fully styled (centered narrow card, matches Sonarr layout).

SSO config (FleetDM-shaped, storage-only):
- New SsoStore in openpxe-core: { enabled, idp_name, metadata,
  metadata_url } persisted to <work_dir>/sso.json with size caps and
  URL-scheme validation.
- Endpoints: GET /api/sso, PUT /api/sso. Validation: enabling SSO
  without either metadata or metadata_url returns 400.
- WebUI: SSO card in Settings with a URL-vs-XML mode switch and an
  inert "Sign in with X" button on the login screen while runtime
  flow is pending. Per the brief: no Entity ID field (defaults to the
  advertised public_base_url internally when SAML wiring lands).

Quality:
- 132 tests passing (was 106 in v0.4.4): +5 auth unit tests, +5 SSO
  unit tests, +7 auth integration tests, +1 SSO integration test, +1
  regression guard pinning the new Casper cmdline.
- cargo clippy --workspace --all-targets clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

.gitignore

@@ -1,5 +1,4 @@
 /target
-Cargo.lock
 data/isos/*.iso
 data/isos/*.partial
 data/isos/*.meta.json

Cargo.toml

@@ -12,9 +12,9 @@ members = [
 ]
 
 [workspace.package]
-version = "0.3.2"
+version = "0.4.5"
 edition = "2021"
-rust-version = "1.80"
+rust-version = "1.95"
 license = "MIT OR Apache-2.0"
 repository = "https://gitea.milesward.dev/mward4/OpenPXE"
 authors = ["OpenPXE contributors"]

README.md

@@ -5,11 +5,11 @@ Container-native PXE boot server. A Rust reimplementation of
 for Docker/OCI and OpenShift. Upload `.iso` files via the web UI; network
 clients PXE-boot them.
 
-> **Status:** v0.3.2 / pre-beta. Phases 1–5 complete: full PXE stack,
+> **Status:** v0.4.1 / pre-beta. Phases 1–5 complete: full PXE stack,
 > Queued Deployment queue, NFS-share ISO sources, live tracing log + an
-> operator terminal, per-MAC host bindings (Tinkerbell-style),
+> operator terminal, per-MAC host bindings, Prometheus `/metrics`,
-> Prometheus `/metrics`, light/dark theme toggle, animated OpenPXE
+> light/dark theme toggle, animated OpenPXE imaging-progress widget,
-> imaging-progress widget, and per-ISO boot passwords. The test suite and
+> chunked ISO uploads, and per-ISO boot passwords. The test suite and
 > clippy are part of the release checklist. Ready for real-hardware validation.
 
 ## Design non-negotiables
@@ -51,8 +51,7 @@ clients PXE-boot them.
    widget when devices are imaging. All assets served from the binary —
    no external requests.
 8. **Per-MAC host bindings.** Pin a MAC to a boot target and the client
-   skips the menu, chains straight through. Inspired by Tinkerbell's
+   skips the menu, chains straight through.
-   `smee` MAC-prepended URL pattern.
 9. **Prometheus metrics** at `/metrics` — DHCP replies by arch, TFTP
    transfer counts and bytes, HTTP request counts by route, queue /
    imaging gauges, uptime, build info. Plain text exposition format,
@@ -81,7 +80,7 @@ skip TFTP and respond with an HTTP URL.
 ./scripts/fetch-ipxe.sh
 
 # 2. Build the container image (~3 min first time).
-docker buildx build -f deploy/docker/Dockerfile -t openpxe:0.3.2 --load .
+docker buildx build -f deploy/docker/Dockerfile -t openpxe:0.4.1 --load .
 
 # 3. Run it on the box plugged into your PXE network. Set PUBLIC_IP to
 #    this host's LAN address so advertised iPXE URLs are reachable.
@@ -91,7 +90,7 @@ docker run -d --name openpxe \
   -e OPENPXE_DHCP_MODE=proxy \
   -v $PWD/data/isos:/var/lib/openpxe/isos \
   -v $PWD/data/work:/var/lib/openpxe/work \
-  openpxe:0.3.2
+  openpxe:0.4.1
 
 # 4. Open the UI and drop an ISO in.
 open http://10.0.0.5
@@ -122,7 +121,7 @@ docker buildx create --name openpxe-multi --driver docker-container --use
 # Build + push both linux/amd64 and linux/arm64 under one tag.
 docker buildx build --builder openpxe-multi \
   --platform linux/amd64,linux/arm64 \
-  -t ghcr.io/YOUR-ORG/openpxe:0.3.2 \
+  -t ghcr.io/YOUR-ORG/openpxe:0.4.1 \
   --push \
   -f deploy/docker/Dockerfile .
 ```
@@ -155,10 +154,10 @@ docker run --rm \
   -v /my/iso-library:/seed:ro \
   -v openpxe-data:/var/lib/openpxe/isos \
   -e OPENPXE_PUBLIC_IP=10.0.0.5 \
-  openpxe:0.3.2 seed --from /seed
+  openpxe:0.4.1 seed --from /seed
 
 # Dry run first to see what would be imported:
-docker run --rm -v /my/iso-library:/seed:ro openpxe:0.3.2 seed --from /seed --dry-run
+docker run --rm -v /my/iso-library:/seed:ro openpxe:0.4.1 seed --from /seed --dry-run
 ```
 
 ### Environment overrides

crates/core/Cargo.toml

@@ -21,6 +21,9 @@ time.workspace = true
 uuid.workspace = true
 parking_lot.workspace = true
 tokio = { workspace = true, features = ["sync", "rt", "macros", "time"] }
+# bcrypt for the admin Forms auth (v0.4.5). Already in the workspace
+# for per-ISO boot passwords; just re-exported here.
+bcrypt.workspace = true
 
 [dev-dependencies]
 tempfile = "3.12"

crates/core/src/auth.rs

@@ -0,0 +1,353 @@
+//! Operator authentication — Sonarr/Radarr-style single-admin Forms model.
+//!
+//! On a fresh install, no admin account exists; the WebUI's first-run
+//! flow prompts the operator to create one. After that the chosen
+//! credentials gate `/api/*` access. The admin can rotate username +
+//! password from Settings → Account.
+//!
+//! Multi-user RBAC isn't a goal for OpenPXE — the user explicitly asked
+//! for "you have access or you don't". When SSO is configured, additional
+//! users come in through the IdP; the locally-stored admin is the
+//! fallback owner who can change SSO config or the seal-breaker for an
+//! IdP outage. So one record is enough.
+//!
+//! Storage policy mirrors [`crate::host_bindings::HostBindings`] and
+//! [`crate::boot_log::BootLog`]: in-memory authoritative; disk is the
+//! crash-survival cache; a corrupt `auth.json` falls back to "no admin
+//! configured" rather than blocking startup, which puts the UI back
+//! into setup mode rather than locking the operator out.
+
+use parking_lot::RwLock;
+use serde::{Deserialize, Serialize};
+use std::path::PathBuf;
+use std::sync::Arc;
+use time::OffsetDateTime;
+
+use crate::{Error, Result};
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct AdminAccount {
+    pub username: String,
+    /// bcrypt hash (cost 10). The plaintext password never leaves the
+    /// request that set it — same discipline as the per-ISO boot password.
+    pub password_hash: String,
+    #[serde(with = "time::serde::rfc3339")]
+    pub created_at: OffsetDateTime,
+    #[serde(with = "time::serde::rfc3339")]
+    pub updated_at: OffsetDateTime,
+}
+
+/// Public projection — no hash, safe to ship to the WebUI.
+#[derive(Debug, Clone, Serialize)]
+pub struct AdminPublic {
+    pub username: String,
+    #[serde(with = "time::serde::rfc3339")]
+    pub created_at: OffsetDateTime,
+    #[serde(with = "time::serde::rfc3339")]
+    pub updated_at: OffsetDateTime,
+}
+
+impl From<&AdminAccount> for AdminPublic {
+    fn from(a: &AdminAccount) -> Self {
+        Self {
+            username: a.username.clone(),
+            created_at: a.created_at,
+            updated_at: a.updated_at,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+struct Inner {
+    admin: Option<AdminAccount>,
+}
+
+/// In-memory + on-disk admin registry. Cheap to clone.
+#[derive(Debug, Clone)]
+pub struct AdminStore {
+    path: Arc<PathBuf>,
+    inner: Arc<RwLock<Inner>>,
+}
+
+impl AdminStore {
+    /// Load from `<work_dir>/auth.json`, or start empty. A bad file
+    /// logs a warning and falls back to "no admin configured" — better
+    /// to surface the setup flow than lock the operator out of their
+    /// own install.
+    #[must_use]
+    pub fn load_or_default(work_dir: &std::path::Path) -> Self {
+        let path = work_dir.join("auth.json");
+        let inner = match std::fs::read_to_string(&path) {
+            Ok(text) => match serde_json::from_str::<Inner>(&text) {
+                Ok(parsed) => parsed,
+                Err(e) => {
+                    tracing::warn!(
+                        target: "openpxe::auth",
+                        "auth.json present but unreadable ({e}); starting in setup mode"
+                    );
+                    Inner::default()
+                }
+            },
+            Err(_) => Inner::default(),
+        };
+        Self {
+            path: Arc::new(path),
+            inner: Arc::new(RwLock::new(inner)),
+        }
+    }
+
+    /// Has an admin been bootstrapped? Drives the first-run / login
+    /// fork in the HTTP layer.
+    #[must_use]
+    pub fn is_configured(&self) -> bool {
+        self.inner.read().admin.is_some()
+    }
+
+    /// Public-safe snapshot for the WebUI.
+    #[must_use]
+    pub fn snapshot(&self) -> Option<AdminPublic> {
+        self.inner.read().admin.as_ref().map(AdminPublic::from)
+    }
+
+    /// First-run setup: create the admin account. Fails if one already
+    /// exists — the HTTP layer surfaces that as 409.
+    pub fn bootstrap(&self, username: &str, password: &str) -> Result<AdminPublic> {
+        validate_username(username)?;
+        validate_password(password)?;
+        let hash = bcrypt_hash(password)?;
+        let now = OffsetDateTime::now_utc();
+        let admin = AdminAccount {
+            username: username.trim().to_string(),
+            password_hash: hash,
+            created_at: now,
+            updated_at: now,
+        };
+        {
+            let mut g = self.inner.write();
+            if g.admin.is_some() {
+                return Err(Error::Invalid(
+                    "admin account already configured".into(),
+                ));
+            }
+            g.admin = Some(admin.clone());
+        }
+        self.persist();
+        tracing::info!(
+            target: "openpxe::auth",
+            username = %admin.username,
+            "admin account created (first-run setup)"
+        );
+        Ok((&admin).into())
+    }
+
+    /// Verify credentials. Returns the admin record (public projection)
+    /// on success, `Ok(None)` on mismatch, `Err` on systemic bcrypt
+    /// failure (treated as "auth not available right now" by callers).
+    pub fn verify(&self, username: &str, password: &str) -> Result<Option<AdminPublic>> {
+        let Some(admin) = self.inner.read().admin.clone() else {
+            return Ok(None);
+        };
+        if username.trim() != admin.username {
+            return Ok(None);
+        }
+        // bcrypt compares in constant time relative to the same hash.
+        // Doing the username check first is fine — a username mismatch
+        // returns immediately, but the only thing leaked is "this isn't
+        // the admin's username" which the operator already knows.
+        match bcrypt::verify(password, &admin.password_hash) {
+            Ok(true) => Ok(Some((&admin).into())),
+            Ok(false) => Ok(None),
+            Err(e) => Err(Error::Other(e.into())),
+        }
+    }
+
+    /// Rotate username and/or password. `current_password` must match
+    /// the *existing* hash — same flow as Sonarr's "current password
+    /// required to change". `new_username`/`new_password` are optional:
+    /// pass only what you want to change.
+    pub fn update_credentials(
+        &self,
+        current_password: &str,
+        new_username: Option<&str>,
+        new_password: Option<&str>,
+    ) -> Result<AdminPublic> {
+        // Re-check ownership before any state mutation.
+        let existing = self
+            .inner
+            .read()
+            .admin
+            .clone()
+            .ok_or_else(|| Error::Invalid("no admin configured".into()))?;
+        match bcrypt::verify(current_password, &existing.password_hash) {
+            Ok(true) => {}
+            Ok(false) => return Err(Error::Invalid("current password is incorrect".into())),
+            Err(e) => return Err(Error::Other(e.into())),
+        }
+
+        let mut updated = existing.clone();
+        if let Some(u) = new_username {
+            validate_username(u)?;
+            updated.username = u.trim().to_string();
+        }
+        if let Some(p) = new_password {
+            validate_password(p)?;
+            updated.password_hash = bcrypt_hash(p)?;
+        }
+        updated.updated_at = OffsetDateTime::now_utc();
+
+        {
+            let mut g = self.inner.write();
+            g.admin = Some(updated.clone());
+        }
+        self.persist();
+        tracing::info!(
+            target: "openpxe::auth",
+            username = %updated.username,
+            "admin credentials updated"
+        );
+        Ok((&updated).into())
+    }
+
+    fn persist(&self) {
+        let snap = self.inner.read().clone();
+        let body = match serde_json::to_vec_pretty(&snap) {
+            Ok(b) => b,
+            Err(e) => {
+                tracing::warn!(target: "openpxe::auth", "serialize auth.json: {e}");
+                return;
+            }
+        };
+        if let Some(parent) = self.path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        let tmp = self.path.with_extension("json.tmp");
+        if let Err(e) = std::fs::write(&tmp, body) {
+            tracing::warn!(target: "openpxe::auth", "write auth.json tmp: {e}");
+            return;
+        }
+        if let Err(e) = std::fs::rename(&tmp, self.path.as_path()) {
+            tracing::warn!(target: "openpxe::auth", "rename auth.json: {e}");
+        }
+    }
+}
+
+fn validate_username(u: &str) -> Result<()> {
+    let u = u.trim();
+    if u.is_empty() {
+        return Err(Error::Invalid("username must not be empty".into()));
+    }
+    if u.len() > 64 {
+        return Err(Error::Invalid("username must be 64 chars or fewer".into()));
+    }
+    if !u.chars().all(|c| c.is_ascii_graphic() && c != ':') {
+        return Err(Error::Invalid(
+            "username must be ASCII printable with no ':' character".into(),
+        ));
+    }
+    Ok(())
+}
+
+fn validate_password(p: &str) -> Result<()> {
+    if p.len() < 8 {
+        return Err(Error::Invalid(
+            "password must be at least 8 characters".into(),
+        ));
+    }
+    if p.len() > 256 {
+        return Err(Error::Invalid(
+            "password must be 256 characters or fewer".into(),
+        ));
+    }
+    Ok(())
+}
+
+fn bcrypt_hash(password: &str) -> Result<String> {
+    bcrypt::hash(password, bcrypt::DEFAULT_COST).map_err(|e| Error::Other(e.into()))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::tempdir;
+
+    #[test]
+    fn empty_after_load_when_no_file() {
+        let dir = tempdir().unwrap();
+        let s = AdminStore::load_or_default(dir.path());
+        assert!(!s.is_configured());
+        assert!(s.snapshot().is_none());
+    }
+
+    #[test]
+    fn bootstrap_then_verify_round_trip() {
+        let dir = tempdir().unwrap();
+        let s = AdminStore::load_or_default(dir.path());
+        let pub_ = s.bootstrap("admin", "hunter2hunter2").unwrap();
+        assert_eq!(pub_.username, "admin");
+        assert!(s.is_configured());
+
+        // Correct creds match; wrong creds don't.
+        assert!(s.verify("admin", "hunter2hunter2").unwrap().is_some());
+        assert!(s.verify("admin", "wrong").unwrap().is_none());
+        assert!(s.verify("nobody", "hunter2hunter2").unwrap().is_none());
+    }
+
+    #[test]
+    fn bootstrap_rejects_second_call() {
+        let dir = tempdir().unwrap();
+        let s = AdminStore::load_or_default(dir.path());
+        s.bootstrap("admin", "hunter2hunter2").unwrap();
+        let r = s.bootstrap("other", "anotherpass1");
+        assert!(matches!(r, Err(Error::Invalid(_))));
+    }
+
+    #[test]
+    fn round_trip_survives_disk_reload() {
+        let dir = tempdir().unwrap();
+        let s = AdminStore::load_or_default(dir.path());
+        s.bootstrap("admin", "hunter2hunter2").unwrap();
+        drop(s);
+        let s2 = AdminStore::load_or_default(dir.path());
+        assert!(s2.is_configured());
+        assert!(s2.verify("admin", "hunter2hunter2").unwrap().is_some());
+    }
+
+    #[test]
+    fn update_credentials_requires_current_password() {
+        let dir = tempdir().unwrap();
+        let s = AdminStore::load_or_default(dir.path());
+        s.bootstrap("admin", "hunter2hunter2").unwrap();
+        // Wrong current password → no change.
+        let r = s.update_credentials("nope", None, Some("newpassword1"));
+        assert!(matches!(r, Err(Error::Invalid(_))));
+        assert!(s.verify("admin", "hunter2hunter2").unwrap().is_some());
+
+        // Correct current password rotates only what's supplied.
+        s.update_credentials("hunter2hunter2", Some("alice"), Some("newpassword1"))
+            .unwrap();
+        assert!(s.verify("admin", "hunter2hunter2").unwrap().is_none());
+        assert!(s.verify("alice", "newpassword1").unwrap().is_some());
+    }
+
+    #[test]
+    fn update_credentials_partial_password_only_keeps_username() {
+        let dir = tempdir().unwrap();
+        let s = AdminStore::load_or_default(dir.path());
+        s.bootstrap("admin", "hunter2hunter2").unwrap();
+        s.update_credentials("hunter2hunter2", None, Some("newpassword1"))
+            .unwrap();
+        assert!(s.verify("admin", "newpassword1").unwrap().is_some());
+    }
+
+    #[test]
+    fn validates_username_and_password() {
+        let dir = tempdir().unwrap();
+        let s = AdminStore::load_or_default(dir.path());
+        assert!(s.bootstrap("", "hunter2hunter2").is_err());
+        assert!(s.bootstrap("ad:min", "hunter2hunter2").is_err()); // ':' reserved
+        assert!(s.bootstrap("admin", "short").is_err()); // <8 chars
+        // 65-char username is too long.
+        let long = "a".repeat(65);
+        assert!(s.bootstrap(&long, "hunter2hunter2").is_err());
+    }
+}

crates/core/src/boot_log.rs

@@ -0,0 +1,249 @@
+//! Boot-event log — "who installed what, when, from where".
+//!
+//! Each `/boot/<entry>.ipxe` fetch that actually goes on to serve a boot
+//! script lands an entry here. The log is bounded in memory (newest-first,
+//! ring-buffered at [`BootLog::CAP`]) and is mirrored append-only to
+//! `<work_dir>/boot_log.jsonl`. Mirrors `HostBindings`'s "in-memory is
+//! authoritative, disk is a cache" policy — a corrupt log file should
+//! never block PXE for the network.
+//!
+//! We deliberately don't push these onto the `LogBus` (the operator
+//! terminal stream). The terminal already shows the http traces; the
+//! Host log is a curated, persistent, easy-to-scan view of "what got
+//! imaged on what hardware" and conflating the two would be noisy.
+
+use parking_lot::RwLock;
+use serde::{Deserialize, Serialize};
+use std::collections::VecDeque;
+use std::io::Write;
+use std::net::IpAddr;
+use std::path::PathBuf;
+use std::sync::Arc;
+use time::OffsetDateTime;
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct BootEvent {
+    #[serde(with = "time::serde::rfc3339")]
+    pub timestamp: OffsetDateTime,
+    /// Lowercase, colon-separated. `None` when iPXE didn't supply
+    /// `?mac=${mac}` in the chain URL (older bookmarks, custom scripts).
+    pub mac: Option<String>,
+    /// Connecting peer's IP — taken from the TCP socket when available
+    /// (PXE clients connect direct, no reverse proxy), and falls back to
+    /// `X-Forwarded-For` for the rare case where one is present.
+    pub ip: Option<IpAddr>,
+    /// `BootEntry::id` — the same id used in `/boot/<id>.ipxe`.
+    pub target_id: String,
+    /// Human-friendly label: the ISO's filename / volume label / entry
+    /// title. Pre-resolved at log time so the UI can render without
+    /// joining against the ISO store (and so "what image was installed?"
+    /// survives the operator deleting the ISO later).
+    pub target_title: String,
+}
+
+/// In-memory ring + disk-backed append log of boot events. Cheap to
+/// clone; the inner state is `Arc<RwLock<_>>`.
+#[derive(Debug, Clone)]
+pub struct BootLog {
+    path: Arc<PathBuf>,
+    inner: Arc<RwLock<VecDeque<BootEvent>>>,
+}
+
+impl BootLog {
+    /// Newest entries we retain in memory. Past this, the oldest gets
+    /// evicted — the on-disk JSONL keeps the full history for offline
+    /// inspection. 500 covers a typical install-day's worth without
+    /// turning the Hosts tab into a wall of text.
+    pub const CAP: usize = 500;
+
+    /// Load up to `CAP` newest events from `<work_dir>/boot_log.jsonl`,
+    /// or start empty if the file is missing / unreadable.
+    #[must_use]
+    pub fn load_or_default(work_dir: &std::path::Path) -> Self {
+        let path = work_dir.join("boot_log.jsonl");
+        let mut events = VecDeque::with_capacity(Self::CAP);
+        if let Ok(text) = std::fs::read_to_string(&path) {
+            for line in text.lines() {
+                if line.trim().is_empty() {
+                    continue;
+                }
+                match serde_json::from_str::<BootEvent>(line) {
+                    Ok(ev) => {
+                        if events.len() == Self::CAP {
+                            events.pop_front();
+                        }
+                        events.push_back(ev);
+                    }
+                    Err(e) => {
+                        tracing::warn!(
+                            target: "openpxe::boot_log",
+                            "skipping unparseable boot_log line: {e}"
+                        );
+                    }
+                }
+            }
+        }
+        Self {
+            path: Arc::new(path),
+            inner: Arc::new(RwLock::new(events)),
+        }
+    }
+
+    /// Append an event. Persistence is best-effort and never blocks the
+    /// caller on a failed write (the in-memory copy is the source of
+    /// truth for the live UI; the JSONL is just for crash survival).
+    pub fn record(&self, ev: &BootEvent) {
+        // Push into the ring first so a slow / failing disk doesn't lose
+        // events for the live UI.
+        {
+            let mut g = self.inner.write();
+            if g.len() == Self::CAP {
+                g.pop_front();
+            }
+            g.push_back(ev.clone());
+        }
+        tracing::info!(
+            target: "openpxe::boot_log",
+            mac = ev.mac.as_deref().unwrap_or("?"),
+            ip = ev.ip.map(|i| i.to_string()).as_deref().unwrap_or("?"),
+            target = %ev.target_id,
+            "boot event"
+        );
+        // Append to disk. We tolerate write failures — they'd show up as
+        // missing entries on the next restart only.
+        let mut line = match serde_json::to_string(ev) {
+            Ok(s) => s,
+            Err(e) => {
+                tracing::warn!(target: "openpxe::boot_log", "serialize boot event: {e}");
+                return;
+            }
+        };
+        line.push('\n');
+        if let Some(parent) = self.path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        match std::fs::OpenOptions::new()
+            .create(true)
+            .append(true)
+            .open(self.path.as_path())
+        {
+            Ok(mut f) => {
+                if let Err(e) = f.write_all(line.as_bytes()) {
+                    tracing::warn!(target: "openpxe::boot_log", "append boot_log.jsonl: {e}");
+                }
+            }
+            Err(e) => {
+                tracing::warn!(target: "openpxe::boot_log", "open boot_log.jsonl: {e}");
+            }
+        }
+    }
+
+    /// Newest-first snapshot, up to `CAP` entries.
+    #[must_use]
+    pub fn list(&self) -> Vec<BootEvent> {
+        let g = self.inner.read();
+        // VecDeque preserves insertion order; reverse so newest is first.
+        g.iter().rev().cloned().collect()
+    }
+
+    #[must_use]
+    pub fn len(&self) -> usize {
+        self.inner.read().len()
+    }
+
+    #[must_use]
+    pub fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+
+    /// Wipe in-memory + the on-disk file. Used by the `terminal clear`
+    /// equivalent or future operator action; not currently wired to a UI
+    /// button but exposed for completeness.
+    pub fn clear(&self) {
+        self.inner.write().clear();
+        let _ = std::fs::remove_file(self.path.as_path());
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::tempdir;
+
+    fn ev(target: &str, mac: Option<&str>) -> BootEvent {
+        BootEvent {
+            timestamp: OffsetDateTime::now_utc(),
+            mac: mac.map(str::to_string),
+            ip: Some("10.0.0.42".parse().unwrap()),
+            target_id: target.into(),
+            target_title: format!("{target}.iso"),
+        }
+    }
+
+    #[test]
+    fn record_then_list_is_newest_first() {
+        let dir = tempdir().unwrap();
+        let log = BootLog::load_or_default(dir.path());
+        assert!(log.is_empty());
+        log.record(&ev("alpha", Some("aa:bb:cc:00:00:01")));
+        log.record(&ev("beta", Some("aa:bb:cc:00:00:02")));
+        let list = log.list();
+        assert_eq!(list.len(), 2);
+        assert_eq!(list[0].target_id, "beta");
+        assert_eq!(list[1].target_id, "alpha");
+    }
+
+    #[test]
+    fn round_trip_through_disk() {
+        let dir = tempdir().unwrap();
+        let log = BootLog::load_or_default(dir.path());
+        log.record(&ev("alpha", Some("aa:bb:cc:00:00:01")));
+        log.record(&ev("beta", None));
+        drop(log);
+        let log2 = BootLog::load_or_default(dir.path());
+        assert_eq!(log2.len(), 2);
+        let list = log2.list();
+        assert_eq!(list[0].target_id, "beta");
+        assert_eq!(list[1].target_id, "alpha");
+        assert!(list[0].mac.is_none());
+        assert_eq!(list[1].mac.as_deref(), Some("aa:bb:cc:00:00:01"));
+    }
+
+    #[test]
+    fn ring_evicts_oldest_past_cap() {
+        let dir = tempdir().unwrap();
+        let log = BootLog::load_or_default(dir.path());
+        for i in 0..(BootLog::CAP + 5) {
+            log.record(&ev(&format!("e{i}"), None));
+        }
+        assert_eq!(log.len(), BootLog::CAP);
+        let list = log.list();
+        // Newest first; the most recent push is the last index inserted.
+        assert_eq!(list[0].target_id, format!("e{}", BootLog::CAP + 4));
+        // Oldest in-memory should be the 6th push (0..5 were evicted).
+        assert_eq!(list[BootLog::CAP - 1].target_id, "e5");
+    }
+
+    #[test]
+    fn clear_wipes_memory_and_disk() {
+        let dir = tempdir().unwrap();
+        let log = BootLog::load_or_default(dir.path());
+        log.record(&ev("alpha", None));
+        log.clear();
+        assert!(log.is_empty());
+        let log2 = BootLog::load_or_default(dir.path());
+        assert!(log2.is_empty());
+    }
+
+    #[test]
+    fn corrupt_disk_lines_are_skipped_not_fatal() {
+        // Write a file with one valid + one garbage line; loader should
+        // surface the valid one and skip the garbage.
+        let dir = tempdir().unwrap();
+        let path = dir.path().join("boot_log.jsonl");
+        let valid = serde_json::to_string(&ev("ok", Some("aa:bb:cc:00:00:09"))).unwrap();
+        std::fs::write(&path, format!("{valid}\nNOT_JSON\n{valid}\n")).unwrap();
+        let log = BootLog::load_or_default(dir.path());
+        assert_eq!(log.len(), 2);
+    }
+}

