v0.4.4: Settings tab, API reference, ISO category, branding, disk space

Settings:
- New top-level Settings tab. Carries a placeholder for the planned
  LDAP / OIDC / user-management work, the new branding controls, and
  the API reference at the bottom.
- Custom logo upload (PNG/SVG/JPEG/WebP/GIF up to 2 MB) replaces the
  bundled brand mark via /assets/logo.svg; bytes live at
  <work_dir>/branding/ and survive restart. The original "OpenPXE
  v<x.y.z>" pins to the sidebar footer for support.
- API reference rendered from a new GET /api/docs into a per-method
  coloured pill list grouped by area.

ISO category (Storage):
- New IsoCategory { Os, Tools } on IsoMeta with PUT
  /api/isos/:id/category. Storage table's Type cell becomes a
  dropdown; selecting Tools moves the ISO into the Tools submenu next
  to memtest / shell / NIC info and removes it from the OS Installers
  family submenu. Family detection still drives BIOS/UEFI / kernel
  args; only the menu placement changes.

Storage telemetry:
- New IsoStore::disk_usage (libc::statvfs, lives in iso-store so the
  http-api crate stays #![forbid(unsafe_code)]) and GET
  /api/storage/disk. The Storage tab now shows free/used/total for
  the volume hosting the ISO directory with an 80%/95% colour ramp.

UI polish:
- Brand block in the sidebar now matches the topbar height exactly,
  so the divider runs straight across the top of the app rather than
  stepping; version label moved out of the brand and pinned to the
  sidebar footer ("OpenPXE v0.4.4").
- Light-mode terminal: --terminal-bg + per-level text colours track
  the active theme rather than being hard-coded dark.
- About: lead paragraph spans the full content width; new Docs row
  links to https://openpxe.com/.

106 tests passing (was 89 in v0.4.1, +17 across branding unit tests
and new integration coverage for category / disk / docs / branding).
cargo clippy --workspace --all-targets clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

.gitignore

@@ -1,5 +1,4 @@
 /target
-Cargo.lock
 data/isos/*.iso
 data/isos/*.partial
 data/isos/*.meta.json

Cargo.toml

@@ -12,9 +12,9 @@ members = [
 ]
 
 [workspace.package]
-version = "0.4.0"
+version = "0.4.4"
 edition = "2021"
-rust-version = "1.80"
+rust-version = "1.95"
 license = "MIT OR Apache-2.0"
 repository = "https://gitea.milesward.dev/mward4/OpenPXE"
 authors = ["OpenPXE contributors"]

README.md

@@ -5,11 +5,11 @@ Container-native PXE boot server. A Rust reimplementation of
 for Docker/OCI and OpenShift. Upload `.iso` files via the web UI; network
 clients PXE-boot them.
 
-> **Status:** v0.3.2 / pre-beta. Phases 1–5 complete: full PXE stack,
+> **Status:** v0.4.1 / pre-beta. Phases 1–5 complete: full PXE stack,
 > Queued Deployment queue, NFS-share ISO sources, live tracing log + an
-> operator terminal, per-MAC host bindings (Tinkerbell-style),
-> Prometheus `/metrics`, light/dark theme toggle, animated OpenPXE
-> imaging-progress widget, and per-ISO boot passwords. The test suite and
+> operator terminal, per-MAC host bindings, Prometheus `/metrics`,
+> light/dark theme toggle, animated OpenPXE imaging-progress widget,
+> chunked ISO uploads, and per-ISO boot passwords. The test suite and
 > clippy are part of the release checklist. Ready for real-hardware validation.
 
 ## Design non-negotiables
@@ -51,8 +51,7 @@ clients PXE-boot them.
    widget when devices are imaging. All assets served from the binary —
    no external requests.
 8. **Per-MAC host bindings.** Pin a MAC to a boot target and the client
-   skips the menu, chains straight through. Inspired by Tinkerbell's
-   `smee` MAC-prepended URL pattern.
+   skips the menu, chains straight through.
 9. **Prometheus metrics** at `/metrics` — DHCP replies by arch, TFTP
    transfer counts and bytes, HTTP request counts by route, queue /
    imaging gauges, uptime, build info. Plain text exposition format,
@@ -81,7 +80,7 @@ skip TFTP and respond with an HTTP URL.
 ./scripts/fetch-ipxe.sh
 
 # 2. Build the container image (~3 min first time).
-docker buildx build -f deploy/docker/Dockerfile -t openpxe:0.3.2 --load .
+docker buildx build -f deploy/docker/Dockerfile -t openpxe:0.4.1 --load .
 
 # 3. Run it on the box plugged into your PXE network. Set PUBLIC_IP to
 #    this host's LAN address so advertised iPXE URLs are reachable.
@@ -91,7 +90,7 @@ docker run -d --name openpxe \
   -e OPENPXE_DHCP_MODE=proxy \
   -v $PWD/data/isos:/var/lib/openpxe/isos \
   -v $PWD/data/work:/var/lib/openpxe/work \
-  openpxe:0.3.2
+  openpxe:0.4.1
 
 # 4. Open the UI and drop an ISO in.
 open http://10.0.0.5
@@ -122,7 +121,7 @@ docker buildx create --name openpxe-multi --driver docker-container --use
 # Build + push both linux/amd64 and linux/arm64 under one tag.
 docker buildx build --builder openpxe-multi \
   --platform linux/amd64,linux/arm64 \
-  -t ghcr.io/YOUR-ORG/openpxe:0.3.2 \
+  -t ghcr.io/YOUR-ORG/openpxe:0.4.1 \
   --push \
   -f deploy/docker/Dockerfile .
 ```
@@ -155,10 +154,10 @@ docker run --rm \
   -v /my/iso-library:/seed:ro \
   -v openpxe-data:/var/lib/openpxe/isos \
   -e OPENPXE_PUBLIC_IP=10.0.0.5 \
-  openpxe:0.3.2 seed --from /seed
+  openpxe:0.4.1 seed --from /seed
 
 # Dry run first to see what would be imported:
-docker run --rm -v /my/iso-library:/seed:ro openpxe:0.3.2 seed --from /seed --dry-run
+docker run --rm -v /my/iso-library:/seed:ro openpxe:0.4.1 seed --from /seed --dry-run
 ```
 
 ### Environment overrides

crates/core/src/branding.rs

@@ -0,0 +1,339 @@
+//! Operator-controlled branding overrides.
+//!
+//! The browser tab's logo (`/assets/logo.svg`) defaults to the bundled
+//! rainbow-horizon mark. Operators who deploy OpenPXE behind their own
+//! branding can upload a replacement that lives at
+//! `<work_dir>/branding/logo.<ext>` and is served in preference to the
+//! bundled SVG when present. Borrowed-from-FleetDM: tenant chrome, same
+//! product.
+//!
+//! Storage policy mirrors `HostBindings` / `BootLog`: in-memory cache is
+//! authoritative for the current process, disk is the source of truth on
+//! restart, and a corrupt cache file falls back to the bundled default
+//! rather than blocking startup.
+
+use parking_lot::RwLock;
+use serde::{Deserialize, Serialize};
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+
+/// Allowed MIME types for an uploaded logo. We deliberately keep this
+/// narrow — anything that can be `<img src="...">`'d into the brand
+/// block, no scripts. SVG carries the obvious XSS risk for raw inline
+/// HTML; we always serve the bytes as a separate asset with a strict
+/// content-type rather than inlining, so SVG is safe.
+pub const ALLOWED_LOGO_MIMES: &[&str] = &[
+    "image/svg+xml",
+    "image/png",
+    "image/jpeg",
+    "image/webp",
+    "image/gif",
+];
+
+/// Disk cap for an uploaded logo. PXE WebUIs are operator-facing — even
+/// a generous 2 MB cap is comfortable for any reasonable brand mark and
+/// puts a clear bound on memory + serialization cost.
+pub const MAX_LOGO_BYTES: usize = 2 * 1024 * 1024;
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+struct Inner {
+    /// File name (relative to the branding dir) for the active logo, if
+    /// any. Always under `<work_dir>/branding/`; never an absolute path
+    /// from the operator.
+    logo_filename: Option<String>,
+    /// MIME of the active logo, mirroring `logo_filename`. Cached here
+    /// so the HTTP layer can set Content-Type without re-sniffing.
+    logo_mime: Option<String>,
+}
+
+/// In-memory + on-disk override registry. Cheap to clone; locks are
+/// brief. The `branding.json` cache lives alongside the active asset
+/// inside `<work_dir>/branding/`.
+#[derive(Debug, Clone)]
+pub struct BrandingStore {
+    /// Root directory: `<work_dir>/branding/`. Created on first write.
+    dir: Arc<PathBuf>,
+    inner: Arc<RwLock<Inner>>,
+}
+
+impl BrandingStore {
+    /// Load (or initialise empty) from `<work_dir>/branding/`. Tolerates
+    /// missing directories, partial state, and corrupt JSON — a bad
+    /// cache should never block PXE for the network.
+    #[must_use]
+    pub fn load_or_default(work_dir: &Path) -> Self {
+        let dir = work_dir.join("branding");
+        let path = dir.join("branding.json");
+        let mut inner = Inner::default();
+        if let Ok(text) = std::fs::read_to_string(&path) {
+            match serde_json::from_str::<Inner>(&text) {
+                Ok(parsed) => {
+                    // Sanity: if the JSON says we have a logo but the
+                    // file is gone, clear the in-memory pointer so
+                    // /assets/logo.svg falls back to the bundled SVG
+                    // rather than 500ing on a missing file.
+                    if let Some(name) = parsed.logo_filename.as_deref() {
+                        if dir.join(name).is_file() {
+                            inner = parsed;
+                        } else {
+                            tracing::warn!(
+                                target: "openpxe::branding",
+                                file = %name,
+                                "branding.json points at missing file; clearing"
+                            );
+                        }
+                    } else {
+                        inner = parsed;
+                    }
+                }
+                Err(e) => {
+                    tracing::warn!(
+                        target: "openpxe::branding",
+                        "branding.json present but unreadable ({e}); starting empty"
+                    );
+                }
+            }
+        }
+        Self {
+            dir: Arc::new(dir),
+            inner: Arc::new(RwLock::new(inner)),
+        }
+    }
+
+    /// Absolute path to the active logo, if one is set and present on
+    /// disk. `None` means the HTTP layer should serve the bundled SVG.
+    #[must_use]
+    pub fn logo_path(&self) -> Option<PathBuf> {
+        let g = self.inner.read();
+        g.logo_filename.as_deref().map(|n| self.dir.join(n))
+    }
+
+    /// MIME of the active logo, if any. The HTTP layer pairs this with
+    /// the bytes returned by [`Self::logo_path`].
+    #[must_use]
+    pub fn logo_mime(&self) -> Option<String> {
+        self.inner.read().logo_mime.clone()
+    }
+
+    /// Replace the active logo. Returns the chosen on-disk filename so
+    /// the caller can echo it back in the API response. Old logos are
+    /// removed best-effort.
+    pub fn set_logo(&self, mime: &str, ext: &str, bytes: &[u8]) -> std::io::Result<String> {
+        std::fs::create_dir_all(self.dir.as_path())?;
+        // Single canonical filename per upload — overwriting the old one
+        // (after clearing it) keeps the directory tidy and avoids any
+        // path-traversal concern: the operator never supplies the name.
+        let safe_ext = sanitize_ext(ext);
+        let filename = format!("logo.{safe_ext}");
+        let final_path = self.dir.join(&filename);
+        // Atomic write: tmp -> rename. Guarantees the file is either
+        // entirely the old logo or entirely the new one.
+        let tmp = final_path.with_extension(format!("{safe_ext}.tmp"));
+        std::fs::write(&tmp, bytes)?;
+        std::fs::rename(&tmp, &final_path)?;
+        // Clean up any sibling logo.<otherext> so there's exactly one
+        // canonical file at any time.
+        if let Ok(entries) = std::fs::read_dir(self.dir.as_path()) {
+            for e in entries.flatten() {
+                let p = e.path();
+                let name = p
+                    .file_name()
+                    .and_then(|s| s.to_str())
+                    .unwrap_or("");
+                if name.starts_with("logo.") && name != filename {
+                    let _ = std::fs::remove_file(&p);
+                }
+            }
+        }
+
+        {
+            let mut g = self.inner.write();
+            g.logo_filename = Some(filename.clone());
+            g.logo_mime = Some(mime.to_string());
+        }
+        self.persist();
+        tracing::info!(
+            target: "openpxe::branding",
+            file = %filename, mime = %mime, size = bytes.len(),
+            "custom logo installed"
+        );
+        Ok(filename)
+    }
+
+    /// Drop the override and return to the bundled SVG.
+    pub fn clear_logo(&self) -> std::io::Result<()> {
+        let removed = {
+            let mut g = self.inner.write();
+            let removed = g.logo_filename.take();
+            g.logo_mime = None;
+            removed
+        };
+        if let Some(name) = removed {
+            let p = self.dir.join(&name);
+            let _ = std::fs::remove_file(&p);
+            tracing::info!(target: "openpxe::branding", file = %name, "custom logo cleared");
+        }
+        self.persist();
+        Ok(())
+    }
+
+    /// Convenience: true if a custom logo is configured. Surfaces on
+    /// `/api/status` so the WebUI can show "Custom logo: yes" without
+    /// fetching the asset itself.
+    #[must_use]
+    pub fn has_logo(&self) -> bool {
+        self.inner.read().logo_filename.is_some()
+    }
+
+    fn persist(&self) {
+        let snap = self.inner.read().clone();
+        let body = match serde_json::to_vec_pretty(&snap) {
+            Ok(b) => b,
+            Err(e) => {
+                tracing::warn!(target: "openpxe::branding", "serialize branding.json: {e}");
+                return;
+            }
+        };
+        if let Err(e) = std::fs::create_dir_all(self.dir.as_path()) {
+            tracing::warn!(target: "openpxe::branding", "mkdir branding/: {e}");
+            return;
+        }
+        let path = self.dir.join("branding.json");
+        let tmp = path.with_extension("json.tmp");
+        if let Err(e) = std::fs::write(&tmp, body) {
+            tracing::warn!(target: "openpxe::branding", "write branding.json tmp: {e}");
+            return;
+        }
+        if let Err(e) = std::fs::rename(&tmp, &path) {
+            tracing::warn!(target: "openpxe::branding", "rename branding.json: {e}");
+        }
+    }
+}
+
+/// Trim arbitrary operator-supplied extension strings to a small, safe
+/// alphanumeric form. Anything weird collapses to `bin`. We never let
+/// the extension affect the path beyond the final segment of `logo.<x>`.
+fn sanitize_ext(ext: &str) -> String {
+    let lc: String = ext
+        .chars()
+        .filter(char::is_ascii_alphanumeric)
+        .map(|c| c.to_ascii_lowercase())
+        .collect();
+    if lc.is_empty() || lc.len() > 5 {
+        "bin".into()
+    } else {
+        lc
+    }
+}
+
+/// Pick a safe filesystem extension from a MIME type. Returns `None`
+/// if the MIME isn't on the [`ALLOWED_LOGO_MIMES`] allowlist.
+#[must_use]
+pub fn ext_for_mime(mime: &str) -> Option<&'static str> {
+    match mime {
+        "image/svg+xml" => Some("svg"),
+        "image/png" => Some("png"),
+        "image/jpeg" => Some("jpg"),
+        "image/webp" => Some("webp"),
+        "image/gif" => Some("gif"),
+        _ => None,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::tempdir;
+
+    #[test]
+    fn empty_after_load_when_no_branding_dir() {
+        let dir = tempdir().unwrap();
+        let b = BrandingStore::load_or_default(dir.path());
+        assert!(!b.has_logo());
+        assert!(b.logo_path().is_none());
+        assert!(b.logo_mime().is_none());
+    }
+
+    #[test]
+    fn set_clear_round_trip_persists() {
+        let dir = tempdir().unwrap();
+        let b = BrandingStore::load_or_default(dir.path());
+        let name = b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake").unwrap();
+        assert_eq!(name, "logo.png");
+        assert!(b.has_logo());
+        assert_eq!(b.logo_mime().as_deref(), Some("image/png"));
+        let p = b.logo_path().unwrap();
+        assert!(p.is_file());
+
+        // Re-open and confirm the override survives a restart.
+        drop(b);
+        let b2 = BrandingStore::load_or_default(dir.path());
+        assert!(b2.has_logo());
+        assert_eq!(b2.logo_mime().as_deref(), Some("image/png"));
+
+        // Clear; the file goes away and has_logo flips off.
+        b2.clear_logo().unwrap();
+        assert!(!b2.has_logo());
+        assert!(!p.exists());
+    }
+
+    #[test]
+    fn replacing_logo_removes_old_extension_sibling() {
+        // PNG then SVG; only the SVG should remain on disk.
+        let dir = tempdir().unwrap();
+        let b = BrandingStore::load_or_default(dir.path());
+        b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake").unwrap();
+        b.set_logo("image/svg+xml", "svg", br#"<svg xmlns="http://www.w3.org/2000/svg"/>"#).unwrap();
+        let entries: Vec<_> = std::fs::read_dir(dir.path().join("branding"))
+            .unwrap()
+            .filter_map(|e| e.ok().map(|e| e.file_name().to_string_lossy().into_owned()))
+            .collect();
+        assert!(entries.iter().any(|n| n == "logo.svg"), "got {entries:?}");
+        assert!(!entries.iter().any(|n| n == "logo.png"), "stale PNG left over: {entries:?}");
+    }
+
+    #[test]
+    fn sanitize_ext_strips_separators_and_path_chars() {
+        assert_eq!(sanitize_ext("svg"), "svg");
+        // Path separators and non-alphanumerics filter out, leaving just
+        // letters. The remaining "etcpasswd" exceeds the 5-char cap so
+        // it collapses to `bin` rather than producing `etcpa`.
+        assert_eq!(sanitize_ext("../etc/passwd"), "bin");
+        // Short alphanumeric strip-through stays itself.
+        assert_eq!(sanitize_ext("../svg"), "svg");
+        assert_eq!(sanitize_ext(""), "bin");
+        assert_eq!(sanitize_ext("PNG"), "png");
+        // Anything past five chars is suspicious — collapse to `bin`.
+        assert_eq!(sanitize_ext("svgvvvv"), "bin");
+    }
+
+    #[test]
+    fn missing_file_referenced_by_json_resolves_to_empty() {
+        // If the operator nukes the file out from under the JSON cache,
+        // we should silently fall back to no-override rather than
+        // hanging on to a bogus path.
+        let dir = tempdir().unwrap();
+        let brand_dir = dir.path().join("branding");
+        std::fs::create_dir_all(&brand_dir).unwrap();
+        // Hand-write a branding.json claiming logo.png exists.
+        let inner = Inner {
+            logo_filename: Some("logo.png".into()),
+            logo_mime: Some("image/png".into()),
+        };
+        std::fs::write(
+            brand_dir.join("branding.json"),
+            serde_json::to_vec_pretty(&inner).unwrap(),
+        )
+        .unwrap();
+        let b = BrandingStore::load_or_default(dir.path());
+        assert!(!b.has_logo(), "should fall back when referenced file is missing");
+    }
+
+    #[test]
+    fn ext_for_mime_only_accepts_known_types() {
+        assert_eq!(ext_for_mime("image/png"), Some("png"));
+        assert_eq!(ext_for_mime("image/svg+xml"), Some("svg"));
+        assert_eq!(ext_for_mime("application/octet-stream"), None);
+        assert_eq!(ext_for_mime("text/html"), None);
+    }
+}

