v0.4.65: swap kernel-mount NFS for userspace SMB (smbclient)

v0.4.64's NFS path didn't work on Unraid even with --privileged
because Unraid's base kernel ships without the nfs/nfsv4 client
modules — and no container-side configuration can load a host kernel
module. SMB has the same kernel-mount problem (`mount -t cifs` needs
the cifs module) but it also has a usable *userspace* client: Samba's
`smbclient` CLI, which speaks the SMB protocol over a plain TCP socket
with no kernel involvement. This is the same approach Bootimus uses,
and works in every container regardless of host kernel modules or
container capabilities.

What's gone:

* `crates/iso-store/src/nfs.rs` (in entirety)
* `NfsManager`, `NfsMount`, `NfsAddRequest`, `NfsVersion` types
* `IsoSource::Nfs` variant
* `IsoStore::nfs_root` / `IsoStore::set_nfs_root`
* `/api/nfs`, `/api/nfs/:id`, `/api/nfs/:id/scan` routes
* `nfs` terminal command
* Storage tab's NFS shares card and the v0.4.64 fstab-options
  diagnostics work (the whole error path is moot now)

What's new:

* `crates/iso-store/src/smb_share.rs` — `SmbShareManager` that drives
  `smbclient` as a subprocess. Indexes shares via `smbclient -c "ls
  *.iso"` and streams files via `smbclient -c "get file -"` piped
  straight into HTTP response bodies. No local cache, no double disk
  usage.
* `IsoSource::Smb { share_id, relative_path }` variant.
* `IsoStore::iso_path_for` returns None for SMB sources — the HTTP
  ISO download handler dispatches on the source kind and streams via
  the SmbShareManager when it's SMB.
* `/api/smb-shares` + `/api/smb-shares/:id` + `/api/smb-shares/:id/scan`
  routes.
* `share` terminal command (`list | add //srv/share [auth] | remove |
  scan`). Auth spec is `guest` or `user:password`.
* Storage tab: SMB shares card replaces the NFS one. Two-column form
  for server + share name, three-column form for guest checkbox /
  username / password. Username and password fields auto-disable when
  Guest is checked.
* Credentials live under <work_dir>/smb_creds/<id>.cred at 0600
  permissions so they don't leak through `ps`. Persisted state at
  <work_dir>/smb_shares.json (sans password — re-entered on add /
  re-scan).

Why subprocess and not a Rust crate:

* The Debian runtime image already ships the `samba` package
  (Dockerfile line 84) — `smbclient` is right there.
* Library options (pavao, etc.) wrap libsmbclient so they still pull
  in the same C library at runtime.
* Subprocess gives operators a verifiable mental model — anything
  OpenPXE can do over SMB, they can reproduce by running `smbclient`
  manually at a shell.

Range-request limitation, called out in the smb_share.rs module docs
and the UI explainer: `smbclient -c 'get file -'` is a sequential
whole-file stream. HTTP range requests on SMB-sourced ISOs return
416. PXE workloads (iPXE chain, casper sanboot, wimboot) do
whole-file sequential reads, so this works in practice. A follow-up
release can add libsmbclient-based seek if a real workload needs it.

Stderr-to-hint translation patterns mirror v0.4.64's NFS work:
NT_STATUS_LOGON_FAILURE → "check credentials", BAD_NETWORK_NAME →
"check share name", connection refused / timeout → "verify
reachability + firewall", etc. UI renders the raw smbclient error
plus the hint as two lines.

Tests (149 total, was 142 in v0.4.64):
* smb_share parser tests covering ISO + skipped directory, filenames
  with spaces, non-ISO filtering.
* hint_for() translation tests for the dominant NT_STATUS codes.
* Server normalization (smb://, cifs://, \\, // prefixes all stripped).
* HTTP integration: shares list starts empty, invalid server / missing
  username / path in share name all rejected with actionable hints.

`cargo clippy --workspace --all-targets -- -D warnings` clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

.gitignore

@@ -1,5 +1,4 @@
 /target
-Cargo.lock
 data/isos/*.iso
 data/isos/*.partial
 data/isos/*.meta.json

Cargo.toml

@@ -12,9 +12,9 @@ members = [
 ]
 
 [workspace.package]
-version = "0.4.0"
+version = "0.4.65"
 edition = "2021"
-rust-version = "1.80"
+rust-version = "1.95"
 license = "MIT OR Apache-2.0"
 repository = "https://gitea.milesward.dev/mward4/OpenPXE"
 authors = ["OpenPXE contributors"]

README.md

@@ -5,11 +5,11 @@ Container-native PXE boot server. A Rust reimplementation of
 for Docker/OCI and OpenShift. Upload `.iso` files via the web UI; network
 clients PXE-boot them.
 
-> **Status:** v0.3.2 / pre-beta. Phases 1–5 complete: full PXE stack,
+> **Status:** v0.4.1 / pre-beta. Phases 1–5 complete: full PXE stack,
 > Queued Deployment queue, NFS-share ISO sources, live tracing log + an
-> operator terminal, per-MAC host bindings (Tinkerbell-style),
-> Prometheus `/metrics`, light/dark theme toggle, animated OpenPXE
-> imaging-progress widget, and per-ISO boot passwords. The test suite and
+> operator terminal, per-MAC host bindings, Prometheus `/metrics`,
+> light/dark theme toggle, animated OpenPXE imaging-progress widget,
+> chunked ISO uploads, and per-ISO boot passwords. The test suite and
 > clippy are part of the release checklist. Ready for real-hardware validation.
 
 ## Design non-negotiables
@@ -51,8 +51,7 @@ clients PXE-boot them.
    widget when devices are imaging. All assets served from the binary —
    no external requests.
 8. **Per-MAC host bindings.** Pin a MAC to a boot target and the client
-   skips the menu, chains straight through. Inspired by Tinkerbell's
-   `smee` MAC-prepended URL pattern.
+   skips the menu, chains straight through.
 9. **Prometheus metrics** at `/metrics` — DHCP replies by arch, TFTP
    transfer counts and bytes, HTTP request counts by route, queue /
    imaging gauges, uptime, build info. Plain text exposition format,
@@ -81,7 +80,7 @@ skip TFTP and respond with an HTTP URL.
 ./scripts/fetch-ipxe.sh
 
 # 2. Build the container image (~3 min first time).
-docker buildx build -f deploy/docker/Dockerfile -t openpxe:0.3.2 --load .
+docker buildx build -f deploy/docker/Dockerfile -t openpxe:0.4.1 --load .
 