crates/core/src/branding.rs

@@ -0,0 +1,339 @@
+//! Operator-controlled branding overrides.
+//!
+//! The browser tab's logo (`/assets/logo.svg`) defaults to the bundled
+//! rainbow-horizon mark. Operators who deploy OpenPXE behind their own
+//! branding can upload a replacement that lives at
+//! `<work_dir>/branding/logo.<ext>` and is served in preference to the
+//! bundled SVG when present. Borrowed-from-FleetDM: tenant chrome, same
+//! product.
+//!
+//! Storage policy mirrors `HostBindings` / `BootLog`: in-memory cache is
+//! authoritative for the current process, disk is the source of truth on
+//! restart, and a corrupt cache file falls back to the bundled default
+//! rather than blocking startup.
+
+use parking_lot::RwLock;
+use serde::{Deserialize, Serialize};
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+
+/// Allowed MIME types for an uploaded logo. We deliberately keep this
+/// narrow — anything that can be `<img src="...">`'d into the brand
+/// block, no scripts. SVG carries the obvious XSS risk for raw inline
+/// HTML; we always serve the bytes as a separate asset with a strict
+/// content-type rather than inlining, so SVG is safe.
+pub const ALLOWED_LOGO_MIMES: &[&str] = &[
+    "image/svg+xml",
+    "image/png",
+    "image/jpeg",
+    "image/webp",
+    "image/gif",
+];
+
+/// Disk cap for an uploaded logo. PXE WebUIs are operator-facing — even
+/// a generous 2 MB cap is comfortable for any reasonable brand mark and
+/// puts a clear bound on memory + serialization cost.
+pub const MAX_LOGO_BYTES: usize = 2 * 1024 * 1024;
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+struct Inner {
+    /// File name (relative to the branding dir) for the active logo, if
+    /// any. Always under `<work_dir>/branding/`; never an absolute path
+    /// from the operator.
+    logo_filename: Option<String>,
+    /// MIME of the active logo, mirroring `logo_filename`. Cached here
+    /// so the HTTP layer can set Content-Type without re-sniffing.
+    logo_mime: Option<String>,
+}
+
+/// In-memory + on-disk override registry. Cheap to clone; locks are
+/// brief. The `branding.json` cache lives alongside the active asset
+/// inside `<work_dir>/branding/`.
+#[derive(Debug, Clone)]
+pub struct BrandingStore {
+    /// Root directory: `<work_dir>/branding/`. Created on first write.
+    dir: Arc<PathBuf>,
+    inner: Arc<RwLock<Inner>>,
+}
+
+impl BrandingStore {
+    /// Load (or initialise empty) from `<work_dir>/branding/`. Tolerates
+    /// missing directories, partial state, and corrupt JSON — a bad
+    /// cache should never block PXE for the network.
+    #[must_use]
+    pub fn load_or_default(work_dir: &Path) -> Self {
+        let dir = work_dir.join("branding");
+        let path = dir.join("branding.json");
+        let mut inner = Inner::default();
+        if let Ok(text) = std::fs::read_to_string(&path) {
+            match serde_json::from_str::<Inner>(&text) {
+                Ok(parsed) => {
+                    // Sanity: if the JSON says we have a logo but the
+                    // file is gone, clear the in-memory pointer so
+                    // /assets/logo.svg falls back to the bundled SVG
+                    // rather than 500ing on a missing file.
+                    if let Some(name) = parsed.logo_filename.as_deref() {
+                        if dir.join(name).is_file() {
+                            inner = parsed;
+                        } else {
+                            tracing::warn!(
+                                target: "openpxe::branding",
+                                file = %name,
+                                "branding.json points at missing file; clearing"
+                            );
+                        }
+                    } else {
+                        inner = parsed;
+                    }
+                }
+                Err(e) => {
+                    tracing::warn!(
+                        target: "openpxe::branding",
+                        "branding.json present but unreadable ({e}); starting empty"
+                    );
+                }
+            }
+        }
+        Self {
+            dir: Arc::new(dir),
+            inner: Arc::new(RwLock::new(inner)),
+        }
+    }
+
+    /// Absolute path to the active logo, if one is set and present on
+    /// disk. `None` means the HTTP layer should serve the bundled SVG.
+    #[must_use]
+    pub fn logo_path(&self) -> Option<PathBuf> {
+        let g = self.inner.read();
+        g.logo_filename.as_deref().map(|n| self.dir.join(n))
+    }
+
+    /// MIME of the active logo, if any. The HTTP layer pairs this with
+    /// the bytes returned by [`Self::logo_path`].
+    #[must_use]
+    pub fn logo_mime(&self) -> Option<String> {
+        self.inner.read().logo_mime.clone()
+    }
+
+    /// Replace the active logo. Returns the chosen on-disk filename so
+    /// the caller can echo it back in the API response. Old logos are
+    /// removed best-effort.
+    pub fn set_logo(&self, mime: &str, ext: &str, bytes: &[u8]) -> std::io::Result<String> {
+        std::fs::create_dir_all(self.dir.as_path())?;
+        // Single canonical filename per upload — overwriting the old one
+        // (after clearing it) keeps the directory tidy and avoids any
+        // path-traversal concern: the operator never supplies the name.
+        let safe_ext = sanitize_ext(ext);
+        let filename = format!("logo.{safe_ext}");
+        let final_path = self.dir.join(&filename);
+        // Atomic write: tmp -> rename. Guarantees the file is either
+        // entirely the old logo or entirely the new one.
+        let tmp = final_path.with_extension(format!("{safe_ext}.tmp"));
+        std::fs::write(&tmp, bytes)?;
+        std::fs::rename(&tmp, &final_path)?;
+        // Clean up any sibling logo.<otherext> so there's exactly one
+        // canonical file at any time.
+        if let Ok(entries) = std::fs::read_dir(self.dir.as_path()) {
+            for e in entries.flatten() {
+                let p = e.path();
+                let name = p
+                    .file_name()
+                    .and_then(|s| s.to_str())
+                    .unwrap_or("");
+                if name.starts_with("logo.") && name != filename {
+                    let _ = std::fs::remove_file(&p);
+                }
+            }
+        }
+
+        {
+            let mut g = self.inner.write();
+            g.logo_filename = Some(filename.clone());
+            g.logo_mime = Some(mime.to_string());
+        }
+        self.persist();
+        tracing::info!(
+            target: "openpxe::branding",
+            file = %filename, mime = %mime, size = bytes.len(),
+            "custom logo installed"
+        );
+        Ok(filename)
+    }
+
+    /// Drop the override and return to the bundled SVG.
+    pub fn clear_logo(&self) -> std::io::Result<()> {
+        let removed = {
+            let mut g = self.inner.write();
+            let removed = g.logo_filename.take();
+            g.logo_mime = None;
+            removed
+        };
+        if let Some(name) = removed {
+            let p = self.dir.join(&name);
+            let _ = std::fs::remove_file(&p);
+            tracing::info!(target: "openpxe::branding", file = %name, "custom logo cleared");
+        }
+        self.persist();
+        Ok(())
+    }
+
+    /// Convenience: true if a custom logo is configured. Surfaces on
+    /// `/api/status` so the WebUI can show "Custom logo: yes" without
+    /// fetching the asset itself.
+    #[must_use]
+    pub fn has_logo(&self) -> bool {
+        self.inner.read().logo_filename.is_some()
+    }
+
+    fn persist(&self) {
+        let snap = self.inner.read().clone();
+        let body = match serde_json::to_vec_pretty(&snap) {
+            Ok(b) => b,
+            Err(e) => {
+                tracing::warn!(target: "openpxe::branding", "serialize branding.json: {e}");
+                return;
+            }
+        };
+        if let Err(e) = std::fs::create_dir_all(self.dir.as_path()) {
+            tracing::warn!(target: "openpxe::branding", "mkdir branding/: {e}");
+            return;
+        }
+        let path = self.dir.join("branding.json");
+        let tmp = path.with_extension("json.tmp");
+        if let Err(e) = std::fs::write(&tmp, body) {
+            tracing::warn!(target: "openpxe::branding", "write branding.json tmp: {e}");
+            return;
+        }
+        if let Err(e) = std::fs::rename(&tmp, &path) {
+            tracing::warn!(target: "openpxe::branding", "rename branding.json: {e}");
+        }
+    }
+}
+
+/// Trim arbitrary operator-supplied extension strings to a small, safe
+/// alphanumeric form. Anything weird collapses to `bin`. We never let
+/// the extension affect the path beyond the final segment of `logo.<x>`.
+fn sanitize_ext(ext: &str) -> String {
+    let lc: String = ext
+        .chars()
+        .filter(char::is_ascii_alphanumeric)
+        .map(|c| c.to_ascii_lowercase())
+        .collect();
+    if lc.is_empty() || lc.len() > 5 {
+        "bin".into()
+    } else {
+        lc
+    }
+}
+
+/// Pick a safe filesystem extension from a MIME type. Returns `None`
+/// if the MIME isn't on the [`ALLOWED_LOGO_MIMES`] allowlist.
+#[must_use]
+pub fn ext_for_mime(mime: &str) -> Option<&'static str> {
+    match mime {
+        "image/svg+xml" => Some("svg"),
+        "image/png" => Some("png"),
+        "image/jpeg" => Some("jpg"),
+        "image/webp" => Some("webp"),
+        "image/gif" => Some("gif"),
+        _ => None,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::tempdir;
+
+    #[test]
+    fn empty_after_load_when_no_branding_dir() {
+        let dir = tempdir().unwrap();
+        let b = BrandingStore::load_or_default(dir.path());
+        assert!(!b.has_logo());
+        assert!(b.logo_path().is_none());
+        assert!(b.logo_mime().is_none());
+    }
+
+    #[test]
+    fn set_clear_round_trip_persists() {
+        let dir = tempdir().unwrap();
+        let b = BrandingStore::load_or_default(dir.path());
+        let name = b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake").unwrap();
+        assert_eq!(name, "logo.png");
+        assert!(b.has_logo());
+        assert_eq!(b.logo_mime().as_deref(), Some("image/png"));
+        let p = b.logo_path().unwrap();
+        assert!(p.is_file());
+
+        // Re-open and confirm the override survives a restart.
+        drop(b);
+        let b2 = BrandingStore::load_or_default(dir.path());
+        assert!(b2.has_logo());
+        assert_eq!(b2.logo_mime().as_deref(), Some("image/png"));
+
+        // Clear; the file goes away and has_logo flips off.
+        b2.clear_logo().unwrap();
+        assert!(!b2.has_logo());
+        assert!(!p.exists());
+    }
+
+    #[test]
+    fn replacing_logo_removes_old_extension_sibling() {
+        // PNG then SVG; only the SVG should remain on disk.
+        let dir = tempdir().unwrap();
+        let b = BrandingStore::load_or_default(dir.path());
+        b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake").unwrap();
+        b.set_logo("image/svg+xml", "svg", br#"<svg xmlns="http://www.w3.org/2000/svg"/>"#).unwrap();
+        let entries: Vec<_> = std::fs::read_dir(dir.path().join("branding"))
+            .unwrap()
+            .filter_map(|e| e.ok().map(|e| e.file_name().to_string_lossy().into_owned()))
+            .collect();
+        assert!(entries.iter().any(|n| n == "logo.svg"), "got {entries:?}");
+        assert!(!entries.iter().any(|n| n == "logo.png"), "stale PNG left over: {entries:?}");
+    }
+
+    #[test]
+    fn sanitize_ext_strips_separators_and_path_chars() {
+        assert_eq!(sanitize_ext("svg"), "svg");
+        // Path separators and non-alphanumerics filter out, leaving just
+        // letters. The remaining "etcpasswd" exceeds the 5-char cap so
+        // it collapses to `bin` rather than producing `etcpa`.
+        assert_eq!(sanitize_ext("../etc/passwd"), "bin");
+        // Short alphanumeric strip-through stays itself.
+        assert_eq!(sanitize_ext("../svg"), "svg");
+        assert_eq!(sanitize_ext(""), "bin");
+        assert_eq!(sanitize_ext("PNG"), "png");
+        // Anything past five chars is suspicious — collapse to `bin`.
+        assert_eq!(sanitize_ext("svgvvvv"), "bin");
+    }
+
+    #[test]
+    fn missing_file_referenced_by_json_resolves_to_empty() {
+        // If the operator nukes the file out from under the JSON cache,
+        // we should silently fall back to no-override rather than
+        // hanging on to a bogus path.
+        let dir = tempdir().unwrap();
+        let brand_dir = dir.path().join("branding");
+        std::fs::create_dir_all(&brand_dir).unwrap();
+        // Hand-write a branding.json claiming logo.png exists.
+        let inner = Inner {
+            logo_filename: Some("logo.png".into()),
+            logo_mime: Some("image/png".into()),
+        };
+        std::fs::write(
+            brand_dir.join("branding.json"),
+            serde_json::to_vec_pretty(&inner).unwrap(),
+        )
+        .unwrap();
+        let b = BrandingStore::load_or_default(dir.path());
+        assert!(!b.has_logo(), "should fall back when referenced file is missing");
+    }
+
+    #[test]
+    fn ext_for_mime_only_accepts_known_types() {
+        assert_eq!(ext_for_mime("image/png"), Some("png"));
+        assert_eq!(ext_for_mime("image/svg+xml"), Some("svg"));
+        assert_eq!(ext_for_mime("application/octet-stream"), None);
+        assert_eq!(ext_for_mime("text/html"), None);
+    }
+}

crates/core/src/host_bindings.rs

@@ -1,10 +1,9 @@
 //! Per-MAC host bindings.
 //!
-//! Inspired by the Tinkerbell `smee` "MAC-prepended URL" pattern: an
+//! Operators can attach a preferred boot target (a `BootEntry::id`) to a
-//! operator can attach a preferred boot target (a `BootEntry::id`) to a
+//! specific MAC address. When a client with that MAC arrives, the top-level
-//! specific MAC address. When a client with that MAC arrives, the
+//! boot script chains straight to that target instead of showing the
-//! top-level boot script chains straight to that target instead of
+//! interactive menu.
-//! showing the interactive menu.
 //!
 //! Use cases:
 //! - "This rack of Dell servers always images with Ubuntu Server 24.04"

crates/core/src/lib.rs

@@ -3,6 +3,9 @@
 #![forbid(unsafe_code)]
 
 pub mod arch;
+pub mod auth;
+pub mod boot_log;
+pub mod branding;
 pub mod client;
 pub mod config;
 pub mod error;
@@ -11,9 +14,14 @@ pub mod log_bus;
 pub mod metrics;
 pub mod queue;
 pub mod settings;
+pub mod sso;
 
 pub use arch::{ClientArch, FirmwareClass};
+pub use auth::{AdminAccount, AdminPublic, AdminStore};
+pub use boot_log::{BootEvent, BootLog};
+pub use branding::{ext_for_mime, BrandingStore, ALLOWED_LOGO_MIMES, MAX_LOGO_BYTES};
 pub use client::{ClientEvent, ClientRegistry, ClientSnapshot};
+pub use sso::{SsoConfig, SsoStore};
 pub use config::{Config, DhcpMode, NetworkConfig, Paths, ServerConfig};
 pub use error::{Error, Result};
 pub use host_bindings::{normalize_mac, HostBinding, HostBindings};

crates/core/src/sso.rs

@@ -0,0 +1,267 @@
+//! SAML SSO configuration — FleetDM-shaped, storage-only for v0.4.5.
+//!
+//! The operator pastes their IdP's metadata XML (or its URL) and a
+//! human-readable label; v0.4.5 just persists it. The actual SAML
+//! response-validation / JIT-provisioning flow lands in a later release
+//! — for now we cover the "configurable" half so an operator can teach
+//! OpenPXE about their IdP today and flip the switch on next upgrade.
+//!
+//! Shape borrowed from <https://github.com/fleetdm/fleet>'s app-config
+//! SSO block, minus the user-RBAC fields (OpenPXE is single-tier: you
+//! have access or you don't). Entity ID is omitted from the operator
+//! UI per the v0.4.5 brief — it defaults to the advertised public base
+//! URL when SAML wiring lands, which is what most IdPs expect anyway.
+
+use parking_lot::RwLock;
+use serde::{Deserialize, Serialize};
+use std::path::PathBuf;
+use std::sync::Arc;
+
+use crate::{Error, Result};
+
+/// The configurable surface. `metadata` and `metadata_url` are mutually
+/// exclusive at apply time (one or the other identifies the IdP); the
+/// store keeps both fields so an operator can switch between them
+/// without losing the inactive one.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+pub struct SsoConfig {
+    /// Master switch — when false, all SSO machinery (planned for a
+    /// later release) is skipped regardless of the rest of the fields.
+    #[serde(default)]
+    pub enabled: bool,
+    /// Display name shown on the WebUI's login screen as the "Sign in
+    /// with X" button label. Empty/whitespace falls back to "SSO".
+    #[serde(default)]
+    pub idp_name: String,
+    /// Raw SAML metadata XML pasted by the operator. Mutually exclusive
+    /// with `metadata_url`; if both are set, the URL wins at apply time
+    /// (operators typically forget about a stale XML paste).
+    #[serde(default)]
+    pub metadata: String,
+    /// HTTPS URL where the IdP serves its metadata. Loaded lazily by the
+    /// future SAML flow; not validated here beyond a basic length cap.
+    #[serde(default)]
+    pub metadata_url: String,
+}
+
+impl SsoConfig {
+    /// Returns `true` only when the config is *usable* — enabled, and
+    /// at least one of metadata/metadata_url is present. The future
+    /// login flow will key off this; for v0.4.5 the WebUI uses it to
+    /// surface a yellow "configured but not live yet" hint.
+    #[must_use]
+    pub fn is_usable(&self) -> bool {
+        self.enabled
+            && (!self.metadata.trim().is_empty() || !self.metadata_url.trim().is_empty())
+    }
+}
+
+/// In-memory + on-disk SSO settings registry.
+#[derive(Debug, Clone)]
+pub struct SsoStore {
+    path: Arc<PathBuf>,
+    inner: Arc<RwLock<SsoConfig>>,
+}
+
+impl SsoStore {
+    /// Load from `<work_dir>/sso.json`, or start with the default empty
+    /// (`enabled = false`) config. A corrupt file falls back to default
+    /// rather than blocking startup.
+    #[must_use]
+    pub fn load_or_default(work_dir: &std::path::Path) -> Self {
+        let path = work_dir.join("sso.json");
+        let cfg = match std::fs::read_to_string(&path) {
+            Ok(text) => match serde_json::from_str::<SsoConfig>(&text) {
+                Ok(parsed) => parsed,
+                Err(e) => {
+                    tracing::warn!(
+                        target: "openpxe::sso",
+                        "sso.json present but unreadable ({e}); starting with default config"
+                    );
+                    SsoConfig::default()
+                }
+            },
+            Err(_) => SsoConfig::default(),
+        };
+        Self {
+            path: Arc::new(path),
+            inner: Arc::new(RwLock::new(cfg)),
+        }
+    }
+
+    #[must_use]
+    pub fn snapshot(&self) -> SsoConfig {
+        self.inner.read().clone()
+    }
+
+    /// Replace the whole config in one shot. Light validation: metadata
+    /// XML and URL are length-capped so an operator can't OOM us by
+    /// pasting a 10 GiB blob; the IdP UI tab clamps the input visually,
+    /// but the server enforces a hard ceiling regardless.
+    pub fn replace(&self, mut cfg: SsoConfig) -> Result<SsoConfig> {
+        cfg.idp_name = cfg.idp_name.trim().to_string();
+        cfg.metadata = cfg.metadata.trim().to_string();
+        cfg.metadata_url = cfg.metadata_url.trim().to_string();
+        if cfg.metadata.len() > MAX_METADATA_BYTES {
+            return Err(Error::Invalid(format!(
+                "metadata XML exceeds {MAX_METADATA_BYTES}-byte cap"
+            )));
+        }
+        if cfg.metadata_url.len() > MAX_URL_LEN {
+            return Err(Error::Invalid(format!(
+                "metadata_url exceeds {MAX_URL_LEN}-char cap"
+            )));
+        }
+        if !cfg.metadata_url.is_empty()
+            && !cfg.metadata_url.starts_with("http://")
+            && !cfg.metadata_url.starts_with("https://")
+        {
+            return Err(Error::Invalid(
+                "metadata_url must start with http:// or https://".into(),
+            ));
+        }
+        // If they're trying to *enable* the integration but haven't
+        // supplied either source, reject — saves a "configured but
+        // unusable" surprise later.
+        if cfg.enabled && cfg.metadata.is_empty() && cfg.metadata_url.is_empty() {
+            return Err(Error::Invalid(
+                "enable SSO requires either metadata XML or a metadata URL".into(),
+            ));
+        }
+        {
+            let mut g = self.inner.write();
+            *g = cfg.clone();
+        }
+        self.persist();
+        tracing::info!(
+            target: "openpxe::sso",
+            enabled = cfg.enabled,
+            idp = %cfg.idp_name,
+            has_xml = !cfg.metadata.is_empty(),
+            has_url = !cfg.metadata_url.is_empty(),
+            "sso configuration updated"
+        );
+        Ok(cfg)
+    }
+
+    fn persist(&self) {
+        let snap = self.inner.read().clone();
+        let body = match serde_json::to_vec_pretty(&snap) {
+            Ok(b) => b,
+            Err(e) => {
+                tracing::warn!(target: "openpxe::sso", "serialize sso.json: {e}");
+                return;
+            }
+        };
+        if let Some(parent) = self.path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        let tmp = self.path.with_extension("json.tmp");
+        if let Err(e) = std::fs::write(&tmp, body) {
+            tracing::warn!(target: "openpxe::sso", "write sso.json tmp: {e}");
+            return;
+        }
+        if let Err(e) = std::fs::rename(&tmp, self.path.as_path()) {
+            tracing::warn!(target: "openpxe::sso", "rename sso.json: {e}");
+        }
+    }
+}
+
+/// Saturation caps. The numbers are generous for any real IdP metadata
+/// document — Okta's largest is ~50 KB, Azure AD's ~30 KB.
+const MAX_METADATA_BYTES: usize = 1024 * 1024;
+const MAX_URL_LEN: usize = 2048;
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::tempdir;
+
+    #[test]
+    fn default_is_disabled_and_empty() {
+        let dir = tempdir().unwrap();
+        let s = SsoStore::load_or_default(dir.path());
+        let cfg = s.snapshot();
+        assert!(!cfg.enabled);
+        assert!(cfg.metadata.is_empty());
+        assert!(cfg.metadata_url.is_empty());
+        assert!(!cfg.is_usable());
+    }
+
+    #[test]
+    fn replace_metadata_url_round_trip_via_disk() {
+        let dir = tempdir().unwrap();
+        let s = SsoStore::load_or_default(dir.path());
+        s.replace(SsoConfig {
+            enabled: true,
+            idp_name: "Okta".into(),
+            metadata: String::new(),
+            metadata_url: "https://idp.example.com/metadata".into(),
+        })
+        .unwrap();
+        drop(s);
+        let s2 = SsoStore::load_or_default(dir.path());
+        let cfg = s2.snapshot();
+        assert!(cfg.enabled);
+        assert!(cfg.is_usable());
+        assert_eq!(cfg.idp_name, "Okta");
+        assert_eq!(cfg.metadata_url, "https://idp.example.com/metadata");
+    }
+
+    #[test]
+    fn replace_xml_paste_is_accepted() {
+        let dir = tempdir().unwrap();
+        let s = SsoStore::load_or_default(dir.path());
+        let xml = r#"<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata">test</EntityDescriptor>"#;
+        s.replace(SsoConfig {
+            enabled: true,
+            idp_name: "Test IdP".into(),
+            metadata: xml.into(),
+            metadata_url: String::new(),
+        })
+        .unwrap();
+        assert!(s.snapshot().is_usable());
+    }
+
+    #[test]
+    fn enable_without_source_is_rejected() {
+        let dir = tempdir().unwrap();
+        let s = SsoStore::load_or_default(dir.path());
+        let r = s.replace(SsoConfig {
+            enabled: true,
+            idp_name: "Okta".into(),
+            metadata: String::new(),
+            metadata_url: String::new(),
+        });
+        assert!(matches!(r, Err(Error::Invalid(_))));
+        // …and a disabled blank config is fine.
+        s.replace(SsoConfig::default()).unwrap();
+    }
+
+    #[test]
+    fn metadata_url_must_be_http_scheme() {
+        let dir = tempdir().unwrap();
+        let s = SsoStore::load_or_default(dir.path());
+        let r = s.replace(SsoConfig {
+            enabled: false,
+            idp_name: String::new(),
+            metadata: String::new(),
+            metadata_url: "ftp://idp.example.com/metadata".into(),
+        });
+        assert!(matches!(r, Err(Error::Invalid(_))));
+    }
+
+    #[test]
+    fn metadata_size_cap_enforced() {
+        let dir = tempdir().unwrap();
+        let s = SsoStore::load_or_default(dir.path());
+        let oversize = "a".repeat(MAX_METADATA_BYTES + 1);
+        let r = s.replace(SsoConfig {
+            enabled: false,
+            idp_name: String::new(),
+            metadata: oversize,
+            metadata_url: String::new(),
+        });
+        assert!(matches!(r, Err(Error::Invalid(_))));
+    }
+}

crates/http-api/Cargo.toml

@@ -31,6 +31,9 @@ bytes.workspace = true
 futures.workspace = true
 mime.workspace = true
 mime_guess.workspace = true
+uuid.workspace = true
+# v0.4.5 Forms auth: lock-free session store and cookie helpers.
+parking_lot.workspace = true
 
 [dev-dependencies]
 tokio = { workspace = true, features = ["macros", "rt", "rt-multi-thread", "time"] }

crates/http-api/src/app.rs

@@ -13,6 +13,7 @@
 //! | `/iso/<id>/*`    | Files inside the ISO (for wimboot & kernel/initrd)    |
 //! | `/api/*`         | JSON/HTML API for the web UI                          |
 
+use crate::auth as auth_api;
 use crate::ipxe_script::{
     render_entry, render_family_menu, render_local_hdd, render_menu, render_nic_info,
     render_queue_entry, render_shell, render_tools_menu, render_util,
@@ -22,18 +23,22 @@ use crate::log_stream;
 use crate::state::AppState;
 use crate::terminal;
 use axum::{
-    body::Body,
+    body::{Body, Bytes},
-    extract::{DefaultBodyLimit, Multipart, Path as AxumPath, Query, State},
+    extract::{ConnectInfo, DefaultBodyLimit, Multipart, Path as AxumPath, Query, State},
     http::{header, HeaderMap, HeaderValue, StatusCode},
     response::{IntoResponse, Response},
-    routing::{delete, get, post},
+    routing::{delete, get, post, put},
     Json, Router,
 };
-use openpxe_core::{ClientEvent, Settings};
+use openpxe_core::{
+    ext_for_mime, BootEvent, ClientEvent, Error, Settings, SsoConfig, ALLOWED_LOGO_MIMES,
+    MAX_LOGO_BYTES,
+};
 use openpxe_ipxe_assets::asset_bytes;
-use openpxe_iso_store::{IsoMeta, NfsAddRequest};
+use openpxe_iso_store::{IsoCategory, IsoMeta, NfsAddRequest};
 use serde::Deserialize;
 use serde_json::json;
+use std::net::SocketAddr;
 use std::time::Duration;
 use tokio::io::{AsyncReadExt, AsyncSeekExt};
 use tower_http::trace::TraceLayer;
@@ -61,12 +66,57 @@ pub fn build_router(state: AppState) -> Router {
         // JSON API.
         .route("/api/isos", get(api_list_isos).post(api_upload_iso))
         .route("/api/isos/:id", delete(api_delete_iso))
+        .route("/api/uploads", post(api_upload_begin))
+        .route(
+            "/api/uploads/:upload_id",
+            put(api_upload_chunk).delete(api_upload_abort),
+        )
         // Per-ISO password prompt. PUT body `{ "password": "..." }`
         // sets, `{ "password": null }` (or DELETE) clears.
         .route(
             "/api/isos/:id/password",
             axum::routing::put(api_set_iso_password).delete(api_clear_iso_password),
         )
+        // v0.4.4: per-ISO menu category (Os / Tools). Drives whether the
+        // image appears under Linux/Windows Installers (default) or in
+        // the Tools submenu next to memtest / shell / NIC info.
+        .route(
+            "/api/isos/:id/category",
+            axum::routing::put(api_set_iso_category),
+        )
+        // v0.4.4: filesystem free-space telemetry for the ISO directory's
+        // volume — surfaced as a small card on the Storage tab so the
+        // operator knows when they're about to run out of room.
+        .route("/api/storage/disk", get(api_storage_disk))
+        // v0.4.4: operator-controlled WebUI branding overrides
+        // (custom logo). Multipart upload to POST; DELETE clears.
+        .route(
+            "/api/branding/logo",
+            post(api_branding_upload).delete(api_branding_clear),
+        )
+        // v0.4.4: self-rendered API reference, served as JSON so the UI
+        // can format it consistently with the rest of the chrome. Lives
+        // under the Settings tab — operators chasing an integration get
+        // it in-product instead of having to fetch the OpenAPI YAML.
+        .route("/api/docs", get(api_docs))
+        // v0.4.5: Sonarr/Radarr-style admin Forms auth. First-run
+        // /setup creates the single admin account; /login validates;
+        // /logout revokes the session; /me powers the front-end's
+        // "should I show the setup page, the login page, or the
+        // dashboard?" decision. /me/credentials rotates the admin's
+        // username/password.
+        .route("/api/setup", post(auth_api::api_setup))
+        .route("/api/login", post(auth_api::api_login))
+        .route("/api/logout", post(auth_api::api_logout))
+        .route("/api/me", get(auth_api::api_me))
+        .route(
+            "/api/me/credentials",
+            put(auth_api::api_update_credentials),
+        )
+        // v0.4.5: SAML SSO configuration (FleetDM-shaped, storage-only).
+        // The actual sign-in flow lands in a later release; this just
+        // gives operators a place to paste their IdP metadata today.
+        .route("/api/sso", get(api_sso_get).put(api_sso_put))
         .route("/api/clients", get(api_list_clients))
         .route("/api/status", get(api_status))
         .route("/api/settings", get(api_get_settings).put(api_put_settings))
@@ -87,20 +137,52 @@ pub fn build_router(state: AppState) -> Router {
         .route("/api/log/clear", post(log_stream::clear))
         // Phase 4: operator terminal commands (whitelisted).
         .route("/api/terminal", post(terminal::run_command))
-        // Phase 5: per-MAC host bindings (Tinkerbell-style). Operator
+        // Phase 5: per-MAC host bindings. Operator
         // pins a MAC to a boot entry; /boot.ipxe?mac=... chains directly.
         .route("/api/hosts", get(api_hosts_list).post(api_hosts_upsert))
         .route("/api/hosts/:mac", delete(api_hosts_remove))
+        // Rolling "host log" of boot events: what image actually
+        // started installing on what MAC/IP, and when. Persisted to disk.
+        .route("/api/boot-log", get(api_boot_log))
         // Phase 5: Prometheus scrape endpoint. Plain text exposition
         // format. No auth — the metrics surface is intentionally
         // boring (counts, no payloads).
         .route("/metrics", get(api_metrics))
+        // v0.4.5: Forms-auth middleware. Layered *after* `.route(...)`
+        // calls so it applies uniformly; passes everything through when
+        // no admin is configured (tests + fresh installs ride this path).
+        // The allowlist inside `auth_api::require_auth` keeps PXE-essential
+        // endpoints reachable for iPXE clients that can't authenticate.
+        .layer(axum::middleware::from_fn_with_state(
+            state.clone(),
+            auth_api::require_auth,
+        ))
         .layer(TraceLayer::new_for_http())
         // 16 GiB upload cap — ISOs are big; chunks stream so this isn't memory use.
         .layer(DefaultBodyLimit::max(16 * 1024 * 1024 * 1024))
         .with_state(state)
 }
 