crates/core/src/host_bindings.rs

@@ -1,10 +1,9 @@
 //! Per-MAC host bindings.
 //!
-//! Inspired by the Tinkerbell `smee` "MAC-prepended URL" pattern: an
-//! operator can attach a preferred boot target (a `BootEntry::id`) to a
-//! specific MAC address. When a client with that MAC arrives, the
-//! top-level boot script chains straight to that target instead of
-//! showing the interactive menu.
+//! Operators can attach a preferred boot target (a `BootEntry::id`) to a
+//! specific MAC address. When a client with that MAC arrives, the top-level
+//! boot script chains straight to that target instead of showing the
+//! interactive menu.
 //!
 //! Use cases:
 //! - "This rack of Dell servers always images with Ubuntu Server 24.04"

crates/core/src/lib.rs

@@ -4,6 +4,7 @@
 
 pub mod arch;
 pub mod boot_log;
+pub mod branding;
 pub mod client;
 pub mod config;
 pub mod error;
@@ -15,6 +16,7 @@ pub mod settings;
 
 pub use arch::{ClientArch, FirmwareClass};
 pub use boot_log::{BootEvent, BootLog};
+pub use branding::{ext_for_mime, BrandingStore, ALLOWED_LOGO_MIMES, MAX_LOGO_BYTES};
 pub use client::{ClientEvent, ClientRegistry, ClientSnapshot};
 pub use config::{Config, DhcpMode, NetworkConfig, Paths, ServerConfig};
 pub use error::{Error, Result};

crates/http-api/Cargo.toml

@@ -31,6 +31,7 @@ bytes.workspace = true
 futures.workspace = true
 mime.workspace = true
 mime_guess.workspace = true
+uuid.workspace = true
 
 [dev-dependencies]
 tokio = { workspace = true, features = ["macros", "rt", "rt-multi-thread", "time"] }

crates/http-api/src/app.rs

@@ -22,19 +22,21 @@ use crate::log_stream;
 use crate::state::AppState;
 use crate::terminal;
 use axum::{
-    body::Body,
+    body::{Body, Bytes},
     extract::{ConnectInfo, DefaultBodyLimit, Multipart, Path as AxumPath, Query, State},
     http::{header, HeaderMap, HeaderValue, StatusCode},
     response::{IntoResponse, Response},
-    routing::{delete, get, post},
+    routing::{delete, get, post, put},
     Json, Router,
 };
-use openpxe_core::{BootEvent, ClientEvent, Settings};
-use std::net::SocketAddr;
+use openpxe_core::{
+    ext_for_mime, BootEvent, ClientEvent, Error, Settings, ALLOWED_LOGO_MIMES, MAX_LOGO_BYTES,
+};
 use openpxe_ipxe_assets::asset_bytes;
-use openpxe_iso_store::{IsoMeta, NfsAddRequest};
+use openpxe_iso_store::{IsoCategory, IsoMeta, NfsAddRequest};
 use serde::Deserialize;
 use serde_json::json;
+use std::net::SocketAddr;
 use std::time::Duration;
 use tokio::io::{AsyncReadExt, AsyncSeekExt};
 use tower_http::trace::TraceLayer;
@@ -62,12 +64,39 @@ pub fn build_router(state: AppState) -> Router {
         // JSON API.
         .route("/api/isos", get(api_list_isos).post(api_upload_iso))
         .route("/api/isos/:id", delete(api_delete_iso))
+        .route("/api/uploads", post(api_upload_begin))
+        .route(
+            "/api/uploads/:upload_id",
+            put(api_upload_chunk).delete(api_upload_abort),
+        )
         // Per-ISO password prompt. PUT body `{ "password": "..." }`
         // sets, `{ "password": null }` (or DELETE) clears.
         .route(
             "/api/isos/:id/password",
             axum::routing::put(api_set_iso_password).delete(api_clear_iso_password),
         )
+        // v0.4.4: per-ISO menu category (Os / Tools). Drives whether the
+        // image appears under Linux/Windows Installers (default) or in
+        // the Tools submenu next to memtest / shell / NIC info.
+        .route(
+            "/api/isos/:id/category",
+            axum::routing::put(api_set_iso_category),
+        )
+        // v0.4.4: filesystem free-space telemetry for the ISO directory's
+        // volume — surfaced as a small card on the Storage tab so the
+        // operator knows when they're about to run out of room.
+        .route("/api/storage/disk", get(api_storage_disk))
+        // v0.4.4: operator-controlled WebUI branding overrides
+        // (custom logo). Multipart upload to POST; DELETE clears.
+        .route(
+            "/api/branding/logo",
+            post(api_branding_upload).delete(api_branding_clear),
+        )
+        // v0.4.4: self-rendered API reference, served as JSON so the UI
+        // can format it consistently with the rest of the chrome. Lives
+        // under the Settings tab — operators chasing an integration get
+        // it in-product instead of having to fetch the OpenAPI YAML.
+        .route("/api/docs", get(api_docs))
         .route("/api/clients", get(api_list_clients))
         .route("/api/status", get(api_status))
         .route("/api/settings", get(api_get_settings).put(api_put_settings))
@@ -88,11 +117,11 @@ pub fn build_router(state: AppState) -> Router {
         .route("/api/log/clear", post(log_stream::clear))
         // Phase 4: operator terminal commands (whitelisted).
         .route("/api/terminal", post(terminal::run_command))
-        // Phase 5: per-MAC host bindings (Tinkerbell-style). Operator
+        // Phase 5: per-MAC host bindings. Operator
         // pins a MAC to a boot entry; /boot.ipxe?mac=... chains directly.
         .route("/api/hosts", get(api_hosts_list).post(api_hosts_upsert))
         .route("/api/hosts/:mac", delete(api_hosts_remove))
-        // v0.4.0: rolling "host log" of boot events — what image actually
+        // Rolling "host log" of boot events: what image actually
         // started installing on what MAC/IP, and when. Persisted to disk.
         .route("/api/boot-log", get(api_boot_log))
         // Phase 5: Prometheus scrape endpoint. Plain text exposition
@@ -138,7 +167,43 @@ async fn ui_css() -> Response {
         .into_response()
 }
 
-async fn ui_logo() -> Response {
+async fn ui_logo(State(state): State<AppState>) -> Response {
+    // Custom override first; fall back to the bundled rainbow-horizon
+    // SVG. We resolve the override on each request rather than caching
+    // because operators may upload/clear from the Settings tab while the
+    // server is live, and we want them to see their change immediately
+    // without bouncing the binary.
+    if let Some(path) = state.branding.logo_path() {
+        let mime = state
+            .branding
+            .logo_mime()
+            .unwrap_or_else(|| "image/svg+xml".to_string());
+        match tokio::fs::read(&path).await {
+            Ok(bytes) => {
+                let ct = match HeaderValue::from_str(&mime) {
+                    Ok(v) => v,
+                    Err(_) => HeaderValue::from_static("application/octet-stream"),
+                };
+                return (
+                    [
+                        (header::CONTENT_TYPE, ct),
+                        (
+                            header::CACHE_CONTROL,
+                            HeaderValue::from_static("no-cache, max-age=0"),
+                        ),
+                    ],
+                    bytes,
+                )
+                    .into_response();
+            }
+            Err(e) => {
+                tracing::warn!(
+                    target: "openpxe::http::branding",
+                    error = %e, "failed to read custom logo; falling back to bundled"
+                );
+            }
+        }
+    }
     (
         [(
             header::CONTENT_TYPE,
@@ -293,7 +358,7 @@ async fn boot_sub(
         "_local" => render_local_hdd(base),
         "_linux_menu" => render_family_menu(&isos, base, false),
         "_windows_menu" => render_family_menu(&isos, base, true),
-        "_tools_menu" => render_tools_menu(base),
+        "_tools_menu" => render_tools_menu(&isos, base),
         "_util" => render_util(base),
         "_shell" => render_shell(base),
         "_nic" => render_nic_info(base),
@@ -615,6 +680,274 @@ async fn api_clear_iso_password(
     }
 }
 