 # 3. Run it on the box plugged into your PXE network. Set PUBLIC_IP to
 #    this host's LAN address so advertised iPXE URLs are reachable.
@@ -91,7 +90,7 @@ docker run -d --name openpxe \
   -e OPENPXE_DHCP_MODE=proxy \
   -v $PWD/data/isos:/var/lib/openpxe/isos \
   -v $PWD/data/work:/var/lib/openpxe/work \
-  openpxe:0.3.2
+  openpxe:0.4.1
 
 # 4. Open the UI and drop an ISO in.
 open http://10.0.0.5
@@ -122,7 +121,7 @@ docker buildx create --name openpxe-multi --driver docker-container --use
 # Build + push both linux/amd64 and linux/arm64 under one tag.
 docker buildx build --builder openpxe-multi \
   --platform linux/amd64,linux/arm64 \
-  -t ghcr.io/YOUR-ORG/openpxe:0.3.2 \
+  -t ghcr.io/YOUR-ORG/openpxe:0.4.1 \
   --push \
   -f deploy/docker/Dockerfile .
 ```
@@ -155,10 +154,10 @@ docker run --rm \
   -v /my/iso-library:/seed:ro \
   -v openpxe-data:/var/lib/openpxe/isos \
   -e OPENPXE_PUBLIC_IP=10.0.0.5 \
-  openpxe:0.3.2 seed --from /seed
+  openpxe:0.4.1 seed --from /seed
 
 # Dry run first to see what would be imported:
-docker run --rm -v /my/iso-library:/seed:ro openpxe:0.3.2 seed --from /seed --dry-run
+docker run --rm -v /my/iso-library:/seed:ro openpxe:0.4.1 seed --from /seed --dry-run
 ```
 
 ### Environment overrides

crates/core/Cargo.toml

@@ -21,6 +21,9 @@ time.workspace = true
 uuid.workspace = true
 parking_lot.workspace = true
 tokio = { workspace = true, features = ["sync", "rt", "macros", "time"] }
+# bcrypt for the admin Forms auth (v0.4.5). Already in the workspace
+# for per-ISO boot passwords; just re-exported here.
+bcrypt.workspace = true
 
 [dev-dependencies]
 tempfile = "3.12"