+// ─── SSO config endpoints ─────────────────────────────────────────────────
+
+async fn api_sso_get(State(state): State<AppState>) -> Json<SsoConfig> {
+    // We deliberately do not redact the metadata — the operator who's
+    // signed in needs to be able to round-trip it. /api/sso requires
+    // the auth middleware anyway, so unauthenticated callers can't see
+    // it once admin is configured.
+    Json(state.sso.snapshot())
+}
+
+async fn api_sso_put(State(state): State<AppState>, Json(body): Json<SsoConfig>) -> Response {
+    match state.sso.replace(body) {
+        Ok(cfg) => (StatusCode::OK, Json(cfg)).into_response(),
+        Err(Error::Invalid(msg)) => {
+            (StatusCode::BAD_REQUEST, msg).into_response()
+        }
+        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
+    }
+}
+
 // ─── UI ────────────────────────────────────────────────────────────────────
 
 async fn index(State(state): State<AppState>) -> Response {
@@ -134,7 +216,43 @@ async fn ui_css() -> Response {
         .into_response()
 }
 
-async fn ui_logo() -> Response {
+async fn ui_logo(State(state): State<AppState>) -> Response {
+    // Custom override first; fall back to the bundled rainbow-horizon
+    // SVG. We resolve the override on each request rather than caching
+    // because operators may upload/clear from the Settings tab while the
+    // server is live, and we want them to see their change immediately
+    // without bouncing the binary.
+    if let Some(path) = state.branding.logo_path() {
+        let mime = state
+            .branding
+            .logo_mime()
+            .unwrap_or_else(|| "image/svg+xml".to_string());
+        match tokio::fs::read(&path).await {
+            Ok(bytes) => {
+                let ct = match HeaderValue::from_str(&mime) {
+                    Ok(v) => v,
+                    Err(_) => HeaderValue::from_static("application/octet-stream"),
+                };
+                return (
+                    [
+                        (header::CONTENT_TYPE, ct),
+                        (
+                            header::CACHE_CONTROL,
+                            HeaderValue::from_static("no-cache, max-age=0"),
+                        ),
+                    ],
+                    bytes,
+                )
+                    .into_response();
+            }
+            Err(e) => {
+                tracing::warn!(
+                    target: "openpxe::http::branding",
+                    error = %e, "failed to read custom logo; falling back to bundled"
+                );
+            }
+        }
+    }
     (
         [(
             header::CONTENT_TYPE,
@@ -173,7 +291,16 @@ fn text_plain(body: String) -> Response {
 /// requesting client carries a `?mac=...` query param (iPXE's `${mac}`
 /// substitution) and that MAC has a binding, we short-circuit straight
 /// to the bound target instead of rendering the menu.
-async fn boot_top_menu(State(state): State<AppState>, Query(p): Query<BootMenuParams>) -> Response {
+async fn boot_top_menu(
+    State(state): State<AppState>,
+    peer: Option<ConnectInfo<SocketAddr>>,
+    Query(p): Query<BootMenuParams>,
+) -> Response {
+    // `ConnectInfo` is only populated when axum was started with
+    // `into_make_service_with_connect_info` (production path). Tests
+    // call the router via `oneshot`, which skips that wiring — we
+    // tolerate it by treating the peer as unknown rather than 500ing.
+    let peer_ip = peer.map(|c| c.0.ip());
     state
         .metrics
         .record_http(openpxe_core::HttpRoute::BootScript);
@@ -192,14 +319,33 @@ async fn boot_top_menu(State(state): State<AppState>, Query(p): Query<BootMenuPa
                 mac = %binding.mac, target = %binding.target,
                 "host binding applied"
             );
+            // Pre-record the host-binding event. Reserved menu shortcuts
+            // (`_local`, `_queue`, …) are operator-driven non-imaging
+            // targets — recording them would clutter the Host log with
+            // routine console activity, so we skip those and only record
+            // for real boot-entry ids.
+            if !binding.target.starts_with('_') {
+                let title = lookup_entry_title(&isos, &binding.target);
+                state.boot_log.record(&BootEvent {
+                    timestamp: time::OffsetDateTime::now_utc(),
+                    mac: Some(binding.mac.clone()),
+                    ip: peer_ip,
+                    target_id: binding.target.clone(),
+                    target_title: title,
+                });
+            }
             let target = binding.target;
+            let bound_mac = binding.mac;
             // Reserved menu shortcuts are emitted as `_xxx`; per-entry
             // boot scripts are at `/boot/<id>.ipxe`. Both share the same
-            // `/boot/<name>` route, so the URL is identical.
+            // `/boot/<name>` route, so the URL is identical. We forward
+            // `?mac=` so the per-entry handler can record the boot into
+            // the Host log without depending on iPXE substitution at
+            // this stage.
             return text_plain(format!(
                 "#!ipxe\n\
                  echo OpenPXE: per-MAC binding -> {target}\n\
-                 chain {base}/boot/{target}.ipxe || chain {base}/boot.ipxe\n"
+                 chain {base}/boot/{target}.ipxe?mac={bound_mac} || chain {base}/boot.ipxe\n"
             ));
         }
     }
@@ -207,6 +353,22 @@ async fn boot_top_menu(State(state): State<AppState>, Query(p): Query<BootMenuPa
     text_plain(render_menu(&isos, &settings, base))
 }
 
+/// Best-effort human title for a boot entry id — falls back to the id
+/// itself if the ISO has been deleted between record-time and now.
+fn lookup_entry_title(isos: &[openpxe_iso_store::IsoMeta], target_id: &str) -> String {
+    for iso in isos {
+        for e in &iso.boot_entries {
+            if e.id == target_id {
+                // ISO filename plus the entry title gives the operator
+                // both "which image" and "which variant" (e.g. wimboot
+                // vs sanboot) at a glance.
+                return format!("{} — {}", iso.filename, e.title);
+            }
+        }
+    }
+    target_id.to_string()
+}
+
 #[derive(Debug, Deserialize)]
 struct BootMenuParams {
     /// Client MAC, supplied by iPXE via `${mac}` variable in
@@ -222,13 +384,19 @@ struct BootSubParams {
     /// encoding. Absent on the first request — that's how we know the
     /// client hasn't been prompted yet.
     token: Option<String>,
+    /// Client MAC, supplied by iPXE via `${mac}` in the chain URLs we
+    /// render. Optional — older bookmarks may omit it; the boot log
+    /// just records `None` in that case rather than refusing to boot.
+    mac: Option<String>,
 }
 
 async fn boot_sub(
     State(state): State<AppState>,
+    peer: Option<ConnectInfo<SocketAddr>>,
     AxumPath(filename): AxumPath<String>,
     Query(p): Query<BootSubParams>,
 ) -> Response {
+    let peer_ip = peer.map(|c| c.0.ip());
     // `/boot/<name>.ipxe` where `<name>` is either one of our reserved
     // submenu names (prefixed `_`) or a boot entry id.
     let name = filename.strip_suffix(".ipxe").unwrap_or(&filename);
@@ -239,7 +407,7 @@ async fn boot_sub(
         "_local" => render_local_hdd(base),
         "_linux_menu" => render_family_menu(&isos, base, false),
         "_windows_menu" => render_family_menu(&isos, base, true),
-        "_tools_menu" => render_tools_menu(base),
+        "_tools_menu" => render_tools_menu(&isos, base),
         "_util" => render_util(base),
         "_shell" => render_shell(base),
         "_nic" => render_nic_info(base),
@@ -300,6 +468,22 @@ async fn boot_sub(
                                 }
                             }
                         }
+                        // Record the boot event. This is the canonical
+                        // moment: password gate (if any) passed, and the
+                        // script is about to be served — i.e. the client
+                        // is genuinely about to start imaging.
+                        let mac_normalized = p
+                            .mac
+                            .as_deref()
+                            .map(openpxe_core::normalize_mac)
+                            .filter(|m| !m.is_empty());
+                        state.boot_log.record(&BootEvent {
+                            timestamp: time::OffsetDateTime::now_utc(),
+                            mac: mac_normalized,
+                            ip: peer_ip,
+                            target_id: entry.id.clone(),
+                            target_title: format!("{} — {}", iso.filename, entry.title),
+                        });
                         return text_plain(render_entry(entry, &settings, base));
                     }
                 }
@@ -545,34 +729,568 @@ async fn api_clear_iso_password(
     }
 }
 
-async fn api_upload_iso(State(state): State<AppState>, mut multipart: Multipart) -> Response {
+// ─── ISO category (OS / Tools) ────────────────────────────────────────────
-    while let Ok(Some(mut field)) = multipart.next_field().await {
+
-        if field.name() != Some("file") {
+#[derive(Debug, Deserialize)]
+struct SetCategoryBody {
+    /// `"os"` or `"tools"` — matches `IsoCategory`'s snake_case serde
+    /// repr. Anything else returns 400 with the allowed set spelled out.
+    category: String,
+}
+
+async fn api_set_iso_category(
+    State(state): State<AppState>,
+    AxumPath(id): AxumPath<String>,
+    Json(body): Json<SetCategoryBody>,
+) -> Response {
+    let cat = match body.category.as_str() {
+        "os" => IsoCategory::Os,
+        "tools" => IsoCategory::Tools,
+        other => {
+            return (
+                StatusCode::BAD_REQUEST,
+                format!("unknown category '{other}'; expected one of: os, tools"),
+            )
+                .into_response();
+        }
+    };
+    match state.iso_store.set_category(&id, cat).await {
+        Ok(meta) => {
+            tracing::info!(
+                target: "openpxe::http::iso",
+                iso = %id, category = ?cat,
+                "iso category updated"
+            );
+            (StatusCode::OK, Json(meta)).into_response()
+        }
+        Err(Error::Invalid(msg)) => (StatusCode::NOT_FOUND, msg).into_response(),
+        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
+    }
+}
+
+// ─── Disk space (Storage tab) ─────────────────────────────────────────────
+
+async fn api_storage_disk(State(state): State<AppState>) -> Json<serde_json::Value> {
+    // statvfs on the directory that holds the ISO store. We deliberately
+    // don't walk the directory ourselves — the kernel already tracks
+    // free/total at the volume level and that's the only number the
+    // operator actually cares about for "do I have room for one more
+    // 5 GB ISO?". `statvfs` itself lives in iso-store to keep the
+    // http-api crate free of `unsafe`.
+    let dir = state.iso_store.iso_dir();
+    let (total, available) = state.iso_store.disk_usage().unwrap_or((0, 0));
+    let used = total.saturating_sub(available);
+    Json(json!({
+        "path": dir.to_string_lossy(),
+        "total_bytes": total,
+        "available_bytes": available,
+        "used_bytes": used,
+    }))
+}
+
+// ─── Branding (custom logo) ───────────────────────────────────────────────
+
+async fn api_branding_upload(
+    State(state): State<AppState>,
+    mut multipart: Multipart,
+) -> Response {
+    while let Ok(Some(field)) = multipart.next_field().await {
+        let name = field.name().unwrap_or("").to_string();
+        if name != "file" && name != "logo" {
             continue;
         }
-        let filename = field.file_name().unwrap_or("uploaded.iso").to_string();
+        let mime = field.content_type().unwrap_or("").to_string();
-        if !filename.to_ascii_lowercase().ends_with(".iso") {
+        if !ALLOWED_LOGO_MIMES.iter().any(|m| *m == mime) {
-            return (StatusCode::BAD_REQUEST, "only .iso uploads accepted").into_response();
+            return (
+                StatusCode::BAD_REQUEST,
+                format!(
+                    "unsupported MIME '{mime}'. Allowed: {}",
+                    ALLOWED_LOGO_MIMES.join(", ")
+                ),
+            )
+                .into_response();
         }
-        let mut handle = match state.iso_store.begin_upload(&filename).await {
+        // Pre-read into memory so we can enforce the size cap before
-            Ok(h) => h,
+        // hitting disk. Logos are tiny by definition.
-            Err(e) => return (StatusCode::CONFLICT, format!("{e}")).into_response(),
+        let bytes = match field.bytes().await {
+            Ok(b) => b,
+            Err(e) => {
+                return (StatusCode::BAD_REQUEST, format!("read body: {e}")).into_response()
+            }
         };
-        while let Ok(Some(chunk)) = field.chunk().await {
+        if bytes.len() > MAX_LOGO_BYTES {
-            if let Err(e) = handle.write_chunk(&chunk).await {
+            return (
-                let _ = handle.abort().await;
+                StatusCode::PAYLOAD_TOO_LARGE,
-                return (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response();
+                format!(
+                    "logo too large ({} bytes, max {})",
+                    bytes.len(),
+                    MAX_LOGO_BYTES
+                ),
+            )
+                .into_response();
+        }
+        let Some(ext) = ext_for_mime(&mime) else {
+            return (StatusCode::BAD_REQUEST, "unsupported MIME").into_response();
+        };
+        match state.branding.set_logo(&mime, ext, &bytes) {
+            Ok(filename) => {
+                return (
+                    StatusCode::OK,
+                    Json(json!({
+                        "filename": filename,
+                        "mime": mime,
+                        "size_bytes": bytes.len(),
+                    })),
+                )
+                    .into_response()
+            }
+            Err(e) => {
+                return (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response()
             }
         }
-        let meta = match handle.finish(&state.iso_store).await {
-            Ok(m) => m,
-            Err(e) => return (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
-        };
-        return (StatusCode::CREATED, Json(meta)).into_response();
     }
     (StatusCode::BAD_REQUEST, "no 'file' part").into_response()
 }
 
+async fn api_branding_clear(State(state): State<AppState>) -> Response {
+    match state.branding.clear_logo() {
+        Ok(()) => StatusCode::NO_CONTENT.into_response(),
+        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
+    }
+}
+
+// ─── API reference (Settings → bottom) ────────────────────────────────────
+
+async fn api_docs() -> Json<serde_json::Value> {
+    // Hand-curated rather than introspected from axum because:
+    //   1. axum's runtime route table doesn't carry parameter docs;
+    //   2. the WebUI surfaces this as a readable list, not as an OpenAPI
+    //      spec — readers are operators chasing an integration, not
+    //      machines.
+    // Keep this in lockstep with `build_router` when adding endpoints.
+    Json(json!({
+        "version": env!("CARGO_PKG_VERSION"),
+        "groups": [
+            {
+                "name": "Status & health",
+                "endpoints": [
+                    {"method": "GET", "path": "/healthz",
+                     "summary": "Liveness — always 200 OK while the HTTP task is alive."},
+                    {"method": "GET", "path": "/readyz",
+                     "summary": "Readiness — 200 only when iPXE binaries are bundled and the ISO directory is readable."},
+                    {"method": "GET", "path": "/api/status",
+                     "summary": "Dashboard JSON — versions, counts, settings snapshot, uptime."},
+                    {"method": "GET", "path": "/metrics",
+                     "summary": "Prometheus text exposition (counters + gauges)."},
+                ],
+            },
+            {
+                "name": "ISO images",
+                "endpoints": [
+                    {"method": "GET", "path": "/api/isos",
+                     "summary": "List ISOs (local + NFS) with size, family, boot entries, category."},
+                    {"method": "POST", "path": "/api/isos",
+                     "summary": "Legacy single-shot multipart upload. Prefer /api/uploads for big files."},
+                    {"method": "DELETE", "path": "/api/isos/:id",
+                     "summary": "Delete a local ISO and its sidecar metadata."},
+                    {"method": "PUT", "path": "/api/isos/:id/password",
+                     "summary": "Set or update an ISO's boot password (bcrypt-hashed; plaintext never stored)."},
+                    {"method": "DELETE", "path": "/api/isos/:id/password",
+                     "summary": "Clear an ISO's boot password."},
+                    {"method": "PUT", "path": "/api/isos/:id/category",
+                     "summary": "Set the menu category. Body: { \"category\": \"os\" | \"tools\" }."},
+                ],
+            },
+            {
+                "name": "Chunked uploads",
+                "endpoints": [
+                    {"method": "POST", "path": "/api/uploads",
+                     "summary": "Begin a chunked upload session. Body: { \"filename\", \"size_bytes\" }."},
+                    {"method": "PUT", "path": "/api/uploads/:upload_id",
+                     "summary": "Append a chunk. Headers: x-openpxe-upload-offset, x-openpxe-upload-complete."},
+                    {"method": "DELETE", "path": "/api/uploads/:upload_id",
+                     "summary": "Abort a chunked upload session and remove the .partial file."},
+                ],
+            },
+            {
+                "name": "NFS shares",
+                "endpoints": [
+                    {"method": "GET", "path": "/api/nfs",
+                     "summary": "List configured NFS shares with mount state and iso counts."},
+                    {"method": "POST", "path": "/api/nfs",
+                     "summary": "Mount an NFS share. Body: { server, export, version, read_only }."},
+                    {"method": "DELETE", "path": "/api/nfs/:id",
+                     "summary": "Unmount a share and drop its entries from the ISO store."},
+                    {"method": "POST", "path": "/api/nfs/:id/scan",
+                     "summary": "Re-walk a mounted share for ISOs."},
+                ],
+            },
+            {
+                "name": "Network",
+                "endpoints": [
+                    {"method": "GET", "path": "/api/network",
+                     "summary": "Detected NIC, server IP, subnet, gateway, advertised base URL."},
+                    {"method": "PUT", "path": "/api/network",
+                     "summary": "Update the informational DNS server hint (does not run DNS)."},
+                ],
+            },
+            {
+                "name": "Settings",
+                "endpoints": [
+                    {"method": "GET", "path": "/api/settings",
+                     "summary": "Current runtime settings (Windows toggle, timeout, dns hint, …)."},
+                    {"method": "PUT", "path": "/api/settings",
+                     "summary": "Replace runtime settings. Guards against enabling Windows when wimboot isn't bundled."},
+                    {"method": "POST", "path": "/api/branding/logo",
+                     "summary": "Upload a custom WebUI logo (multipart 'file', PNG/SVG/JPEG/WebP/GIF up to 2 MB)."},
+                    {"method": "DELETE", "path": "/api/branding/logo",
+                     "summary": "Remove the custom logo and revert to the bundled mark."},
+                    {"method": "GET", "path": "/api/sso",
+                     "summary": "Current SAML SSO configuration."},
+                    {"method": "PUT", "path": "/api/sso",
+                     "summary": "Replace SAML SSO configuration. Body: { enabled, idp_name, metadata, metadata_url }."},
+                    {"method": "GET", "path": "/api/docs",
+                     "summary": "This API reference."},
+                ],
+            },
+            {
+                "name": "Auth (Forms)",
+                "endpoints": [
+                    {"method": "POST", "path": "/api/setup",
+                     "summary": "First-run admin bootstrap. Body: { username, password }. Refuses after the admin exists."},
+                    {"method": "POST", "path": "/api/login",
+                     "summary": "Sign in. Body: { username, password }. Sets the openpxe_session cookie."},
+                    {"method": "POST", "path": "/api/logout",
+                     "summary": "Revoke the current session and clear the cookie."},
+                    {"method": "GET", "path": "/api/me",
+                     "summary": "Auth status — { setup_required, authenticated, user }. Always 200."},
+                    {"method": "PUT", "path": "/api/me/credentials",
+                     "summary": "Rotate the admin's credentials. Body: { current_password, new_username?, new_password? }. Revokes all other sessions on success."},
+                ],
+            },
+            {
+                "name": "Storage telemetry",
+                "endpoints": [
+                    {"method": "GET", "path": "/api/storage/disk",
+                     "summary": "Free / used / total bytes for the volume hosting the ISO directory."},
+                ],
+            },
+            {
+                "name": "Queued Deployment",
+                "endpoints": [
+                    {"method": "GET", "path": "/api/queue",
+                     "summary": "List queue entries (waiting + assigned)."},
+                    {"method": "POST", "path": "/api/queue/assign",
+                     "summary": "Assign a target image to queued clients. Body: { target, entry_ids }."},
+                    {"method": "DELETE", "path": "/api/queue/:entry_id",
+                     "summary": "Release a queue entry without assigning."},
+                ],
+            },
+            {
+                "name": "Hosts & boot log",
+                "endpoints": [
+                    {"method": "GET", "path": "/api/hosts",
+                     "summary": "List per-MAC boot bindings."},
+                    {"method": "POST", "path": "/api/hosts",
+                     "summary": "Pin a MAC to a boot target. Body: { mac, target, label }."},
+                    {"method": "DELETE", "path": "/api/hosts/:mac",
+                     "summary": "Remove a binding."},
+                    {"method": "GET", "path": "/api/boot-log",
+                     "summary": "Ring of recent boot events (timestamp, mac, ip, target)."},
+                ],
+            },
+            {
+                "name": "Operator console",
+                "endpoints": [
+                    {"method": "GET", "path": "/api/clients",
+                     "summary": "Live PXE-client registry — MAC, last IP, arch, events."},
+                    {"method": "GET", "path": "/api/log/recent",
+                     "summary": "Ring of recent server log lines for the Terminal tab."},
+                    {"method": "GET", "path": "/api/log/stream",
+                     "summary": "Server-Sent Events stream of log lines."},
+                    {"method": "POST", "path": "/api/terminal",
+                     "summary": "Run a whitelisted operator command. Body: { command }."},
+                ],
+            },
+        ],
+    }))
+}
+
+async fn api_upload_iso(State(state): State<AppState>, mut multipart: Multipart) -> Response {
+    // Walk multipart parts until we find the file. Each branch logs so an
+    // operator chasing a "stuck" upload in the Terminal tab can see
+    // exactly which stage failed (no field, wrong field name, parser
+    // error, mid-stream drop, sha mismatch on finish, etc.).
+    loop {
+        let field_res = multipart.next_field().await;
+        match field_res {
+            Ok(Some(mut field)) => {
+                if field.name() != Some("file") {
+                    tracing::debug!(
+                        target: "openpxe::http::upload",
+                        field = field.name().unwrap_or("?"),
+                        "skipping non-file multipart part"
+                    );
+                    continue;
+                }
+                let filename = field.file_name().unwrap_or("uploaded.iso").to_string();
+                if !filename.to_ascii_lowercase().ends_with(".iso") {
+                    tracing::warn!(
+                        target: "openpxe::http::upload",
+                        filename = %filename, "rejecting non-.iso upload"
+                    );
+                    return (StatusCode::BAD_REQUEST, "only .iso uploads accepted").into_response();
+                }
+                tracing::info!(
+                    target: "openpxe::http::upload",
+                    filename = %filename, "upload started"
+                );
+                let mut handle = match state.iso_store.begin_upload(&filename).await {
+                    Ok(h) => h,
+                    Err(e) => {
+                        tracing::warn!(
+                            target: "openpxe::http::upload",
+                            filename = %filename, error = %e,
+                            "begin_upload rejected (likely duplicate name)"
+                        );
+                        return (StatusCode::CONFLICT, format!("{e}")).into_response();
+                    }
+                };
+                // Streamed reader loop. We use an explicit `match` instead
+                // of `while let Ok(Some(_))` so a mid-stream `Err(_)` (a
+                // truncated body from a reverse proxy 524 / network drop)
+                // is treated as a failure rather than silently completing
+                // with a partial file.
+                let mut bytes: u64 = 0;
+                let mut next_log_at: u64 = 64 * 1024 * 1024;
+                loop {
+                    match field.chunk().await {
+                        Ok(Some(chunk)) => {
+                            if let Err(e) = handle.write_chunk(&chunk).await {
+                                tracing::error!(
+                                    target: "openpxe::http::upload",
+                                    filename = %filename, bytes,
+                                    error = %e, "write_chunk failed; aborting"
+                                );
+                                let _ = handle.abort().await;
+                                return (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}"))
+                                    .into_response();
+                            }
+                            bytes += chunk.len() as u64;
+                            if bytes >= next_log_at {
+                                tracing::info!(
+                                    target: "openpxe::http::upload",
+                                    filename = %filename,
+                                    received_bytes = bytes,
+                                    "upload streaming"
+                                );
+                                // Backoff log cadence: 64 MB, 128, 256, …
+                                next_log_at = next_log_at.saturating_mul(2);
+                            }
+                        }
+                        Ok(None) => break,
+                        Err(e) => {
+                            tracing::error!(
+                                target: "openpxe::http::upload",
+                                filename = %filename, received_bytes = bytes,
+                                error = %e,
+                                "multipart stream ended with error (likely client \
+                                 disconnect or reverse-proxy buffer cap); aborting"
+                            );
+                            let _ = handle.abort().await;
+                            return (
+                                StatusCode::BAD_REQUEST,
+                                format!(
+                                    "upload truncated after {bytes} bytes: {e}. \
+                                     If you went through a reverse proxy, try the \
+                                     LAN IP directly — large body buffering caps \
+                                     (Cloudflare free tier is 100 MB) commonly \
+                                     cause this."
+                                ),
+                            )
+                                .into_response();
+                        }
+                    }
+                }
+                tracing::info!(
+                    target: "openpxe::http::upload",
+                    filename = %filename, received_bytes = bytes,
+                    "upload body complete; introspecting"
+                );
+                let meta = match handle.finish(&state.iso_store).await {
+                    Ok(m) => m,
+                    Err(e) => {
+                        tracing::error!(
+                            target: "openpxe::http::upload",
+                            filename = %filename, error = %e,
+                            "finish failed (rename/introspect)"
+                        );
+                        return (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response();
+                    }
+                };
+                tracing::info!(
+                    target: "openpxe::http::upload",
+                    iso = %meta.id, size = meta.size_bytes,
+                    family = ?meta.introspection.family,
+                    entries = meta.boot_entries.len(),
+                    "upload finished"
+                );
+                return (StatusCode::CREATED, Json(meta)).into_response();
+            }
+            Ok(None) => {
+                tracing::warn!(target: "openpxe::http::upload", "upload had no 'file' part");
+                return (StatusCode::BAD_REQUEST, "no 'file' part").into_response();
+            }
+            Err(e) => {
+                tracing::error!(
+                    target: "openpxe::http::upload",
+                    error = %e,
+                    "multipart parser error before reading any field"
+                );
+                return (
+                    StatusCode::BAD_REQUEST,
+                    format!("multipart parse error: {e}"),
+                )
+                    .into_response();
+            }
+        }
+    }
+}
+
+#[derive(Debug, Deserialize)]
+struct UploadBeginBody {
+    filename: String,
+    #[serde(default)]
+    size_bytes: Option<u64>,
+}
+
+async fn api_upload_begin(
+    State(state): State<AppState>,
+    Json(body): Json<UploadBeginBody>,
+) -> Response {
+    match state
+        .uploads
+        .begin(&state.iso_store, &body.filename, body.size_bytes)
+        .await
+    {
+        Ok(started) => {
+            tracing::info!(
+                target: "openpxe::http::upload",
+                upload_id = %started.upload_id,
+                iso = %started.iso_id,
+                filename = %started.filename,
+                expected_size = ?body.size_bytes,
+                "chunked upload started"
+            );
+            (StatusCode::CREATED, Json(started)).into_response()
+        }
+        Err(Error::Invalid(e)) if e.contains("already exists") => {
+            (StatusCode::CONFLICT, e).into_response()
+        }
+        Err(Error::Invalid(e)) => (StatusCode::BAD_REQUEST, e).into_response(),
+        Err(e) => {
+            tracing::error!(target: "openpxe::http::upload", error = %e, "chunked upload begin failed");
+            (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response()
+        }
+    }
+}
+
+async fn api_upload_chunk(
+    State(state): State<AppState>,
+    AxumPath(upload_id): AxumPath<String>,
+    headers: HeaderMap,
+    chunk: Bytes,
+) -> Response {
+    let Some(offset) = parse_u64_header(&headers, "x-openpxe-upload-offset") else {
+        return (
+            StatusCode::BAD_REQUEST,
+            "missing or invalid x-openpxe-upload-offset",
+        )
+            .into_response();
+    };
+    let complete = bool_header(&headers, "x-openpxe-upload-complete");
+
+    match state
+        .uploads
+        .append(&state.iso_store, &upload_id, offset, chunk, complete)
+        .await
+    {
+        Ok(crate::uploads::UploadAppend::Progress { offset }) => (
+            StatusCode::ACCEPTED,
+            Json(json!({
+                "ok": true,
+                "upload_id": upload_id,
+                "offset": offset,
+                "complete": false,
+            })),
+        )
+            .into_response(),
+        Ok(crate::uploads::UploadAppend::Complete { offset, iso }) => {
+            tracing::info!(
+                target: "openpxe::http::upload",
+                upload_id = %upload_id,
+                iso = %iso.id,
+                size = iso.size_bytes,
+                family = ?iso.introspection.family,
+                entries = iso.boot_entries.len(),
+                "chunked upload finished"
+            );
+            (
+                StatusCode::CREATED,
+                Json(json!({
+                    "ok": true,
+                    "upload_id": upload_id,
+                    "offset": offset,
+                    "complete": true,
+                    "iso": iso,
+                })),
+            )
+                .into_response()
+        }
+        Err(Error::Invalid(e)) if e.starts_with("expected offset") => {
+            (StatusCode::CONFLICT, e).into_response()
+        }
+        Err(Error::Invalid(e)) if e.starts_with("no such upload") => {
+            (StatusCode::NOT_FOUND, e).into_response()
+        }
+        Err(Error::Invalid(e)) => (StatusCode::BAD_REQUEST, e).into_response(),
+        Err(e) => {
+            tracing::error!(
+                target: "openpxe::http::upload",
+                upload_id = %upload_id,
+                error = %e,
+                "chunked upload failed"
+            );
+            (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response()
+        }
+    }
+}
+
+async fn api_upload_abort(
+    State(state): State<AppState>,
+    AxumPath(upload_id): AxumPath<String>,
+) -> Response {
+    match state.uploads.abort(&upload_id).await {
+        Ok(()) => StatusCode::NO_CONTENT.into_response(),
+        Err(Error::Invalid(e)) if e.starts_with("no such upload") => {
+            (StatusCode::NOT_FOUND, e).into_response()
+        }
+        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
+    }
+}
+
+fn parse_u64_header(headers: &HeaderMap, name: &'static str) -> Option<u64> {
+    headers.get(name)?.to_str().ok()?.trim().parse::<u64>().ok()
+}
+
+fn bool_header(headers: &HeaderMap, name: &'static str) -> bool {
+    headers
+        .get(name)
+        .and_then(|v| v.to_str().ok())
+        .map(str::trim)
+        .is_some_and(|v| matches!(v, "1" | "true" | "TRUE" | "yes" | "YES"))
+}
+
 // ─── health / readiness ───────────────────────────────────────────────────
 