+// ─── ISO category (OS / Tools) ────────────────────────────────────────────
+
+#[derive(Debug, Deserialize)]
+struct SetCategoryBody {
+    /// `"os"` or `"tools"` — matches `IsoCategory`'s snake_case serde
+    /// repr. Anything else returns 400 with the allowed set spelled out.
+    category: String,
+}
+
+async fn api_set_iso_category(
+    State(state): State<AppState>,
+    AxumPath(id): AxumPath<String>,
+    Json(body): Json<SetCategoryBody>,
+) -> Response {
+    let cat = match body.category.as_str() {
+        "os" => IsoCategory::Os,
+        "tools" => IsoCategory::Tools,
+        other => {
+            return (
+                StatusCode::BAD_REQUEST,
+                format!("unknown category '{other}'; expected one of: os, tools"),
+            )
+                .into_response();
+        }
+    };
+    match state.iso_store.set_category(&id, cat).await {
+        Ok(meta) => {
+            tracing::info!(
+                target: "openpxe::http::iso",
+                iso = %id, category = ?cat,
+                "iso category updated"
+            );
+            (StatusCode::OK, Json(meta)).into_response()
+        }
+        Err(Error::Invalid(msg)) => (StatusCode::NOT_FOUND, msg).into_response(),
+        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
+    }
+}
+
+// ─── Disk space (Storage tab) ─────────────────────────────────────────────
+
+async fn api_storage_disk(State(state): State<AppState>) -> Json<serde_json::Value> {
+    // statvfs on the directory that holds the ISO store. We deliberately
+    // don't walk the directory ourselves — the kernel already tracks
+    // free/total at the volume level and that's the only number the
+    // operator actually cares about for "do I have room for one more
+    // 5 GB ISO?". `statvfs` itself lives in iso-store to keep the
+    // http-api crate free of `unsafe`.
+    let dir = state.iso_store.iso_dir();
+    let (total, available) = state.iso_store.disk_usage().unwrap_or((0, 0));
+    let used = total.saturating_sub(available);
+    Json(json!({
+        "path": dir.to_string_lossy(),
+        "total_bytes": total,
+        "available_bytes": available,
+        "used_bytes": used,
+    }))
+}
+
+// ─── Branding (custom logo) ───────────────────────────────────────────────
+
+async fn api_branding_upload(
+    State(state): State<AppState>,
+    mut multipart: Multipart,
+) -> Response {
+    while let Ok(Some(field)) = multipart.next_field().await {
+        let name = field.name().unwrap_or("").to_string();
+        if name != "file" && name != "logo" {
+            continue;
+        }
+        let mime = field.content_type().unwrap_or("").to_string();
+        if !ALLOWED_LOGO_MIMES.iter().any(|m| *m == mime) {
+            return (
+                StatusCode::BAD_REQUEST,
+                format!(
+                    "unsupported MIME '{mime}'. Allowed: {}",
+                    ALLOWED_LOGO_MIMES.join(", ")
+                ),
+            )
+                .into_response();
+        }
+        // Pre-read into memory so we can enforce the size cap before
+        // hitting disk. Logos are tiny by definition.
+        let bytes = match field.bytes().await {
+            Ok(b) => b,
+            Err(e) => {
+                return (StatusCode::BAD_REQUEST, format!("read body: {e}")).into_response()
+            }
+        };
+        if bytes.len() > MAX_LOGO_BYTES {
+            return (
+                StatusCode::PAYLOAD_TOO_LARGE,
+                format!(
+                    "logo too large ({} bytes, max {})",
+                    bytes.len(),
+                    MAX_LOGO_BYTES
+                ),
+            )
+                .into_response();
+        }
+        let Some(ext) = ext_for_mime(&mime) else {
+            return (StatusCode::BAD_REQUEST, "unsupported MIME").into_response();
+        };
+        match state.branding.set_logo(&mime, ext, &bytes) {
+            Ok(filename) => {
+                return (
+                    StatusCode::OK,
+                    Json(json!({
+                        "filename": filename,
+                        "mime": mime,
+                        "size_bytes": bytes.len(),
+                    })),
+                )
+                    .into_response()
+            }
+            Err(e) => {
+                return (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response()
+            }
+        }
+    }
+    (StatusCode::BAD_REQUEST, "no 'file' part").into_response()
+}
+
+async fn api_branding_clear(State(state): State<AppState>) -> Response {
+    match state.branding.clear_logo() {
+        Ok(()) => StatusCode::NO_CONTENT.into_response(),
+        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
+    }
+}
+
+// ─── API reference (Settings → bottom) ────────────────────────────────────
+
+async fn api_docs() -> Json<serde_json::Value> {
+    // Hand-curated rather than introspected from axum because:
+    //   1. axum's runtime route table doesn't carry parameter docs;
+    //   2. the WebUI surfaces this as a readable list, not as an OpenAPI
+    //      spec — readers are operators chasing an integration, not
+    //      machines.
+    // Keep this in lockstep with `build_router` when adding endpoints.
+    Json(json!({
+        "version": env!("CARGO_PKG_VERSION"),
+        "groups": [
+            {
+                "name": "Status & health",
+                "endpoints": [
+                    {"method": "GET", "path": "/healthz",
+                     "summary": "Liveness — always 200 OK while the HTTP task is alive."},
+                    {"method": "GET", "path": "/readyz",
+                     "summary": "Readiness — 200 only when iPXE binaries are bundled and the ISO directory is readable."},
+                    {"method": "GET", "path": "/api/status",
+                     "summary": "Dashboard JSON — versions, counts, settings snapshot, uptime."},
+                    {"method": "GET", "path": "/metrics",
+                     "summary": "Prometheus text exposition (counters + gauges)."},
+                ],
+            },
+            {
+                "name": "ISO images",
+                "endpoints": [
+                    {"method": "GET", "path": "/api/isos",
+                     "summary": "List ISOs (local + NFS) with size, family, boot entries, category."},
+                    {"method": "POST", "path": "/api/isos",
+                     "summary": "Legacy single-shot multipart upload. Prefer /api/uploads for big files."},
+                    {"method": "DELETE", "path": "/api/isos/:id",
+                     "summary": "Delete a local ISO and its sidecar metadata."},
+                    {"method": "PUT", "path": "/api/isos/:id/password",
+                     "summary": "Set or update an ISO's boot password (bcrypt-hashed; plaintext never stored)."},
+                    {"method": "DELETE", "path": "/api/isos/:id/password",
+                     "summary": "Clear an ISO's boot password."},
+                    {"method": "PUT", "path": "/api/isos/:id/category",
+                     "summary": "Set the menu category. Body: { \"category\": \"os\" | \"tools\" }."},
+                ],
+            },
+            {
+                "name": "Chunked uploads",
+                "endpoints": [
+                    {"method": "POST", "path": "/api/uploads",
+                     "summary": "Begin a chunked upload session. Body: { \"filename\", \"size_bytes\" }."},
+                    {"method": "PUT", "path": "/api/uploads/:upload_id",
+                     "summary": "Append a chunk. Headers: x-openpxe-upload-offset, x-openpxe-upload-complete."},
+                    {"method": "DELETE", "path": "/api/uploads/:upload_id",
+                     "summary": "Abort a chunked upload session and remove the .partial file."},
+                ],
+            },
+            {
+                "name": "NFS shares",
+                "endpoints": [
+                    {"method": "GET", "path": "/api/nfs",
+                     "summary": "List configured NFS shares with mount state and iso counts."},
+                    {"method": "POST", "path": "/api/nfs",
+                     "summary": "Mount an NFS share. Body: { server, export, version, read_only }."},
+                    {"method": "DELETE", "path": "/api/nfs/:id",
+                     "summary": "Unmount a share and drop its entries from the ISO store."},
+                    {"method": "POST", "path": "/api/nfs/:id/scan",
+                     "summary": "Re-walk a mounted share for ISOs."},
+                ],
+            },
+            {
+                "name": "Network",
+                "endpoints": [
+                    {"method": "GET", "path": "/api/network",
+                     "summary": "Detected NIC, server IP, subnet, gateway, advertised base URL."},
+                    {"method": "PUT", "path": "/api/network",
+                     "summary": "Update the informational DNS server hint (does not run DNS)."},
+                ],
+            },
+            {
+                "name": "Settings",
+                "endpoints": [
+                    {"method": "GET", "path": "/api/settings",
+                     "summary": "Current runtime settings (Windows toggle, timeout, dns hint, …)."},
+                    {"method": "PUT", "path": "/api/settings",
+                     "summary": "Replace runtime settings. Guards against enabling Windows when wimboot isn't bundled."},
+                    {"method": "POST", "path": "/api/branding/logo",
+                     "summary": "Upload a custom WebUI logo (multipart 'file', PNG/SVG/JPEG/WebP/GIF up to 2 MB)."},
+                    {"method": "DELETE", "path": "/api/branding/logo",
+                     "summary": "Remove the custom logo and revert to the bundled mark."},
+                    {"method": "GET", "path": "/api/docs",
+                     "summary": "This API reference."},
+                ],
+            },
+            {
+                "name": "Storage telemetry",
+                "endpoints": [
+                    {"method": "GET", "path": "/api/storage/disk",
+                     "summary": "Free / used / total bytes for the volume hosting the ISO directory."},
+                ],
+            },
+            {
+                "name": "Queued Deployment",
+                "endpoints": [
+                    {"method": "GET", "path": "/api/queue",
+                     "summary": "List queue entries (waiting + assigned)."},
+                    {"method": "POST", "path": "/api/queue/assign",
+                     "summary": "Assign a target image to queued clients. Body: { target, entry_ids }."},
+                    {"method": "DELETE", "path": "/api/queue/:entry_id",
+                     "summary": "Release a queue entry without assigning."},
+                ],
+            },
+            {
+                "name": "Hosts & boot log",
+                "endpoints": [
+                    {"method": "GET", "path": "/api/hosts",
+                     "summary": "List per-MAC boot bindings."},
+                    {"method": "POST", "path": "/api/hosts",
+                     "summary": "Pin a MAC to a boot target. Body: { mac, target, label }."},
+                    {"method": "DELETE", "path": "/api/hosts/:mac",
+                     "summary": "Remove a binding."},
+                    {"method": "GET", "path": "/api/boot-log",
+                     "summary": "Ring of recent boot events (timestamp, mac, ip, target)."},
+                ],
+            },
+            {
+                "name": "Operator console",
+                "endpoints": [
+                    {"method": "GET", "path": "/api/clients",
+                     "summary": "Live PXE-client registry — MAC, last IP, arch, events."},
+                    {"method": "GET", "path": "/api/log/recent",
+                     "summary": "Ring of recent server log lines for the Terminal tab."},
+                    {"method": "GET", "path": "/api/log/stream",
+                     "summary": "Server-Sent Events stream of log lines."},
+                    {"method": "POST", "path": "/api/terminal",
+                     "summary": "Run a whitelisted operator command. Body: { command }."},
+                ],
+            },
+        ],
+    }))
+}
+
 async fn api_upload_iso(State(state): State<AppState>, mut multipart: Multipart) -> Response {
     // Walk multipart parts until we find the file. Each branch logs so an
     // operator chasing a "stuck" upload in the Terminal tab can see
@@ -638,8 +971,7 @@ async fn api_upload_iso(State(state): State<AppState>, mut multipart: Multipart)
                         target: "openpxe::http::upload",
                         filename = %filename, "rejecting non-.iso upload"
                     );
-                    return (StatusCode::BAD_REQUEST, "only .iso uploads accepted")
-                        .into_response();
+                    return (StatusCode::BAD_REQUEST, "only .iso uploads accepted").into_response();
                 }
                 tracing::info!(
                     target: "openpxe::http::upload",
@@ -725,8 +1057,7 @@ async fn api_upload_iso(State(state): State<AppState>, mut multipart: Multipart)
                             filename = %filename, error = %e,
                             "finish failed (rename/introspect)"
                         );
-                        return (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}"))
-                            .into_response();
+                        return (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response();
                     }
                 };
                 tracing::info!(
@@ -758,6 +1089,140 @@ async fn api_upload_iso(State(state): State<AppState>, mut multipart: Multipart)
     }
 }
 
+#[derive(Debug, Deserialize)]
+struct UploadBeginBody {
+    filename: String,
+    #[serde(default)]
+    size_bytes: Option<u64>,
+}
+
+async fn api_upload_begin(
+    State(state): State<AppState>,
+    Json(body): Json<UploadBeginBody>,
+) -> Response {
+    match state
+        .uploads
+        .begin(&state.iso_store, &body.filename, body.size_bytes)
+        .await
+    {
+        Ok(started) => {
+            tracing::info!(
+                target: "openpxe::http::upload",
+                upload_id = %started.upload_id,
+                iso = %started.iso_id,
+                filename = %started.filename,
+                expected_size = ?body.size_bytes,
+                "chunked upload started"
+            );
+            (StatusCode::CREATED, Json(started)).into_response()
+        }
+        Err(Error::Invalid(e)) if e.contains("already exists") => {
+            (StatusCode::CONFLICT, e).into_response()
+        }
+        Err(Error::Invalid(e)) => (StatusCode::BAD_REQUEST, e).into_response(),
+        Err(e) => {
+            tracing::error!(target: "openpxe::http::upload", error = %e, "chunked upload begin failed");
+            (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response()
+        }
+    }
+}
+
+async fn api_upload_chunk(
+    State(state): State<AppState>,
+    AxumPath(upload_id): AxumPath<String>,
+    headers: HeaderMap,
+    chunk: Bytes,
+) -> Response {
+    let Some(offset) = parse_u64_header(&headers, "x-openpxe-upload-offset") else {
+        return (
+            StatusCode::BAD_REQUEST,
+            "missing or invalid x-openpxe-upload-offset",
+        )
+            .into_response();
+    };
+    let complete = bool_header(&headers, "x-openpxe-upload-complete");
+
+    match state
+        .uploads
+        .append(&state.iso_store, &upload_id, offset, chunk, complete)
+        .await
+    {
+        Ok(crate::uploads::UploadAppend::Progress { offset }) => (
+            StatusCode::ACCEPTED,
+            Json(json!({
+                "ok": true,
+                "upload_id": upload_id,
+                "offset": offset,
+                "complete": false,
+            })),
+        )
+            .into_response(),
+        Ok(crate::uploads::UploadAppend::Complete { offset, iso }) => {
+            tracing::info!(
+                target: "openpxe::http::upload",
+                upload_id = %upload_id,
+                iso = %iso.id,
+                size = iso.size_bytes,
+                family = ?iso.introspection.family,
+                entries = iso.boot_entries.len(),
+                "chunked upload finished"
+            );
+            (
+                StatusCode::CREATED,
+                Json(json!({
+                    "ok": true,
+                    "upload_id": upload_id,
+                    "offset": offset,
+                    "complete": true,
+                    "iso": iso,
+                })),
+            )
+                .into_response()
+        }
+        Err(Error::Invalid(e)) if e.starts_with("expected offset") => {
+            (StatusCode::CONFLICT, e).into_response()
+        }
+        Err(Error::Invalid(e)) if e.starts_with("no such upload") => {
+            (StatusCode::NOT_FOUND, e).into_response()
+        }
+        Err(Error::Invalid(e)) => (StatusCode::BAD_REQUEST, e).into_response(),
+        Err(e) => {
+            tracing::error!(
+                target: "openpxe::http::upload",
+                upload_id = %upload_id,
+                error = %e,
+                "chunked upload failed"
+            );
+            (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response()
+        }
+    }
+}
+
+async fn api_upload_abort(
+    State(state): State<AppState>,
+    AxumPath(upload_id): AxumPath<String>,
+) -> Response {
+    match state.uploads.abort(&upload_id).await {
+        Ok(()) => StatusCode::NO_CONTENT.into_response(),
+        Err(Error::Invalid(e)) if e.starts_with("no such upload") => {
+            (StatusCode::NOT_FOUND, e).into_response()
+        }
+        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
+    }
+}
+
+fn parse_u64_header(headers: &HeaderMap, name: &'static str) -> Option<u64> {
+    headers.get(name)?.to_str().ok()?.trim().parse::<u64>().ok()
+}
+
+fn bool_header(headers: &HeaderMap, name: &'static str) -> bool {
+    headers
+        .get(name)
+        .and_then(|v| v.to_str().ok())
+        .map(str::trim)
+        .is_some_and(|v| matches!(v, "1" | "true" | "TRUE" | "yes" | "YES"))
+}
+
 // ─── health / readiness ───────────────────────────────────────────────────
 