crates/core/src/auth.rs

@@ -0,0 +1,353 @@
+//! Operator authentication — Sonarr/Radarr-style single-admin Forms model.
+//!
+//! On a fresh install, no admin account exists; the WebUI's first-run
+//! flow prompts the operator to create one. After that the chosen
+//! credentials gate `/api/*` access. The admin can rotate username +
+//! password from Settings → Account.
+//!
+//! Multi-user RBAC isn't a goal for OpenPXE — the user explicitly asked
+//! for "you have access or you don't". When SSO is configured, additional
+//! users come in through the IdP; the locally-stored admin is the
+//! fallback owner who can change SSO config or the seal-breaker for an
+//! IdP outage. So one record is enough.
+//!
+//! Storage policy mirrors [`crate::host_bindings::HostBindings`] and
+//! [`crate::boot_log::BootLog`]: in-memory authoritative; disk is the
+//! crash-survival cache; a corrupt `auth.json` falls back to "no admin
+//! configured" rather than blocking startup, which puts the UI back
+//! into setup mode rather than locking the operator out.
+
+use parking_lot::RwLock;
+use serde::{Deserialize, Serialize};
+use std::path::PathBuf;
+use std::sync::Arc;
+use time::OffsetDateTime;
+
+use crate::{Error, Result};
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct AdminAccount {
+    pub username: String,
+    /// bcrypt hash (cost 10). The plaintext password never leaves the
+    /// request that set it — same discipline as the per-ISO boot password.
+    pub password_hash: String,
+    #[serde(with = "time::serde::rfc3339")]
+    pub created_at: OffsetDateTime,
+    #[serde(with = "time::serde::rfc3339")]
+    pub updated_at: OffsetDateTime,
+}
+
+/// Public projection — no hash, safe to ship to the WebUI.
+#[derive(Debug, Clone, Serialize)]
+pub struct AdminPublic {
+    pub username: String,
+    #[serde(with = "time::serde::rfc3339")]
+    pub created_at: OffsetDateTime,
+    #[serde(with = "time::serde::rfc3339")]
+    pub updated_at: OffsetDateTime,
+}
+
+impl From<&AdminAccount> for AdminPublic {
+    fn from(a: &AdminAccount) -> Self {
+        Self {
+            username: a.username.clone(),
+            created_at: a.created_at,
+            updated_at: a.updated_at,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+struct Inner {
+    admin: Option<AdminAccount>,
+}
+
+/// In-memory + on-disk admin registry. Cheap to clone.
+#[derive(Debug, Clone)]
+pub struct AdminStore {
+    path: Arc<PathBuf>,
+    inner: Arc<RwLock<Inner>>,
+}
+
+impl AdminStore {
+    /// Load from `<work_dir>/auth.json`, or start empty. A bad file
+    /// logs a warning and falls back to "no admin configured" — better
+    /// to surface the setup flow than lock the operator out of their
+    /// own install.
+    #[must_use]
+    pub fn load_or_default(work_dir: &std::path::Path) -> Self {
+        let path = work_dir.join("auth.json");
+        let inner = match std::fs::read_to_string(&path) {
+            Ok(text) => match serde_json::from_str::<Inner>(&text) {
+                Ok(parsed) => parsed,
+                Err(e) => {
+                    tracing::warn!(
+                        target: "openpxe::auth",
+                        "auth.json present but unreadable ({e}); starting in setup mode"
+                    );
+                    Inner::default()
+                }
+            },
+            Err(_) => Inner::default(),
+        };
+        Self {
+            path: Arc::new(path),
+            inner: Arc::new(RwLock::new(inner)),
+        }
+    }
+
+    /// Has an admin been bootstrapped? Drives the first-run / login
+    /// fork in the HTTP layer.
+    #[must_use]
+    pub fn is_configured(&self) -> bool {
+        self.inner.read().admin.is_some()
+    }
+
+    /// Public-safe snapshot for the WebUI.
+    #[must_use]
+    pub fn snapshot(&self) -> Option<AdminPublic> {
+        self.inner.read().admin.as_ref().map(AdminPublic::from)
+    }
+
+    /// First-run setup: create the admin account. Fails if one already
+    /// exists — the HTTP layer surfaces that as 409.
+    pub fn bootstrap(&self, username: &str, password: &str) -> Result<AdminPublic> {
+        validate_username(username)?;
+        validate_password(password)?;
+        let hash = bcrypt_hash(password)?;
+        let now = OffsetDateTime::now_utc();
+        let admin = AdminAccount {
+            username: username.trim().to_string(),
+            password_hash: hash,
+            created_at: now,
+            updated_at: now,
+        };
+        {
+            let mut g = self.inner.write();
+            if g.admin.is_some() {
+                return Err(Error::Invalid(
+                    "admin account already configured".into(),
+                ));
+            }
+            g.admin = Some(admin.clone());
+        }
+        self.persist();
+        tracing::info!(
+            target: "openpxe::auth",
+            username = %admin.username,
+            "admin account created (first-run setup)"
+        );
+        Ok((&admin).into())
+    }
+
+    /// Verify credentials. Returns the admin record (public projection)
+    /// on success, `Ok(None)` on mismatch, `Err` on systemic bcrypt
+    /// failure (treated as "auth not available right now" by callers).
+    pub fn verify(&self, username: &str, password: &str) -> Result<Option<AdminPublic>> {
+        let Some(admin) = self.inner.read().admin.clone() else {
+            return Ok(None);
+        };
+        if username.trim() != admin.username {
+            return Ok(None);
+        }
+        // bcrypt compares in constant time relative to the same hash.
+        // Doing the username check first is fine — a username mismatch
+        // returns immediately, but the only thing leaked is "this isn't
+        // the admin's username" which the operator already knows.
+        match bcrypt::verify(password, &admin.password_hash) {
+            Ok(true) => Ok(Some((&admin).into())),
+            Ok(false) => Ok(None),
+            Err(e) => Err(Error::Other(e.into())),
+        }
+    }
+
+    /// Rotate username and/or password. `current_password` must match
+    /// the *existing* hash — same flow as Sonarr's "current password
+    /// required to change". `new_username`/`new_password` are optional:
+    /// pass only what you want to change.
+    pub fn update_credentials(
+        &self,
+        current_password: &str,
+        new_username: Option<&str>,
+        new_password: Option<&str>,
+    ) -> Result<AdminPublic> {
+        // Re-check ownership before any state mutation.
+        let existing = self
+            .inner
+            .read()
+            .admin
+            .clone()
+            .ok_or_else(|| Error::Invalid("no admin configured".into()))?;
+        match bcrypt::verify(current_password, &existing.password_hash) {
+            Ok(true) => {}
+            Ok(false) => return Err(Error::Invalid("current password is incorrect".into())),
+            Err(e) => return Err(Error::Other(e.into())),
+        }
+
+        let mut updated = existing.clone();
+        if let Some(u) = new_username {
+            validate_username(u)?;
+            updated.username = u.trim().to_string();
+        }
+        if let Some(p) = new_password {
+            validate_password(p)?;
+            updated.password_hash = bcrypt_hash(p)?;
+        }
+        updated.updated_at = OffsetDateTime::now_utc();
+
+        {
+            let mut g = self.inner.write();
+            g.admin = Some(updated.clone());
+        }
+        self.persist();
+        tracing::info!(
+            target: "openpxe::auth",
+            username = %updated.username,
+            "admin credentials updated"
+        );
+        Ok((&updated).into())
+    }
+
+    fn persist(&self) {
+        let snap = self.inner.read().clone();
+        let body = match serde_json::to_vec_pretty(&snap) {
+            Ok(b) => b,
+            Err(e) => {
+                tracing::warn!(target: "openpxe::auth", "serialize auth.json: {e}");
+                return;
+            }
+        };
+        if let Some(parent) = self.path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        let tmp = self.path.with_extension("json.tmp");
+        if let Err(e) = std::fs::write(&tmp, body) {
+            tracing::warn!(target: "openpxe::auth", "write auth.json tmp: {e}");
+            return;
+        }
+        if let Err(e) = std::fs::rename(&tmp, self.path.as_path()) {
+            tracing::warn!(target: "openpxe::auth", "rename auth.json: {e}");
+        }
+    }
+}
+
+fn validate_username(u: &str) -> Result<()> {
+    let u = u.trim();
+    if u.is_empty() {
+        return Err(Error::Invalid("username must not be empty".into()));
+    }
+    if u.len() > 64 {
+        return Err(Error::Invalid("username must be 64 chars or fewer".into()));
+    }
+    if !u.chars().all(|c| c.is_ascii_graphic() && c != ':') {
+        return Err(Error::Invalid(
+            "username must be ASCII printable with no ':' character".into(),
+        ));
+    }
+    Ok(())
+}
+
+fn validate_password(p: &str) -> Result<()> {
+    if p.len() < 8 {
+        return Err(Error::Invalid(
+            "password must be at least 8 characters".into(),
+        ));
+    }
+    if p.len() > 256 {
+        return Err(Error::Invalid(
+            "password must be 256 characters or fewer".into(),
+        ));
+    }
+    Ok(())
+}
+
+fn bcrypt_hash(password: &str) -> Result<String> {
+    bcrypt::hash(password, bcrypt::DEFAULT_COST).map_err(|e| Error::Other(e.into()))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::tempdir;
+
+    #[test]
+    fn empty_after_load_when_no_file() {
+        let dir = tempdir().unwrap();
+        let s = AdminStore::load_or_default(dir.path());
+        assert!(!s.is_configured());
+        assert!(s.snapshot().is_none());
+    }
+
+    #[test]
+    fn bootstrap_then_verify_round_trip() {
+        let dir = tempdir().unwrap();
+        let s = AdminStore::load_or_default(dir.path());
+        let pub_ = s.bootstrap("admin", "hunter2hunter2").unwrap();
+        assert_eq!(pub_.username, "admin");
+        assert!(s.is_configured());
+
+        // Correct creds match; wrong creds don't.
+        assert!(s.verify("admin", "hunter2hunter2").unwrap().is_some());
+        assert!(s.verify("admin", "wrong").unwrap().is_none());
+        assert!(s.verify("nobody", "hunter2hunter2").unwrap().is_none());
+    }
+
+    #[test]
+    fn bootstrap_rejects_second_call() {
+        let dir = tempdir().unwrap();
+        let s = AdminStore::load_or_default(dir.path());
+        s.bootstrap("admin", "hunter2hunter2").unwrap();
+        let r = s.bootstrap("other", "anotherpass1");
+        assert!(matches!(r, Err(Error::Invalid(_))));
+    }
+
+    #[test]
+    fn round_trip_survives_disk_reload() {
+        let dir = tempdir().unwrap();
+        let s = AdminStore::load_or_default(dir.path());
+        s.bootstrap("admin", "hunter2hunter2").unwrap();
+        drop(s);
+        let s2 = AdminStore::load_or_default(dir.path());
+        assert!(s2.is_configured());
+        assert!(s2.verify("admin", "hunter2hunter2").unwrap().is_some());
+    }
+
+    #[test]
+    fn update_credentials_requires_current_password() {
+        let dir = tempdir().unwrap();
+        let s = AdminStore::load_or_default(dir.path());
+        s.bootstrap("admin", "hunter2hunter2").unwrap();
+        // Wrong current password → no change.
+        let r = s.update_credentials("nope", None, Some("newpassword1"));
+        assert!(matches!(r, Err(Error::Invalid(_))));
+        assert!(s.verify("admin", "hunter2hunter2").unwrap().is_some());
+
+        // Correct current password rotates only what's supplied.
+        s.update_credentials("hunter2hunter2", Some("alice"), Some("newpassword1"))
+            .unwrap();
+        assert!(s.verify("admin", "hunter2hunter2").unwrap().is_none());
+        assert!(s.verify("alice", "newpassword1").unwrap().is_some());
+    }
+
+    #[test]
+    fn update_credentials_partial_password_only_keeps_username() {
+        let dir = tempdir().unwrap();
+        let s = AdminStore::load_or_default(dir.path());
+        s.bootstrap("admin", "hunter2hunter2").unwrap();
+        s.update_credentials("hunter2hunter2", None, Some("newpassword1"))
+            .unwrap();
+        assert!(s.verify("admin", "newpassword1").unwrap().is_some());
+    }
+
+    #[test]
+    fn validates_username_and_password() {
+        let dir = tempdir().unwrap();
+        let s = AdminStore::load_or_default(dir.path());
+        assert!(s.bootstrap("", "hunter2hunter2").is_err());
+        assert!(s.bootstrap("ad:min", "hunter2hunter2").is_err()); // ':' reserved
+        assert!(s.bootstrap("admin", "short").is_err()); // <8 chars
+        // 65-char username is too long.
+        let long = "a".repeat(65);
+        assert!(s.bootstrap(&long, "hunter2hunter2").is_err());
+    }
+}