 async fn healthz() -> Response {
@@ -657,6 +1375,7 @@ async fn api_status(State(state): State<AppState>) -> Json<serde_json::Value> {
         "nfs_count": nfs.len(),
         "nfs_active": nfs_active,
         "host_bindings": state.hosts.len(),
+        "custom_logo": state.branding.has_logo(),
         "uptime_secs": uptime_secs,
         "started_at": state.started_at,
         "nic_name": state.nic_name,
@@ -988,6 +1707,12 @@ async fn api_hosts_remove(
     }
 }
 
+// ─── Boot event log ───────────────────────────────────────────────────────
+
+async fn api_boot_log(State(state): State<AppState>) -> Json<serde_json::Value> {
+    Json(json!({ "events": state.boot_log.list() }))
+}
+
 // ─── Prometheus metrics ───────────────────────────────────────────────────
 
 async fn api_metrics(State(state): State<AppState>) -> Response {

crates/http-api/src/auth.rs

@@ -0,0 +1,482 @@
+//! Forms auth layer — sessions, login, setup, middleware.
+//!
+//! Three states:
+//!
+//! * **Unconfigured** (`AdminStore::is_configured() == false`). The
+//!   middleware passes every request through — there's no one to gate
+//!   against. The UI's `/api/me` returns `setup_required: true` and the
+//!   front-end pushes the operator into the first-run flow.
+//! * **Logged in**. The session cookie maps to an in-memory session
+//!   record with an idle expiry; `/api/me` returns the username.
+//! * **Logged out**. The middleware bounces `/api/*` (with the PXE
+//!   allowlist below) to `401 Unauthorized`; the front-end intercepts
+//!   that and shows `/login`.
+//!
+//! Allowlist for unauthenticated access *after* the admin is set up:
+//!
+//! * everything outside `/api/*` (the WebUI bundle, asset chrome, PXE
+//!   script endpoints, the bundled iPXE/wimboot binaries, ISO bytes,
+//!   liveness/readiness probes, the Prometheus scrape) — these are
+//!   read-only or PXE-essential and breaking them locks out booting
+//!   machines that have no way to authenticate;
+//! * `/api/setup`, `/api/login`, `/api/me` (the auth surface itself);
+//! * `/api/queue/join`, `/api/queue/poll/:entry_id` (iPXE long-poll for
+//!   Queued Deployment — the iPXE client can't send a session cookie).
+//!
+//! Everything else inside `/api/*` requires a valid session.
+
+use crate::state::AppState;
+use axum::{
+    body::Body,
+    extract::{Request, State},
+    http::{header, HeaderValue, StatusCode},
+    middleware::Next,
+    response::{IntoResponse, Response},
+    Json,
+};
+use openpxe_core::AdminPublic;
+use parking_lot::RwLock;
+use serde::{Deserialize, Serialize};
+use serde_json::json;
+use std::collections::HashMap;
+use std::sync::Arc;
+use std::time::{Duration, Instant};
+use uuid::Uuid;
+
+/// Idle session lifetime. Sliding — every authenticated request resets
+/// the expiry. 24h is the Sonarr default and matches what most operators
+/// expect for an on-prem admin console.
+const SESSION_TTL: Duration = Duration::from_hours(24);
+
+/// Name of the cookie we set/read. Distinct from a generic `session=`
+/// to avoid collisions with anything else sharing the host.
+pub const SESSION_COOKIE: &str = "openpxe_session";
+
+#[derive(Debug, Clone)]
+struct Session {
+    username: String,
+    expires_at: Instant,
+}
+
+/// In-memory session table. Cheap to clone (Arc-shared) and contention
+/// is rare — operators sign in once per browser session.
+#[derive(Debug, Clone, Default)]
+pub struct SessionStore {
+    inner: Arc<RwLock<HashMap<String, Session>>>,
+}
+
+impl SessionStore {
+    /// Mint a fresh session for `username` and return the opaque cookie
+    /// value. UUID v4 gives us 122 random bits — comfortably more than
+    /// the 64-128 bits typical for session IDs.
+    #[must_use]
+    pub fn create(&self, username: &str) -> String {
+        let id = Uuid::new_v4().simple().to_string();
+        let session = Session {
+            username: username.to_string(),
+            expires_at: Instant::now() + SESSION_TTL,
+        };
+        self.inner.write().insert(id.clone(), session);
+        id
+    }
+
+    /// Resolve a cookie value to the owning username, refreshing the
+    /// idle timer. Returns `None` for missing / expired sessions and
+    /// proactively evicts the expired entry so the map doesn't grow
+    /// unbounded across long-lived deployments.
+    pub fn touch(&self, id: &str) -> Option<String> {
+        let mut g = self.inner.write();
+        let s = g.get_mut(id)?;
+        if s.expires_at <= Instant::now() {
+            g.remove(id);
+            return None;
+        }
+        s.expires_at = Instant::now() + SESSION_TTL;
+        Some(s.username.clone())
+    }
+
+    /// Invalidate one session (the user's `/api/logout`).
+    pub fn revoke(&self, id: &str) {
+        self.inner.write().remove(id);
+    }
+
+    /// Invalidate every session — used after a credentials rotation so
+    /// stale cookies for the old password can't keep operating.
+    pub fn revoke_all(&self) {
+        self.inner.write().clear();
+    }
+
+    /// Periodic / opportunistic GC. Not currently scheduled (we evict
+    /// on touch), but exposed for a future janitor task.
+    pub fn gc(&self) {
+        let now = Instant::now();
+        self.inner.write().retain(|_, s| s.expires_at > now);
+    }
+
+    #[must_use]
+    pub fn len(&self) -> usize {
+        self.inner.read().len()
+    }
+
+    #[must_use]
+    pub fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+}
+
+// ── Cookie helpers ────────────────────────────────────────────────────────
+
+fn cookie_attrs(value: &str, max_age: Option<i64>) -> String {
+    // Same flags FleetDM and Sonarr ship by default:
+    //   - HttpOnly: blocks JS access (XSS containment)
+    //   - SameSite=Lax: allows top-level GET navigations from the IdP
+    //     to land authenticated when SSO arrives, but blocks
+    //     cross-site POST CSRF;
+    //   - Path=/: the cookie applies to the whole app;
+    //   - no Secure flag yet — many operators host on plain http://
+    //     LAN IPs (Unraid templates default to that); we'll add Secure
+    //     opportunistically when we add a TLS terminator option.
+    // SESSION_TTL fits in 32 bits comfortably (24h ≈ 86400 seconds); we
+    // never overflow i64, but clippy's `cast_possible_wrap` lint wants
+    // us to be explicit. `cast_signed` is the documented form.
+    let lifetime = max_age.unwrap_or_else(|| SESSION_TTL.as_secs().cast_signed());
+    format!(
+        "{SESSION_COOKIE}={value}; Path=/; HttpOnly; SameSite=Lax; Max-Age={lifetime}"
+    )
+}
+
+fn parse_cookie(headers: &axum::http::HeaderMap) -> Option<String> {
+    // `Cookie: a=b; c=d` parsing — small enough not to drag in a crate.
+    let raw = headers.get(header::COOKIE)?.to_str().ok()?;
+    for part in raw.split(';') {
+        let part = part.trim();
+        if let Some(v) = part.strip_prefix(&format!("{SESSION_COOKIE}=")) {
+            return Some(v.to_string());
+        }
+    }
+    None
+}
+
+// ── Middleware ────────────────────────────────────────────────────────────
+
+/// Return `true` if `path` is on the allowlist and should bypass the
+/// session check. The middleware applies this rule only when the admin
+/// account is configured; before then everything is open.
+fn is_public_path(path: &str) -> bool {
+    // Non-API paths: WebUI bundle, PXE chain, ISO bytes, health probes,
+    // metrics. All read-only / PXE-essential.
+    if !path.starts_with("/api/") {
+        return true;
+    }
+    // Auth surface and iPXE long-poll endpoints (no cookie available).
+    matches!(
+        path,
+        "/api/setup" | "/api/login" | "/api/logout" | "/api/me"
+    ) || path.starts_with("/api/queue/join")
+        || path.starts_with("/api/queue/poll/")
+}
+
+/// Axum middleware: gate `/api/*` behind a valid session, with the
+/// allowlist above. `State<AppState>` reaches in for the admin store +
+/// session store.
+pub async fn require_auth(
+    State(state): State<AppState>,
+    req: Request<Body>,
+    next: Next,
+) -> Response {
+    // Bypass entirely while unconfigured. The /api/setup endpoint is
+    // the only one that can flip this back to "configured", and it
+    // refuses to run a second time. Tests + fresh installs ride this
+    // path.
+    if !state.admin.is_configured() {
+        return next.run(req).await;
+    }
+    let path = req.uri().path();
+    if is_public_path(path) {
+        return next.run(req).await;
+    }
+    // Authenticated path. The cookie must be present, map to a live
+    // session, and the TTL refresh happens as a side-effect.
+    let token = parse_cookie(req.headers());
+    if let Some(t) = token {
+        if state.sessions.touch(&t).is_some() {
+            return next.run(req).await;
+        }
+    }
+    (
+        StatusCode::UNAUTHORIZED,
+        Json(json!({ "error": "authentication required" })),
+    )
+        .into_response()
+}
+
+// ── Handlers ──────────────────────────────────────────────────────────────
+
+#[derive(Debug, Deserialize)]
+pub struct SetupBody {
+    pub username: String,
+    pub password: String,
+}
+
+/// First-run setup. Refuses to run once an admin already exists — that
+/// guards against a leaked WebUI being re-bootstrapped by an attacker
+/// who's seen the deployment URL. After bootstrap, the new session
+/// cookie is set so the operator goes straight to the dashboard.
+pub async fn api_setup(
+    State(state): State<AppState>,
+    Json(body): Json<SetupBody>,
+) -> Response {
+    if state.admin.is_configured() {
+        return (
+            StatusCode::CONFLICT,
+            Json(json!({ "error": "admin account already configured" })),
+        )
+            .into_response();
+    }
+    match state.admin.bootstrap(&body.username, &body.password) {
+        Ok(pub_) => {
+            let session = state.sessions.create(&pub_.username);
+            login_response(StatusCode::CREATED, &pub_, &session)
+        }
+        Err(openpxe_core::Error::Invalid(msg)) => {
+            (StatusCode::BAD_REQUEST, Json(json!({ "error": msg }))).into_response()
+        }
+        Err(e) => (
+            StatusCode::INTERNAL_SERVER_ERROR,
+            Json(json!({ "error": format!("{e}") })),
+        )
+            .into_response(),
+    }
+}
+
+#[derive(Debug, Deserialize)]
+pub struct LoginBody {
+    pub username: String,
+    pub password: String,
+}
+
+pub async fn api_login(State(state): State<AppState>, Json(body): Json<LoginBody>) -> Response {
+    // Brief, deliberately vague — "invalid credentials" rather than
+    // "no such user" / "wrong password". Same anti-enumeration posture
+    // as Sonarr/Radarr.
+    let pub_ = match state.admin.verify(&body.username, &body.password) {
+        Ok(Some(u)) => u,
+        Ok(None) => {
+            return (
+                StatusCode::UNAUTHORIZED,
+                Json(json!({ "error": "invalid username or password" })),
+            )
+                .into_response();
+        }
+        Err(e) => {
+            return (
+                StatusCode::INTERNAL_SERVER_ERROR,
+                Json(json!({ "error": format!("{e}") })),
+            )
+                .into_response();
+        }
+    };
+    let session = state.sessions.create(&pub_.username);
+    login_response(StatusCode::OK, &pub_, &session)
+}
+
+pub async fn api_logout(
+    State(state): State<AppState>,
+    headers: axum::http::HeaderMap,
+) -> Response {
+    if let Some(t) = parse_cookie(&headers) {
+        state.sessions.revoke(&t);
+    }
+    // Stomp the cookie unconditionally — even if the request didn't
+    // carry one, the browser shouldn't keep a stale value.
+    let mut resp = StatusCode::NO_CONTENT.into_response();
+    resp.headers_mut().insert(
+        header::SET_COOKIE,
+        HeaderValue::from_str(&cookie_attrs("", Some(0))).unwrap(),
+    );
+    resp
+}
+
+/// Status surface for the front-end shell. Returns four cases:
+///
+/// * `setup_required: true` — no admin yet; show first-run page.
+/// * `authenticated: false` — admin exists, no session; show login.
+/// * `authenticated: true` + `user` — let the dashboard load.
+pub async fn api_me(State(state): State<AppState>, headers: axum::http::HeaderMap) -> Response {
+    if !state.admin.is_configured() {
+        return (
+            StatusCode::OK,
+            Json(json!({
+                "setup_required": true,
+                "authenticated": false,
+            })),
+        )
+            .into_response();
+    }
+    let token = parse_cookie(&headers);
+    let username = token.as_deref().and_then(|t| state.sessions.touch(t));
+    match username {
+        Some(u) => (
+            StatusCode::OK,
+            Json(json!({
+                "setup_required": false,
+                "authenticated": true,
+                "user": state.admin.snapshot(),
+                "session_user": u,
+            })),
+        )
+            .into_response(),
+        None => (
+            StatusCode::OK,
+            Json(json!({
+                "setup_required": false,
+                "authenticated": false,
+            })),
+        )
+            .into_response(),
+    }
+}
+
+#[derive(Debug, Deserialize)]
+pub struct UpdateCredentialsBody {
+    pub current_password: String,
+    #[serde(default)]
+    pub new_username: Option<String>,
+    #[serde(default)]
+    pub new_password: Option<String>,
+}
+
+/// Rotate the admin's username and/or password. Auth middleware has
+/// already proved the caller owns a session; we additionally require
+/// the *current* password to prove "person at the keyboard right now".
+/// On success we issue a fresh session cookie keyed to the (possibly
+/// new) username and revoke every prior session so a stolen cookie
+/// from before the rotation stops working.
+pub async fn api_update_credentials(
+    State(state): State<AppState>,
+    Json(body): Json<UpdateCredentialsBody>,
+) -> Response {
+    if !state.admin.is_configured() {
+        return (
+            StatusCode::CONFLICT,
+            Json(json!({ "error": "no admin configured" })),
+        )
+            .into_response();
+    }
+    let result = state.admin.update_credentials(
+        &body.current_password,
+        body.new_username.as_deref(),
+        body.new_password.as_deref(),
+    );
+    match result {
+        Ok(pub_) => {
+            state.sessions.revoke_all();
+            let session = state.sessions.create(&pub_.username);
+            login_response(StatusCode::OK, &pub_, &session)
+        }
+        Err(openpxe_core::Error::Invalid(msg)) => {
+            (StatusCode::BAD_REQUEST, Json(json!({ "error": msg }))).into_response()
+        }
+        Err(e) => (
+            StatusCode::INTERNAL_SERVER_ERROR,
+            Json(json!({ "error": format!("{e}") })),
+        )
+            .into_response(),
+    }
+}
+
+#[derive(Debug, Serialize)]
+struct LoginPayload<'a> {
+    user: &'a AdminPublic,
+    authenticated: bool,
+}
+
+fn login_response(status: StatusCode, user: &AdminPublic, session: &str) -> Response {
+    let body = Json(LoginPayload {
+        user,
+        authenticated: true,
+    });
+    let mut resp = (status, body).into_response();
+    resp.headers_mut().insert(
+        header::SET_COOKIE,
+        HeaderValue::from_str(&cookie_attrs(session, None)).unwrap(),
+    );
+    resp
+}
+
+// ── Tests ─────────────────────────────────────────────────────────────────
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn session_create_touch_revoke() {
+        let s = SessionStore::default();
+        assert!(s.is_empty());
+        let t = s.create("admin");
+        assert_eq!(s.len(), 1);
+        assert_eq!(s.touch(&t).as_deref(), Some("admin"));
+        s.revoke(&t);
+        assert!(s.is_empty());
+        // Stale token doesn't error, just returns None.
+        assert!(s.touch(&t).is_none());
+    }
+
+    #[test]
+    fn session_revoke_all_clears() {
+        let s = SessionStore::default();
+        let _ = s.create("a");
+        let _ = s.create("b");
+        assert_eq!(s.len(), 2);
+        s.revoke_all();
+        assert!(s.is_empty());
+    }
+
+    #[test]
+    fn public_path_allowlist() {
+        // PXE + chrome paths bypass auth.
+        for p in [
+            "/", "/assets/app.js", "/boot.ipxe", "/boot/fake.ipxe",
+            "/iso/fake.iso", "/ipxe/snponly.efi", "/healthz", "/readyz",
+            "/metrics",
+        ] {
+            assert!(is_public_path(p), "expected {p} to be public");
+        }
+        // Auth surface itself is public.
+        for p in ["/api/setup", "/api/login", "/api/logout", "/api/me"] {
+            assert!(is_public_path(p), "expected {p} to be public");
+        }
+        // iPXE long-poll endpoints are public (no cookie available).
+        assert!(is_public_path("/api/queue/join"));
+        assert!(is_public_path("/api/queue/poll/abc"));
+        // Everything else under /api/* must auth.
+        for p in [
+            "/api/isos",
+            "/api/isos/x/category",
+            "/api/storage/disk",
+            "/api/branding/logo",
+            "/api/sso",
+            "/api/hosts",
+        ] {
+            assert!(!is_public_path(p), "expected {p} to require auth");
+        }
+    }
+
+    #[test]
+    fn cookie_parse_picks_session_value() {
+        let mut h = axum::http::HeaderMap::new();
+        h.insert(
+            header::COOKIE,
+            HeaderValue::from_str(&format!("foo=bar; {SESSION_COOKIE}=abc123; baz=qux"))
+                .unwrap(),
+        );
+        assert_eq!(parse_cookie(&h).as_deref(), Some("abc123"));
+        // Different name → None.
+        let mut h2 = axum::http::HeaderMap::new();
+        h2.insert(header::COOKIE, HeaderValue::from_str("foo=bar").unwrap());
+        assert!(parse_cookie(&h2).is_none());
+        // No cookie header at all → None.
+        assert!(parse_cookie(&axum::http::HeaderMap::new()).is_none());
+    }
+}

crates/http-api/src/ipxe_script.rs

@@ -149,6 +149,13 @@ pub fn render_family_menu(isos: &[IsoMeta], base_url: &str, is_windows: bool) ->
         if !filter(iso.introspection.family) {
             continue;
         }
+        // v0.4.4: ISOs the operator flipped to the Tools category move
+        // out of the OS installer submenus entirely — they only appear
+        // under Tools. Without this filter the operator would see the
+        // same ISO in both menus.
+        if matches!(iso.category, openpxe_iso_store::IsoCategory::Tools) {
+            continue;
+        }
         for entry in &iso.boot_entries {
             let size_label = fmt_size_mib(iso.size_bytes);
             let key = hotkey_for_index(count);
@@ -182,7 +189,14 @@ pub fn render_family_menu(isos: &[IsoMeta], base_url: &str, is_windows: bool) ->
         s,
         "iseq ${{target}} back && chain {base}/boot.ipxe || goto menu"
     );
-    let _ = writeln!(s, "chain {base}/boot/${{target}}.ipxe || goto menu");
+    // Pass `?mac=${mac}` so the per-entry handler can record the booting
+    // client into the Host log. iPXE substitutes `${mac}` before
+    // the HTTP fetch; if the firmware can't resolve it the literal
+    // `${mac}` is sent and the server treats it as "unknown".
+    let _ = writeln!(
+        s,
+        "chain {base}/boot/${{target}}.ipxe?mac=${{mac}} || goto menu"
+    );
     s
 }
 
@@ -203,15 +217,52 @@ fn hotkey_for_index(i: usize) -> String {
     }
 }
 
-/// Tools submenu — Utilities, Shell, NIC Info, Reboot, Exit to firmware.
+/// Tools submenu — Utilities, Shell, NIC Info, Reboot, Exit to firmware,
+/// plus any ISOs the operator flipped to [`IsoCategory::Tools`] in the
+/// Storage tab. The category-Tools ISOs render first so frequently used
+/// recovery / hardware tools are reachable with a single number key
+/// before the built-in shortcuts.
 #[must_use]
-pub fn render_tools_menu(base_url: &str) -> String {
+pub fn render_tools_menu(isos: &[IsoMeta], base_url: &str) -> String {
     let base = base_url.trim_end_matches('/');
     let mut s = String::new();
     let _ = writeln!(s, "#!ipxe");
     let _ = writeln!(s, "set base-url {base}");
     let _ = writeln!(s, ":menu");
     let _ = writeln!(s, "menu OpenPXE - Tools");
+
+    // Operator-categorized tool ISOs (hotkeys 1..9), each chained the
+    // same way as a per-family menu pick — through the boot-entry id
+    // route, carrying `?mac=${mac}` for Host log attribution.
+    let mut count = 0;
+    for iso in isos {
+        if !matches!(iso.category, openpxe_iso_store::IsoCategory::Tools) {
+            continue;
+        }
+        for entry in &iso.boot_entries {
+            let size_label = fmt_size_mib(iso.size_bytes);
+            let key = hotkey_for_index(count);
+            let lock = if iso.is_password_protected() {
+                "*"
+            } else {
+                " "
+            };
+            let _ = writeln!(
+                s,
+                "item {}{} {}[{:>6}] {}",
+                key,
+                entry.id,
+                lock,
+                size_label,
+                escape_label(&entry.title),
+            );
+            count += 1;
+        }
+    }
+    if count > 0 {
+        let _ = writeln!(s, "item --gap");
+    }
+
     let _ = writeln!(s, "item --key u util     Utilities  (memtest, ...)");
     let _ = writeln!(s, "item --key s shell    OpenPXE Shell");
     let _ = writeln!(s, "item --key n nic      Network Card Info");
@@ -245,7 +296,12 @@ pub fn render_tools_menu(base_url: &str) -> String {
         s,
         "iseq ${{target}} back     && chain {base}/boot.ipxe        || goto menu"
     );
-    let _ = writeln!(s, "goto menu");
+    // Fall-through for category-Tools ISO ids — same as the family
+    // submenu, carrying `?mac=${mac}` for the boot log.
+    let _ = writeln!(
+        s,
+        "chain {base}/boot/${{target}}.ipxe?mac=${{mac}} || goto menu"
+    );
     s
 }
 