 async fn healthz() -> Response {
@@ -842,6 +1307,7 @@ async fn api_status(State(state): State<AppState>) -> Json<serde_json::Value> {
         "nfs_count": nfs.len(),
         "nfs_active": nfs_active,
         "host_bindings": state.hosts.len(),
+        "custom_logo": state.branding.has_logo(),
         "uptime_secs": uptime_secs,
         "started_at": state.started_at,
         "nic_name": state.nic_name,

crates/http-api/src/ipxe_script.rs

@@ -149,6 +149,13 @@ pub fn render_family_menu(isos: &[IsoMeta], base_url: &str, is_windows: bool) ->
         if !filter(iso.introspection.family) {
             continue;
         }
+        // v0.4.4: ISOs the operator flipped to the Tools category move
+        // out of the OS installer submenus entirely — they only appear
+        // under Tools. Without this filter the operator would see the
+        // same ISO in both menus.
+        if matches!(iso.category, openpxe_iso_store::IsoCategory::Tools) {
+            continue;
+        }
         for entry in &iso.boot_entries {
             let size_label = fmt_size_mib(iso.size_bytes);
             let key = hotkey_for_index(count);
@@ -183,7 +190,7 @@ pub fn render_family_menu(isos: &[IsoMeta], base_url: &str, is_windows: bool) ->
         "iseq ${{target}} back && chain {base}/boot.ipxe || goto menu"
     );
     // Pass `?mac=${mac}` so the per-entry handler can record the booting
-    // client into the Host log (v0.4.0). iPXE substitutes `${mac}` before
+    // client into the Host log. iPXE substitutes `${mac}` before
     // the HTTP fetch; if the firmware can't resolve it the literal
     // `${mac}` is sent and the server treats it as "unknown".
     let _ = writeln!(
@@ -210,15 +217,52 @@ fn hotkey_for_index(i: usize) -> String {
     }
 }
 
-/// Tools submenu — Utilities, Shell, NIC Info, Reboot, Exit to firmware.
+/// Tools submenu — Utilities, Shell, NIC Info, Reboot, Exit to firmware,
+/// plus any ISOs the operator flipped to [`IsoCategory::Tools`] in the
+/// Storage tab. The category-Tools ISOs render first so frequently used
+/// recovery / hardware tools are reachable with a single number key
+/// before the built-in shortcuts.
 #[must_use]
-pub fn render_tools_menu(base_url: &str) -> String {
+pub fn render_tools_menu(isos: &[IsoMeta], base_url: &str) -> String {
     let base = base_url.trim_end_matches('/');
     let mut s = String::new();
     let _ = writeln!(s, "#!ipxe");
     let _ = writeln!(s, "set base-url {base}");
     let _ = writeln!(s, ":menu");
     let _ = writeln!(s, "menu OpenPXE - Tools");
+
+    // Operator-categorized tool ISOs (hotkeys 1..9), each chained the
+    // same way as a per-family menu pick — through the boot-entry id
+    // route, carrying `?mac=${mac}` for Host log attribution.
+    let mut count = 0;
+    for iso in isos {
+        if !matches!(iso.category, openpxe_iso_store::IsoCategory::Tools) {
+            continue;
+        }
+        for entry in &iso.boot_entries {
+            let size_label = fmt_size_mib(iso.size_bytes);
+            let key = hotkey_for_index(count);
+            let lock = if iso.is_password_protected() {
+                "*"
+            } else {
+                " "
+            };
+            let _ = writeln!(
+                s,
+                "item {}{} {}[{:>6}] {}",
+                key,
+                entry.id,
+                lock,
+                size_label,
+                escape_label(&entry.title),
+            );
+            count += 1;
+        }
+    }
+    if count > 0 {
+        let _ = writeln!(s, "item --gap");
+    }
+
     let _ = writeln!(s, "item --key u util     Utilities  (memtest, ...)");
     let _ = writeln!(s, "item --key s shell    OpenPXE Shell");
     let _ = writeln!(s, "item --key n nic      Network Card Info");
@@ -252,7 +296,12 @@ pub fn render_tools_menu(base_url: &str) -> String {
         s,
         "iseq ${{target}} back     && chain {base}/boot.ipxe        || goto menu"
     );
-    let _ = writeln!(s, "goto menu");
+    // Fall-through for category-Tools ISO ids — same as the family
+    // submenu, carrying `?mac=${mac}` for the boot log.
+    let _ = writeln!(
+        s,
+        "chain {base}/boot/${{target}}.ipxe?mac=${{mac}} || goto menu"
+    );
     s
 }
 
@@ -469,7 +518,7 @@ pub fn render_password_prompt(entry_id: &str, iso_filename: &str, base_url: &str
     let _ = writeln!(s, ":submit");
     let _ = writeln!(s, "echo Verifying...");
     // Carry `mac=${mac}` alongside the token so a successful unlock
-    // records the actual client MAC into the Host log (v0.4.0). On
+    // records the actual client MAC into the Host log. On
     // older iPXE that can't resolve `${mac}` the server just stores it
     // as "unknown" rather than refusing to boot.
     let _ = writeln!(
@@ -531,7 +580,7 @@ mod password_tests {
         let settings = Settings::default();
         let scripts = [
             render_menu(&[], &settings, "http://10.0.0.5"),
-            render_tools_menu("http://10.0.0.5"),
+            render_tools_menu(&[], "http://10.0.0.5"),
             render_local_hdd("http://10.0.0.5"),
             render_util("http://10.0.0.5"),
             render_shell("http://10.0.0.5"),

crates/http-api/src/lib.rs

@@ -19,6 +19,7 @@ pub mod iso_fs;
 pub mod log_stream;
 pub mod state;
 pub mod terminal;
+pub mod uploads;
 
 pub use app::build_router;
 pub use state::AppState;

crates/http-api/src/state.rs

@@ -1,5 +1,7 @@
+use crate::uploads::UploadSessions;
 use openpxe_core::{
-    BootLog, ClientRegistry, DeploymentQueue, HostBindings, LogBus, Metrics, SettingsStore,
+    BootLog, BrandingStore, ClientRegistry, DeploymentQueue, HostBindings, LogBus, Metrics,
+    SettingsStore,
 };
 use openpxe_iso_store::{IsoStore, NfsManager, SmbManager};
 use std::sync::Arc;
@@ -19,6 +21,10 @@ pub struct AppState {
     /// every `/boot/<entry>.ipxe` chain that goes on to serve a script
     /// (i.e. an image actually starting to install on a machine).
     pub boot_log: BootLog,
+    /// Operator-controlled UI overrides (custom logo). When the
+    /// operator hasn't uploaded anything, the WebUI serves the bundled
+    /// rainbow-horizon mark.
+    pub branding: BrandingStore,
     /// Lock-free metrics counters surfaced at `/metrics` in Prometheus
     /// text format. Cheap to clone (handles to atomics).
     pub metrics: Metrics,
@@ -31,6 +37,10 @@ pub struct AppState {
     /// available in the runtime image. Surfaces errors per-mount rather
     /// than failing the global state.
     pub nfs: NfsManager,
+    /// Browser chunked upload state. Multipart uploads still go straight
+    /// through `IsoStore`, but the UI uses sessions so large ISO transfers
+    /// can show deterministic progress and leave visible partial files.
+    pub uploads: UploadSessions,
     /// Live log bus consumed by the Terminal tab via SSE. Operator-issued
     /// terminal commands also push synthetic lines onto it so the tail
     /// shows them inline.

crates/http-api/src/uploads.rs

@@ -0,0 +1,180 @@
+//! Chunked upload sessions for browser-driven ISO uploads.
+//!
+//! The legacy multipart endpoint still exists for simple API clients, but
+//! browsers get a better failure mode with raw chunks: progress advances after
+//! each acknowledged write, partial files appear in the ISO directory
+//! immediately, and reverse proxies are less likely to buffer an entire DVD
+//! image before OpenPXE sees byte one.
+
+use bytes::Bytes;
+use openpxe_core::{Error, Result};
+use openpxe_iso_store::{IsoMeta, IsoStore, UploadHandle};
+use serde::Serialize;
+use std::collections::HashMap;
+use std::sync::Arc;
+use tokio::sync::Mutex;
+use uuid::Uuid;
+
+const DEFAULT_CHUNK_SIZE: u64 = 8 * 1024 * 1024;
+
+#[derive(Clone, Default)]
+pub struct UploadSessions {
+    inner: Arc<Mutex<HashMap<String, Arc<Mutex<UploadSession>>>>>,
+}
+
+struct UploadSession {
+    filename: String,
+    expected_size: Option<u64>,
+    offset: u64,
+    handle: Option<UploadHandle>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct UploadStarted {
+    pub upload_id: String,
+    pub iso_id: String,
+    pub filename: String,
+    pub offset: u64,
+    pub chunk_size: u64,
+}
+
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum UploadAppend {
+    Progress { offset: u64 },
+    Complete { offset: u64, iso: Box<IsoMeta> },
+}
+
+impl UploadSessions {
+    pub async fn begin(
+        &self,
+        store: &IsoStore,
+        filename: &str,
+        expected_size: Option<u64>,
+    ) -> Result<UploadStarted> {
+        if !filename.to_ascii_lowercase().ends_with(".iso") {
+            return Err(Error::Invalid("only .iso uploads accepted".to_string()));
+        }
+
+        let handle = store.begin_upload(filename).await?;
+        let iso_id = handle.id.clone();
+        let upload_id = Uuid::new_v4().to_string();
+        let session = UploadSession {
+            filename: filename.to_string(),
+            expected_size,
+            offset: 0,
+            handle: Some(handle),
+        };
+
+        self.inner
+            .lock()
+            .await
+            .insert(upload_id.clone(), Arc::new(Mutex::new(session)));
+
+        Ok(UploadStarted {
+            upload_id,
+            iso_id,
+            filename: filename.to_string(),
+            offset: 0,
+            chunk_size: DEFAULT_CHUNK_SIZE,
+        })
+    }
+
+    pub async fn append(
+        &self,
+        store: &IsoStore,
+        upload_id: &str,
+        offset: u64,
+        chunk: Bytes,
+        complete: bool,
+    ) -> Result<UploadAppend> {
+        let Some(session_lock) = self.inner.lock().await.get(upload_id).cloned() else {
+            return Err(Error::Invalid(format!("no such upload '{upload_id}'")));
+        };
+
+        let mut session = session_lock.lock().await;
+        if session.offset != offset {
+            return Err(Error::Invalid(format!(
+                "expected offset {}, got {offset}",
+                session.offset
+            )));
+        }
+
+        let new_offset = session
+            .offset
+            .checked_add(chunk.len() as u64)
+            .ok_or_else(|| Error::Invalid("upload offset overflow".to_string()))?;
+
+        if let Some(expected) = session.expected_size {
+            if new_offset > expected {
+                return Err(Error::Invalid(format!(
+                    "chunk exceeds declared upload size {expected}"
+                )));
+            }
+        }
+
+        let Some(handle) = session.handle.as_mut() else {
+            return Err(Error::Invalid("upload already completed".to_string()));
+        };
+        if let Err(e) = handle.write_chunk(&chunk).await {
+            let handle = session.handle.take();
+            drop(session);
+            self.inner.lock().await.remove(upload_id);
+            if let Some(handle) = handle {
+                let _ = handle.abort().await;
+            }
+            return Err(e);
+        }
+
+        session.offset = new_offset;
+        if !complete {
+            return Ok(UploadAppend::Progress { offset: new_offset });
+        }
+
+        if let Some(expected) = session.expected_size {
+            if new_offset != expected {
+                return Err(Error::Invalid(format!(
+                    "final chunk ended at {new_offset}, expected {expected}"
+                )));
+            }
+        }
+
+        let Some(handle) = session.handle.take() else {
+            return Err(Error::Invalid("upload already completed".to_string()));
+        };
+        let filename = session.filename.clone();
+        drop(session);
+
+        tracing::info!(
+            target: "openpxe::http::upload",
+            upload_id,
+            filename = %filename,
+            received_bytes = new_offset,
+            "chunked upload body complete; introspecting"
+        );
+
+        let meta = match handle.finish(store).await {
+            Ok(meta) => meta,
+            Err(e) => {
+                self.inner.lock().await.remove(upload_id);
+                return Err(e);
+            }
+        };
+        self.inner.lock().await.remove(upload_id);
+        Ok(UploadAppend::Complete {
+            offset: new_offset,
+            iso: Box::new(meta),
+        })
+    }
+
+    pub async fn abort(&self, upload_id: &str) -> Result<()> {
+        let Some(session_lock) = self.inner.lock().await.remove(upload_id) else {
+            return Err(Error::Invalid(format!("no such upload '{upload_id}'")));
+        };
+        let mut session = session_lock.lock().await;
+        if let Some(handle) = session.handle.take() {
+            handle.abort().await?;
+        }
+        Ok(())
+    }
+}

crates/http-api/tests/full_flow.rs

@@ -99,6 +99,7 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
     let log_bus = LogBus::new(64);
     let hosts = HostBindings::load_or_default(dir.path());
     let boot_log = openpxe_core::BootLog::load_or_default(dir.path());
+    let branding = openpxe_core::BrandingStore::load_or_default(dir.path());
     let metrics = Metrics::new();
     let state = AppState {
         iso_store,
@@ -107,9 +108,11 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
         settings,
         hosts,
         boot_log,
+        branding,
         metrics,
         smb: None,
         nfs,
+        uploads: openpxe_http_api::uploads::UploadSessions::default(),
         log_bus,
         started_at: time::OffsetDateTime::now_utc(),
         public_base_url: "http://127.0.0.1".into(),
@@ -1002,11 +1005,7 @@ async fn boot_log_records_entry_serve_with_mac() {
     assert_eq!(upload.status(), StatusCode::CREATED);
 