crates/core/src/branding.rs

@@ -0,0 +1,339 @@
+//! Operator-controlled branding overrides.
+//!
+//! The browser tab's logo (`/assets/logo.svg`) defaults to the bundled
+//! rainbow-horizon mark. Operators who deploy OpenPXE behind their own
+//! branding can upload a replacement that lives at
+//! `<work_dir>/branding/logo.<ext>` and is served in preference to the
+//! bundled SVG when present. Borrowed-from-FleetDM: tenant chrome, same
+//! product.
+//!
+//! Storage policy mirrors `HostBindings` / `BootLog`: in-memory cache is
+//! authoritative for the current process, disk is the source of truth on
+//! restart, and a corrupt cache file falls back to the bundled default
+//! rather than blocking startup.
+
+use parking_lot::RwLock;
+use serde::{Deserialize, Serialize};
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+
+/// Allowed MIME types for an uploaded logo. We deliberately keep this
+/// narrow — anything that can be `<img src="...">`'d into the brand
+/// block, no scripts. SVG carries the obvious XSS risk for raw inline
+/// HTML; we always serve the bytes as a separate asset with a strict
+/// content-type rather than inlining, so SVG is safe.
+pub const ALLOWED_LOGO_MIMES: &[&str] = &[
+    "image/svg+xml",
+    "image/png",
+    "image/jpeg",
+    "image/webp",
+    "image/gif",
+];
+
+/// Disk cap for an uploaded logo. PXE WebUIs are operator-facing — even
+/// a generous 2 MB cap is comfortable for any reasonable brand mark and
+/// puts a clear bound on memory + serialization cost.
+pub const MAX_LOGO_BYTES: usize = 2 * 1024 * 1024;
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+struct Inner {
+    /// File name (relative to the branding dir) for the active logo, if
+    /// any. Always under `<work_dir>/branding/`; never an absolute path
+    /// from the operator.
+    logo_filename: Option<String>,
+    /// MIME of the active logo, mirroring `logo_filename`. Cached here
+    /// so the HTTP layer can set Content-Type without re-sniffing.
+    logo_mime: Option<String>,
+}
+
+/// In-memory + on-disk override registry. Cheap to clone; locks are
+/// brief. The `branding.json` cache lives alongside the active asset
+/// inside `<work_dir>/branding/`.
+#[derive(Debug, Clone)]
+pub struct BrandingStore {
+    /// Root directory: `<work_dir>/branding/`. Created on first write.
+    dir: Arc<PathBuf>,
+    inner: Arc<RwLock<Inner>>,
+}
+
+impl BrandingStore {
+    /// Load (or initialise empty) from `<work_dir>/branding/`. Tolerates
+    /// missing directories, partial state, and corrupt JSON — a bad
+    /// cache should never block PXE for the network.
+    #[must_use]
+    pub fn load_or_default(work_dir: &Path) -> Self {
+        let dir = work_dir.join("branding");
+        let path = dir.join("branding.json");
+        let mut inner = Inner::default();
+        if let Ok(text) = std::fs::read_to_string(&path) {
+            match serde_json::from_str::<Inner>(&text) {
+                Ok(parsed) => {
+                    // Sanity: if the JSON says we have a logo but the
+                    // file is gone, clear the in-memory pointer so
+                    // /assets/logo.svg falls back to the bundled SVG
+                    // rather than 500ing on a missing file.
+                    if let Some(name) = parsed.logo_filename.as_deref() {
+                        if dir.join(name).is_file() {
+                            inner = parsed;
+                        } else {
+                            tracing::warn!(
+                                target: "openpxe::branding",
+                                file = %name,
+                                "branding.json points at missing file; clearing"
+                            );
+                        }
+                    } else {
+                        inner = parsed;
+                    }
+                }
+                Err(e) => {
+                    tracing::warn!(
+                        target: "openpxe::branding",
+                        "branding.json present but unreadable ({e}); starting empty"
+                    );
+                }
+            }
+        }
+        Self {
+            dir: Arc::new(dir),
+            inner: Arc::new(RwLock::new(inner)),
+        }
+    }
+
+    /// Absolute path to the active logo, if one is set and present on
+    /// disk. `None` means the HTTP layer should serve the bundled SVG.
+    #[must_use]
+    pub fn logo_path(&self) -> Option<PathBuf> {
+        let g = self.inner.read();
+        g.logo_filename.as_deref().map(|n| self.dir.join(n))
+    }
+
+    /// MIME of the active logo, if any. The HTTP layer pairs this with
+    /// the bytes returned by [`Self::logo_path`].
+    #[must_use]
+    pub fn logo_mime(&self) -> Option<String> {
+        self.inner.read().logo_mime.clone()
+    }
+
+    /// Replace the active logo. Returns the chosen on-disk filename so
+    /// the caller can echo it back in the API response. Old logos are
+    /// removed best-effort.
+    pub fn set_logo(&self, mime: &str, ext: &str, bytes: &[u8]) -> std::io::Result<String> {
+        std::fs::create_dir_all(self.dir.as_path())?;
+        // Single canonical filename per upload — overwriting the old one
+        // (after clearing it) keeps the directory tidy and avoids any
+        // path-traversal concern: the operator never supplies the name.
+        let safe_ext = sanitize_ext(ext);
+        let filename = format!("logo.{safe_ext}");
+        let final_path = self.dir.join(&filename);
+        // Atomic write: tmp -> rename. Guarantees the file is either
+        // entirely the old logo or entirely the new one.
+        let tmp = final_path.with_extension(format!("{safe_ext}.tmp"));
+        std::fs::write(&tmp, bytes)?;
+        std::fs::rename(&tmp, &final_path)?;
+        // Clean up any sibling logo.<otherext> so there's exactly one
+        // canonical file at any time.
+        if let Ok(entries) = std::fs::read_dir(self.dir.as_path()) {
+            for e in entries.flatten() {
+                let p = e.path();
+                let name = p
+                    .file_name()
+                    .and_then(|s| s.to_str())
+                    .unwrap_or("");
+                if name.starts_with("logo.") && name != filename {
+                    let _ = std::fs::remove_file(&p);
+                }
+            }
+        }
+
+        {
+            let mut g = self.inner.write();
+            g.logo_filename = Some(filename.clone());
+            g.logo_mime = Some(mime.to_string());
+        }
+        self.persist();
+        tracing::info!(
+            target: "openpxe::branding",
+            file = %filename, mime = %mime, size = bytes.len(),
+            "custom logo installed"
+        );
+        Ok(filename)
+    }
+