@@ -461,9 +517,14 @@ pub fn render_password_prompt(entry_id: &str, iso_filename: &str, base_url: &str
     );
     let _ = writeln!(s, ":submit");
     let _ = writeln!(s, "echo Verifying...");
+    // Carry `mac=${mac}` alongside the token so a successful unlock
+    // records the actual client MAC into the Host log. On
+    // older iPXE that can't resolve `${mac}` the server just stores it
+    // as "unknown" rather than refusing to boot.
     let _ = writeln!(
         s,
-        "chain {base}/boot/{entry_id}.ipxe?token=${{password:uristring}} || chain {base}/boot.ipxe"
+        "chain {base}/boot/{entry_id}.ipxe?token=${{password:uristring}}&mac=${{mac}} \
+         || chain {base}/boot.ipxe"
     );
     s
 }
@@ -519,7 +580,7 @@ mod password_tests {
         let settings = Settings::default();
         let scripts = [
             render_menu(&[], &settings, "http://10.0.0.5"),
-            render_tools_menu("http://10.0.0.5"),
+            render_tools_menu(&[], "http://10.0.0.5"),
             render_local_hdd("http://10.0.0.5"),
             render_util("http://10.0.0.5"),
             render_shell("http://10.0.0.5"),

crates/http-api/src/lib.rs

@@ -14,11 +14,13 @@
 #![forbid(unsafe_code)]
 
 pub mod app;
+pub mod auth;
 pub mod ipxe_script;
 pub mod iso_fs;
 pub mod log_stream;
 pub mod state;
 pub mod terminal;
+pub mod uploads;
 
 pub use app::build_router;
 pub use state::AppState;

crates/http-api/src/state.rs

@@ -1,4 +1,9 @@
-use openpxe_core::{ClientRegistry, DeploymentQueue, HostBindings, LogBus, Metrics, SettingsStore};
+use crate::uploads::UploadSessions;
+use crate::auth::SessionStore;
+use openpxe_core::{
+    AdminStore, BootLog, BrandingStore, ClientRegistry, DeploymentQueue, HostBindings, LogBus,
+    Metrics, SettingsStore, SsoStore,
+};
 use openpxe_iso_store::{IsoStore, NfsManager, SmbManager};
 use std::sync::Arc;
 use time::OffsetDateTime;
@@ -13,6 +18,25 @@ pub struct AppState {
     /// these MACs requests `/boot.ipxe`, we chain straight to the
     /// configured target instead of rendering the menu.
     pub hosts: HostBindings,
+    /// Persistent boot-event log surfaced under the Hosts tab. Records
+    /// every `/boot/<entry>.ipxe` chain that goes on to serve a script
+    /// (i.e. an image actually starting to install on a machine).
+    pub boot_log: BootLog,
+    /// Operator-controlled UI overrides (custom logo). When the
+    /// operator hasn't uploaded anything, the WebUI serves the bundled
+    /// rainbow-horizon mark.
+    pub branding: BrandingStore,
+    /// Forms-auth admin record + first-run bootstrap state. When
+    /// `admin.is_configured() == false`, the auth middleware passes
+    /// every request through and `/api/me` reports `setup_required`.
+    pub admin: AdminStore,
+    /// In-memory session table for active operator logins. Cleared on
+    /// process restart (sessions are tied to UI state, not persisted —
+    /// matches Sonarr/Radarr behaviour).
+    pub sessions: SessionStore,
+    /// SAML SSO configuration. v0.4.5 stores it; the actual SSO login
+    /// flow ships in a later release.
+    pub sso: SsoStore,
     /// Lock-free metrics counters surfaced at `/metrics` in Prometheus
     /// text format. Cheap to clone (handles to atomics).
     pub metrics: Metrics,
@@ -25,6 +49,10 @@ pub struct AppState {
     /// available in the runtime image. Surfaces errors per-mount rather
     /// than failing the global state.
     pub nfs: NfsManager,
+    /// Browser chunked upload state. Multipart uploads still go straight
+    /// through `IsoStore`, but the UI uses sessions so large ISO transfers
+    /// can show deterministic progress and leave visible partial files.
+    pub uploads: UploadSessions,
     /// Live log bus consumed by the Terminal tab via SSE. Operator-issued
     /// terminal commands also push synthetic lines onto it so the tail
     /// shows them inline.

crates/http-api/src/uploads.rs

@@ -0,0 +1,180 @@
+//! Chunked upload sessions for browser-driven ISO uploads.
+//!
+//! The legacy multipart endpoint still exists for simple API clients, but
+//! browsers get a better failure mode with raw chunks: progress advances after
+//! each acknowledged write, partial files appear in the ISO directory
+//! immediately, and reverse proxies are less likely to buffer an entire DVD
+//! image before OpenPXE sees byte one.
+
+use bytes::Bytes;
+use openpxe_core::{Error, Result};
+use openpxe_iso_store::{IsoMeta, IsoStore, UploadHandle};
+use serde::Serialize;
+use std::collections::HashMap;
+use std::sync::Arc;
+use tokio::sync::Mutex;
+use uuid::Uuid;
+
+const DEFAULT_CHUNK_SIZE: u64 = 8 * 1024 * 1024;
+
+#[derive(Clone, Default)]
+pub struct UploadSessions {
+    inner: Arc<Mutex<HashMap<String, Arc<Mutex<UploadSession>>>>>,
+}
+
+struct UploadSession {
+    filename: String,
+    expected_size: Option<u64>,
+    offset: u64,
+    handle: Option<UploadHandle>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct UploadStarted {
+    pub upload_id: String,
+    pub iso_id: String,
+    pub filename: String,
+    pub offset: u64,
+    pub chunk_size: u64,
+}
+
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum UploadAppend {
+    Progress { offset: u64 },
+    Complete { offset: u64, iso: Box<IsoMeta> },
+}
+
+impl UploadSessions {
+    pub async fn begin(
+        &self,
+        store: &IsoStore,
+        filename: &str,
+        expected_size: Option<u64>,
+    ) -> Result<UploadStarted> {
+        if !filename.to_ascii_lowercase().ends_with(".iso") {
+            return Err(Error::Invalid("only .iso uploads accepted".to_string()));
+        }
+
+        let handle = store.begin_upload(filename).await?;
+        let iso_id = handle.id.clone();
+        let upload_id = Uuid::new_v4().to_string();
+        let session = UploadSession {
+            filename: filename.to_string(),
+            expected_size,
+            offset: 0,
+            handle: Some(handle),
+        };
+
+        self.inner
+            .lock()
+            .await
+            .insert(upload_id.clone(), Arc::new(Mutex::new(session)));
+
+        Ok(UploadStarted {
+            upload_id,
+            iso_id,
+            filename: filename.to_string(),
+            offset: 0,
+            chunk_size: DEFAULT_CHUNK_SIZE,
+        })
+    }
+
+    pub async fn append(
+        &self,
+        store: &IsoStore,
+        upload_id: &str,
+        offset: u64,
+        chunk: Bytes,
+        complete: bool,
+    ) -> Result<UploadAppend> {
+        let Some(session_lock) = self.inner.lock().await.get(upload_id).cloned() else {
+            return Err(Error::Invalid(format!("no such upload '{upload_id}'")));
+        };
+
+        let mut session = session_lock.lock().await;
+        if session.offset != offset {
+            return Err(Error::Invalid(format!(
+                "expected offset {}, got {offset}",
+                session.offset
+            )));
+        }
+
+        let new_offset = session
+            .offset
+            .checked_add(chunk.len() as u64)
+            .ok_or_else(|| Error::Invalid("upload offset overflow".to_string()))?;
+
+        if let Some(expected) = session.expected_size {
+            if new_offset > expected {
+                return Err(Error::Invalid(format!(
+                    "chunk exceeds declared upload size {expected}"
+                )));
+            }
+        }
+
+        let Some(handle) = session.handle.as_mut() else {
+            return Err(Error::Invalid("upload already completed".to_string()));
+        };
+        if let Err(e) = handle.write_chunk(&chunk).await {
+            let handle = session.handle.take();
+            drop(session);
+            self.inner.lock().await.remove(upload_id);
+            if let Some(handle) = handle {
+                let _ = handle.abort().await;
+            }
+            return Err(e);
+        }
+
+        session.offset = new_offset;
+        if !complete {
+            return Ok(UploadAppend::Progress { offset: new_offset });
+        }
+
+        if let Some(expected) = session.expected_size {
+            if new_offset != expected {
+                return Err(Error::Invalid(format!(
+                    "final chunk ended at {new_offset}, expected {expected}"
+                )));
+            }
+        }
+
+        let Some(handle) = session.handle.take() else {
+            return Err(Error::Invalid("upload already completed".to_string()));
+        };
+        let filename = session.filename.clone();
+        drop(session);
+
+        tracing::info!(
+            target: "openpxe::http::upload",
+            upload_id,
+            filename = %filename,
+            received_bytes = new_offset,
+            "chunked upload body complete; introspecting"
+        );
+
+        let meta = match handle.finish(store).await {
+            Ok(meta) => meta,
+            Err(e) => {
+                self.inner.lock().await.remove(upload_id);
+                return Err(e);
+            }
+        };
+        self.inner.lock().await.remove(upload_id);
+        Ok(UploadAppend::Complete {
+            offset: new_offset,
+            iso: Box::new(meta),
+        })
+    }
+
+    pub async fn abort(&self, upload_id: &str) -> Result<()> {
+        let Some(session_lock) = self.inner.lock().await.remove(upload_id) else {
+            return Err(Error::Invalid(format!("no such upload '{upload_id}'")));
+        };
+        let mut session = session_lock.lock().await;
+        if let Some(handle) = session.handle.take() {
+            handle.abort().await?;
+        }
+        Ok(())
+    }
+}

crates/http-api/tests/full_flow.rs

@@ -98,6 +98,11 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
     iso_store.set_nfs_root(nfs.mount_root());
     let log_bus = LogBus::new(64);
     let hosts = HostBindings::load_or_default(dir.path());
+    let boot_log = openpxe_core::BootLog::load_or_default(dir.path());
+    let branding = openpxe_core::BrandingStore::load_or_default(dir.path());
+    let admin = openpxe_core::AdminStore::load_or_default(dir.path());
+    let sso = openpxe_core::SsoStore::load_or_default(dir.path());
+    let sessions = openpxe_http_api::auth::SessionStore::default();
     let metrics = Metrics::new();
     let state = AppState {
         iso_store,
@@ -105,9 +110,15 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
         queue,
         settings,
         hosts,
+        boot_log,
+        branding,
+        admin,
+        sessions,
+        sso,
         metrics,
         smb: None,
         nfs,
+        uploads: openpxe_http_api::uploads::UploadSessions::default(),
         log_bus,
         started_at: time::OffsetDateTime::now_utc(),
         public_base_url: "http://127.0.0.1".into(),
@@ -975,3 +986,759 @@ async fn set_password_for_unknown_iso_returns_404() {
         .unwrap();
     assert_eq!(res.status(), StatusCode::NOT_FOUND);
 }
+
+#[tokio::test]
+async fn boot_log_records_entry_serve_with_mac() {
+    // End-to-end: upload an ISO, fetch the entry's boot script with a
+    // MAC query param, then GET /api/boot-log and assert the event is
+    // there with the supplied mac.
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+
+    let (ct, body) = multipart_iso_body("fake-alpine.iso", &fake_alpine_iso());
+    let upload = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri("/api/isos")
+                .header("content-type", ct)
+                .body(Body::from(body))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(upload.status(), StatusCode::CREATED);
+
+    // Fetch the per-entry script with ?mac=...
+    let (s, _) = get(&app, "/boot/fake-alpine-linux.ipxe?mac=AA:BB:CC:00:00:09").await;
+    assert_eq!(s, StatusCode::OK);
+
+    // The boot log should now contain exactly one entry, with the
+    // normalized MAC and our target id.
+    let (s, body) = get(&app, "/api/boot-log").await;
+    assert_eq!(s, StatusCode::OK);
+    let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    let events = v["events"].as_array().expect("events");
+    assert_eq!(events.len(), 1);
+    let ev = &events[0];
+    assert_eq!(ev["target_id"], "fake-alpine-linux");
+    assert_eq!(ev["mac"], "aa:bb:cc:00:00:09"); // normalized
+                                                // Title should include the filename and entry title.
+    let title = ev["target_title"].as_str().unwrap();
+    assert!(title.contains("fake-alpine.iso"), "title was {title}");
+}
+
+#[tokio::test]
+async fn boot_log_endpoint_empty_when_no_boots() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (s, body) = get(&app, "/api/boot-log").await;
+    assert_eq!(s, StatusCode::OK);
+    let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert!(v["events"].as_array().unwrap().is_empty());
+}
+
+#[tokio::test]
+async fn boot_log_does_not_record_reserved_menu_targets() {
+    // Reserved targets (_local, _queue, …) are operator console actions,
+    // not imaging events. The Hosts log skips them so it stays focused
+    // on "what got installed where".
+    let (state, _dir) = build_state().await;
+    let app = build_router(state.clone());
+
+    // Bind a MAC to the _local shortcut and hit /boot.ipxe.
+    let body = r#"{"mac":"aa:bb:cc:00:00:11","target":"_local","label":"q"}"#;
+    let (s, _) = post_json(&app, "/api/hosts", body).await;
+    assert_eq!(s, StatusCode::CREATED);
+    let (s, _) = get(&app, "/boot.ipxe?mac=aa:bb:cc:00:00:11").await;
+    assert_eq!(s, StatusCode::OK);
+
+    let (_, body) = get(&app, "/api/boot-log").await;
+    let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert!(
+        v["events"].as_array().unwrap().is_empty(),
+        "reserved targets should not appear in boot log; got {v}"
+    );
+}
+
+#[tokio::test]
+async fn upload_rejects_non_iso_filename_with_clear_message() {
+    // Sanity for the upload-logging path: a wrong extension should land
+    // a 400 with the human message rather than silently being eaten by
+    // the multipart loop. (No iso ends up in the store either.)
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (ct, body) = multipart_iso_body("not-an-iso.txt", b"hello world");
+    let res = app
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri("/api/isos")
+                .header("content-type", ct)
+                .body(Body::from(body))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(res.status(), StatusCode::BAD_REQUEST);
+    let body = axum::body::to_bytes(res.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    let text = std::str::from_utf8(&body).unwrap();
+    assert!(text.contains("only .iso uploads accepted"), "got: {text}");
+}
+
+#[tokio::test]
+async fn chunked_upload_writes_progressively_and_finishes_iso() {
+    let (state, dir) = build_state().await;
+    let app = build_router(state);
+    let iso = fake_alpine_iso();
+
+    let start = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri("/api/uploads")
+                .header("content-type", "application/json")
+                .body(Body::from(
+                    r#"{"filename":"chunked-alpine.iso","size_bytes":65536}"#,
+                ))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(start.status(), StatusCode::CREATED);
+    let body = axum::body::to_bytes(start.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    let started: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    let upload_id = started["upload_id"].as_str().unwrap();
+
+    let split = 8192usize;
+    let first = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("PUT")
+                .uri(format!("/api/uploads/{upload_id}"))
+                .header("x-openpxe-upload-offset", "0")
+                .body(Body::from(iso[..split].to_vec()))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(first.status(), StatusCode::ACCEPTED);
+    let body = axum::body::to_bytes(first.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    let progress: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert_eq!(progress["offset"].as_u64().unwrap(), split as u64);
+    assert!(!progress["complete"].as_bool().unwrap());
+    assert!(
+        dir.path().join("isos/chunked-alpine.partial").exists(),
+        "chunked upload should leave a visible partial file while in progress"
+    );
+
+    let final_chunk = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("PUT")
+                .uri(format!("/api/uploads/{upload_id}"))
+                .header("x-openpxe-upload-offset", split.to_string())
+                .header("x-openpxe-upload-complete", "true")
+                .body(Body::from(iso[split..].to_vec()))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(final_chunk.status(), StatusCode::CREATED);
+    let body = axum::body::to_bytes(final_chunk.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    let finished: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert!(finished["complete"].as_bool().unwrap());
+    assert_eq!(finished["iso"]["id"], "chunked-alpine");
+    assert!(dir.path().join("isos/chunked-alpine.iso").exists());
+    assert!(!dir.path().join("isos/chunked-alpine.partial").exists());
+}
+
+#[tokio::test]
+async fn chunked_upload_rejects_offset_mismatch_without_advancing() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+
+    let start = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri("/api/uploads")
+                .header("content-type", "application/json")
+                .body(Body::from(
+                    r#"{"filename":"offset-test.iso","size_bytes":16}"#,
+                ))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(start.status(), StatusCode::CREATED);
+    let body = axum::body::to_bytes(start.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    let started: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    let upload_id = started["upload_id"].as_str().unwrap();
+
+    let mismatch = app
+        .oneshot(
+            Request::builder()
+                .method("PUT")
+                .uri(format!("/api/uploads/{upload_id}"))
+                .header("x-openpxe-upload-offset", "8")
+                .body(Body::from(vec![1, 2, 3, 4]))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(mismatch.status(), StatusCode::CONFLICT);
+    let body = axum::body::to_bytes(mismatch.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    let text = String::from_utf8(body.to_vec()).unwrap();
+    assert!(text.contains("expected offset 0"), "got: {text}");
+}
+
+#[tokio::test]
+async fn iso_category_switch_moves_entry_between_menus() {
+    // OS (default): appears in Linux Installers submenu and not in Tools.
+    // After flipping to Tools: gone from Linux, present under Tools.
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+
+    let (ct, body) = multipart_iso_body("fake-alpine.iso", &fake_alpine_iso());
+    let upload = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri("/api/isos")
+                .header("content-type", ct)
+                .body(Body::from(body))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(upload.status(), StatusCode::CREATED);
+
+    let (_, linux_before) = get(&app, "/boot/_linux_menu.ipxe").await;
+    let linux_before = String::from_utf8(linux_before).unwrap();
+    assert!(
+        linux_before.contains("fake-alpine-linux"),
+        "expected entry in Linux submenu (default OS):\n{linux_before}"
+    );
+    let (_, tools_before) = get(&app, "/boot/_tools_menu.ipxe").await;
+    let tools_before = String::from_utf8(tools_before).unwrap();
+    assert!(
+        !tools_before.contains("fake-alpine-linux"),
+        "OS-category ISO shouldn't appear in Tools yet:\n{tools_before}"
+    );
+
+    // Flip to Tools.
+    let (s, _) = put_json(
+        &app,
+        "/api/isos/fake-alpine/category",
+        r#"{"category":"tools"}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::OK);
+
+    let (_, linux_after) = get(&app, "/boot/_linux_menu.ipxe").await;
+    let linux_after = String::from_utf8(linux_after).unwrap();
+    assert!(
+        !linux_after.contains("fake-alpine-linux"),
+        "Tools-category ISO should NOT appear in Linux submenu:\n{linux_after}"
+    );
+    let (_, tools_after) = get(&app, "/boot/_tools_menu.ipxe").await;
+    let tools_after = String::from_utf8(tools_after).unwrap();
+    assert!(
+        tools_after.contains("fake-alpine-linux"),
+        "Tools-category ISO should appear in Tools submenu:\n{tools_after}"
+    );
+}
+
+#[tokio::test]
+async fn iso_category_unknown_value_returns_400() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (ct, body) = multipart_iso_body("fake-alpine.iso", &fake_alpine_iso());
+    app.clone()
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri("/api/isos")
+                .header("content-type", ct)
+                .body(Body::from(body))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+
+    let (s, body) = put_json(
+        &app,
+        "/api/isos/fake-alpine/category",
+        r#"{"category":"gibberish"}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::BAD_REQUEST);
+    let text = std::str::from_utf8(&body).unwrap();
+    assert!(text.contains("unknown category"), "got: {text}");
+}
+
+#[tokio::test]
+async fn iso_category_unknown_id_returns_404() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (s, _) = put_json(
+        &app,
+        "/api/isos/does-not-exist/category",
+        r#"{"category":"tools"}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::NOT_FOUND);
+}
+
+#[tokio::test]
+async fn storage_disk_endpoint_reports_volume_stats() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (s, body) = get(&app, "/api/storage/disk").await;
+    assert_eq!(s, StatusCode::OK);
+    let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    // statvfs always returns something on the tempdir filesystem; check
+    // that the shape is sane (total >= used >= 0 and total >= available).
+    assert!(v["total_bytes"].as_u64().unwrap() > 0, "got {v}");
+    let total = v["total_bytes"].as_u64().unwrap();
+    let avail = v["available_bytes"].as_u64().unwrap();
+    let used = v["used_bytes"].as_u64().unwrap();
+    assert!(total >= avail, "{v}");
+    assert!(total >= used,  "{v}");
+    assert!(v["path"].as_str().unwrap().contains("isos"), "got {v}");
+}
+
+#[tokio::test]
+async fn api_docs_lists_known_endpoints() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (s, body) = get(&app, "/api/docs").await;
+    assert_eq!(s, StatusCode::OK);
+    let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    let groups = v["groups"].as_array().expect("groups array");
+    assert!(!groups.is_empty());
+    // Flatten the paths and confirm a handful of the routes that real
+    // operators will look up are documented.
+    let mut paths: Vec<String> = Vec::new();
+    for g in groups {
+        for ep in g["endpoints"].as_array().unwrap() {
+            paths.push(ep["path"].as_str().unwrap().into());
+        }
+    }
+    for needle in [
+        "/api/isos",
+        "/api/isos/:id/category",
+        "/api/storage/disk",
+        "/api/branding/logo",
+        "/api/boot-log",
+        "/metrics",
+    ] {
+        assert!(
+            paths.iter().any(|p| p == needle),
+            "expected {needle} in docs; got {paths:?}"
+        );
+    }
+}
+
+#[tokio::test]
+async fn branding_clear_when_no_logo_is_no_content() {
+    // No-op clear should still 204 — it's not an error to revert to
+    // the default when there's nothing to revert from.
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let res = app
+        .oneshot(
+            Request::builder()
+                .method("DELETE")
+                .uri("/api/branding/logo")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(res.status(), StatusCode::NO_CONTENT);
+}
+
+#[tokio::test]
+async fn status_exposes_custom_logo_flag() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (s, body) = get(&app, "/api/status").await;
+    assert_eq!(s, StatusCode::OK);
+    let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert_eq!(
+        v["custom_logo"].as_bool(),
+        Some(false),
+        "fresh state has no custom logo: {v}"
+    );
+}
+
+async fn put_json(router: &axum::Router, path: &str, body: &str) -> (StatusCode, Vec<u8>) {
+    let res = router
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("PUT")
+                .uri(path)
+                .header("content-type", "application/json")
+                .body(Body::from(body.to_owned()))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    let status = res.status();
+    let bytes = axum::body::to_bytes(res.into_body(), usize::MAX)
+        .await
+        .unwrap()
+        .to_vec();
+    (status, bytes)
+}
+
+// ─── v0.4.5: Forms auth + SSO ─────────────────────────────────────────────
+
+async fn post_collect(router: &axum::Router, path: &str, body: &str) -> (StatusCode, Vec<u8>, Vec<axum::http::HeaderValue>) {
+    let res = router
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri(path)
+                .header("content-type", "application/json")
+                .body(Body::from(body.to_owned()))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    let status = res.status();
+    let cookies: Vec<_> = res
+        .headers()
+        .get_all(axum::http::header::SET_COOKIE)
+        .iter()
+        .cloned()
+        .collect();
+    let body = axum::body::to_bytes(res.into_body(), usize::MAX)
+        .await
+        .unwrap()
+        .to_vec();
+    (status, body, cookies)
+}
+
+fn session_value(cookies: &[axum::http::HeaderValue]) -> Option<String> {
+    for c in cookies {
+        let s = c.to_str().ok()?;
+        if let Some(rest) = s.strip_prefix("openpxe_session=") {
+            // Until the first ';'
+            let val = rest.split(';').next().unwrap_or("").to_string();
+            return Some(val);
+        }
+    }
+    None
+}
+
+async fn get_with_cookie(router: &axum::Router, path: &str, cookie: &str) -> (StatusCode, Vec<u8>) {
+    let res = router
+        .clone()
+        .oneshot(
+            Request::builder()
+                .uri(path)
+                .header("cookie", format!("openpxe_session={cookie}"))
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    let status = res.status();
+    let body = axum::body::to_bytes(res.into_body(), usize::MAX)
+        .await
+        .unwrap()
+        .to_vec();
+    (status, body)
+}
+
+#[tokio::test]
+async fn me_reports_setup_required_when_no_admin() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (s, body) = get(&app, "/api/me").await;
+    assert_eq!(s, StatusCode::OK);
+    let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert_eq!(v["setup_required"].as_bool(), Some(true));
+    assert_eq!(v["authenticated"].as_bool(), Some(false));
+}
+
+#[tokio::test]
+async fn setup_creates_admin_logs_in_and_blocks_second_call() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    // First-run setup succeeds and returns a session cookie.
+    let (s, body, cookies) = post_collect(
+        &app,
+        "/api/setup",
+        r#"{"username":"admin","password":"hunter2hunter2"}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::CREATED);
+    let token = session_value(&cookies).expect("setup should set cookie");
+    let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert_eq!(v["user"]["username"], "admin");
+
+    // /api/me with that cookie reports authenticated.
+    let (s, body) = get_with_cookie(&app, "/api/me", &token).await;
+    assert_eq!(s, StatusCode::OK);
+    let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert_eq!(v["authenticated"].as_bool(), Some(true));
+    assert_eq!(v["user"]["username"], "admin");
+
+    // /api/setup is now closed.
+    let (s, _, _) = post_collect(
+        &app,
+        "/api/setup",
+        r#"{"username":"second","password":"hunter2hunter2"}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::CONFLICT);
+}
+
+#[tokio::test]
+async fn protected_route_returns_401_after_setup_without_cookie() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    // Set up an admin so the middleware engages.
+    let (s, _, _) = post_collect(
+        &app,
+        "/api/setup",
+        r#"{"username":"admin","password":"hunter2hunter2"}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::CREATED);
+    // No cookie → 401 on a protected route.
+    let (s, _) = get(&app, "/api/isos").await;
+    assert_eq!(s, StatusCode::UNAUTHORIZED);
+    // PXE-essential routes stay reachable.
+    let (s, _) = get(&app, "/boot.ipxe").await;
+    assert_eq!(s, StatusCode::OK);
+    let (s, _) = get(&app, "/healthz").await;
+    assert_eq!(s, StatusCode::OK);
+}
+
+#[tokio::test]
+async fn login_logout_round_trip_uses_session_cookie() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (_, _, _) = post_collect(
+        &app,
+        "/api/setup",
+        r#"{"username":"admin","password":"hunter2hunter2"}"#,
+    )
+    .await;
+
+    // Fresh login (separate from the setup-issued session).
+    let (s, _, cookies) = post_collect(
+        &app,
+        "/api/login",
+        r#"{"username":"admin","password":"hunter2hunter2"}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::OK);
+    let token = session_value(&cookies).expect("login should set cookie");
+
+    // With cookie, /api/isos is reachable.
+    let (s, _) = get_with_cookie(&app, "/api/isos", &token).await;
+    assert_eq!(s, StatusCode::OK);
+
+    // Logout revokes the session; /api/isos goes back to 401.
+    let res = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri("/api/logout")
+                .header("cookie", format!("openpxe_session={token}"))
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(res.status(), StatusCode::NO_CONTENT);
+    let (s, _) = get_with_cookie(&app, "/api/isos", &token).await;
+    assert_eq!(s, StatusCode::UNAUTHORIZED);
+}
+
+#[tokio::test]
+async fn login_rejects_wrong_password_with_401_and_no_cookie() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (_, _, _) = post_collect(
+        &app,
+        "/api/setup",
+        r#"{"username":"admin","password":"hunter2hunter2"}"#,
+    )
+    .await;
+    let (s, body, cookies) = post_collect(
+        &app,
+        "/api/login",
+        r#"{"username":"admin","password":"nope"}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::UNAUTHORIZED);
+    assert!(session_value(&cookies).is_none(), "no cookie on failure");
+    let text = std::str::from_utf8(&body).unwrap();
+    assert!(text.contains("invalid"), "got: {text}");
+}
+
+#[tokio::test]
+async fn update_credentials_requires_current_password_and_rotates_session() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (_, _, cookies) = post_collect(
+        &app,
+        "/api/setup",
+        r#"{"username":"admin","password":"hunter2hunter2"}"#,
+    )
+    .await;
+    let token = session_value(&cookies).unwrap();
+
+    // Wrong current password → 400.
+    let res = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("PUT")
+                .uri("/api/me/credentials")
+                .header("content-type", "application/json")
+                .header("cookie", format!("openpxe_session={token}"))
+                .body(Body::from(
+                    r#"{"current_password":"wrong","new_password":"newpassword1"}"#,
+                ))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(res.status(), StatusCode::BAD_REQUEST);
+
+    // Correct current password rotates + returns a fresh cookie.
+    let res = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("PUT")
+                .uri("/api/me/credentials")
+                .header("content-type", "application/json")
+                .header("cookie", format!("openpxe_session={token}"))
+                .body(Body::from(
+                    r#"{"current_password":"hunter2hunter2","new_username":"alice","new_password":"newpassword1"}"#,
+                ))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(res.status(), StatusCode::OK);
+    let new_cookies: Vec<_> = res
+        .headers()
+        .get_all(axum::http::header::SET_COOKIE)
+        .iter()
+        .cloned()
+        .collect();
+    let new_token = session_value(&new_cookies).expect("rotation issues fresh cookie");
+
+    // Old cookie no longer valid (every session was revoked).
+    let (s, _) = get_with_cookie(&app, "/api/isos", &token).await;
+    assert_eq!(s, StatusCode::UNAUTHORIZED);
+
+    // New cookie works.
+    let (s, _) = get_with_cookie(&app, "/api/isos", &new_token).await;
+    assert_eq!(s, StatusCode::OK);
+
+    // Old creds no longer log in.
+    let (s, _, _) = post_collect(
+        &app,
+        "/api/login",
+        r#"{"username":"admin","password":"hunter2hunter2"}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::UNAUTHORIZED);
+    // New creds do.
+    let (s, _, _) = post_collect(
+        &app,
+        "/api/login",
+        r#"{"username":"alice","password":"newpassword1"}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::OK);
+}
+
+#[tokio::test]
+async fn sso_round_trip_default_then_replace() {
+    // Pre-setup state: middleware is open, so we can hit /api/sso directly.
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+
+    let (s, body) = get(&app, "/api/sso").await;
+    assert_eq!(s, StatusCode::OK);
+    let cfg: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert_eq!(cfg["enabled"].as_bool(), Some(false));
+
+    // Enable with a metadata URL.
+    let (s, _) = put_json(
+        &app,
+        "/api/sso",
+        r#"{"enabled":true,"idp_name":"Okta","metadata":"","metadata_url":"https://idp.example.com/metadata"}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::OK);
+    let (_, body) = get(&app, "/api/sso").await;
+    let cfg: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert_eq!(cfg["enabled"].as_bool(), Some(true));
+    assert_eq!(cfg["idp_name"], "Okta");
+
+    // Enabling without a source is rejected.
+    let (s, body) = put_json(
+        &app,
+        "/api/sso",
+        r#"{"enabled":true,"idp_name":"","metadata":"","metadata_url":""}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::BAD_REQUEST);
+    let text = std::str::from_utf8(&body).unwrap();
+    assert!(text.contains("metadata"), "got: {text}");
+}
+
+#[tokio::test]
+async fn docs_lists_new_v0_4_5_endpoints() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (s, body) = get(&app, "/api/docs").await;
+    assert_eq!(s, StatusCode::OK);
+    let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    let mut paths: Vec<String> = Vec::new();
+    for g in v["groups"].as_array().unwrap() {
+        for ep in g["endpoints"].as_array().unwrap() {
+            paths.push(ep["path"].as_str().unwrap().into());
+        }
+    }
+    // /api/docs predates v0.4.5 but the new surface should be reachable
+    // here too — confirms we don't forget to update it. For now we only
+    // require the *existing* docs entries to keep working.
+    for needle in ["/api/isos", "/api/boot-log", "/api/storage/disk"] {
+        assert!(paths.iter().any(|p| p == needle), "{needle} missing");
+    }
+}