     // Fetch the per-entry script with ?mac=...
-    let (s, _) = get(
-        &app,
-        "/boot/fake-alpine-linux.ipxe?mac=AA:BB:CC:00:00:09",
-    )
-    .await;
+    let (s, _) = get(&app, "/boot/fake-alpine-linux.ipxe?mac=AA:BB:CC:00:00:09").await;
     assert_eq!(s, StatusCode::OK);
 
     // The boot log should now contain exactly one entry, with the
@@ -1019,7 +1018,7 @@ async fn boot_log_records_entry_serve_with_mac() {
     let ev = &events[0];
     assert_eq!(ev["target_id"], "fake-alpine-linux");
     assert_eq!(ev["mac"], "aa:bb:cc:00:00:09"); // normalized
-    // Title should include the filename and entry title.
+                                                // Title should include the filename and entry title.
     let title = ev["target_title"].as_str().unwrap();
     assert!(title.contains("fake-alpine.iso"), "title was {title}");
 }
@@ -1083,3 +1082,327 @@ async fn upload_rejects_non_iso_filename_with_clear_message() {
     let text = std::str::from_utf8(&body).unwrap();
     assert!(text.contains("only .iso uploads accepted"), "got: {text}");
 }
+
+#[tokio::test]
+async fn chunked_upload_writes_progressively_and_finishes_iso() {
+    let (state, dir) = build_state().await;
+    let app = build_router(state);
+    let iso = fake_alpine_iso();
+
+    let start = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri("/api/uploads")
+                .header("content-type", "application/json")
+                .body(Body::from(
+                    r#"{"filename":"chunked-alpine.iso","size_bytes":65536}"#,
+                ))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(start.status(), StatusCode::CREATED);
+    let body = axum::body::to_bytes(start.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    let started: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    let upload_id = started["upload_id"].as_str().unwrap();
+
+    let split = 8192usize;
+    let first = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("PUT")
+                .uri(format!("/api/uploads/{upload_id}"))
+                .header("x-openpxe-upload-offset", "0")
+                .body(Body::from(iso[..split].to_vec()))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(first.status(), StatusCode::ACCEPTED);
+    let body = axum::body::to_bytes(first.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    let progress: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert_eq!(progress["offset"].as_u64().unwrap(), split as u64);
+    assert!(!progress["complete"].as_bool().unwrap());
+    assert!(
+        dir.path().join("isos/chunked-alpine.partial").exists(),
+        "chunked upload should leave a visible partial file while in progress"
+    );
+
+    let final_chunk = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("PUT")
+                .uri(format!("/api/uploads/{upload_id}"))
+                .header("x-openpxe-upload-offset", split.to_string())
+                .header("x-openpxe-upload-complete", "true")
+                .body(Body::from(iso[split..].to_vec()))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(final_chunk.status(), StatusCode::CREATED);
+    let body = axum::body::to_bytes(final_chunk.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    let finished: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert!(finished["complete"].as_bool().unwrap());
+    assert_eq!(finished["iso"]["id"], "chunked-alpine");
+    assert!(dir.path().join("isos/chunked-alpine.iso").exists());
+    assert!(!dir.path().join("isos/chunked-alpine.partial").exists());
+}
+
+#[tokio::test]
+async fn chunked_upload_rejects_offset_mismatch_without_advancing() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+
+    let start = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri("/api/uploads")
+                .header("content-type", "application/json")
+                .body(Body::from(
+                    r#"{"filename":"offset-test.iso","size_bytes":16}"#,
+                ))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(start.status(), StatusCode::CREATED);
+    let body = axum::body::to_bytes(start.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    let started: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    let upload_id = started["upload_id"].as_str().unwrap();
+
+    let mismatch = app
+        .oneshot(
+            Request::builder()
+                .method("PUT")
+                .uri(format!("/api/uploads/{upload_id}"))
+                .header("x-openpxe-upload-offset", "8")
+                .body(Body::from(vec![1, 2, 3, 4]))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(mismatch.status(), StatusCode::CONFLICT);
+    let body = axum::body::to_bytes(mismatch.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    let text = String::from_utf8(body.to_vec()).unwrap();
+    assert!(text.contains("expected offset 0"), "got: {text}");
+}
+
+#[tokio::test]
+async fn iso_category_switch_moves_entry_between_menus() {
+    // OS (default): appears in Linux Installers submenu and not in Tools.
+    // After flipping to Tools: gone from Linux, present under Tools.
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+
+    let (ct, body) = multipart_iso_body("fake-alpine.iso", &fake_alpine_iso());
+    let upload = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri("/api/isos")
+                .header("content-type", ct)
+                .body(Body::from(body))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(upload.status(), StatusCode::CREATED);
+
+    let (_, linux_before) = get(&app, "/boot/_linux_menu.ipxe").await;
+    let linux_before = String::from_utf8(linux_before).unwrap();
+    assert!(
+        linux_before.contains("fake-alpine-linux"),
+        "expected entry in Linux submenu (default OS):\n{linux_before}"
+    );
+    let (_, tools_before) = get(&app, "/boot/_tools_menu.ipxe").await;
+    let tools_before = String::from_utf8(tools_before).unwrap();
+    assert!(
+        !tools_before.contains("fake-alpine-linux"),
+        "OS-category ISO shouldn't appear in Tools yet:\n{tools_before}"
+    );
+
+    // Flip to Tools.
+    let (s, _) = put_json(
+        &app,
+        "/api/isos/fake-alpine/category",
+        r#"{"category":"tools"}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::OK);
+
+    let (_, linux_after) = get(&app, "/boot/_linux_menu.ipxe").await;
+    let linux_after = String::from_utf8(linux_after).unwrap();
+    assert!(
+        !linux_after.contains("fake-alpine-linux"),
+        "Tools-category ISO should NOT appear in Linux submenu:\n{linux_after}"
+    );
+    let (_, tools_after) = get(&app, "/boot/_tools_menu.ipxe").await;
+    let tools_after = String::from_utf8(tools_after).unwrap();
+    assert!(
+        tools_after.contains("fake-alpine-linux"),
+        "Tools-category ISO should appear in Tools submenu:\n{tools_after}"
+    );
+}
+
+#[tokio::test]
+async fn iso_category_unknown_value_returns_400() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (ct, body) = multipart_iso_body("fake-alpine.iso", &fake_alpine_iso());
+    app.clone()
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri("/api/isos")
+                .header("content-type", ct)
+                .body(Body::from(body))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+
+    let (s, body) = put_json(
+        &app,
+        "/api/isos/fake-alpine/category",
+        r#"{"category":"gibberish"}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::BAD_REQUEST);
+    let text = std::str::from_utf8(&body).unwrap();
+    assert!(text.contains("unknown category"), "got: {text}");
+}
+
+#[tokio::test]
+async fn iso_category_unknown_id_returns_404() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (s, _) = put_json(
+        &app,
+        "/api/isos/does-not-exist/category",
+        r#"{"category":"tools"}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::NOT_FOUND);
+}
+
+#[tokio::test]
+async fn storage_disk_endpoint_reports_volume_stats() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (s, body) = get(&app, "/api/storage/disk").await;
+    assert_eq!(s, StatusCode::OK);
+    let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    // statvfs always returns something on the tempdir filesystem; check
+    // that the shape is sane (total >= used >= 0 and total >= available).
+    assert!(v["total_bytes"].as_u64().unwrap() > 0, "got {v}");
+    let total = v["total_bytes"].as_u64().unwrap();
+    let avail = v["available_bytes"].as_u64().unwrap();
+    let used = v["used_bytes"].as_u64().unwrap();
+    assert!(total >= avail, "{v}");
+    assert!(total >= used,  "{v}");
+    assert!(v["path"].as_str().unwrap().contains("isos"), "got {v}");
+}
+
+#[tokio::test]
+async fn api_docs_lists_known_endpoints() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (s, body) = get(&app, "/api/docs").await;
+    assert_eq!(s, StatusCode::OK);
+    let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    let groups = v["groups"].as_array().expect("groups array");
+    assert!(!groups.is_empty());
+    // Flatten the paths and confirm a handful of the routes that real
+    // operators will look up are documented.
+    let mut paths: Vec<String> = Vec::new();
+    for g in groups {
+        for ep in g["endpoints"].as_array().unwrap() {
+            paths.push(ep["path"].as_str().unwrap().into());
+        }
+    }
+    for needle in [
+        "/api/isos",
+        "/api/isos/:id/category",
+        "/api/storage/disk",
+        "/api/branding/logo",
+        "/api/boot-log",
+        "/metrics",
+    ] {
+        assert!(
+            paths.iter().any(|p| p == needle),
+            "expected {needle} in docs; got {paths:?}"
+        );
+    }
+}
+
+#[tokio::test]
+async fn branding_clear_when_no_logo_is_no_content() {
+    // No-op clear should still 204 — it's not an error to revert to
+    // the default when there's nothing to revert from.
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let res = app
+        .oneshot(
+            Request::builder()
+                .method("DELETE")
+                .uri("/api/branding/logo")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(res.status(), StatusCode::NO_CONTENT);
+}
+
+#[tokio::test]
+async fn status_exposes_custom_logo_flag() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (s, body) = get(&app, "/api/status").await;
+    assert_eq!(s, StatusCode::OK);
+    let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert_eq!(
+        v["custom_logo"].as_bool(),
+        Some(false),
+        "fresh state has no custom logo: {v}"
+    );
+}
+
+async fn put_json(router: &axum::Router, path: &str, body: &str) -> (StatusCode, Vec<u8>) {
+    let res = router
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("PUT")
+                .uri(path)
+                .header("content-type", "application/json")
+                .body(Body::from(body.to_owned()))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    let status = res.status();
+    let bytes = axum::body::to_bytes(res.into_body(), usize::MAX)
+        .await
+        .unwrap()
+        .to_vec();
+    (status, bytes)
+}

crates/iso-store/src/lib.rs

@@ -28,6 +28,7 @@ pub use introspect::{DistroFamily, IntrospectionReport};
 pub use nfs::{NfsAddRequest, NfsManager, NfsMount, NfsVersion};
 pub use smb::{extract_windows_iso, SmbManager, SmbState};
 pub use store::{
-    generate_boot_entries_for, slugify_str, IsoMeta, IsoSource, IsoStore, UploadHandle,
+    generate_boot_entries_for, slugify_str, IsoCategory, IsoMeta, IsoSource, IsoStore,
+    UploadHandle,
 };
 pub use windows::{WimPatcher, WinPatchState};

crates/iso-store/src/store.rs

@@ -31,6 +31,30 @@ pub enum IsoSource {
     },
 }
 
+/// Where the ISO lands in the PXE menu hierarchy.
+///
+/// Auto-detected family (Debian, Windows, …) still drives BIOS/UEFI
+/// behaviour and per-entry boot args, but the *menu placement* is
+/// operator-controlled — an operator who's uploaded a TinyCore live ISO
+/// to use as a recovery shim, or a SystemRescue image, can flip its
+/// category to `Tools` so it lands next to memtest/shell instead of
+/// under Linux Installers.
+///
+/// Old `meta.json` files without this field deserialize as `Os`, which
+/// matches v0.4.1 behaviour (everything goes under OS Installers).
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum IsoCategory {
+    /// "OS Installer" — routed via the auto-detected family into the
+    /// Linux / Windows installer submenus.
+    #[default]
+    Os,
+    /// "Tool" — surfaced under the Tools menu next to memtest, shell,
+    /// NIC info, etc. Family detection still decides BIOS/UEFI vs
+    /// wimboot vs sanboot at boot time.
+    Tools,
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct IsoMeta {
     /// Stable slug used in URLs (derived from the uploaded filename).
@@ -56,6 +80,10 @@ pub struct IsoMeta {
     /// the common no-password case.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub password_hash: Option<String>,
+    /// Where the ISO sits in the PXE menu hierarchy — operator-controlled,
+    /// not driven by family detection. Defaults to [`IsoCategory::Os`].
+    #[serde(default)]
+    pub category: IsoCategory,
 }
 
 impl IsoMeta {
@@ -114,6 +142,7 @@ impl UploadHandle {
             boot_entries,
             source: IsoSource::Local,
             password_hash: None,
+            category: IsoCategory::default(),
         };
         store.persist_meta(&meta).await?;
         store.insert(meta.clone());
@@ -216,6 +245,9 @@ impl IsoStore {
             return Err(Error::Invalid(format!("iso '{id}' already exists")));
         }
         let partial_path = self.iso_dir.join(format!("{id}.partial"));
+        if partial_path.exists() {
+            return Err(Error::Invalid(format!("iso '{id}' is already uploading")));
+        }
         let file = tokio::fs::File::create(&partial_path).await?;
         Ok(UploadHandle {
             id,
@@ -315,6 +347,7 @@ impl IsoStore {
             boot_entries,
             source,
             password_hash: None,
+            category: IsoCategory::default(),
         };
         self.inner.write().isos.insert(id, meta);
     }
@@ -374,6 +407,47 @@ impl IsoStore {
         Ok(())
     }
 
+    /// Flip an ISO's menu category. Persists to `meta.json` for local
+    /// ISOs; NFS-sourced ISOs keep the change in memory only (the next
+    /// re-scan would overwrite it anyway).
+    pub async fn set_category(&self, id: &str, category: IsoCategory) -> Result<IsoMeta> {
+        let updated = {
+            let mut g = self.inner.write();
+            let m = g
+                .isos
+                .get_mut(id)
+                .ok_or_else(|| Error::Invalid(format!("no such iso '{id}'")))?;
+            m.category = category;
+            m.clone()
+        };
+        if matches!(updated.source, IsoSource::Local) {
+            self.persist_meta(&updated).await?;
+        }
+        Ok(updated)
+    }
+
+    /// Absolute path to the directory holding local ISO uploads. Used
+    /// by the HTTP layer for the disk-space endpoint — the volume that
+    /// hosts this directory is what runs out of room first.
+    #[must_use]
+    pub fn iso_dir(&self) -> PathBuf {
+        self.iso_dir.as_path().to_path_buf()
+    }
+
+    /// `(total_bytes, available_bytes)` for the filesystem hosting the
+    /// ISO directory. Returns `None` if `statvfs` fails (read-only
+    /// filesystem with no quota, mount disappeared, …) — callers
+    /// should treat that as "unknown" rather than zero.
+    ///
+    /// Lives here rather than the HTTP crate because `http-api`'s
+    /// `#![forbid(unsafe_code)]` rules out the libc FFI directly, and
+    /// because this is naturally an `IsoStore` question — the volume
+    /// of interest is whatever's hosting the iso dir.
+    #[must_use]
+    pub fn disk_usage(&self) -> Option<(u64, u64)> {
+        disk_usage_for(self.iso_dir.as_path())
+    }
+
     /// Verify a candidate password against the stored bcrypt hash.
     /// Returns:
     /// - `Ok(true)`   — match (or the ISO has no password set; boot is open)
@@ -390,6 +464,33 @@ impl IsoStore {
     }
 }
 