+    /// Drop the override and return to the bundled SVG.
+    pub fn clear_logo(&self) -> std::io::Result<()> {
+        let removed = {
+            let mut g = self.inner.write();
+            let removed = g.logo_filename.take();
+            g.logo_mime = None;
+            removed
+        };
+        if let Some(name) = removed {
+            let p = self.dir.join(&name);
+            let _ = std::fs::remove_file(&p);
+            tracing::info!(target: "openpxe::branding", file = %name, "custom logo cleared");
+        }
+        self.persist();
+        Ok(())
+    }
+
+    /// Convenience: true if a custom logo is configured. Surfaces on
+    /// `/api/status` so the WebUI can show "Custom logo: yes" without
+    /// fetching the asset itself.
+    #[must_use]
+    pub fn has_logo(&self) -> bool {
+        self.inner.read().logo_filename.is_some()
+    }
+
+    fn persist(&self) {
+        let snap = self.inner.read().clone();
+        let body = match serde_json::to_vec_pretty(&snap) {
+            Ok(b) => b,
+            Err(e) => {
+                tracing::warn!(target: "openpxe::branding", "serialize branding.json: {e}");
+                return;
+            }
+        };
+        if let Err(e) = std::fs::create_dir_all(self.dir.as_path()) {
+            tracing::warn!(target: "openpxe::branding", "mkdir branding/: {e}");
+            return;
+        }
+        let path = self.dir.join("branding.json");
+        let tmp = path.with_extension("json.tmp");
+        if let Err(e) = std::fs::write(&tmp, body) {
+            tracing::warn!(target: "openpxe::branding", "write branding.json tmp: {e}");
+            return;
+        }
+        if let Err(e) = std::fs::rename(&tmp, &path) {
+            tracing::warn!(target: "openpxe::branding", "rename branding.json: {e}");
+        }
+    }
+}
+
+/// Trim arbitrary operator-supplied extension strings to a small, safe
+/// alphanumeric form. Anything weird collapses to `bin`. We never let
+/// the extension affect the path beyond the final segment of `logo.<x>`.
+fn sanitize_ext(ext: &str) -> String {
+    let lc: String = ext
+        .chars()
+        .filter(char::is_ascii_alphanumeric)
+        .map(|c| c.to_ascii_lowercase())
+        .collect();
+    if lc.is_empty() || lc.len() > 5 {
+        "bin".into()
+    } else {
+        lc
+    }
+}
+
+/// Pick a safe filesystem extension from a MIME type. Returns `None`
+/// if the MIME isn't on the [`ALLOWED_LOGO_MIMES`] allowlist.
+#[must_use]
+pub fn ext_for_mime(mime: &str) -> Option<&'static str> {
+    match mime {
+        "image/svg+xml" => Some("svg"),
+        "image/png" => Some("png"),
+        "image/jpeg" => Some("jpg"),
+        "image/webp" => Some("webp"),
+        "image/gif" => Some("gif"),
+        _ => None,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::tempdir;
+
+    #[test]
+    fn empty_after_load_when_no_branding_dir() {
+        let dir = tempdir().unwrap();
+        let b = BrandingStore::load_or_default(dir.path());
+        assert!(!b.has_logo());
+        assert!(b.logo_path().is_none());
+        assert!(b.logo_mime().is_none());
+    }
+
+    #[test]
+    fn set_clear_round_trip_persists() {
+        let dir = tempdir().unwrap();
+        let b = BrandingStore::load_or_default(dir.path());
+        let name = b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake").unwrap();
+        assert_eq!(name, "logo.png");
+        assert!(b.has_logo());
+        assert_eq!(b.logo_mime().as_deref(), Some("image/png"));
+        let p = b.logo_path().unwrap();
+        assert!(p.is_file());
+
+        // Re-open and confirm the override survives a restart.
+        drop(b);
+        let b2 = BrandingStore::load_or_default(dir.path());
+        assert!(b2.has_logo());
+        assert_eq!(b2.logo_mime().as_deref(), Some("image/png"));
+
+        // Clear; the file goes away and has_logo flips off.
+        b2.clear_logo().unwrap();
+        assert!(!b2.has_logo());
+        assert!(!p.exists());
+    }
+
+    #[test]
+    fn replacing_logo_removes_old_extension_sibling() {
+        // PNG then SVG; only the SVG should remain on disk.
+        let dir = tempdir().unwrap();
+        let b = BrandingStore::load_or_default(dir.path());
+        b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake").unwrap();
+        b.set_logo("image/svg+xml", "svg", br#"<svg xmlns="http://www.w3.org/2000/svg"/>"#).unwrap();
+        let entries: Vec<_> = std::fs::read_dir(dir.path().join("branding"))
+            .unwrap()
+            .filter_map(|e| e.ok().map(|e| e.file_name().to_string_lossy().into_owned()))
+            .collect();
+        assert!(entries.iter().any(|n| n == "logo.svg"), "got {entries:?}");
+        assert!(!entries.iter().any(|n| n == "logo.png"), "stale PNG left over: {entries:?}");
+    }
+
+    #[test]
+    fn sanitize_ext_strips_separators_and_path_chars() {
+        assert_eq!(sanitize_ext("svg"), "svg");
+        // Path separators and non-alphanumerics filter out, leaving just
+        // letters. The remaining "etcpasswd" exceeds the 5-char cap so
+        // it collapses to `bin` rather than producing `etcpa`.
+        assert_eq!(sanitize_ext("../etc/passwd"), "bin");
+        // Short alphanumeric strip-through stays itself.
+        assert_eq!(sanitize_ext("../svg"), "svg");
+        assert_eq!(sanitize_ext(""), "bin");
+        assert_eq!(sanitize_ext("PNG"), "png");
+        // Anything past five chars is suspicious — collapse to `bin`.
+        assert_eq!(sanitize_ext("svgvvvv"), "bin");
+    }
+
+    #[test]
+    fn missing_file_referenced_by_json_resolves_to_empty() {
+        // If the operator nukes the file out from under the JSON cache,
+        // we should silently fall back to no-override rather than
+        // hanging on to a bogus path.
+        let dir = tempdir().unwrap();
+        let brand_dir = dir.path().join("branding");
+        std::fs::create_dir_all(&brand_dir).unwrap();
+        // Hand-write a branding.json claiming logo.png exists.
+        let inner = Inner {
+            logo_filename: Some("logo.png".into()),
+            logo_mime: Some("image/png".into()),
+        };
+        std::fs::write(
+            brand_dir.join("branding.json"),
+            serde_json::to_vec_pretty(&inner).unwrap(),
+        )
+        .unwrap();
+        let b = BrandingStore::load_or_default(dir.path());
+        assert!(!b.has_logo(), "should fall back when referenced file is missing");
+    }
+
+    #[test]
+    fn ext_for_mime_only_accepts_known_types() {
+        assert_eq!(ext_for_mime("image/png"), Some("png"));
+        assert_eq!(ext_for_mime("image/svg+xml"), Some("svg"));
+        assert_eq!(ext_for_mime("application/octet-stream"), None);
+        assert_eq!(ext_for_mime("text/html"), None);
+    }
+}