crates/iso-store/src/lib.rs

@@ -28,6 +28,7 @@ pub use introspect::{DistroFamily, IntrospectionReport};
 pub use nfs::{NfsAddRequest, NfsManager, NfsMount, NfsVersion};
 pub use smb::{extract_windows_iso, SmbManager, SmbState};
 pub use store::{
-    generate_boot_entries_for, slugify_str, IsoMeta, IsoSource, IsoStore, UploadHandle,
+    generate_boot_entries_for, slugify_str, IsoCategory, IsoMeta, IsoSource, IsoStore,
+    UploadHandle,
 };
 pub use windows::{WimPatcher, WinPatchState};

crates/iso-store/src/store.rs

@@ -31,6 +31,30 @@ pub enum IsoSource {
     },
 }
 
+/// Where the ISO lands in the PXE menu hierarchy.
+///
+/// Auto-detected family (Debian, Windows, …) still drives BIOS/UEFI
+/// behaviour and per-entry boot args, but the *menu placement* is
+/// operator-controlled — an operator who's uploaded a TinyCore live ISO
+/// to use as a recovery shim, or a SystemRescue image, can flip its
+/// category to `Tools` so it lands next to memtest/shell instead of
+/// under Linux Installers.
+///
+/// Old `meta.json` files without this field deserialize as `Os`, which
+/// matches v0.4.1 behaviour (everything goes under OS Installers).
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum IsoCategory {
+    /// "OS Installer" — routed via the auto-detected family into the
+    /// Linux / Windows installer submenus.
+    #[default]
+    Os,
+    /// "Tool" — surfaced under the Tools menu next to memtest, shell,
+    /// NIC info, etc. Family detection still decides BIOS/UEFI vs
+    /// wimboot vs sanboot at boot time.
+    Tools,
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct IsoMeta {
     /// Stable slug used in URLs (derived from the uploaded filename).
@@ -56,6 +80,10 @@ pub struct IsoMeta {
     /// the common no-password case.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub password_hash: Option<String>,
+    /// Where the ISO sits in the PXE menu hierarchy — operator-controlled,
+    /// not driven by family detection. Defaults to [`IsoCategory::Os`].
+    #[serde(default)]
+    pub category: IsoCategory,
 }
 
 impl IsoMeta {
@@ -114,6 +142,7 @@ impl UploadHandle {
             boot_entries,
             source: IsoSource::Local,
             password_hash: None,
+            category: IsoCategory::default(),
         };
         store.persist_meta(&meta).await?;
         store.insert(meta.clone());
@@ -216,6 +245,9 @@ impl IsoStore {
             return Err(Error::Invalid(format!("iso '{id}' already exists")));
         }
         let partial_path = self.iso_dir.join(format!("{id}.partial"));
+        if partial_path.exists() {
+            return Err(Error::Invalid(format!("iso '{id}' is already uploading")));
+        }
         let file = tokio::fs::File::create(&partial_path).await?;
         Ok(UploadHandle {
             id,
@@ -315,6 +347,7 @@ impl IsoStore {
             boot_entries,
             source,
             password_hash: None,
+            category: IsoCategory::default(),
         };
         self.inner.write().isos.insert(id, meta);
     }
@@ -374,6 +407,47 @@ impl IsoStore {
         Ok(())
     }
 
+    /// Flip an ISO's menu category. Persists to `meta.json` for local
+    /// ISOs; NFS-sourced ISOs keep the change in memory only (the next
+    /// re-scan would overwrite it anyway).
+    pub async fn set_category(&self, id: &str, category: IsoCategory) -> Result<IsoMeta> {
+        let updated = {
+            let mut g = self.inner.write();
+            let m = g
+                .isos
+                .get_mut(id)
+                .ok_or_else(|| Error::Invalid(format!("no such iso '{id}'")))?;
+            m.category = category;
+            m.clone()
+        };
+        if matches!(updated.source, IsoSource::Local) {
+            self.persist_meta(&updated).await?;
+        }
+        Ok(updated)
+    }
+
+    /// Absolute path to the directory holding local ISO uploads. Used
+    /// by the HTTP layer for the disk-space endpoint — the volume that
+    /// hosts this directory is what runs out of room first.
+    #[must_use]
+    pub fn iso_dir(&self) -> PathBuf {
+        self.iso_dir.as_path().to_path_buf()
+    }
+
+    /// `(total_bytes, available_bytes)` for the filesystem hosting the
+    /// ISO directory. Returns `None` if `statvfs` fails (read-only
+    /// filesystem with no quota, mount disappeared, …) — callers
+    /// should treat that as "unknown" rather than zero.
+    ///
+    /// Lives here rather than the HTTP crate because `http-api`'s
+    /// `#![forbid(unsafe_code)]` rules out the libc FFI directly, and
+    /// because this is naturally an `IsoStore` question — the volume
+    /// of interest is whatever's hosting the iso dir.
+    #[must_use]
+    pub fn disk_usage(&self) -> Option<(u64, u64)> {
+        disk_usage_for(self.iso_dir.as_path())
+    }
+
     /// Verify a candidate password against the stored bcrypt hash.
     /// Returns:
     /// - `Ok(true)`   — match (or the ISO has no password set; boot is open)
@@ -390,6 +464,33 @@ impl IsoStore {
     }
 }
 
+/// Resolve `(total, available)` bytes for the filesystem hosting `path`.
+/// Returns `None` if `statvfs` fails.
+#[allow(unsafe_code)]
+fn disk_usage_for(path: &std::path::Path) -> Option<(u64, u64)> {
+    use std::ffi::CString;
+    use std::os::unix::ffi::OsStrExt;
+    let c = CString::new(path.as_os_str().as_bytes()).ok()?;
+    // SAFETY: `statvfs` is repr(C); a zeroed value is a valid initial
+    // state per POSIX. The FFI call writes every field we then read.
+    let mut stat: libc::statvfs = unsafe { std::mem::zeroed() };
+    // SAFETY: `c` is a NUL-terminated C string pointing into a stack
+    // CString that outlives this call; `&mut stat` is a unique aligned
+    // pointer to a stack-local `statvfs`. The kernel writes through
+    // it but does not retain the pointer past return.
+    let rc = unsafe { libc::statvfs(c.as_ptr(), &raw mut stat) };
+    if rc != 0 {
+        return None;
+    }
+    // Use f_frsize (fundamental block size). f_bsize is "preferred I/O
+    // block" and doesn't always match the unit f_blocks is denominated
+    // in — on some BSDs it would over-report by a factor of 8.
+    let frsize = stat.f_frsize as u64;
+    let total = stat.f_blocks as u64 * frsize;
+    let avail = stat.f_bavail as u64 * frsize;
+    Some((total, avail))
+}
+
 fn slugify(filename: &str) -> String {
     let stem = Path::new(filename)
         .file_stem()
@@ -495,8 +596,17 @@ fn linux_cmdline(family: DistroFamily, id: &str) -> String {
     // The HTTP layer resolves `${base-url}` at render time.
     let iso_url = format!("${{base-url}}/iso/{id}.iso");
     match family {
+        // VMware-UEFI fix (v0.4.5, matching Bootimus v0.1.67's Casper
+        // patch): drop `netboot=url url=… ---` in favour of the
+        // canonical Casper option `iso-url=` and add `ds=nocloud` so
+        // cloud-init / subiquity (live-server) doesn't stall waiting on
+        // a metadata datasource that doesn't exist in PXE. Without
+        // `ds=nocloud`, Ubuntu live-server / Mint / Pop!_OS / elementary
+        // ISOs would boot fine on bare-metal UEFI but hang at "cloud-init
+        // running" on VMware-UEFI guests because the vmxnet3 driver's
+        // late-init upsets cloud-init's network probe.
         DistroFamily::DebianUbuntu => format!(
-            "boot=casper netboot=url url={iso_url} ip=dhcp ---"
+            "boot=casper initrd=initrd ds=nocloud ip=dhcp iso-url={iso_url}"
         ),
         DistroFamily::RhelFedora => format!(
             "inst.repo={iso_url} inst.stage2={iso_url} ip=dhcp"
@@ -531,6 +641,23 @@ mod tests {
         assert_eq!(slugify("/etc/passwd"), "passwd");
     }
 
+    #[test]
+    fn casper_cmdline_vmware_uefi_safe() {
+        // v0.4.5 regression guard: the Debian/Ubuntu cmdline must use
+        // the canonical Casper `iso-url=` option and include
+        // `ds=nocloud` so VMware-UEFI guests don't hang at "cloud-init
+        // running" waiting on a metadata datasource that PXE can't
+        // provide. The legacy `netboot=url url=… ---` form is gone for
+        // good.
+        let s = linux_cmdline(DistroFamily::DebianUbuntu, "ubuntu-24-04");
+        assert!(s.contains("boot=casper"), "{s}");
+        assert!(s.contains("iso-url=${base-url}/iso/ubuntu-24-04.iso"), "{s}");
+        assert!(s.contains("ds=nocloud"), "{s}");
+        assert!(s.contains("ip=dhcp"), "{s}");
+        assert!(!s.contains("netboot=url"), "legacy option leaked: {s}");
+        assert!(!s.contains(" --- "), "stray ---: {s}");
+    }
+
     fn fake_meta(id: &str) -> IsoMeta {
         IsoMeta {
             id: id.into(),
@@ -548,6 +675,7 @@ mod tests {
             boot_entries: vec![],
             source: IsoSource::Local,
             password_hash: None,
+            category: IsoCategory::default(),
         }
     }
 
@@ -594,6 +722,19 @@ mod tests {
         assert!(matches!(r, Err(Error::Invalid(_))));
     }
 
+    #[tokio::test]
+    async fn begin_upload_rejects_existing_partial_file() {
+        let dir = tempdir().unwrap();
+        let store = IsoStore::new(dir.path().to_path_buf());
+        store.ensure_dirs().await.unwrap();
+        tokio::fs::write(dir.path().join("ubuntu.partial"), b"in-flight")
+            .await
+            .unwrap();
+
+        let r = store.begin_upload("ubuntu.iso").await;
+        assert!(matches!(r, Err(Error::Invalid(_))));
+    }
+
     #[tokio::test]
     async fn password_persists_via_meta_json_for_local_isos() {
         // Hash makes it onto disk so it survives a restart.

crates/openpxe/src/main.rs

@@ -39,7 +39,7 @@ enum Command {
     ///   docker run --rm \
     ///     -v /my/isos:/seed:ro \
     ///     -v openpxe-data:/var/lib/openpxe/isos \
-    ///     openpxe:0.3.2 seed --from /seed
+    ///     openpxe:0.4.1 seed --from /seed
     Seed {
         /// Source directory containing one or more `.iso` files.
         #[arg(long)]
@@ -103,6 +103,11 @@ async fn main() -> anyhow::Result<()> {
     let queue = DeploymentQueue::new();
     let settings = SettingsStore::load_or_default(&config.paths.work_dir);
     let hosts = HostBindings::load_or_default(&config.paths.work_dir);
+    let boot_log = openpxe_core::BootLog::load_or_default(&config.paths.work_dir);
+    let branding = openpxe_core::BrandingStore::load_or_default(&config.paths.work_dir);
+    let admin = openpxe_core::AdminStore::load_or_default(&config.paths.work_dir);
+    let sso = openpxe_core::SsoStore::load_or_default(&config.paths.work_dir);
+    let sessions = openpxe_http_api::auth::SessionStore::default();
     let metrics = Metrics::new();
 
     // Build the SMB manager unconditionally — it starts/stops on the
@@ -140,9 +145,15 @@ async fn main() -> anyhow::Result<()> {
         settings: settings.clone(),
         queue: queue.clone(),
         hosts: hosts.clone(),
+        boot_log: boot_log.clone(),
+        branding: branding.clone(),
+        admin: admin.clone(),
+        sessions: sessions.clone(),
+        sso: sso.clone(),
         metrics: metrics.clone(),
         smb: Some(smb.clone()),
         nfs: nfs.clone(),
+        uploads: openpxe_http_api::uploads::UploadSessions::default(),
         log_bus: log_bus.clone(),
         started_at: time::OffsetDateTime::now_utc(),
         public_base_url: public_base_url.clone(),
@@ -156,7 +167,15 @@ async fn main() -> anyhow::Result<()> {
     let http_task = tokio::spawn(async move {
         let listener = tokio::net::TcpListener::bind(http_addr).await?;
         tracing::info!(target: "openpxe::http", "HTTP listening on {http_addr}");
-        axum::serve(listener, router).await?;
+        // `into_make_service_with_connect_info` is required so per-request
+        // `ConnectInfo<SocketAddr>` extractors can resolve the peer IP —
+        // used by `/boot/<entry>.ipxe` to record the booting client's
+        // address into the Host log. Without this the extractor 500s.
+        axum::serve(
+            listener,
+            router.into_make_service_with_connect_info::<std::net::SocketAddr>(),
+        )
+        .await?;
         Ok::<_, anyhow::Error>(())
     });
 

crates/webui/src/app.css

@@ -8,23 +8,26 @@
  * CSS lands). */
 
 :root {
-  /* Dark palette (default). */
+  /* Jet-black dark palette (default). Modelled on Netbox Labs's
-  --bg:           #0b1018;
+     near-black product chrome, with surfaces stepping subtly upward
-  --bg-panel:    #121826;
+     rather than the previous blue-tinted ramp, so the UI reads as a
-  --bg-panel-2:  #1a2334;
+     genuine "dark" rather than "dim navy". */
-  --bg-elev:     #223047;
+  --bg:           #030303;
-  --fg:           #e4e8ef;
+  --bg-panel:    #0a0a0a;
-  --fg-dim:      #8a94a7;
+  --bg-panel-2:  #141414;
-  --fg-dimmer:   #5a6379;
+  --bg-elev:     #1c1c1c;
-  --accent:       #00d4b4;   /* Netbox-ish teal */
+  --fg:           #e8eaed;
+  --fg-dim:      #9aa0a6;
+  --fg-dimmer:   #6b7077;
+  --accent:       #00d4b4;   /* Netbox-ish teal — kept for brand */
   --accent-dim:  #07a38c;
   --warn:         #ffb347;
   --err:          #ef6e6e;
   --ok:           #4ade80;
-  --border:       #223047;
+  --border:       #1f1f1f;
-  --border-soft: #172033;
+  --border-soft: #141414;
-  --terminal-bg: #06090e;
+  --terminal-bg: #050505;
-  --shadow-card: 0 1px 0 rgba(255,255,255,0.02), 0 8px 24px rgba(0,0,0,0.25);
+  --shadow-card: 0 1px 0 rgba(255,255,255,0.02), 0 8px 24px rgba(0,0,0,0.55);
   --radius:      6px;
   --radius-lg:  10px;
   --sidebar-w:  240px;
@@ -38,7 +41,7 @@
      consistency. Designed against Netbox Labs's reference screenshot:
      near-white surfaces, soft grey dividers, dark text. */
   --bg:           #f6f8fb;
-  --bg-panel:    #ffffff;
+  --bg-panel:    #fbfcfe;
   --bg-panel-2:  #f0f3f8;
   --bg-elev:     #e6ebf2;
   --fg:           #1c2330;
@@ -51,7 +54,11 @@
   --ok:           #1f9b54;
   --border:       #d8dde6;
   --border-soft: #e7eaf0;
-  --terminal-bg: #0d1219; /* terminal stays dark even in light mode */
+  /* Light-mode terminal: the pane background and chrome track the rest
+     of the light theme. Per-level text colours below recolour-on-light
+     so log lines stay readable on a pale background — previously the
+     terminal was locked to dark and looked like a stuck panel. */
+  --terminal-bg: #ffffff;
   --shadow-card: 0 1px 0 rgba(0,0,0,0.02), 0 6px 18px rgba(20,28,52,0.06);
 }
 
@@ -84,14 +91,23 @@ code, kbd { font-family: var(--mono); font-size: 12.5px;
   border-right: 1px solid var(--border);
   display: flex; flex-direction: column;
 }
+/* The brand block sits flush with the topbar so the sidebar+topbar reads
+   as one continuous bar across the top of the app, rather than a chunky
+   2-line logo block plus a separate (smaller-typeface) page title. The
+   height/border-bottom match the topbar exactly so the divider runs
+   straight across without a step. */
 .sidebar .brand {
   display: flex; align-items: center; gap: 12px;
-  padding: 14px 18px;
+  padding: 0 18px;
+  height: var(--topbar-h);
   border-bottom: 1px solid var(--border);
 }
-.sidebar .brand img { width: 40px; height: auto; }
+.sidebar .brand img { width: 26px; height: 26px; flex: none; }
-.sidebar .brand strong { font-size: 16px; letter-spacing: 0.4px; }
+.sidebar .brand strong {
-.sidebar .brand .sub { color: var(--fg-dim); font-size: 11px; }
+  font-size: 15px; font-weight: 600;
+  letter-spacing: 0.2px;
+  color: var(--fg);
+}
 .sidebar nav { padding: 10px 0; flex: 1; overflow-y: auto; }
 .sidebar nav a {
   display: flex; align-items: center; gap: 10px;
@@ -113,10 +129,40 @@ code, kbd { font-family: var(--mono); font-size: 12.5px;
 }
 .sidebar nav a.active .count { background: var(--accent); color: #002923; }
 .sidebar .footer {
-  padding: 10px 18px; border-top: 1px solid var(--border);
+  padding: 12px 18px; border-top: 1px solid var(--border);
   color: var(--fg-dimmer); font-size: 11px;
+  display: flex; flex-direction: column; gap: 4px;
+}
+.sidebar .footer code { background: transparent; color: var(--fg-dim); padding: 0;
+  font-size: 11px; word-break: break-all; }
+.sidebar .footer .status-row {
+  display: flex; align-items: center; gap: 8px;
+  margin-bottom: 4px;
+}
+.sidebar .footer .status-row .dot {
+  width: 8px; height: 8px; border-radius: 50%; display: inline-block;
+  background: var(--fg-dimmer); flex: none;
+}
+.sidebar .footer .status-row .dot.ok   { background: var(--ok);
+  box-shadow: 0 0 6px color-mix(in srgb, var(--ok) 60%, transparent); }
+.sidebar .footer .status-row .dot.err  { background: var(--err); }
+.sidebar .footer .status-row .dot.warn { background: var(--warn); }
+.sidebar .footer .status-label { color: var(--fg-dim); }
+.sidebar .footer .status-value { color: var(--fg); font-weight: 600; }
+.sidebar .footer .status-value.ok   { color: var(--ok); }
+.sidebar .footer .status-value.err  { color: var(--err); }
+.sidebar .footer .status-value.warn { color: var(--warn); }
+.sidebar .footer .footer-sub { color: var(--fg-dimmer); margin-top: 2px; }
+/* Persistent backend identity. Sits below the advertised URL so even
+   when an operator has uploaded their own logo, "what is this" stays
+   answerable from the bottom-left of every page. */
+.sidebar .footer .footer-version {
+  margin-top: 8px; padding-top: 8px;
+  border-top: 1px dashed var(--border-soft);
+  color: var(--fg-dim);
+  font-variant-numeric: tabular-nums;
+  letter-spacing: 0.2px;
 }
-.sidebar .footer code { background: transparent; color: var(--fg-dim); padding: 0; }
 
 /* ── Top bar ───────────────────────────────────────────────────────── */
 
@@ -230,7 +276,7 @@ button, .btn {
   cursor: pointer;
   transition: background 0.12s ease;
 }
-button:hover, .btn:hover { background: var(--accent-dim); color: #fff; }
+button:hover, .btn:hover { background: var(--accent-dim); color: #f4fffd; }
 button.ghost { background: transparent; color: var(--fg); border: 1px solid var(--border); }
 button.ghost:hover { background: var(--bg-panel-2); color: var(--fg); }
 button.danger { background: transparent; color: var(--err); border: 1px solid color-mix(in srgb, var(--err) 35%, transparent); }
@@ -413,52 +459,204 @@ tr.unbootable td:first-child { border-left: 3px solid var(--warn); }
   min-height: 480px;
   box-shadow: var(--shadow-card);
 }
+/* Terminal pane colours follow the active theme. Hard-coded hexes
+   (#050505, #181818, #cfd6e2 etc.) were leaving the light-mode pane
+   looking dark; we keep palette-aware vars instead so the toggle works. */
 .terminal .pane {
   flex: 1; overflow: auto;
   padding: 10px 14px;
   font-family: var(--mono); font-size: 12.5px; line-height: 1.5;
-  color: #cfd6e2;
+  color: var(--fg);
   white-space: pre-wrap; word-break: break-word;
 }
 .terminal .pane .lvl-error { color: var(--err); }
 .terminal .pane .lvl-warn  { color: var(--warn); }
-.terminal .pane .lvl-info  { color: #cfd6e2; }
+.terminal .pane .lvl-info  { color: var(--fg); }
-.terminal .pane .lvl-debug { color: #8b94a8; }
+.terminal .pane .lvl-debug { color: var(--fg-dim); }
-.terminal .pane .lvl-trace { color: #5a6379; }
+.terminal .pane .lvl-trace { color: var(--fg-dimmer); }
-.terminal .pane .ts        { color: #5a6379; }
+.terminal .pane .ts        { color: var(--fg-dimmer); }
-.terminal .pane .tg        { color: #7cd3ff; }
+.terminal .pane .tg        { color: var(--accent); }
 .terminal .pane .echo      { color: var(--accent); }
 .terminal .input-row {
   display: flex; align-items: center; gap: 8px;
   padding: 8px 14px;
-  background: #0a0e15;
+  background: var(--bg-panel-2);
-  border-top: 1px solid #1d2330;
+  border-top: 1px solid var(--border);
 }
 .terminal .input-row .prompt { color: var(--accent); font-family: var(--mono); }
 .terminal .input-row input {
-  flex: 1; background: transparent; border: 0; color: #e4e8ef;
+  flex: 1; background: transparent; border: 0; color: var(--fg);
   font: inherit; font-family: var(--mono); font-size: 13px;
   outline: none; padding: 4px 0;
 }
 .terminal .toolbar {
   display: flex; gap: 8px; align-items: center;
   padding: 8px 14px;
-  background: #0a0e15;
+  background: var(--bg-panel-2);
-  border-bottom: 1px solid #1d2330;
+  border-bottom: 1px solid var(--border);
-  font-size: 12px; color: #8a94a7;
+  font-size: 12px; color: var(--fg-dim);
 }
 .terminal .toolbar .right { margin-left: auto; display: flex; gap: 6px; }
 .terminal .toolbar button {
   padding: 3px 9px; font-size: 11px;
-  background: transparent; color: #8a94a7; border: 1px solid #1d2330;
+  background: transparent; color: var(--fg-dim); border: 1px solid var(--border);
   font-weight: 500;
 }
-.terminal .toolbar button:hover { color: #e4e8ef; background: #1d2330; }
+.terminal .toolbar button:hover { color: var(--fg); background: var(--bg-elev); }
+
+/* ── Auth screen (first-run setup + login) ───────────────────────
+   Used when /api/me reports setup_required or !authenticated. The
+   regular .shell is hidden; this overlay takes the full viewport so
+   the operator never sees half-loaded dashboard chrome while the auth
+   state is unknown. Same palette as the rest of the UI — borrows the
+   Sonarr/Radarr layout (centered narrow card on the page background).
+*/
+.auth-screen {
+  position: fixed; inset: 0;
+  display: flex; align-items: center; justify-content: center;
+  background: var(--bg);
+  padding: 24px;
+  z-index: 100;
+}
+.auth-card {
+  width: 100%; max-width: 380px;
+  background: var(--bg-panel);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-lg);
+  box-shadow: var(--shadow-card);
+  padding: 28px 28px 22px;
+}
+.auth-card .brand-row {
+  display: flex; align-items: center; gap: 12px;
+  margin-bottom: 18px;
+}
+.auth-card .brand-row img { width: 32px; height: 32px; flex: none; }
+.auth-card .brand-row .name { font-size: 17px; font-weight: 600; letter-spacing: 0.2px; color: var(--fg); }
+.auth-card h2 {
+  margin: 0 0 6px; font-size: 16px; font-weight: 600; color: var(--fg);
+}
+.auth-card .lede {
+  color: var(--fg-dim); font-size: 13px; margin: 0 0 18px;
+  line-height: 1.5;
+}
+.auth-card .field { margin-bottom: 12px; }
+.auth-card input[type="text"],
+.auth-card input[type="password"] {
+  width: 100%; background: var(--bg); color: var(--fg);
+  border: 1px solid var(--border); border-radius: var(--radius);
+  padding: 9px 11px; font: inherit; font-size: 13.5px;
+}
+.auth-card input:focus { outline: none; border-color: var(--accent); }
+.auth-card .submit { width: 100%; padding: 9px 12px; margin-top: 6px; }
+.auth-card .auth-err {
+  margin-top: 12px; color: var(--err); font-size: 12.5px;
+}
+.auth-card .auth-foot {
+  margin-top: 14px; padding-top: 12px;
+  border-top: 1px solid var(--border-soft);
+  color: var(--fg-dimmer); font-size: 11.5px; text-align: center;
+}
+.auth-card .sso-btn {
+  width: 100%; margin-top: 10px;
+  background: transparent; color: var(--fg);
+  border: 1px solid var(--border);
+  padding: 9px 12px;
+}
+.auth-card .sso-btn:hover {
+  background: var(--bg-panel-2); border-color: var(--accent); color: var(--fg);
+}
+.auth-card .sso-btn .meta { color: var(--fg-dim); font-size: 11px; margin-top: 2px; }
+
+/* ── Logout chip (sidebar footer) ────────────────────────────── */
+.sidebar .footer .logout-row {
+  margin-top: 8px; display: flex; align-items: center; justify-content: space-between;
+  gap: 8px;
+}
+.sidebar .footer .logout-row .who {
+  color: var(--fg); font-weight: 600; font-size: 11.5px;
+  overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
+}
+.sidebar .footer .logout-btn {
+  background: transparent; color: var(--fg-dim);
+  border: 1px solid var(--border); border-radius: var(--radius);
+  padding: 2px 8px; font: inherit; font-size: 11px; font-weight: 500;
+  cursor: pointer;
+}
+.sidebar .footer .logout-btn:hover { color: var(--fg); background: var(--bg-panel-2); border-color: var(--accent); }
 