+/// Resolve `(total, available)` bytes for the filesystem hosting `path`.
+/// Returns `None` if `statvfs` fails.
+#[allow(unsafe_code)]
+fn disk_usage_for(path: &std::path::Path) -> Option<(u64, u64)> {
+    use std::ffi::CString;
+    use std::os::unix::ffi::OsStrExt;
+    let c = CString::new(path.as_os_str().as_bytes()).ok()?;
+    // SAFETY: `statvfs` is repr(C); a zeroed value is a valid initial
+    // state per POSIX. The FFI call writes every field we then read.
+    let mut stat: libc::statvfs = unsafe { std::mem::zeroed() };
+    // SAFETY: `c` is a NUL-terminated C string pointing into a stack
+    // CString that outlives this call; `&mut stat` is a unique aligned
+    // pointer to a stack-local `statvfs`. The kernel writes through
+    // it but does not retain the pointer past return.
+    let rc = unsafe { libc::statvfs(c.as_ptr(), &raw mut stat) };
+    if rc != 0 {
+        return None;
+    }
+    // Use f_frsize (fundamental block size). f_bsize is "preferred I/O
+    // block" and doesn't always match the unit f_blocks is denominated
+    // in — on some BSDs it would over-report by a factor of 8.
+    let frsize = stat.f_frsize as u64;
+    let total = stat.f_blocks as u64 * frsize;
+    let avail = stat.f_bavail as u64 * frsize;
+    Some((total, avail))
+}
+
 fn slugify(filename: &str) -> String {
     let stem = Path::new(filename)
         .file_stem()
@@ -548,6 +649,7 @@ mod tests {
             boot_entries: vec![],
             source: IsoSource::Local,
             password_hash: None,
+            category: IsoCategory::default(),
         }
     }
 
@@ -594,6 +696,19 @@ mod tests {
         assert!(matches!(r, Err(Error::Invalid(_))));
     }
 
+    #[tokio::test]
+    async fn begin_upload_rejects_existing_partial_file() {
+        let dir = tempdir().unwrap();
+        let store = IsoStore::new(dir.path().to_path_buf());
+        store.ensure_dirs().await.unwrap();
+        tokio::fs::write(dir.path().join("ubuntu.partial"), b"in-flight")
+            .await
+            .unwrap();
+
+        let r = store.begin_upload("ubuntu.iso").await;
+        assert!(matches!(r, Err(Error::Invalid(_))));
+    }
+
     #[tokio::test]
     async fn password_persists_via_meta_json_for_local_isos() {
         // Hash makes it onto disk so it survives a restart.

crates/openpxe/src/main.rs

@@ -39,7 +39,7 @@ enum Command {
     ///   docker run --rm \
     ///     -v /my/isos:/seed:ro \
     ///     -v openpxe-data:/var/lib/openpxe/isos \
-    ///     openpxe:0.3.2 seed --from /seed
+    ///     openpxe:0.4.1 seed --from /seed
     Seed {
         /// Source directory containing one or more `.iso` files.
         #[arg(long)]
@@ -104,6 +104,7 @@ async fn main() -> anyhow::Result<()> {
     let settings = SettingsStore::load_or_default(&config.paths.work_dir);
     let hosts = HostBindings::load_or_default(&config.paths.work_dir);
     let boot_log = openpxe_core::BootLog::load_or_default(&config.paths.work_dir);
+    let branding = openpxe_core::BrandingStore::load_or_default(&config.paths.work_dir);
     let metrics = Metrics::new();
 
     // Build the SMB manager unconditionally — it starts/stops on the
@@ -142,9 +143,11 @@ async fn main() -> anyhow::Result<()> {
         queue: queue.clone(),
         hosts: hosts.clone(),
         boot_log: boot_log.clone(),
+        branding: branding.clone(),
         metrics: metrics.clone(),
         smb: Some(smb.clone()),
         nfs: nfs.clone(),
+        uploads: openpxe_http_api::uploads::UploadSessions::default(),
         log_bus: log_bus.clone(),
         started_at: time::OffsetDateTime::now_utc(),
         public_base_url: public_base_url.clone(),

crates/webui/src/app.css

@@ -9,10 +9,10 @@
 
 :root {
   /* Jet-black dark palette (default). Modelled on Netbox Labs's
-     near-black product chrome — surfaces step from #000 → #0d → #16 → #1c
+     near-black product chrome, with surfaces stepping subtly upward
      rather than the previous blue-tinted ramp, so the UI reads as a
      genuine "dark" rather than "dim navy". */
-  --bg:           #000000;
+  --bg:           #030303;
   --bg-panel:    #0a0a0a;
   --bg-panel-2:  #141414;
   --bg-elev:     #1c1c1c;
@@ -26,7 +26,7 @@
   --ok:           #4ade80;
   --border:       #1f1f1f;
   --border-soft: #141414;
-  --terminal-bg: #000000;
+  --terminal-bg: #050505;
   --shadow-card: 0 1px 0 rgba(255,255,255,0.02), 0 8px 24px rgba(0,0,0,0.55);
   --radius:      6px;
   --radius-lg:  10px;
@@ -41,7 +41,7 @@
      consistency. Designed against Netbox Labs's reference screenshot:
      near-white surfaces, soft grey dividers, dark text. */
   --bg:           #f6f8fb;
-  --bg-panel:    #ffffff;
+  --bg-panel:    #fbfcfe;
   --bg-panel-2:  #f0f3f8;
   --bg-elev:     #e6ebf2;
   --fg:           #1c2330;
@@ -54,7 +54,11 @@
   --ok:           #1f9b54;
   --border:       #d8dde6;
   --border-soft: #e7eaf0;
-  --terminal-bg: #0d1219; /* terminal stays dark even in light mode */
+  /* Light-mode terminal: the pane background and chrome track the rest
+     of the light theme. Per-level text colours below recolour-on-light
+     so log lines stay readable on a pale background — previously the
+     terminal was locked to dark and looked like a stuck panel. */
+  --terminal-bg: #ffffff;
   --shadow-card: 0 1px 0 rgba(0,0,0,0.02), 0 6px 18px rgba(20,28,52,0.06);
 }
 
@@ -87,14 +91,23 @@ code, kbd { font-family: var(--mono); font-size: 12.5px;
   border-right: 1px solid var(--border);
   display: flex; flex-direction: column;
 }
+/* The brand block sits flush with the topbar so the sidebar+topbar reads
+   as one continuous bar across the top of the app, rather than a chunky
+   2-line logo block plus a separate (smaller-typeface) page title. The
+   height/border-bottom match the topbar exactly so the divider runs
+   straight across without a step. */
 .sidebar .brand {
   display: flex; align-items: center; gap: 12px;
-  padding: 14px 18px;
+  padding: 0 18px;
+  height: var(--topbar-h);
   border-bottom: 1px solid var(--border);
 }
-.sidebar .brand img { width: 40px; height: auto; }
-.sidebar .brand strong { font-size: 16px; letter-spacing: 0.4px; }
-.sidebar .brand .sub { color: var(--fg-dim); font-size: 11px; }
+.sidebar .brand img { width: 26px; height: 26px; flex: none; }
+.sidebar .brand strong {
+  font-size: 15px; font-weight: 600;
+  letter-spacing: 0.2px;
+  color: var(--fg);
+}
 .sidebar nav { padding: 10px 0; flex: 1; overflow-y: auto; }
 .sidebar nav a {
   display: flex; align-items: center; gap: 10px;
@@ -140,6 +153,16 @@ code, kbd { font-family: var(--mono); font-size: 12.5px;
 .sidebar .footer .status-value.err  { color: var(--err); }
 .sidebar .footer .status-value.warn { color: var(--warn); }
 .sidebar .footer .footer-sub { color: var(--fg-dimmer); margin-top: 2px; }
+/* Persistent backend identity. Sits below the advertised URL so even
+   when an operator has uploaded their own logo, "what is this" stays
+   answerable from the bottom-left of every page. */
+.sidebar .footer .footer-version {
+  margin-top: 8px; padding-top: 8px;
+  border-top: 1px dashed var(--border-soft);
+  color: var(--fg-dim);
+  font-variant-numeric: tabular-nums;
+  letter-spacing: 0.2px;
+}
 
 /* ── Top bar ───────────────────────────────────────────────────────── */
 
@@ -253,7 +276,7 @@ button, .btn {
   cursor: pointer;
   transition: background 0.12s ease;
 }
-button:hover, .btn:hover { background: var(--accent-dim); color: #fff; }
+button:hover, .btn:hover { background: var(--accent-dim); color: #f4fffd; }
 button.ghost { background: transparent; color: var(--fg); border: 1px solid var(--border); }
 button.ghost:hover { background: var(--bg-panel-2); color: var(--fg); }
 button.danger { background: transparent; color: var(--err); border: 1px solid color-mix(in srgb, var(--err) 35%, transparent); }
@@ -436,26 +459,29 @@ tr.unbootable td:first-child { border-left: 3px solid var(--warn); }
   min-height: 480px;
   box-shadow: var(--shadow-card);
 }
+/* Terminal pane colours follow the active theme. Hard-coded hexes
+   (#050505, #181818, #cfd6e2 etc.) were leaving the light-mode pane
+   looking dark; we keep palette-aware vars instead so the toggle works. */
 .terminal .pane {
   flex: 1; overflow: auto;
   padding: 10px 14px;
   font-family: var(--mono); font-size: 12.5px; line-height: 1.5;
-  color: #cfd6e2;
+  color: var(--fg);
   white-space: pre-wrap; word-break: break-word;
 }
 .terminal .pane .lvl-error { color: var(--err); }
 .terminal .pane .lvl-warn  { color: var(--warn); }
-.terminal .pane .lvl-info  { color: #cfd6e2; }
-.terminal .pane .lvl-debug { color: #8b94a8; }
-.terminal .pane .lvl-trace { color: #5a6379; }
-.terminal .pane .ts        { color: #5a6379; }
-.terminal .pane .tg        { color: #7cd3ff; }
+.terminal .pane .lvl-info  { color: var(--fg); }
+.terminal .pane .lvl-debug { color: var(--fg-dim); }
+.terminal .pane .lvl-trace { color: var(--fg-dimmer); }
+.terminal .pane .ts        { color: var(--fg-dimmer); }
+.terminal .pane .tg        { color: var(--accent); }
 .terminal .pane .echo      { color: var(--accent); }
 .terminal .input-row {
   display: flex; align-items: center; gap: 8px;
   padding: 8px 14px;
-  background: #050505;
-  border-top: 1px solid #181818;
+  background: var(--bg-panel-2);
+  border-top: 1px solid var(--border);
 }
 .terminal .input-row .prompt { color: var(--accent); font-family: var(--mono); }
 .terminal .input-row input {
@@ -466,22 +492,91 @@ tr.unbootable td:first-child { border-left: 3px solid var(--warn); }
 .terminal .toolbar {
   display: flex; gap: 8px; align-items: center;
   padding: 8px 14px;
-  background: #050505;
-  border-bottom: 1px solid #181818;
+  background: var(--bg-panel-2);
+  border-bottom: 1px solid var(--border);
   font-size: 12px; color: var(--fg-dim);
 }
 .terminal .toolbar .right { margin-left: auto; display: flex; gap: 6px; }
 .terminal .toolbar button {
   padding: 3px 9px; font-size: 11px;
-  background: transparent; color: var(--fg-dim); border: 1px solid #181818;
+  background: transparent; color: var(--fg-dim); border: 1px solid var(--border);
   font-weight: 500;
 }
-.terminal .toolbar button:hover { color: var(--fg); background: #181818; }
+.terminal .toolbar button:hover { color: var(--fg); background: var(--bg-elev); }
 