crates/core/src/host_bindings.rs

@@ -1,10 +1,9 @@
 //! Per-MAC host bindings.
 //!
-//! Inspired by the Tinkerbell `smee` "MAC-prepended URL" pattern: an
-//! operator can attach a preferred boot target (a `BootEntry::id`) to a
-//! specific MAC address. When a client with that MAC arrives, the
-//! top-level boot script chains straight to that target instead of
-//! showing the interactive menu.
+//! Operators can attach a preferred boot target (a `BootEntry::id`) to a
+//! specific MAC address. When a client with that MAC arrives, the top-level
+//! boot script chains straight to that target instead of showing the
+//! interactive menu.
 //!
 //! Use cases:
 //! - "This rack of Dell servers always images with Ubuntu Server 24.04"

crates/core/src/lib.rs

@@ -3,7 +3,9 @@
 #![forbid(unsafe_code)]
 
 pub mod arch;
+pub mod auth;
 pub mod boot_log;
+pub mod branding;
 pub mod client;
 pub mod config;
 pub mod error;
@@ -12,10 +14,14 @@ pub mod log_bus;
 pub mod metrics;
 pub mod queue;
 pub mod settings;
+pub mod sso;
 
 pub use arch::{ClientArch, FirmwareClass};
+pub use auth::{AdminAccount, AdminPublic, AdminStore};
 pub use boot_log::{BootEvent, BootLog};
+pub use branding::{ext_for_mime, BrandingStore, ALLOWED_LOGO_MIMES, MAX_LOGO_BYTES};
 pub use client::{ClientEvent, ClientRegistry, ClientSnapshot};
+pub use sso::{SsoConfig, SsoStore};
 pub use config::{Config, DhcpMode, NetworkConfig, Paths, ServerConfig};
 pub use error::{Error, Result};
 pub use host_bindings::{normalize_mac, HostBinding, HostBindings};