 /* ── About card ─────────────────────────────────────────────────── */
 .about-hero { padding: 20px 24px; }
 .about-hero h2 { font-size: 22px; margin: 0 0 8px; color: var(--fg); }
-.about-hero .lead { color: var(--fg-dim); font-size: 14px; max-width: 60ch; }
+/* Span the full main column rather than capping at 60ch — the page is
+   read at typical desktop widths and the cap was leaving the right two
+   thirds of the panel awkwardly empty. */
+.about-hero .lead { color: var(--fg-dim); font-size: 14px; max-width: none; }
 .about-hero .who { margin-top: 18px; font-size: 13px; }
 .about-hero .who span { color: var(--fg-dim); }
 .about-hero .who strong { color: var(--accent); }
+.about-hero a { color: var(--accent); }
+
+/* ── API reference (Settings → bottom) ─────────────────────────── */
+.api-ref { display: grid; gap: 18px; padding: 16px; }
+.api-ref .group h3 {
+  margin: 0 0 8px; font-size: 13px; color: var(--fg-dim);
+  text-transform: uppercase; letter-spacing: 0.8px;
+}
+.api-ref .ep {
+  display: grid; grid-template-columns: 64px minmax(200px, 1fr) 2fr;
+  gap: 12px; align-items: baseline;
+  padding: 6px 0; border-top: 1px solid var(--border-soft);
+  font-size: 13px;
+}
+.api-ref .ep:first-child { border-top: 0; }
+.api-ref .ep .method {
+  font-family: var(--mono); font-weight: 600; font-size: 11px;
+  padding: 2px 6px; border-radius: 4px;
+  text-align: center; letter-spacing: 0.6px;
+}
+.api-ref .ep .method.get    { background: color-mix(in srgb, var(--ok) 22%, transparent);     color: var(--ok); }
+.api-ref .ep .method.post   { background: color-mix(in srgb, var(--accent) 22%, transparent); color: var(--accent); }
+.api-ref .ep .method.put    { background: color-mix(in srgb, var(--warn) 22%, transparent);   color: var(--warn); }
+.api-ref .ep .method.delete { background: color-mix(in srgb, var(--err) 22%, transparent);    color: var(--err); }
+.api-ref .ep .path { font-family: var(--mono); color: var(--fg); word-break: break-all; }
+.api-ref .ep .desc { color: var(--fg-dim); }
+@media (max-width: 900px) {
+  .api-ref .ep { grid-template-columns: 1fr; gap: 4px; }
+  .api-ref .ep .method { justify-self: start; }
+}
+
+/* ── Disk space card ───────────────────────────────────────────── */
+.diskbar {
+  height: 10px; border-radius: 5px;
+  background: var(--bg-elev);
+  overflow: hidden; margin-top: 8px;
+}
+.diskbar .fill {
+  height: 100%;
+  background: linear-gradient(90deg, var(--accent-dim), var(--accent));
+  transition: width 0.4s ease;
+}
+.diskbar.warn .fill { background: var(--warn); }
+.diskbar.full .fill { background: var(--err); }
+.disk-meta { display: flex; gap: 14px; font-size: 12px; color: var(--fg-dim); margin-top: 8px; flex-wrap: wrap; }
+.disk-meta strong { color: var(--fg); font-weight: 600; font-variant-numeric: tabular-nums; }
+
+/* ── Logo upload (Settings) ────────────────────────────────────── */
+.logo-preview {
+  display: flex; align-items: center; gap: 14px;
+  padding: 12px;
+  background: var(--bg-panel-2);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+}
+.logo-preview .swatch {
+  width: 56px; height: 56px;
+  display: flex; align-items: center; justify-content: center;
+  background: var(--bg); border: 1px solid var(--border);
+  border-radius: var(--radius);
+  flex: none;
+}
+.logo-preview .swatch img { max-width: 48px; max-height: 48px; }
+.logo-preview .info { flex: 1; min-width: 0; }
+.logo-preview .info .name { color: var(--fg); font-weight: 600; }
+.logo-preview .info .meta { color: var(--fg-dim); font-size: 12px; margin-top: 2px; }

crates/webui/src/app.js

@@ -63,16 +63,37 @@
   };
 
   // ── network helpers ──────────────────────────────────────────────
+  // All three helpers funnel through a 401 detector. When the server
+  // says "auth required" mid-session — most commonly because the
+  // operator's session expired while the tab was idle — we transparently
+  // swap the SPA out for the login screen rather than letting the UI
+  // throw a generic error.
+  function maybeAuthBounce(r) {
+    if (r && r.status === 401) {
+      // Render the login screen without reloading; any in-flight
+      // promises still return their values to the original caller.
+      showAuthScreen('login');
+    }
+    return r;
+  }
   async function getJSON(url) {
-    const r = await fetch(url);
+    const r = maybeAuthBounce(await fetch(url));
     if (!r.ok) throw new Error(url + ': ' + r.status);
     return r.json();
   }
   async function putJSON(url, body) {
-    return fetch(url, {method:'PUT', headers:{'Content-Type':'application/json'}, body: JSON.stringify(body)});
+    return maybeAuthBounce(await fetch(url, {
+      method:'PUT',
+      headers:{'Content-Type':'application/json'},
+      body: JSON.stringify(body),
+    }));
   }
   async function postJSON(url, body) {
-    return fetch(url, {method:'POST', headers:{'Content-Type':'application/json'}, body: JSON.stringify(body)});
+    return maybeAuthBounce(await fetch(url, {
+      method:'POST',
+      headers:{'Content-Type':'application/json'},
+      body: JSON.stringify(body),
+    }));
   }
 
   // Animated brand-mark + progress bar widget. Built once here and inlined
@@ -295,7 +316,7 @@
 
       return el('div', {class:'grid'}, [
         el('div', {class:'card'}, [
-          el('header', {}, el('h2', {}, 'Forge')),
+          el('header', {}, el('h2', {}, 'Status')),
           queueProgressWidget(imaging, entries.length),
         ]),
         el('div', {class:'card'}, [
@@ -321,8 +342,11 @@
     },
 
     storage: async () => {
-      const [isos, settings, nfsRes] = await Promise.all([
+      const [isos, settings, nfsRes, disk] = await Promise.all([
         getJSON('/api/isos'), getJSON('/api/settings'), getJSON('/api/nfs'),
+        getJSON('/api/storage/disk').catch(() => ({
+          total_bytes: 0, available_bytes: 0, used_bytes: 0, path: '?',
+        })),
       ]);
       const mounts = nfsRes.mounts || [];
 
@@ -346,29 +370,84 @@
       });
       file.onchange = () => { if (file.files[0]) upload(file.files[0]); };
 
-      function upload(f) {
+      // Chunked upload telemetry. The old browser path posted one huge
-        upMsg.textContent = 'Uploading ' + f.name + ' (' + fmtBytes(f.size) + ')…';
+      // multipart body, which left operators staring at 0% when a reverse
-        upMsg.className = 'msg';
+      // proxy buffered or rejected the request before OpenPXE saw it. This
+      // path writes small raw chunks; each acknowledged chunk advances the
+      // bar and leaves a visible .partial file in the ISO directory.
+      async function upload(f) {
+        const started = Date.now();
+        const bar = $('#bar');
+        const setStatus = (text, cls) => { upMsg.textContent = text; upMsg.className = 'msg ' + (cls || ''); };
+        const update = (loaded, total, phase) => {
+          const pct = total > 0 ? Math.min(100, (loaded / total) * 100) : 100;
+          bar.style.width = pct.toFixed(1) + '%';
+          const elapsed = Math.max(0.001, (Date.now() - started) / 1000);
+          const rate = loaded > 0 ? loaded / elapsed : 0;
+          const remain = rate > 0 ? (total - loaded) / rate : 0;
+          setStatus(
+            phase + ' ' + f.name + ' - ' +
+            fmtBytes(loaded) + ' of ' + fmtBytes(total) +
+            ' (' + pct.toFixed(1) + '%, ' + fmtBytes(rate) + '/s' +
+            (remain > 0 ? ', ' + Math.ceil(remain) + 's left' : '') + ')');
+        };
+        const failText = async (r) => {
+          const text = (await r.text()).slice(0, 240);
+          let hint = '';
+          if (r.status === 413)      hint = ' - body too large. A proxy likely rejected this chunk.';
+          else if (r.status === 502) hint = ' - bad gateway. Proxy lost the upstream mid-stream.';
+          else if (r.status === 504) hint = ' - gateway timeout. Try the LAN IP directly.';
+          else if (r.status === 409) hint = ' - name conflict or offset mismatch. Remove the old ISO and retry.';
+          return 'HTTP ' + r.status + ' ' + text + hint;
+        };
+
+        let uploadId = null;
+        setStatus('Preparing upload for ' + f.name + ' (' + fmtBytes(f.size) + ')');
         prog.classList.add('active');
-        const fd = new FormData(); fd.append('file', f);
+        bar.style.width = '1%';
-        const xhr = new XMLHttpRequest();
+
-        xhr.upload.onprogress = e => {
+        try {
-          if (e.lengthComputable) $('#bar').style.width = (e.loaded/e.total*100).toFixed(1) + '%';
+          const begin = await postJSON('/api/uploads', {
-        };
+            filename: f.name,
-        xhr.onload = () => {
+            size_bytes: f.size,
-          prog.classList.remove('active');
+          });
-          $('#bar').style.width = '0';
+          if (!begin.ok) throw new Error(await failText(begin));
-          if (xhr.status >= 200 && xhr.status < 300) {
+          const session = await begin.json();
-            upMsg.textContent = 'Uploaded & analyzed.'; upMsg.className = 'msg ok';
+          uploadId = session.upload_id;
-            render('storage');
+          const chunkSize = Math.max(1024 * 1024, Number(session.chunk_size || 8 * 1024 * 1024));
-          } else {
+
-            upMsg.textContent = 'Upload failed: ' + xhr.status + ' ' + xhr.responseText;
+          let offset = Number(session.offset || 0);
-            upMsg.className = 'msg err';
+          let finished = null;
+          do {
+            const end = Math.min(offset + chunkSize, f.size);
+            const complete = end >= f.size;
+            const r = await fetch('/api/uploads/' + encodeURIComponent(uploadId), {
+              method: 'PUT',
+              headers: {
+                'x-openpxe-upload-offset': String(offset),
+                'x-openpxe-upload-complete': complete ? 'true' : 'false',
+              },
+              body: f.slice(offset, end),
+            });
+            if (!r.ok) throw new Error(await failText(r));
+            const j = await r.json();
+            offset = Number(j.offset || end);
+            update(offset, f.size, complete ? 'Analyzing' : 'Uploading');
+            if (j.complete) finished = j.iso || true;
+          } while (!finished);
+
+          setStatus('Uploaded and analyzed: ' + f.name + ' (' + fmtBytes(f.size) + ')', 'ok');
+          render('storage');
+        } catch (err) {
+          if (uploadId) {
+            try { await fetch('/api/uploads/' + encodeURIComponent(uploadId), {method: 'DELETE'}); }
+            catch {}
           }
-        };
+          setStatus('Upload failed: ' + (err && err.message ? err.message : String(err)), 'err');
-        xhr.onerror = () => { upMsg.textContent = 'Network error.'; upMsg.className = 'msg err'; };
+        } finally {
-        xhr.open('POST', '/api/isos');
+          prog.classList.remove('active');
-        xhr.send(fd);
+          if (!upMsg.className.includes('ok')) bar.style.width = '0';
+        }
       }
 
       // ── ISO table (mixed local + NFS) ──
@@ -456,6 +535,30 @@
         const editorRow = el('tr', {style:'display:none'}, editorCells);
         refreshFieldVisibility();
 
+        // Type cell becomes an OS/Tools <select>. Default is OS (everything
+        // routes through the family-detected installer submenu); switching
+        // to Tools moves the ISO into the Tools submenu next to memtest.
+        // The detected family stays visible as a small subtitle below the
+        // selector so the operator hasn't lost that information.
+        const catSel = el('select', {
+          style: 'min-width:96px;background:var(--bg);color:var(--fg);' +
+                 'border:1px solid var(--border);border-radius:var(--radius);' +
+                 'padding:4px 8px;font:inherit;font-size:12px'
+        }, [
+          el('option', {value: 'os'},    'OS'),
+          el('option', {value: 'tools'}, 'Tools'),
+        ]);
+        catSel.value = (i.category || 'os');
+        catSel.onchange = async () => {
+          const r = await putJSON('/api/isos/' + encodeURIComponent(i.id) + '/category',
+            { category: catSel.value });
+          if (!r.ok) {
+            const t = await r.text();
+            alert('Category change failed: ' + t);
+          }
+          render('storage');
+        };
+
         const tr = el('tr', b.ok ? {} : {class: 'unbootable'}, [
           el('td', {}, [
             el('div', {style:'display:flex;align-items:center;gap:8px'}, [
@@ -468,7 +571,11 @@
             !b.ok ? el('div', {class:'row-warn'}, '⚠ ' + b.reason)
                   : (b.warn ? el('div', {class:'row-warn'}, '⚠ ' + b.warn) : null),
           ]),
-          el('td', {}, el('span', {class:'tag'}, familyLabel(i.introspection.family))),
+          el('td', {}, [
+            catSel,
+            el('div', {style:'color:var(--fg-dim);font-size:11px;margin-top:4px'},
+              familyLabel(i.introspection.family)),
+          ]),
           el('td', {class:'num'}, fmtBytes(i.size_bytes)),
           el('td', {},
             el('span', {class:'src-badge' + (isNfs ? ' nfs' : '')},
@@ -554,7 +661,48 @@
         el('span'),
       ])) : [el('div', {class:'empty'}, 'No NFS shares mounted.')];
 
+      // Disk-space card. Free + used + total for the volume hosting the
+      // ISO directory, with a coloured bar. Warns at 80% and goes red at
+      // 95% so the operator sees the runway shrinking before uploads
+      // start failing with ENOSPC.
+      const total = Number(disk.total_bytes || 0);
+      const avail = Number(disk.available_bytes || 0);
+      const used  = Number(disk.used_bytes  || 0);
+      const pctUsed = total > 0 ? (used / total) * 100 : 0;
+      let barClass = 'diskbar';
+      if (pctUsed >= 95)      barClass += ' full';
+      else if (pctUsed >= 80) barClass += ' warn';
+      const diskCard = el('div', {class:'card'}, [
+        el('header', {}, [
+          el('h2', {}, 'Disk space'),
+          el('span', {class:'sub'},
+            total > 0
+              ? (pctUsed.toFixed(1) + '% used')
+              : 'unavailable'),
+        ]),
+        el('div', {class:'body'}, [
+          el('div', {style:'color:var(--fg-dim);font-size:12px;word-break:break-all'},
+            disk.path ? ('Volume: ' + disk.path) : 'Volume path unknown'),
+          el('div', {class: barClass},
+            el('div', {class:'fill',
+              style:'width:' + Math.min(100, pctUsed).toFixed(1) + '%'})),
+          el('div', {class:'disk-meta'}, [
+            el('span', {}, ['Used ',  el('strong', {}, fmtBytes(used))]),
+            el('span', {}, ['Free ',  el('strong', {}, fmtBytes(avail))]),
+            el('span', {}, ['Total ', el('strong', {}, fmtBytes(total))]),
+          ]),
+          pctUsed >= 95
+            ? el('p', {class:'msg err', style:'margin-top:10px'},
+                '⚠ Less than 5% free. Remove old ISOs or grow the volume before uploading more.')
+            : (pctUsed >= 80
+                ? el('p', {class:'msg', style:'color:var(--warn);margin-top:10px'},
+                    'Volume is getting full. Consider pruning old ISOs.')
+                : null),
+        ]),
+      ]);
+
       return el('div', {class:'grid'}, [
+        diskCard,
         el('div', {class:'card'}, [
           el('header', {}, el('h2', {}, 'Upload ISO')),
           el('div', {class:'body'}, [drop, file, prog, upMsg]),
@@ -602,9 +750,11 @@
     },
 
     hosts: async () => {
-      const [{ hosts = [] }, isos] = await Promise.all([
+      const [{ hosts = [] }, isos, bootLogRes] = await Promise.all([
         getJSON('/api/hosts'), getJSON('/api/isos'),
+        getJSON('/api/boot-log').catch(() => ({ events: [] })),
       ]);
+      const bootEvents = bootLogRes.events || [];
       const targets = isos.flatMap(i => i.boot_entries.map(e => ({
         id: e.id, title: e.title + '  — ' + familyLabel(i.introspection.family),
       })));
@@ -680,8 +830,7 @@
             upsertBtn, msg,
             el('p', {class:'msg', style:'margin-top:14px'},
               'When a client with a bound MAC requests boot.ipxe, OpenPXE ' +
-              'short-circuits past the interactive menu and chains directly. ' +
+              'short-circuits past the interactive menu and chains directly.'),
-              'Inspired by Tinkerbell smee\'s MAC-prepended URL pattern.'),
           ]),
         ]),
         el('div', {class:'card'}, [
@@ -691,6 +840,37 @@
           ]),
           table,
         ]),
+        el('div', {class:'card'}, [
+          el('header', {}, [
+            el('h2', {}, 'Host log'),
+            el('span', {class:'sub'},
+              bootEvents.length + ' event' + (bootEvents.length === 1 ? '' : 's')),
+          ]),
+          bootEvents.length
+            ? el('table', {}, [
+                el('thead', {}, el('tr', {}, [
+                  el('th', {}, 'Time'),
+                  el('th', {}, 'MAC'),
+                  el('th', {}, 'IP'),
+                  el('th', {}, 'Image'),
+                ])),
+                el('tbody', {},
+                  bootEvents.map(e => el('tr', {}, [
+                    el('td', {}, fmtAgo(e.timestamp)),
+                    el('td', {class:'mono'}, e.mac || el('span', {class:'tag'}, '(unknown)')),
+                    el('td', {class:'mono'}, e.ip ? String(e.ip) : '—'),
+                    el('td', {}, [
+                      el('span', {style:'font-weight:600'}, e.target_title || e.target_id),
+                      el('div', {class:'meta',
+                        style:'color:var(--fg-dim);font-size:11.5px;margin-top:2px'},
+                        e.target_id),
+                    ]),
+                  ]))),
+              ])
+            : el('div', {class:'empty'},
+                'No boot events yet. When a PXE client chains a boot entry, ' +
+                'it lands here with the MAC, IP, and image it received.'),
+        ]),
       ]);
     },
 
@@ -821,6 +1001,299 @@
       return term;
     },
 
+    settings: async () => {
+      const [status, docs, me, sso] = await Promise.all([
+        getJSON('/api/status'),
+        getJSON('/api/docs').catch(() => ({ groups: [] })),
+        getJSON('/api/me').catch(() => ({})),
+        getJSON('/api/sso').catch(() => ({
+          enabled:false, idp_name:'', metadata:'', metadata_url:'',
+        })),
+      ]);
+      const hasLogo = !!status.custom_logo;
+
+      // ── Account card (Forms admin credentials, v0.4.5).
+      // Sonarr/Radarr-style: the admin enters their current password
+      // before changing username or password. On success the server
+      // revokes every other session, so a forgotten browser tab can't
+      // keep operating with stale credentials.
+      const currentPw = el('input', {type:'password', autocomplete:'current-password'});
+      const newUser   = el('input', {type:'text', autocomplete:'username',
+        placeholder: (me.user && me.user.username) || 'admin'});
+      const newPw     = el('input', {type:'password', autocomplete:'new-password',
+        placeholder: 'leave blank to keep current'});
+      const newPwConfirm = el('input', {type:'password', autocomplete:'new-password',
+        placeholder: 'confirm new password'});
+      const accountMsg = el('div', {class:'msg', style:'margin-top:8px'});
+      const accountSave = el('button', {onclick: async () => {
+        accountMsg.textContent = ''; accountMsg.className = 'msg';
+        if (!currentPw.value) {
+          accountMsg.textContent = 'Current password is required.';
+          accountMsg.className = 'msg err';
+          return;
+        }
+        if (newPw.value && newPw.value !== newPwConfirm.value) {
+          accountMsg.textContent = 'New password and confirmation do not match.';
+          accountMsg.className = 'msg err';
+          return;
+        }
+        if (!newUser.value && !newPw.value) {
+          accountMsg.textContent = 'Nothing to change. Fill in a new username or password.';
+          accountMsg.className = 'msg err';
+          return;
+        }
+        const body = { current_password: currentPw.value };
+        if (newUser.value) body.new_username = newUser.value;
+        if (newPw.value)   body.new_password = newPw.value;
+        const r = await putJSON('/api/me/credentials', body);
+        // Clear the typed plaintext immediately — minimises DOM dwell time.
+        currentPw.value = ''; newPw.value = ''; newPwConfirm.value = '';
+        if (r.ok) {
+          accountMsg.textContent = 'Credentials updated. Other sessions were signed out.';
+          accountMsg.className = 'msg ok';
+          // Refresh the settings view to pick up the new "logged in as" display.
+          setTimeout(() => render('settings'), 600);
+        } else {
+          const j = await r.json().catch(() => ({}));
+          accountMsg.textContent = j.error || ('Update failed: HTTP ' + r.status);
+          accountMsg.className = 'msg err';
+        }
+      }}, 'Update credentials');
+      const accountCard = el('div', {class:'card'}, [
+        el('header', {}, [
+          el('h2', {}, 'Administrator account'),
+          el('span', {class:'sub'},
+            (me && me.user && me.user.username)
+              ? ('signed in as ' + me.user.username)
+              : 'signed in'),
+        ]),
+        el('div', {class:'body'}, [
+          el('p', {class:'msg', style:'margin-bottom:14px'},
+            'Rotate the administrator login. Your current password is required ' +
+            'to make any change; on success every other browser session is ' +
+            'signed out so a stale cookie can\'t keep operating.'),
+          el('div', {class:'form-row'}, [
+            el('label', {class:'field'}, [
+              el('span', {class:'name'}, 'Current password'),
+              currentPw,
+            ]),
+            el('label', {class:'field'}, [
+              el('span', {class:'name'}, 'New username (optional)'),
+              newUser,
+            ]),
+            el('label', {class:'field'}, [
+              el('span', {class:'name'}, 'New password (optional)'),
+              newPw,
+            ]),
+            el('label', {class:'field'}, [
+              el('span', {class:'name'}, 'Confirm new password'),
+              newPwConfirm,
+            ]),
+          ]),
+          accountSave, accountMsg,
+        ]),
+      ]);
+
+      // ── SSO card (FleetDM-shaped, storage-only for v0.4.5).
+      // Operators paste either a metadata URL or the raw XML; tabs
+      // switch the visible field. Saving validates server-side. The
+      // actual SAML login flow ships in a later release — we surface
+      // a yellow "config saved, runtime pending" line when usable.
+      const ssoEnabled = el('input', {type:'checkbox'});
+      ssoEnabled.checked = !!sso.enabled;
+      const ssoName = el('input', {type:'text', placeholder:'e.g. Okta, Azure AD',
+        value: sso.idp_name || ''});
+      const ssoUrl = el('input', {type:'text', placeholder:'https://idp.example.com/metadata',
+        value: sso.metadata_url || ''});
+      const ssoXml = el('textarea', {rows:'6',
+        placeholder:'<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"…',
+        style:'width:100%;font-family:var(--mono);font-size:12px;background:var(--bg);' +
+              'color:var(--fg);border:1px solid var(--border);border-radius:var(--radius);' +
+              'padding:8px 10px;resize:vertical'},
+        sso.metadata || '');
+      const ssoMode = el('select', {style:'min-width:160px;background:var(--bg);color:var(--fg);' +
+        'border:1px solid var(--border);border-radius:var(--radius);padding:6px 8px;font:inherit'}, [
+        el('option', {value:'url'}, 'Metadata URL'),
+        el('option', {value:'xml'}, 'Metadata XML'),
+      ]);
+      ssoMode.value = sso.metadata && !sso.metadata_url ? 'xml' : 'url';
+      const urlWrap = el('label', {class:'field'}, [
+        el('span', {class:'name'}, 'IdP metadata URL'),
+        ssoUrl,
+        el('span', {class:'hint'},
+          'OpenPXE will fetch this URL once SSO sign-in lands; v0.4.5 just stores it.'),
+      ]);
+      const xmlWrap = el('label', {class:'field'}, [
+        el('span', {class:'name'}, 'IdP metadata XML'),
+        ssoXml,
+        el('span', {class:'hint'},
+          'Paste the raw <EntityDescriptor>…</EntityDescriptor> document from your IdP.'),
+      ]);
+      const refreshSsoFields = () => {
+        if (ssoMode.value === 'url') {
+          urlWrap.style.display = ''; xmlWrap.style.display = 'none';
+        } else {
+          urlWrap.style.display = 'none'; xmlWrap.style.display = '';
+        }
+      };
+      ssoMode.onchange = refreshSsoFields;
+      refreshSsoFields();
+      const ssoMsg = el('div', {class:'msg', style:'margin-top:8px'});
+      const ssoSave = el('button', {onclick: async () => {
+        ssoMsg.textContent = ''; ssoMsg.className = 'msg';
+        const payload = {
+          enabled: ssoEnabled.checked,
+          idp_name: ssoName.value,
+          metadata:     ssoMode.value === 'xml' ? ssoXml.value : '',
+          metadata_url: ssoMode.value === 'url' ? ssoUrl.value : '',
+        };
+        const r = await putJSON('/api/sso', payload);
+        if (r.ok) {
+          ssoMsg.textContent = ssoEnabled.checked
+            ? 'SSO configuration saved. Runtime sign-in flow ships in a future release.'
+            : 'SSO configuration saved (disabled).';
+          ssoMsg.className = 'msg ok';
+        } else {
+          const t = await r.text();
+          ssoMsg.textContent = 'Save failed: ' + t;
+          ssoMsg.className = 'msg err';
+        }
+      }}, 'Save SSO settings');
+      const ssoCard = el('div', {class:'card'}, [
+        el('header', {}, [
+          el('h2', {}, 'Single sign-on (SAML)'),
+          el('span', {class:'sub'},
+            sso.enabled
+              ? (sso.metadata_url || sso.metadata
+                  ? 'configured · runtime pending'
+                  : 'enabled but missing source')
+              : 'disabled'),
+        ]),
+        el('div', {class:'body'}, [
+          el('p', {class:'msg', style:'margin-bottom:14px'},
+            'Configure your SAML IdP today; OpenPXE persists the metadata so ' +
+            'when SSO sign-in lights up in a future release, no operator ' +
+            're-entry is needed. The local administrator account above is ' +
+            'always available as a fallback owner regardless of SSO state.'),
+          el('label', {class:'check', style:'margin-bottom:14px;max-width:280px'}, [
+            ssoEnabled,
+            el('span', {}, 'Enable single sign-on'),
+          ]),
+          el('div', {class:'form-row'}, [
+            el('label', {class:'field'}, [
+              el('span', {class:'name'}, 'IdP display name'),
+              ssoName,
+              el('span', {class:'hint'}, '"Sign in with X" label on the login screen.'),
+            ]),
+            el('label', {class:'field'}, [
+              el('span', {class:'name'}, 'Metadata source'),
+              ssoMode,
+            ]),
+          ]),
+          urlWrap,
+          xmlWrap,
+          ssoSave, ssoMsg,
+        ]),
+      ]);
+
+      // ── Custom logo upload.
+      // Single-file drop-zone; PNG/SVG/JPEG/WebP/GIF up to 2 MB.
+      // Persisted as <work_dir>/branding/logo.<ext> and served from
+      // /assets/logo.svg in preference to the bundled mark.
+      const logoFile = el('input', {
+        type:'file',
+        accept:'image/svg+xml,image/png,image/jpeg,image/webp,image/gif',
+        style:'display:none', id:'logo-file',
+      });
+      const logoMsg = el('div', {class:'msg', style:'margin-top:10px'});
+      const logoBust = '?v=' + Date.now(); // bust the browser cache after upload
+      logoFile.onchange = async () => {
+        if (!logoFile.files[0]) return;
+        const f = logoFile.files[0];
+        const fd = new FormData(); fd.append('file', f, f.name);
+        logoMsg.textContent = 'Uploading ' + f.name + ' (' + fmtBytes(f.size) + ')…';
+        logoMsg.className = 'msg';
+        const r = await fetch('/api/branding/logo', {method:'POST', body: fd});
+        if (r.ok) {
+          logoMsg.textContent = 'Custom logo installed. Reloading…';
+          logoMsg.className = 'msg ok';
+          setTimeout(() => location.reload(), 600);
+        } else {
+          const t = await r.text();
+          logoMsg.textContent = 'Upload failed: ' + t;
+          logoMsg.className = 'msg err';
+        }
+      };
+      const logoCard = el('div', {class:'card'}, [
+        el('header', {}, el('h2', {}, 'Branding')),
+        el('div', {class:'body'}, [
+          el('p', {class:'msg', style:'margin-bottom:14px'},
+            'Override the top-left brand mark with your own logo. Up to 2 MB; ' +
+            'PNG, SVG, JPEG, WebP, or GIF. The original OpenPXE version is ' +
+            'always shown in the bottom-left for support purposes.'),
+          el('div', {class:'logo-preview'}, [
+            el('div', {class:'swatch'},
+              el('img', {src: '/assets/logo.svg' + logoBust, alt:'current logo'})),
+            el('div', {class:'info'}, [
+              el('div', {class:'name'}, hasLogo ? 'Custom logo (uploaded)' : 'Default OpenPXE mark'),
+              el('div', {class:'meta'},
+                hasLogo
+                  ? 'Operator-uploaded; served from <work_dir>/branding/.'
+                  : 'Bundled rainbow-horizon mark. Upload an image to override.'),
+            ]),
+            el('div', {style:'display:flex;gap:8px;flex-wrap:wrap'}, [
+              el('button', {onclick: () => logoFile.click()},
+                hasLogo ? 'Replace logo' : 'Upload logo'),
+              hasLogo
+                ? el('button', {class:'danger', onclick: async () => {
+                    if (!confirm('Remove custom logo and revert to the OpenPXE mark?')) return;
+                    const r = await fetch('/api/branding/logo', {method:'DELETE'});
+                    if (r.ok || r.status === 204) {
+                      logoMsg.textContent = 'Reverted to default mark. Reloading…';
+                      logoMsg.className = 'msg ok';
+                      setTimeout(() => location.reload(), 500);
+                    } else {
+                      const t = await r.text();
+                      logoMsg.textContent = 'Clear failed: ' + t;
+                      logoMsg.className = 'msg err';
+                    }
+                  }}, 'Remove')
+                : null,
+            ]),
+          ]),
+          logoFile, logoMsg,
+        ]),
+      ]);
+
+      // ── API reference (always at the bottom of Settings).
+      // Sourced from /api/docs so the hand-curated list stays the
+      // single source of truth and the UI doesn't need its own copy
+      // baked into the JS bundle.
+      const groups = docs.groups || [];
+      const apiCard = el('div', {class:'card'}, [
+        el('header', {}, [
+          el('h2', {}, 'API reference'),
+          el('span', {class:'sub'},
+            groups.reduce((n, g) => n + (g.endpoints || []).length, 0) + ' endpoints'),
+        ]),
+        el('div', {class:'api-ref'},
+          groups.length
+            ? groups.map(g => el('div', {class:'group'}, [
+                el('h3', {}, g.name),
+                ...(g.endpoints || []).map(ep => el('div', {class:'ep'}, [
+                  el('span', {class:'method ' + (ep.method || 'get').toLowerCase()},
+                    ep.method || 'GET'),
+                  el('span', {class:'path'}, ep.path || '?'),
+                  el('span', {class:'desc'}, ep.summary || ''),
+                ])),
+              ]))
+            : el('div', {class:'empty'},
+                'No API documentation returned by /api/docs.')),
+      ]);
+
+      return el('div', {class:'grid'}, [accountCard, ssoCard, logoCard, apiCard]);
+    },
+
     about: async () => {
       const status = await getJSON('/api/status');
       return el('div', {class:'card'}, [
@@ -833,7 +1306,10 @@
           el('div', {class:'who'}, [
             el('span', {}, 'Developer: '), el('strong', {}, 'Miles Ward'), el('br'),
             el('span', {}, 'Version: '), el('strong', {}, status.version || '?'), el('br'),
-            el('span', {}, 'Base URL: '), el('strong', {}, status.public_base_url),
+            el('span', {}, 'Base URL: '), el('strong', {}, status.public_base_url), el('br'),
+            el('span', {}, 'Docs: '),
+            el('a', {href:'https://openpxe.com/', target:'_blank', rel:'noopener noreferrer'},
+              'https://openpxe.com/'),
           ]),
           el('p', {class:'msg', style:'margin-top:18px'},
             'iPXE is an internal implementation detail. Everything the firmware ' +
@@ -858,6 +1334,7 @@
     storage: 'Storage',
     hosts: 'Hosts',
     terminal: 'Terminal',
+    settings: 'Settings',
     about: 'About',
   };
 