 /* ── About card ─────────────────────────────────────────────────── */
 .about-hero { padding: 20px 24px; }
 .about-hero h2 { font-size: 22px; margin: 0 0 8px; color: var(--fg); }
-.about-hero .lead { color: var(--fg-dim); font-size: 14px; max-width: 60ch; }
+/* Span the full main column rather than capping at 60ch — the page is
+   read at typical desktop widths and the cap was leaving the right two
+   thirds of the panel awkwardly empty. */
+.about-hero .lead { color: var(--fg-dim); font-size: 14px; max-width: none; }
 .about-hero .who { margin-top: 18px; font-size: 13px; }
 .about-hero .who span { color: var(--fg-dim); }
 .about-hero .who strong { color: var(--accent); }
+.about-hero a { color: var(--accent); }
+
+/* ── API reference (Settings → bottom) ─────────────────────────── */
+.api-ref { display: grid; gap: 18px; padding: 16px; }
+.api-ref .group h3 {
+  margin: 0 0 8px; font-size: 13px; color: var(--fg-dim);
+  text-transform: uppercase; letter-spacing: 0.8px;
+}
+.api-ref .ep {
+  display: grid; grid-template-columns: 64px minmax(200px, 1fr) 2fr;
+  gap: 12px; align-items: baseline;
+  padding: 6px 0; border-top: 1px solid var(--border-soft);
+  font-size: 13px;
+}
+.api-ref .ep:first-child { border-top: 0; }
+.api-ref .ep .method {
+  font-family: var(--mono); font-weight: 600; font-size: 11px;
+  padding: 2px 6px; border-radius: 4px;
+  text-align: center; letter-spacing: 0.6px;
+}
+.api-ref .ep .method.get    { background: color-mix(in srgb, var(--ok) 22%, transparent);     color: var(--ok); }
+.api-ref .ep .method.post   { background: color-mix(in srgb, var(--accent) 22%, transparent); color: var(--accent); }
+.api-ref .ep .method.put    { background: color-mix(in srgb, var(--warn) 22%, transparent);   color: var(--warn); }
+.api-ref .ep .method.delete { background: color-mix(in srgb, var(--err) 22%, transparent);    color: var(--err); }
+.api-ref .ep .path { font-family: var(--mono); color: var(--fg); word-break: break-all; }
+.api-ref .ep .desc { color: var(--fg-dim); }
+@media (max-width: 900px) {
+  .api-ref .ep { grid-template-columns: 1fr; gap: 4px; }
+  .api-ref .ep .method { justify-self: start; }
+}
+
+/* ── Disk space card ───────────────────────────────────────────── */
+.diskbar {
+  height: 10px; border-radius: 5px;
+  background: var(--bg-elev);
+  overflow: hidden; margin-top: 8px;
+}
+.diskbar .fill {
+  height: 100%;
+  background: linear-gradient(90deg, var(--accent-dim), var(--accent));
+  transition: width 0.4s ease;
+}
+.diskbar.warn .fill { background: var(--warn); }
+.diskbar.full .fill { background: var(--err); }
+.disk-meta { display: flex; gap: 14px; font-size: 12px; color: var(--fg-dim); margin-top: 8px; flex-wrap: wrap; }
+.disk-meta strong { color: var(--fg); font-weight: 600; font-variant-numeric: tabular-nums; }
+
+/* ── Logo upload (Settings) ────────────────────────────────────── */
+.logo-preview {
+  display: flex; align-items: center; gap: 14px;
+  padding: 12px;
+  background: var(--bg-panel-2);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+}
+.logo-preview .swatch {
+  width: 56px; height: 56px;
+  display: flex; align-items: center; justify-content: center;
+  background: var(--bg); border: 1px solid var(--border);
+  border-radius: var(--radius);
+  flex: none;
+}
+.logo-preview .swatch img { max-width: 48px; max-height: 48px; }
+.logo-preview .info { flex: 1; min-width: 0; }
+.logo-preview .info .name { color: var(--fg); font-weight: 600; }
+.logo-preview .info .meta { color: var(--fg-dim); font-size: 12px; margin-top: 2px; }

crates/webui/src/app.js

@@ -321,8 +321,11 @@
     },
 
     storage: async () => {
-      const [isos, settings, nfsRes] = await Promise.all([
+      const [isos, settings, nfsRes, disk] = await Promise.all([
         getJSON('/api/isos'), getJSON('/api/settings'), getJSON('/api/nfs'),
+        getJSON('/api/storage/disk').catch(() => ({
+          total_bytes: 0, available_bytes: 0, used_bytes: 0, path: '?',
+        })),
       ]);
       const mounts = nfsRes.mounts || [];
 
@@ -346,68 +349,84 @@
       });
       file.onchange = () => { if (file.files[0]) upload(file.files[0]); };
 
-      // Upload telemetry. We surface bytes-sent + percent + ETA so when
-      // an upload stalls (e.g. a reverse proxy is buffering or rejecting
-      // a >100MB body) the operator can see it instead of staring at a
-      // 0% bar. We also tag the most common failure modes — timeout,
-      // network drop, HTTP 413/502/504 — with hints so the path forward
-      // is obvious from the UI.
-      function upload(f) {
+      // Chunked upload telemetry. The old browser path posted one huge
+      // multipart body, which left operators staring at 0% when a reverse
+      // proxy buffered or rejected the request before OpenPXE saw it. This
+      // path writes small raw chunks; each acknowledged chunk advances the
+      // bar and leaves a visible .partial file in the ISO directory.
+      async function upload(f) {
         const started = Date.now();
         const bar = $('#bar');
         const setStatus = (text, cls) => { upMsg.textContent = text; upMsg.className = 'msg ' + (cls || ''); };
-        setStatus('Uploading ' + f.name + ' (' + fmtBytes(f.size) + ')…');
-        prog.classList.add('active');
-        bar.style.width = '0%';
-        const fd = new FormData(); fd.append('file', f);
-        const xhr = new XMLHttpRequest();
-        // 4-hour ceiling for very large ISOs over slow links. Browser
-        // default is 0 (never time out); we set an explicit cap so a
-        // stalled connection doesn't masquerade as "still uploading".
-        xhr.timeout = 4 * 60 * 60 * 1000;
-        xhr.upload.onprogress = e => {
-          if (!e.lengthComputable) return;
-          const pct = (e.loaded / e.total) * 100;
+        const update = (loaded, total, phase) => {
+          const pct = total > 0 ? Math.min(100, (loaded / total) * 100) : 100;
           bar.style.width = pct.toFixed(1) + '%';
-          const elapsed = (Date.now() - started) / 1000;
-          const rate = elapsed > 0 ? e.loaded / elapsed : 0;
-          const remain = rate > 0 ? (e.total - e.loaded) / rate : 0;
+          const elapsed = Math.max(0.001, (Date.now() - started) / 1000);
+          const rate = loaded > 0 ? loaded / elapsed : 0;
+          const remain = rate > 0 ? (total - loaded) / rate : 0;
           setStatus(
-            'Uploading ' + f.name + ' — ' +
-            fmtBytes(e.loaded) + ' of ' + fmtBytes(e.total) +
+            phase + ' ' + f.name + ' - ' +
+            fmtBytes(loaded) + ' of ' + fmtBytes(total) +
             ' (' + pct.toFixed(1) + '%, ' + fmtBytes(rate) + '/s' +
             (remain > 0 ? ', ' + Math.ceil(remain) + 's left' : '') + ')');
         };
-        xhr.onload = () => {
-          prog.classList.remove('active');
-          bar.style.width = '0';
-          if (xhr.status >= 200 && xhr.status < 300) {
-            setStatus('Uploaded & analyzed: ' + f.name + ' (' + fmtBytes(f.size) + ')', 'ok');
-            render('storage');
-            return;
-          }
+        const failText = async (r) => {
+          const text = (await r.text()).slice(0, 240);
           let hint = '';
-          if (xhr.status === 413)      hint = ' — body too large. A reverse proxy in front of OpenPXE (Cloudflare free tier caps at 100 MB) likely rejected it. Try the LAN IP directly.';
-          else if (xhr.status === 502) hint = ' — bad gateway. Reverse proxy lost the upstream mid-stream.';
-          else if (xhr.status === 504) hint = ' — gateway timeout. The upload took longer than the proxy allows; try the LAN IP.';
-          else if (xhr.status === 409) hint = ' — an ISO with this name already exists. Remove the old one or rename.';
-          setStatus('Upload failed: HTTP ' + xhr.status + ' ' + (xhr.responseText || '').slice(0, 200) + hint, 'err');
+          if (r.status === 413)      hint = ' - body too large. A proxy likely rejected this chunk.';
+          else if (r.status === 502) hint = ' - bad gateway. Proxy lost the upstream mid-stream.';
+          else if (r.status === 504) hint = ' - gateway timeout. Try the LAN IP directly.';
+          else if (r.status === 409) hint = ' - name conflict or offset mismatch. Remove the old ISO and retry.';
+          return 'HTTP ' + r.status + ' ' + text + hint;
         };
-        xhr.onerror = () => {
+
+        let uploadId = null;
+        setStatus('Preparing upload for ' + f.name + ' (' + fmtBytes(f.size) + ')');
+        prog.classList.add('active');
+        bar.style.width = '1%';
+
+        try {
+          const begin = await postJSON('/api/uploads', {
+            filename: f.name,
+            size_bytes: f.size,
+          });
+          if (!begin.ok) throw new Error(await failText(begin));
+          const session = await begin.json();
+          uploadId = session.upload_id;
+          const chunkSize = Math.max(1024 * 1024, Number(session.chunk_size || 8 * 1024 * 1024));
+
+          let offset = Number(session.offset || 0);
+          let finished = null;
+          do {
+            const end = Math.min(offset + chunkSize, f.size);
+            const complete = end >= f.size;
+            const r = await fetch('/api/uploads/' + encodeURIComponent(uploadId), {
+              method: 'PUT',
+              headers: {
+                'x-openpxe-upload-offset': String(offset),
+                'x-openpxe-upload-complete': complete ? 'true' : 'false',
+              },
+              body: f.slice(offset, end),
+            });
+            if (!r.ok) throw new Error(await failText(r));
+            const j = await r.json();
+            offset = Number(j.offset || end);
+            update(offset, f.size, complete ? 'Analyzing' : 'Uploading');
+            if (j.complete) finished = j.iso || true;
+          } while (!finished);
+
+          setStatus('Uploaded and analyzed: ' + f.name + ' (' + fmtBytes(f.size) + ')', 'ok');
+          render('storage');
+        } catch (err) {
+          if (uploadId) {
+            try { await fetch('/api/uploads/' + encodeURIComponent(uploadId), {method: 'DELETE'}); }
+            catch {}
+          }
+          setStatus('Upload failed: ' + (err && err.message ? err.message : String(err)), 'err');
+        } finally {
           prog.classList.remove('active');
-          setStatus('Upload failed: network error or connection closed mid-stream. ' +
-                    'If you went through a reverse proxy, try the server\'s LAN IP directly.', 'err');
-        };
-        xhr.ontimeout = () => {
-          prog.classList.remove('active');
-          setStatus('Upload timed out after 4 hours.', 'err');
-        };
-        xhr.onabort = () => {
-          prog.classList.remove('active');
-          setStatus('Upload aborted.', 'err');
-        };
-        xhr.open('POST', '/api/isos');
-        xhr.send(fd);
+          if (!upMsg.className.includes('ok')) bar.style.width = '0';
+        }
       }
 
       // ── ISO table (mixed local + NFS) ──
@@ -495,6 +514,30 @@
         const editorRow = el('tr', {style:'display:none'}, editorCells);
         refreshFieldVisibility();
 
+        // Type cell becomes an OS/Tools <select>. Default is OS (everything
+        // routes through the family-detected installer submenu); switching
+        // to Tools moves the ISO into the Tools submenu next to memtest.
+        // The detected family stays visible as a small subtitle below the
+        // selector so the operator hasn't lost that information.
+        const catSel = el('select', {
+          style: 'min-width:96px;background:var(--bg);color:var(--fg);' +
+                 'border:1px solid var(--border);border-radius:var(--radius);' +
+                 'padding:4px 8px;font:inherit;font-size:12px'
+        }, [
+          el('option', {value: 'os'},    'OS'),
+          el('option', {value: 'tools'}, 'Tools'),
+        ]);
+        catSel.value = (i.category || 'os');
+        catSel.onchange = async () => {
+          const r = await putJSON('/api/isos/' + encodeURIComponent(i.id) + '/category',
+            { category: catSel.value });
+          if (!r.ok) {
+            const t = await r.text();
+            alert('Category change failed: ' + t);
+          }
+          render('storage');
+        };
+
         const tr = el('tr', b.ok ? {} : {class: 'unbootable'}, [
           el('td', {}, [
             el('div', {style:'display:flex;align-items:center;gap:8px'}, [
@@ -507,7 +550,11 @@
             !b.ok ? el('div', {class:'row-warn'}, '⚠ ' + b.reason)
                   : (b.warn ? el('div', {class:'row-warn'}, '⚠ ' + b.warn) : null),
           ]),
-          el('td', {}, el('span', {class:'tag'}, familyLabel(i.introspection.family))),
+          el('td', {}, [
+            catSel,
+            el('div', {style:'color:var(--fg-dim);font-size:11px;margin-top:4px'},
+              familyLabel(i.introspection.family)),
+          ]),
           el('td', {class:'num'}, fmtBytes(i.size_bytes)),
           el('td', {},
             el('span', {class:'src-badge' + (isNfs ? ' nfs' : '')},
@@ -593,7 +640,48 @@
         el('span'),
       ])) : [el('div', {class:'empty'}, 'No NFS shares mounted.')];
 
+      // Disk-space card. Free + used + total for the volume hosting the
+      // ISO directory, with a coloured bar. Warns at 80% and goes red at
+      // 95% so the operator sees the runway shrinking before uploads
+      // start failing with ENOSPC.
+      const total = Number(disk.total_bytes || 0);
+      const avail = Number(disk.available_bytes || 0);
+      const used  = Number(disk.used_bytes  || 0);
+      const pctUsed = total > 0 ? (used / total) * 100 : 0;
+      let barClass = 'diskbar';
+      if (pctUsed >= 95)      barClass += ' full';
+      else if (pctUsed >= 80) barClass += ' warn';
+      const diskCard = el('div', {class:'card'}, [
+        el('header', {}, [
+          el('h2', {}, 'Disk space'),
+          el('span', {class:'sub'},
+            total > 0
+              ? (pctUsed.toFixed(1) + '% used')
+              : 'unavailable'),
+        ]),
+        el('div', {class:'body'}, [
+          el('div', {style:'color:var(--fg-dim);font-size:12px;word-break:break-all'},
+            disk.path ? ('Volume: ' + disk.path) : 'Volume path unknown'),
+          el('div', {class: barClass},
+            el('div', {class:'fill',
+              style:'width:' + Math.min(100, pctUsed).toFixed(1) + '%'})),
+          el('div', {class:'disk-meta'}, [
+            el('span', {}, ['Used ',  el('strong', {}, fmtBytes(used))]),
+            el('span', {}, ['Free ',  el('strong', {}, fmtBytes(avail))]),
+            el('span', {}, ['Total ', el('strong', {}, fmtBytes(total))]),
+          ]),
+          pctUsed >= 95
+            ? el('p', {class:'msg err', style:'margin-top:10px'},
+                '⚠ Less than 5% free. Remove old ISOs or grow the volume before uploading more.')
+            : (pctUsed >= 80
+                ? el('p', {class:'msg', style:'color:var(--warn);margin-top:10px'},
+                    'Volume is getting full. Consider pruning old ISOs.')
+                : null),
+        ]),
+      ]);
+
       return el('div', {class:'grid'}, [
+        diskCard,
         el('div', {class:'card'}, [
           el('header', {}, el('h2', {}, 'Upload ISO')),
           el('div', {class:'body'}, [drop, file, prog, upMsg]),
@@ -892,6 +980,142 @@
       return term;
     },
 