crates/core/src/sso.rs

@@ -0,0 +1,318 @@
+//! SAML SSO configuration — FleetDM-shaped, storage-only for v0.4.5.
+//!
+//! The operator pastes their IdP's metadata XML (or its URL) and a
+//! human-readable label; v0.4.5 just persists it. The actual SAML
+//! response-validation / JIT-provisioning flow lands in a later release
+//! — for now we cover the "configurable" half so an operator can teach
+//! OpenPXE about their IdP today and flip the switch on next upgrade.
+//!
+//! Shape borrowed from <https://github.com/fleetdm/fleet>'s app-config
+//! SSO block, minus the user-RBAC fields (OpenPXE is single-tier: you
+//! have access or you don't). Entity ID is omitted from the operator
+//! UI per the v0.4.5 brief — it defaults to the advertised public base
+//! URL when SAML wiring lands, which is what most IdPs expect anyway.
+
+use parking_lot::RwLock;
+use serde::{Deserialize, Serialize};
+use std::path::PathBuf;
+use std::sync::Arc;
+
+use crate::{Error, Result};
+
+/// The configurable surface. `metadata` and `metadata_url` are mutually
+/// exclusive at apply time (one or the other identifies the IdP); the
+/// store keeps both fields so an operator can switch between them
+/// without losing the inactive one.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+pub struct SsoConfig {
+    /// Master switch — when false, all SSO machinery (planned for a
+    /// later release) is skipped regardless of the rest of the fields.
+    #[serde(default)]
+    pub enabled: bool,
+    /// Display name shown on the WebUI's login screen as the "Sign in
+    /// with X" button label. Empty/whitespace falls back to "SSO".
+    #[serde(default)]
+    pub idp_name: String,
+    /// Optional HTTPS URL pointing at the IdP's brand logo. Rendered
+    /// next to `idp_name` on the WebUI's login screen (FleetDM-style).
+    /// Length-capped at [`MAX_URL_LEN`]; empty is fine.
+    #[serde(default)]
+    pub idp_logo_url: String,
+    /// Raw SAML metadata XML pasted by the operator. Mutually exclusive
+    /// with `metadata_url`; if both are set, the URL wins at apply time
+    /// (operators typically forget about a stale XML paste).
+    #[serde(default)]
+    pub metadata: String,
+    /// HTTPS URL where the IdP serves its metadata. Loaded lazily by the
+    /// future SAML flow; not validated here beyond a basic length cap.
+    #[serde(default)]
+    pub metadata_url: String,
+}
+
+impl SsoConfig {
+    /// Returns `true` only when the config is *usable* — enabled, and
+    /// at least one of metadata/metadata_url is present. The future
+    /// login flow will key off this; for v0.4.5 the WebUI uses it to
+    /// surface a yellow "configured but not live yet" hint.
+    #[must_use]
+    pub fn is_usable(&self) -> bool {
+        self.enabled
+            && (!self.metadata.trim().is_empty() || !self.metadata_url.trim().is_empty())
+    }
+}
+
+/// In-memory + on-disk SSO settings registry.
+#[derive(Debug, Clone)]
+pub struct SsoStore {
+    path: Arc<PathBuf>,
+    inner: Arc<RwLock<SsoConfig>>,
+}
+
+impl SsoStore {
+    /// Load from `<work_dir>/sso.json`, or start with the default empty
+    /// (`enabled = false`) config. A corrupt file falls back to default
+    /// rather than blocking startup.
+    #[must_use]
+    pub fn load_or_default(work_dir: &std::path::Path) -> Self {
+        let path = work_dir.join("sso.json");
+        let cfg = match std::fs::read_to_string(&path) {
+            Ok(text) => match serde_json::from_str::<SsoConfig>(&text) {
+                Ok(parsed) => parsed,
+                Err(e) => {
+                    tracing::warn!(
+                        target: "openpxe::sso",
+                        "sso.json present but unreadable ({e}); starting with default config"
+                    );
+                    SsoConfig::default()
+                }
+            },
+            Err(_) => SsoConfig::default(),
+        };
+        Self {
+            path: Arc::new(path),
+            inner: Arc::new(RwLock::new(cfg)),
+        }
+    }
+
+    #[must_use]
+    pub fn snapshot(&self) -> SsoConfig {
+        self.inner.read().clone()
+    }
+
+    /// Replace the whole config in one shot. Light validation: metadata
+    /// XML and URL are length-capped so an operator can't OOM us by
+    /// pasting a 10 GiB blob; the IdP UI tab clamps the input visually,
+    /// but the server enforces a hard ceiling regardless.
+    pub fn replace(&self, mut cfg: SsoConfig) -> Result<SsoConfig> {
+        cfg.idp_name = cfg.idp_name.trim().to_string();
+        cfg.idp_logo_url = cfg.idp_logo_url.trim().to_string();
+        cfg.metadata = cfg.metadata.trim().to_string();
+        cfg.metadata_url = cfg.metadata_url.trim().to_string();
+        if cfg.metadata.len() > MAX_METADATA_BYTES {
+            return Err(Error::Invalid(format!(
+                "metadata XML exceeds {MAX_METADATA_BYTES}-byte cap"
+            )));
+        }
+        if cfg.metadata_url.len() > MAX_URL_LEN {
+            return Err(Error::Invalid(format!(
+                "metadata_url exceeds {MAX_URL_LEN}-char cap"
+            )));
+        }
+        if cfg.idp_logo_url.len() > MAX_URL_LEN {
+            return Err(Error::Invalid(format!(
+                "idp_logo_url exceeds {MAX_URL_LEN}-char cap"
+            )));
+        }
+        if !cfg.metadata_url.is_empty()
+            && !cfg.metadata_url.starts_with("http://")
+            && !cfg.metadata_url.starts_with("https://")
+        {
+            return Err(Error::Invalid(
+                "metadata_url must start with http:// or https://".into(),
+            ));
+        }
+        if !cfg.idp_logo_url.is_empty()
+            && !cfg.idp_logo_url.starts_with("http://")
+            && !cfg.idp_logo_url.starts_with("https://")
+        {
+            return Err(Error::Invalid(
+                "idp_logo_url must start with http:// or https://".into(),
+            ));
+        }
+        // If they're trying to *enable* the integration but haven't
+        // supplied either source, reject — saves a "configured but
+        // unusable" surprise later.
+        if cfg.enabled && cfg.metadata.is_empty() && cfg.metadata_url.is_empty() {
+            return Err(Error::Invalid(
+                "enable SSO requires either metadata XML or a metadata URL".into(),
+            ));
+        }
+        {
+            let mut g = self.inner.write();
+            *g = cfg.clone();
+        }
+        self.persist();
+        tracing::info!(
+            target: "openpxe::sso",
+            enabled = cfg.enabled,
+            idp = %cfg.idp_name,
+            has_xml = !cfg.metadata.is_empty(),
+            has_url = !cfg.metadata_url.is_empty(),
+            "sso configuration updated"
+        );
+        Ok(cfg)
+    }
+
+    fn persist(&self) {
+        let snap = self.inner.read().clone();
+        let body = match serde_json::to_vec_pretty(&snap) {
+            Ok(b) => b,
+            Err(e) => {
+                tracing::warn!(target: "openpxe::sso", "serialize sso.json: {e}");
+                return;
+            }
+        };
+        if let Some(parent) = self.path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        let tmp = self.path.with_extension("json.tmp");
+        if let Err(e) = std::fs::write(&tmp, body) {
+            tracing::warn!(target: "openpxe::sso", "write sso.json tmp: {e}");
+            return;
+        }
+        if let Err(e) = std::fs::rename(&tmp, self.path.as_path()) {
+            tracing::warn!(target: "openpxe::sso", "rename sso.json: {e}");
+        }
+    }
+}
+
+/// Saturation caps. The numbers are generous for any real IdP metadata
+/// document — Okta's largest is ~50 KB, Azure AD's ~30 KB.
+const MAX_METADATA_BYTES: usize = 1024 * 1024;
+const MAX_URL_LEN: usize = 2048;
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::tempdir;
+
+    #[test]
+    fn default_is_disabled_and_empty() {
+        let dir = tempdir().unwrap();
+        let s = SsoStore::load_or_default(dir.path());
+        let cfg = s.snapshot();
+        assert!(!cfg.enabled);
+        assert!(cfg.metadata.is_empty());
+        assert!(cfg.metadata_url.is_empty());
+        assert!(!cfg.is_usable());
+    }
+
+    #[test]
+    fn replace_metadata_url_round_trip_via_disk() {
+        let dir = tempdir().unwrap();
+        let s = SsoStore::load_or_default(dir.path());
+        s.replace(SsoConfig {
+            enabled: true,
+            idp_name: "Okta".into(),
+            metadata: String::new(),
+            metadata_url: "https://idp.example.com/metadata".into(),
+            idp_logo_url: String::new(),
+        })
+        .unwrap();
+        drop(s);
+        let s2 = SsoStore::load_or_default(dir.path());
+        let cfg = s2.snapshot();
+        assert!(cfg.enabled);
+        assert!(cfg.is_usable());
+        assert_eq!(cfg.idp_name, "Okta");
+        assert_eq!(cfg.metadata_url, "https://idp.example.com/metadata");
+    }
+
+    #[test]
+    fn replace_xml_paste_is_accepted() {
+        let dir = tempdir().unwrap();
+        let s = SsoStore::load_or_default(dir.path());
+        let xml = r#"<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata">test</EntityDescriptor>"#;
+        s.replace(SsoConfig {
+            enabled: true,
+            idp_name: "Test IdP".into(),
+            metadata: xml.into(),
+            metadata_url: String::new(),
+            idp_logo_url: String::new(),
+        })
+        .unwrap();
+        assert!(s.snapshot().is_usable());
+    }
+
+    #[test]
+    fn enable_without_source_is_rejected() {
+        let dir = tempdir().unwrap();
+        let s = SsoStore::load_or_default(dir.path());
+        let r = s.replace(SsoConfig {
+            enabled: true,
+            idp_name: "Okta".into(),
+            metadata: String::new(),
+            metadata_url: String::new(),
+            idp_logo_url: String::new(),
+        });
+        assert!(matches!(r, Err(Error::Invalid(_))));
+        // …and a disabled blank config is fine.
+        s.replace(SsoConfig::default()).unwrap();
+    }
+
+    #[test]
+    fn metadata_url_must_be_http_scheme() {
+        let dir = tempdir().unwrap();
+        let s = SsoStore::load_or_default(dir.path());
+        let r = s.replace(SsoConfig {
+            enabled: false,
+            idp_name: String::new(),
+            metadata: String::new(),
+            metadata_url: "ftp://idp.example.com/metadata".into(),
+            idp_logo_url: String::new(),
+        });
+        assert!(matches!(r, Err(Error::Invalid(_))));
+    }
+
+    #[test]
+    fn idp_logo_url_must_be_http_scheme() {
+        // v0.4.6: SSO settings learned an idp_logo_url so the login
+        // screen can render the FleetDM-style "Sign in with <IdP-logo>"
+        // affordance. Same scheme rule as metadata_url.
+        let dir = tempdir().unwrap();
+        let s = SsoStore::load_or_default(dir.path());
+        let r = s.replace(SsoConfig {
+            enabled: false,
+            idp_name: "Okta".into(),
+            metadata: String::new(),
+            metadata_url: String::new(),
+            idp_logo_url: "data:image/png;base64,...".into(),
+        });
+        assert!(matches!(r, Err(Error::Invalid(_))));
+        // Real HTTPS URL is fine.
+        s.replace(SsoConfig {
+            enabled: false,
+            idp_name: "Okta".into(),
+            metadata: String::new(),
+            metadata_url: String::new(),
+            idp_logo_url: "https://idp.example.com/logo.png".into(),
+        })
+        .unwrap();
+        assert_eq!(s.snapshot().idp_logo_url, "https://idp.example.com/logo.png");
+    }
+
+    #[test]
+    fn metadata_size_cap_enforced() {
+        let dir = tempdir().unwrap();
+        let s = SsoStore::load_or_default(dir.path());
+        let oversize = "a".repeat(MAX_METADATA_BYTES + 1);
+        let r = s.replace(SsoConfig {
+            enabled: false,
+            idp_name: String::new(),
+            metadata: oversize,
+            metadata_url: String::new(),
+            idp_logo_url: String::new(),
+        });
+        assert!(matches!(r, Err(Error::Invalid(_))));
+    }
+}