@@ -915,6 +1392,24 @@
     }
   }
 
+  // Set the sidebar footer "Service status:" line. The chip itself moved
+  // off the topbar in v0.4.x: operators wanted readiness, advertised
+  // URL, and the boot IP grouped together as the bottom-left summary.
+  function setReady(state) {
+    const dot = $('[data-bind=ready_dot]');
+    const lbl = $('[data-bind=ready_label]');
+    if (!dot || !lbl) return;
+    const map = {
+      ready:       { cls: 'ok',  text: 'Ready' },
+      notready:    { cls: 'err', text: 'Not ready' },
+      unreachable: { cls: 'err', text: 'Unreachable' },
+    };
+    const m = map[state] || { cls: 'warn', text: 'Checking…' };
+    dot.className = 'dot ' + m.cls;
+    lbl.className = 'status-value ' + m.cls;
+    lbl.textContent = m.text;
+  }
+
   async function refreshChips() {
     try {
       const s = await getJSON('/api/status');
@@ -924,14 +1419,9 @@
       $$('[data-bind=client_count],[data-bind=client_count2]').forEach(n => n.textContent = String(s.client_count));
       $$('[data-bind=queue_count],[data-bind=queue_count2]').forEach(n => n.textContent = String(s.queue_count));
       $$('[data-bind=host_count]').forEach(n => n.textContent = String(s.host_bindings || 0));
-      const chip = $('[data-bind=ready_chip]');
+      setReady(r.ok ? 'ready' : 'notready');
-      if (chip) {
-        if (r.ok) { chip.textContent = '● ready'; chip.className = 'chip ready'; }
-        else      { chip.textContent = '● not ready'; chip.className = 'chip notready'; }
-      }
     } catch {
-      const chip = $('[data-bind=ready_chip]');
+      setReady('unreachable');
-      if (chip) { chip.textContent = '● unreachable'; chip.className = 'chip notready'; }
     }
   }
 
@@ -940,7 +1430,245 @@
     if (a) { e.preventDefault(); render(a.dataset.view); }
   });
 
-  render('dashboard');
+  // ── Auth bootstrap (v0.4.5) ──────────────────────────────────────
-  refreshChips();
+  // Before painting the dashboard, ask /api/me whether the operator
-  setInterval(refreshChips, 3000);
+  // needs to bootstrap an admin (`setup_required`), sign in
+  // (`!authenticated`), or just load the dashboard. The auth screen
+  // takes over the viewport completely — no half-rendered chrome
+  // bleeding through. Sonarr/Radarr-style.
+  let chipsInterval = null;
+  let authScreenEl = null;
+  let ssoConfig = null;
+
+  function teardownAuthScreen() {
+    if (authScreenEl && authScreenEl.parentNode) {
+      authScreenEl.parentNode.removeChild(authScreenEl);
+    }
+    authScreenEl = null;
+    document.querySelector('.shell').style.display = '';
+  }
+
+  function buildLoginCard() {
+    const usernameInput = el('input', {type:'text', name:'username', autocomplete:'username', autofocus:'autofocus', spellcheck:'false'});
+    const passwordInput = el('input', {type:'password', name:'password', autocomplete:'current-password'});
+    const err = el('div', {class:'auth-err', style:'display:none'});
+    const submit = el('button', {class:'submit', type:'submit'}, 'Sign in');
+
+    const ssoButton = ssoConfig && ssoConfig.enabled && (ssoConfig.metadata_url || ssoConfig.metadata)
+      ? el('button', {type:'button', class:'sso-btn', onclick: () => {
+          // SSO login flow lands in a later release — for now we
+          // surface a friendly note so the operator knows the config
+          // landed but the runtime hookup is pending.
+          err.textContent = 'SSO sign-in is configured but the runtime flow ships in a future release. Sign in with the local admin for now.';
+          err.style.display = '';
+        }}, [
+          el('div', {}, 'Sign in with ' + (ssoConfig.idp_name || 'SSO')),
+          el('div', {class:'meta'}, 'configured · runtime flow pending'),
+        ])
+      : null;
+
+    const form = el('form', {class:'auth-form', onsubmit: async (e) => {
+      e.preventDefault();
+      err.style.display = 'none';
+      submit.disabled = true;
+      submit.textContent = 'Signing in…';
+      try {
+        const r = await fetch('/api/login', {
+          method:'POST',
+          headers:{'Content-Type':'application/json'},
+          body: JSON.stringify({username: usernameInput.value, password: passwordInput.value}),
+        });
+        if (r.ok) {
+          passwordInput.value = '';
+          teardownAuthScreen();
+          await startDashboard();
+          return;
+        }
+        const j = await r.json().catch(() => ({}));
+        err.textContent = j.error || ('Sign-in failed: HTTP ' + r.status);
+        err.style.display = '';
+      } catch (ex) {
+        err.textContent = 'Network error: ' + (ex && ex.message ? ex.message : ex);
+        err.style.display = '';
+      } finally {
+        submit.disabled = false;
+        submit.textContent = 'Sign in';
+      }
+    }}, [
+      el('div', {class:'brand-row'}, [
+        el('img', {src:'/assets/logo.svg', alt:''}),
+        el('div', {class:'name'}, 'OpenPXE'),
+      ]),
+      el('h2', {}, 'Sign in'),
+      el('p', {class:'lede'}, 'Enter your administrator credentials. Forgot them? SSH to the host and remove work_dir/auth.json — the next launch will re-prompt for setup.'),
+      el('label', {class:'field'}, [
+        el('div', {style:'color:var(--fg-dim);font-size:12px;margin-bottom:4px'}, 'Username'),
+        usernameInput,
+      ]),
+      el('label', {class:'field'}, [
+        el('div', {style:'color:var(--fg-dim);font-size:12px;margin-bottom:4px'}, 'Password'),
+        passwordInput,
+      ]),
+      submit,
+      ssoButton,
+      err,
+      el('div', {class:'auth-foot'}, 'OpenPXE · ' + (window.location.host || '')),
+    ]);
+    return form;
+  }
+
+  function buildSetupCard() {
+    const usernameInput = el('input', {type:'text', name:'username', autocomplete:'username', autofocus:'autofocus', spellcheck:'false'});
+    const passwordInput = el('input', {type:'password', name:'password', autocomplete:'new-password'});
+    const confirmInput  = el('input', {type:'password', name:'confirm', autocomplete:'new-password'});
+    const err = el('div', {class:'auth-err', style:'display:none'});
+    const submit = el('button', {class:'submit', type:'submit'}, 'Create administrator');
+
+    const form = el('form', {class:'auth-form', onsubmit: async (e) => {
+      e.preventDefault();
+      err.style.display = 'none';
+      if (passwordInput.value !== confirmInput.value) {
+        err.textContent = 'Passwords do not match.';
+        err.style.display = '';
+        return;
+      }
+      if (passwordInput.value.length < 8) {
+        err.textContent = 'Password must be at least 8 characters.';
+        err.style.display = '';
+        return;
+      }
+      submit.disabled = true;
+      submit.textContent = 'Creating…';
+      try {
+        const r = await fetch('/api/setup', {
+          method:'POST',
+          headers:{'Content-Type':'application/json'},
+          body: JSON.stringify({username: usernameInput.value, password: passwordInput.value}),
+        });
+        if (r.ok) {
+          passwordInput.value = '';
+          confirmInput.value = '';
+          teardownAuthScreen();
+          await startDashboard();
+          return;
+        }
+        const j = await r.json().catch(() => ({}));
+        err.textContent = j.error || ('Setup failed: HTTP ' + r.status);
+        err.style.display = '';
+      } catch (ex) {
+        err.textContent = 'Network error: ' + (ex && ex.message ? ex.message : ex);
+        err.style.display = '';
+      } finally {
+        submit.disabled = false;
+        submit.textContent = 'Create administrator';
+      }
+    }}, [
+      el('div', {class:'brand-row'}, [
+        el('img', {src:'/assets/logo.svg', alt:''}),
+        el('div', {class:'name'}, 'OpenPXE'),
+      ]),
+      el('h2', {}, 'First-run setup'),
+      el('p', {class:'lede'}, 'Welcome. Create the administrator account that will own this OpenPXE deployment. Additional users come in through SSO later.'),
+      el('label', {class:'field'}, [
+        el('div', {style:'color:var(--fg-dim);font-size:12px;margin-bottom:4px'}, 'Username'),
+        usernameInput,
+      ]),
+      el('label', {class:'field'}, [
+        el('div', {style:'color:var(--fg-dim);font-size:12px;margin-bottom:4px'}, 'Password (≥8 chars)'),
+        passwordInput,
+      ]),
+      el('label', {class:'field'}, [
+        el('div', {style:'color:var(--fg-dim);font-size:12px;margin-bottom:4px'}, 'Confirm password'),
+        confirmInput,
+      ]),
+      submit,
+      err,
+      el('div', {class:'auth-foot'}, 'OpenPXE · ' + (window.location.host || '')),
+    ]);
+    return form;
+  }
+
+  function showAuthScreen(mode) {
+    // Tear down any previous screen + the dashboard chrome.
+    if (authScreenEl && authScreenEl.parentNode) {
+      authScreenEl.parentNode.removeChild(authScreenEl);
+    }
+    const shell = document.querySelector('.shell');
+    if (shell) shell.style.display = 'none';
+    if (chipsInterval) { clearInterval(chipsInterval); chipsInterval = null; }
+
+    const card = (mode === 'setup' ? buildSetupCard() : buildLoginCard());
+    authScreenEl = el('div', {class:'auth-screen'},
+      el('div', {class:'auth-card'}, card));
+    document.body.appendChild(authScreenEl);
+    // Focus the first visible input (autofocus on dynamically created
+    // inputs doesn't fire in all browsers).
+    setTimeout(() => {
+      const inp = authScreenEl.querySelector('input[type="text"], input[type="password"]');
+      if (inp) inp.focus();
+    }, 30);
+  }
+
+  async function startDashboard() {
+    // Light up the sidebar's "signed in as X / Sign out" row. It was
+    // hidden in index.html because we don't know the identity until
+    // /api/me resolves.
+    try {
+      const me = await fetch('/api/me').then(r => r.ok ? r.json() : null);
+      const row = $('[data-bind=logout_row]');
+      const who = $('[data-bind=signed_in_as]');
+      const btn = $('[data-bind=logout_btn]');
+      if (row && me && me.authenticated && me.user) {
+        who.textContent = me.user.username;
+        who.title = 'Signed in as ' + me.user.username;
+        row.style.display = '';
+        if (btn && !btn._wired) {
+          btn._wired = true;
+          btn.addEventListener('click', async () => {
+            await fetch('/api/logout', {method:'POST'}).catch(() => {});
+            showAuthScreen('login');
+          });
+        }
+      }
+    } catch (e) { /* surfaces elsewhere */ }
+    render('dashboard');
+    await refreshChips();
+    if (!chipsInterval) chipsInterval = setInterval(refreshChips, 3000);
+  }
+
+  async function bootstrap() {
+    let me;
+    try {
+      me = await fetch('/api/me').then(r => r.json());
+    } catch (e) {
+      // /api/me is unauthenticated in every state — if we can't reach
+      // it the server is genuinely down, not an auth problem.
+      document.body.appendChild(el('div', {class:'auth-screen'},
+        el('div', {class:'auth-card'}, [
+          el('div', {class:'brand-row'}, [
+            el('img', {src:'/assets/logo.svg', alt:''}),
+            el('div', {class:'name'}, 'OpenPXE'),
+          ]),
+          el('h2', {}, 'Connection error'),
+          el('p', {class:'lede'}, 'Could not reach the OpenPXE server. Refresh once it is back up.'),
+        ])));
+      return;
+    }
+    // Preload the SSO config so the login card can offer the operator
+    // an "Sign in with X" button when configured. Failure is harmless.
+    try { ssoConfig = await fetch('/api/sso').then(r => r.ok ? r.json() : null); }
+    catch { ssoConfig = null; }
+
+    if (me.setup_required) {
+      showAuthScreen('setup');
+      return;
+    }
+    if (!me.authenticated) {
+      showAuthScreen('login');
+      return;
+    }
+    await startDashboard();
+  }
+
+  bootstrap();
 })();

crates/webui/src/index.html

@@ -26,11 +26,8 @@
 <div class="shell">
   <aside class="sidebar">
     <div class="brand">
-      <img src="/assets/logo.svg" alt="" />
+      <img src="/assets/logo.svg" alt="OpenPXE" />
-      <div>
+      <strong>OpenPXE</strong>
-        <strong>OpenPXE</strong>
-        <div class="sub">v<span data-bind="version">0.3.2</span></div>
-      </div>
     </div>
     <nav>
       <a data-view="dashboard" class="active">Dashboard</a>
@@ -48,18 +45,35 @@
         <span class="count" data-bind="host_count">0</span>
       </a>
       <a data-view="terminal">Terminal</a>
+      <a data-view="settings">Settings</a>
       <a data-view="about">About</a>
     </nav>
     <div class="footer">
-      Advertised to clients<br/>
+      <div class="status-row">
+        <span class="dot" data-bind="ready_dot" title="Server readiness"></span>
+        <span class="status-label">Service status:</span>
+        <span class="status-value" data-bind="ready_label">checking…</span>
+      </div>
+      <div class="footer-sub">Advertised to clients</div>
       <code>{{BASE_URL}}</code>
+      <!-- The brand badge at the top can be overridden by operator-uploaded
+           logos; keep "OpenPXE v…" pinned in the footer so the backend
+           identity is always visible regardless of branding. -->
+      <div class="footer-version">OpenPXE&nbsp;v<span data-bind="version">0.4.5</span></div>
+      <!-- v0.4.5: signed-in identity + one-click sign-out. The button
+           is populated by app.js after /api/me reports an authenticated
+           session — pre-auth states swap the whole shell for the
+           login/setup card so this row never gets shown there. -->
+      <div class="logout-row" data-bind="logout_row" style="display:none">
+        <span class="who" data-bind="signed_in_as" title=""></span>
+        <button type="button" class="logout-btn" data-bind="logout_btn">Sign out</button>
+      </div>
     </div>
   </aside>
 
   <header class="topbar">
     <h1 data-bind="view_title">Dashboard</h1>
     <div class="spacer"></div>
-    <span class="chip" data-bind="ready_chip" title="Server readiness">checking…</span>
     <span class="chip"><strong data-bind="iso_count2">0</strong>&nbsp;images</span>
     <span class="chip"><strong data-bind="client_count2">0</strong>&nbsp;clients</span>
     <span class="chip"><strong data-bind="queue_count2">0</strong>&nbsp;in queue</span>

deploy/docker/Dockerfile

@@ -14,7 +14,7 @@
 # Debian slim at ~75 MB + binary ~25 MB is fine for a PXE server that
 # spends most of its life idle.
 
-ARG RUST_VERSION=1.82
+ARG RUST_VERSION=1.95
 
 ########## fetch iPXE binaries ##########
 FROM debian:12-slim AS fetch
@@ -28,23 +28,44 @@ RUN mkdir -p assets/ipxe && bash scripts/fetch-ipxe.sh
 FROM rust:${RUST_VERSION}-bookworm AS build
 WORKDIR /src
 
+# v0.4.5: build a fully static musl binary (matches Bootimus v0.1.70's
+# move). The resulting `/openpxe` has no glibc dependency at all, which:
+#   - Lets the runtime stage be any Linux distro (we still ship Debian
+#     slim for the `samba` / `wimtools` / `nfs-common` shellouts, but a
+#     scratch/distroless variant becomes a one-line swap).
+#   - Cuts a class of "GLIBC_2.39 not found" surprises when running on
+#     older RHEL/Rocky hosts that don't match Debian 12's libc version.
+#   - Sidesteps cross-compilation snags (the binary is its own world).
+#
+# x86_64-unknown-linux-musl is fully static by default (no extra
+# RUSTFLAGS needed). musl-tools provides the linker.
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends musl-tools \
+ && rm -rf /var/lib/apt/lists/* \
+ && rustup target add x86_64-unknown-linux-musl
+
 # Copy the whole workspace in one go. We used to do a two-pass "cache-prime
 # with stubs, then real build" dance for dep-compile reuse; that turned out
 # to silently serve stale stub binaries when cargo's fingerprint didn't
 # notice the source swap. A single build is ~1.5 min longer on cold cache
 # but guarantees the binary reflects the sources we copied.
-COPY Cargo.toml rust-toolchain.toml ./
+# Do not copy rust-toolchain.toml into the image. The local workspace pins
+# developer tooling, but inside Docker we intentionally use the Rust version
+# selected by the base image. Copying rust-toolchain.toml with
+# `channel = "stable"` makes rustup download a second full toolchain during
+# `cargo build`, which is slow and can exhaust small Colima/CI disks.
+COPY Cargo.toml Cargo.lock ./
 COPY crates/ crates/
 COPY --from=fetch /src/assets/ipxe /src/assets/ipxe
 
-# Cache cargo registry + target across builds. The `--no-edit` touch is
+# Cache cargo registry + target across builds. The mtime touch is
 # belt-and-suspenders: cargo occasionally misses mtime-only changes on
 # networked FS; this forces a fingerprint check.
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
     --mount=type=cache,target=/src/target,sharing=locked \
     find crates -name '*.rs' -exec touch {} + && \
-    cargo build --release --bin openpxe && \
+    cargo build --release --target x86_64-unknown-linux-musl --bin openpxe && \
-    cp target/release/openpxe /openpxe && \
+    cp target/x86_64-unknown-linux-musl/release/openpxe /openpxe && \
     ls -l /openpxe
 
 ########## runtime ##########
@@ -57,22 +78,28 @@ RUN apt-get update \
  && useradd --system --uid 10001 --home-dir /var/lib/openpxe --shell /usr/sbin/nologin openpxe \
  && mkdir -p /var/lib/openpxe/isos /var/lib/openpxe/work /var/lib/openpxe/smb \
  && chown -R openpxe:openpxe /var/lib/openpxe
-# Runtime deps explained:
+# v0.4.5: the openpxe binary itself is now built against musl and is
-#   wimtools  - provides `wimlib-imagex`, used to inject startnet.cmd into boot.wim.
+# fully static — no glibc dependency. The runtime stage still ships
-#   samba     - `smbd` serves extracted Windows install media on :445 for WinPE
+# Debian slim because OpenPXE shells out to the four packages below for
-#               to `net use`. Guest read-only, scoped to /var/lib/openpxe/smb.
+# functionality we deliberately don't reimplement in-process:
-#   nfs-common - provides `mount.nfs` / `mount.nfs4` for the Storage tab's
+#   wimtools   - `wimlib-imagex`, used to inject startnet.cmd into boot.wim.
-#               NFS share manager. Mount also requires the container to run
+#   samba      - `smbd` serves extracted Windows install media on :445 so
-#               with CAP_SYS_ADMIN — without it, mount(2) returns EPERM and
+#                WinPE can `net use`. Guest read-only, scoped to
-#               the manager surfaces a clear error in the UI instead of
+#                /var/lib/openpxe/smb.
-#               failing silently.
+#   nfs-common - `mount.nfs` / `mount.nfs4` for the Storage tab's NFS
-#   iproute2  - `ip addr` / `ip route` for the auto-detected Network tab
+#                share manager. Mount requires CAP_SYS_ADMIN; without it
-#               fields (NIC name, subnet mask, default gateway). Tiny,
+#                mount(2) returns EPERM and the manager surfaces a clear
-#               always available; we don't pull in netlink crates for
+#                error in the UI.
-#               this one-shot startup probe.
+#   iproute2   - `ip addr` / `ip route` for the auto-detected Network
-#   gosu      - drops privileges cleanly from root after the entrypoint fixes
+#                tab fields (NIC name, subnet mask, default gateway).
-#               bind-mount ownership (common OpenShift/Docker UX issue).
+#                Tiny, always available; we don't pull in netlink crates
-# Windows-specific tools only activate when the WebUI toggle is on.
+#                for this one-shot startup probe.
+#   gosu       - drops privileges cleanly from root after the entrypoint
+#                fixes bind-mount ownership (common OpenShift/Docker UX
+#                issue).
+# A future "openpxe-static" variant could drop everything except the
+# binary onto distroless once we move the Windows + NFS legs to
+# in-process Rust crates.
 
 COPY --from=build /openpxe /usr/local/bin/openpxe
 COPY deploy/docker/entrypoint.sh /usr/local/bin/entrypoint.sh

deploy/openshift/30-deployment.yaml

@@ -34,7 +34,7 @@ spec:
         fsGroup: 10001
       containers:
         - name: openpxe
-          image: gitea.milesward.dev/mward4/openpxe:0.3.2
+          image: gitea.milesward.dev/mward4/openpxe:0.4.1
           imagePullPolicy: IfNotPresent
           ports:
             - name: dhcp

deploy/unraid/README.md

@@ -6,7 +6,7 @@ boot from OpenPXE". Pick the one that matches what you have.
 ## Path A — build on Unraid, push to Gitea registry, pull by tag
 
 Recommended once you've done it once. Image is published to
-`gitea.milesward.dev/mward4/openpxe:0.3.2` (or your equivalent) and
+`gitea.milesward.dev/mward4/openpxe:0.4.1` (or your equivalent) and
 every Unraid template / docker-compose just references the tag.
 
 Pre-flight:
@@ -40,14 +40,14 @@ What it does:
 3. `docker build` against `deploy/docker/Dockerfile`.
 4. `docker login gitea.milesward.dev:3000` using a temp `DOCKER_CONFIG`
    so the credential never lands in your real `~/.docker/config.json`.
-5. `docker push` both `:0.3.2` and `:latest`.
+5. `docker push` both `:0.4.1` and `:latest`.
 6. Logout, scrub the temp config, delete the workspace.
 
 After it finishes, in Unraid → Docker → Add Container, set:
 
 | Field      | Value                                           |
 |------------|-------------------------------------------------|
-| Repository | `gitea.milesward.dev/mward4/openpxe:0.3.2`     |
+| Repository | `gitea.milesward.dev/mward4/openpxe:0.4.1`     |
 | Network    | `host`                                          |
 | Extra args | `--cap-add=NET_BIND_SERVICE`                    |
 
@@ -88,14 +88,14 @@ then:
 
 ```bash
 # On the build host
-docker save openpxe:0.3.2 | gzip > openpxe-0.3.2.tar.gz
+docker save openpxe:0.4.1 | gzip > openpxe-0.4.1.tar.gz
 
 # Transfer (rsync / scp / SMB / ZFS-replicate / sneakernet)
-scp openpxe-0.3.2.tar.gz root@unraid:/tmp/
+scp openpxe-0.4.1.tar.gz root@unraid:/tmp/
 
 # On Unraid
-gunzip -c /tmp/openpxe-0.3.2.tar.gz | docker load
+gunzip -c /tmp/openpxe-0.4.1.tar.gz | docker load
-docker tag openpxe:0.3.2 gitea.milesward.dev/mward4/openpxe:0.3.2
+docker tag openpxe:0.4.1 gitea.milesward.dev/mward4/openpxe:0.4.1
 ```
 
 If you want it pullable by tag from other Unraid templates, push to

docs/NEXT_PHASE.md

@@ -1,6 +1,6 @@
 # Phase 6 — recommendations
 
-The v0.3.2 cut leaves OpenPXE in a state where the entire protocol stack
+The v0.4.1 cut leaves OpenPXE in a state where the entire protocol stack
 and operator UI are exercised by the automated test suite, the container is
 multi-arch buildable, and the image ships at ~97 MB. What's left before
 this looks and feels like a 1.0 product is mostly **real-hardware

docs/architecture.md

@@ -265,10 +265,9 @@ tab is one click from the brand bar.
 - Persisted to `<work_dir>/hosts.json`. Like `SettingsStore`, in-memory
   is authoritative — disk corruption falls back to empty rather than
   failing startup.
-- Inspired by Tinkerbell `smee`'s MAC-prepended URL pattern. The DHCP
+- The DHCP reply embeds `?mac=${mac}` in the boot.ipxe URL; iPXE
-  reply now embeds `?mac=${mac}` in the boot.ipxe URL; iPXE substitutes
+  substitutes the literal MAC client-side, so the HTTP layer can
-  the literal MAC client-side, so the HTTP layer can short-circuit
+  short-circuit past the menu when a binding exists.
-  past the menu when a binding exists.
 - `/api/hosts` GET / POST / DELETE drives the **Hosts** tab.
 
 **Prometheus metrics** (`crates/core/src/metrics.rs`):