+    settings: async () => {
+      const [status, docs] = await Promise.all([
+        getJSON('/api/status'),
+        getJSON('/api/docs').catch(() => ({ groups: [] })),
+      ]);
+      const hasLogo = !!status.custom_logo;
+
+      // ── Identity & access placeholder.
+      // We haven't shipped auth yet — but operators looking at this tab
+      // need to see *where* it'll live so they're not surprised when an
+      // upgrade lights up real config controls under the same heading.
+      const accessCard = el('div', {class:'card'}, [
+        el('header', {}, el('h2', {}, 'Identity & access')),
+        el('div', {class:'body'}, [
+          el('p', {class:'msg'},
+            'LDAP, SSO (OIDC), and operator user management are planned ' +
+            'for a future release. Today, OpenPXE assumes a single trusted ' +
+            'operator on a flat L2 network and provides no built-in ' +
+            'authentication on the WebUI or HTTP API. Run behind your ' +
+            'identity-aware reverse proxy (Authentik, Authelia, oauth2-proxy) ' +
+            'for a hardened deployment until first-class support lands here.'),
+          el('div', {class:'form-row', style:'opacity:.55;pointer-events:none'}, [
+            el('label', {class:'field'}, [
+              el('span', {class:'name'}, 'LDAP server URL'),
+              el('input', {type:'text', placeholder:'ldaps://dc.example.com:636', disabled:'disabled'}),
+            ]),
+            el('label', {class:'field'}, [
+              el('span', {class:'name'}, 'OIDC issuer'),
+              el('input', {type:'text', placeholder:'https://idp.example.com/realms/openpxe', disabled:'disabled'}),
+            ]),
+            el('label', {class:'field'}, [
+              el('span', {class:'name'}, 'User management'),
+              el('input', {type:'text', placeholder:'configurable in a future release', disabled:'disabled'}),
+            ]),
+          ]),
+        ]),
+      ]);
+
+      // ── Custom logo upload.
+      // Single-file drop-zone; PNG/SVG/JPEG/WebP/GIF up to 2 MB.
+      // Persisted as <work_dir>/branding/logo.<ext> and served from
+      // /assets/logo.svg in preference to the bundled mark.
+      const logoFile = el('input', {
+        type:'file',
+        accept:'image/svg+xml,image/png,image/jpeg,image/webp,image/gif',
+        style:'display:none', id:'logo-file',
+      });
+      const logoMsg = el('div', {class:'msg', style:'margin-top:10px'});
+      const logoBust = '?v=' + Date.now(); // bust the browser cache after upload
+      logoFile.onchange = async () => {
+        if (!logoFile.files[0]) return;
+        const f = logoFile.files[0];
+        const fd = new FormData(); fd.append('file', f, f.name);
+        logoMsg.textContent = 'Uploading ' + f.name + ' (' + fmtBytes(f.size) + ')…';
+        logoMsg.className = 'msg';
+        const r = await fetch('/api/branding/logo', {method:'POST', body: fd});
+        if (r.ok) {
+          logoMsg.textContent = 'Custom logo installed. Reloading…';
+          logoMsg.className = 'msg ok';
+          setTimeout(() => location.reload(), 600);
+        } else {
+          const t = await r.text();
+          logoMsg.textContent = 'Upload failed: ' + t;
+          logoMsg.className = 'msg err';
+        }
+      };
+      const logoCard = el('div', {class:'card'}, [
+        el('header', {}, el('h2', {}, 'Branding')),
+        el('div', {class:'body'}, [
+          el('p', {class:'msg', style:'margin-bottom:14px'},
+            'Override the top-left brand mark with your own logo. Up to 2 MB; ' +
+            'PNG, SVG, JPEG, WebP, or GIF. The original OpenPXE version is ' +
+            'always shown in the bottom-left for support purposes.'),
+          el('div', {class:'logo-preview'}, [
+            el('div', {class:'swatch'},
+              el('img', {src: '/assets/logo.svg' + logoBust, alt:'current logo'})),
+            el('div', {class:'info'}, [
+              el('div', {class:'name'}, hasLogo ? 'Custom logo (uploaded)' : 'Default OpenPXE mark'),
+              el('div', {class:'meta'},
+                hasLogo
+                  ? 'Operator-uploaded; served from <work_dir>/branding/.'
+                  : 'Bundled rainbow-horizon mark. Upload an image to override.'),
+            ]),
+            el('div', {style:'display:flex;gap:8px;flex-wrap:wrap'}, [
+              el('button', {onclick: () => logoFile.click()},
+                hasLogo ? 'Replace logo' : 'Upload logo'),
+              hasLogo
+                ? el('button', {class:'danger', onclick: async () => {
+                    if (!confirm('Remove custom logo and revert to the OpenPXE mark?')) return;
+                    const r = await fetch('/api/branding/logo', {method:'DELETE'});
+                    if (r.ok || r.status === 204) {
+                      logoMsg.textContent = 'Reverted to default mark. Reloading…';
+                      logoMsg.className = 'msg ok';
+                      setTimeout(() => location.reload(), 500);
+                    } else {
+                      const t = await r.text();
+                      logoMsg.textContent = 'Clear failed: ' + t;
+                      logoMsg.className = 'msg err';
+                    }
+                  }}, 'Remove')
+                : null,
+            ]),
+          ]),
+          logoFile, logoMsg,
+        ]),
+      ]);
+
+      // ── API reference (always at the bottom of Settings).
+      // Sourced from /api/docs so the hand-curated list stays the
+      // single source of truth and the UI doesn't need its own copy
+      // baked into the JS bundle.
+      const groups = docs.groups || [];
+      const apiCard = el('div', {class:'card'}, [
+        el('header', {}, [
+          el('h2', {}, 'API reference'),
+          el('span', {class:'sub'},
+            groups.reduce((n, g) => n + (g.endpoints || []).length, 0) + ' endpoints'),
+        ]),
+        el('div', {class:'api-ref'},
+          groups.length
+            ? groups.map(g => el('div', {class:'group'}, [
+                el('h3', {}, g.name),
+                ...(g.endpoints || []).map(ep => el('div', {class:'ep'}, [
+                  el('span', {class:'method ' + (ep.method || 'get').toLowerCase()},
+                    ep.method || 'GET'),
+                  el('span', {class:'path'}, ep.path || '?'),
+                  el('span', {class:'desc'}, ep.summary || ''),
+                ])),
+              ]))
+            : el('div', {class:'empty'},
+                'No API documentation returned by /api/docs.')),
+      ]);
+
+      return el('div', {class:'grid'}, [accessCard, logoCard, apiCard]);
+    },
+
     about: async () => {
       const status = await getJSON('/api/status');
       return el('div', {class:'card'}, [
@@ -904,7 +1128,10 @@
           el('div', {class:'who'}, [
             el('span', {}, 'Developer: '), el('strong', {}, 'Miles Ward'), el('br'),
             el('span', {}, 'Version: '), el('strong', {}, status.version || '?'), el('br'),
-            el('span', {}, 'Base URL: '), el('strong', {}, status.public_base_url),
+            el('span', {}, 'Base URL: '), el('strong', {}, status.public_base_url), el('br'),
+            el('span', {}, 'Docs: '),
+            el('a', {href:'https://openpxe.com/', target:'_blank', rel:'noopener noreferrer'},
+              'https://openpxe.com/'),
           ]),
           el('p', {class:'msg', style:'margin-top:18px'},
             'iPXE is an internal implementation detail. Everything the firmware ' +
@@ -929,6 +1156,7 @@
     storage: 'Storage',
     hosts: 'Hosts',
     terminal: 'Terminal',
+    settings: 'Settings',
     about: 'About',
   };
 
@@ -987,7 +1215,7 @@
   }
 
   // Set the sidebar footer "Service status:" line. The chip itself moved
-  // off the topbar in v0.4.0 — operators wanted readiness, advertised
+  // off the topbar in v0.4.x: operators wanted readiness, advertised
   // URL, and the boot IP grouped together as the bottom-left summary.
   function setReady(state) {
     const dot = $('[data-bind=ready_dot]');

crates/webui/src/index.html

@@ -26,11 +26,8 @@
 <div class="shell">
   <aside class="sidebar">
     <div class="brand">
-      <img src="/assets/logo.svg" alt="" />
-      <div>
-        <strong>OpenPXE</strong>
-        <div class="sub">v<span data-bind="version">0.4.0</span></div>
-      </div>
+      <img src="/assets/logo.svg" alt="OpenPXE" />
+      <strong>OpenPXE</strong>
     </div>
     <nav>
       <a data-view="dashboard" class="active">Dashboard</a>
@@ -48,6 +45,7 @@
         <span class="count" data-bind="host_count">0</span>
       </a>
       <a data-view="terminal">Terminal</a>
+      <a data-view="settings">Settings</a>
       <a data-view="about">About</a>
     </nav>
     <div class="footer">
@@ -58,6 +56,10 @@
       </div>
       <div class="footer-sub">Advertised to clients</div>
       <code>{{BASE_URL}}</code>
+      <!-- The brand badge at the top can be overridden by operator-uploaded
+           logos; keep "OpenPXE v…" pinned in the footer so the backend
+           identity is always visible regardless of branding. -->
+      <div class="footer-version">OpenPXE&nbsp;v<span data-bind="version">0.4.4</span></div>
     </div>
   </aside>
 

deploy/docker/Dockerfile

@@ -14,7 +14,7 @@
 # Debian slim at ~75 MB + binary ~25 MB is fine for a PXE server that
 # spends most of its life idle.
 
-ARG RUST_VERSION=1.82
+ARG RUST_VERSION=1.95
 
 ########## fetch iPXE binaries ##########
 FROM debian:12-slim AS fetch
@@ -33,7 +33,12 @@ WORKDIR /src
 # to silently serve stale stub binaries when cargo's fingerprint didn't
 # notice the source swap. A single build is ~1.5 min longer on cold cache
 # but guarantees the binary reflects the sources we copied.
-COPY Cargo.toml rust-toolchain.toml ./
+# Do not copy rust-toolchain.toml into the image. The local workspace pins
+# developer tooling, but inside Docker we intentionally use the Rust version
+# selected by the base image. Copying rust-toolchain.toml with
+# `channel = "stable"` makes rustup download a second full toolchain during
+# `cargo build`, which is slow and can exhaust small Colima/CI disks.
+COPY Cargo.toml Cargo.lock ./
 COPY crates/ crates/
 COPY --from=fetch /src/assets/ipxe /src/assets/ipxe
 

deploy/openshift/30-deployment.yaml

@@ -34,7 +34,7 @@ spec:
         fsGroup: 10001
       containers:
         - name: openpxe
-          image: gitea.milesward.dev/mward4/openpxe:0.3.2
+          image: gitea.milesward.dev/mward4/openpxe:0.4.1
           imagePullPolicy: IfNotPresent
           ports:
             - name: dhcp

deploy/unraid/README.md

@@ -6,7 +6,7 @@ boot from OpenPXE". Pick the one that matches what you have.
 ## Path A — build on Unraid, push to Gitea registry, pull by tag
 
 Recommended once you've done it once. Image is published to
-`gitea.milesward.dev/mward4/openpxe:0.3.2` (or your equivalent) and
+`gitea.milesward.dev/mward4/openpxe:0.4.1` (or your equivalent) and
 every Unraid template / docker-compose just references the tag.
 
 Pre-flight:
@@ -40,14 +40,14 @@ What it does:
 3. `docker build` against `deploy/docker/Dockerfile`.
 4. `docker login gitea.milesward.dev:3000` using a temp `DOCKER_CONFIG`
    so the credential never lands in your real `~/.docker/config.json`.
-5. `docker push` both `:0.3.2` and `:latest`.
+5. `docker push` both `:0.4.1` and `:latest`.
 6. Logout, scrub the temp config, delete the workspace.
 
 After it finishes, in Unraid → Docker → Add Container, set:
 
 | Field      | Value                                           |
 |------------|-------------------------------------------------|
-| Repository | `gitea.milesward.dev/mward4/openpxe:0.3.2`     |
+| Repository | `gitea.milesward.dev/mward4/openpxe:0.4.1`     |
 | Network    | `host`                                          |
 | Extra args | `--cap-add=NET_BIND_SERVICE`                    |
 
@@ -88,14 +88,14 @@ then:
 
 ```bash
 # On the build host
-docker save openpxe:0.3.2 | gzip > openpxe-0.3.2.tar.gz
+docker save openpxe:0.4.1 | gzip > openpxe-0.4.1.tar.gz
 
 # Transfer (rsync / scp / SMB / ZFS-replicate / sneakernet)
-scp openpxe-0.3.2.tar.gz root@unraid:/tmp/
+scp openpxe-0.4.1.tar.gz root@unraid:/tmp/
 
 # On Unraid
-gunzip -c /tmp/openpxe-0.3.2.tar.gz | docker load
-docker tag openpxe:0.3.2 gitea.milesward.dev/mward4/openpxe:0.3.2
+gunzip -c /tmp/openpxe-0.4.1.tar.gz | docker load
+docker tag openpxe:0.4.1 gitea.milesward.dev/mward4/openpxe:0.4.1
 ```
 
 If you want it pullable by tag from other Unraid templates, push to

docs/NEXT_PHASE.md

@@ -1,6 +1,6 @@
 # Phase 6 — recommendations
 
-The v0.3.2 cut leaves OpenPXE in a state where the entire protocol stack
+The v0.4.1 cut leaves OpenPXE in a state where the entire protocol stack
 and operator UI are exercised by the automated test suite, the container is
 multi-arch buildable, and the image ships at ~97 MB. What's left before
 this looks and feels like a 1.0 product is mostly **real-hardware

docs/architecture.md

@@ -265,10 +265,9 @@ tab is one click from the brand bar.
 - Persisted to `<work_dir>/hosts.json`. Like `SettingsStore`, in-memory
   is authoritative — disk corruption falls back to empty rather than
   failing startup.
-- Inspired by Tinkerbell `smee`'s MAC-prepended URL pattern. The DHCP
-  reply now embeds `?mac=${mac}` in the boot.ipxe URL; iPXE substitutes
-  the literal MAC client-side, so the HTTP layer can short-circuit
-  past the menu when a binding exists.
+- The DHCP reply embeds `?mac=${mac}` in the boot.ipxe URL; iPXE
+  substitutes the literal MAC client-side, so the HTTP layer can
+  short-circuit past the menu when a binding exists.
 - `/api/hosts` GET / POST / DELETE drives the **Hosts** tab.
 
 **Prometheus metrics** (`crates/core/src/metrics.rs`):