crates/http-api/Cargo.toml

@@ -31,6 +31,9 @@ bytes.workspace = true
 futures.workspace = true
 mime.workspace = true
 mime_guess.workspace = true
+uuid.workspace = true
+# v0.4.5 Forms auth: lock-free session store and cookie helpers.
+parking_lot.workspace = true
 
 [dev-dependencies]
 tokio = { workspace = true, features = ["macros", "rt", "rt-multi-thread", "time"] }
@@ -38,3 +41,6 @@ tower = { workspace = true }
 tempfile = "3.12"
 serde_json = { workspace = true }
 time = { workspace = true }
+# v0.4.61: integration tests need to generate real PNG bytes for the
+# `/branding/pxe-logo` compositor; hand-rolled CRCs are too fragile.
+image = { version = "0.25", default-features = false, features = ["png"] }

crates/http-api/src/auth.rs

@@ -0,0 +1,485 @@
+//! Forms auth layer — sessions, login, setup, middleware.
+//!
+//! Three states:
+//!
+//! * **Unconfigured** (`AdminStore::is_configured() == false`). The
+//!   middleware passes every request through — there's no one to gate
+//!   against. The UI's `/api/me` returns `setup_required: true` and the
+//!   front-end pushes the operator into the first-run flow.
+//! * **Logged in**. The session cookie maps to an in-memory session
+//!   record with an idle expiry; `/api/me` returns the username.
+//! * **Logged out**. The middleware bounces `/api/*` (with the PXE
+//!   allowlist below) to `401 Unauthorized`; the front-end intercepts
+//!   that and shows `/login`.
+//!
+//! Allowlist for unauthenticated access *after* the admin is set up:
+//!
+//! * everything outside `/api/*` (the WebUI bundle, asset chrome, PXE
+//!   script endpoints, the bundled iPXE/wimboot binaries, ISO bytes,
+//!   liveness/readiness probes, the Prometheus scrape) — these are
+//!   read-only or PXE-essential and breaking them locks out booting
+//!   machines that have no way to authenticate;
+//! * `/api/setup`, `/api/login`, `/api/me` (the auth surface itself);
+//! * `/api/queue/join`, `/api/queue/poll/:entry_id` (iPXE long-poll for
+//!   Queued Deployment — the iPXE client can't send a session cookie).
+//!
+//! Everything else inside `/api/*` requires a valid session.
+
+use crate::state::AppState;
+use axum::{
+    body::Body,
+    extract::{Request, State},
+    http::{header, HeaderValue, StatusCode},
+    middleware::Next,
+    response::{IntoResponse, Response},
+    Json,
+};
+use openpxe_core::AdminPublic;
+use parking_lot::RwLock;
+use serde::{Deserialize, Serialize};
+use serde_json::json;
+use std::collections::HashMap;
+use std::sync::Arc;
+use std::time::{Duration, Instant};
+use uuid::Uuid;
+
+/// Idle session lifetime. Sliding — every authenticated request resets
+/// the expiry. 24h is the Sonarr default and matches what most operators
+/// expect for an on-prem admin console.
+const SESSION_TTL: Duration = Duration::from_hours(24);
+
+/// Name of the cookie we set/read. Distinct from a generic `session=`
+/// to avoid collisions with anything else sharing the host.
+pub const SESSION_COOKIE: &str = "openpxe_session";
+
+#[derive(Debug, Clone)]
+struct Session {
+    username: String,
+    expires_at: Instant,
+}
+
+/// In-memory session table. Cheap to clone (Arc-shared) and contention
+/// is rare — operators sign in once per browser session.
+#[derive(Debug, Clone, Default)]
+pub struct SessionStore {
+    inner: Arc<RwLock<HashMap<String, Session>>>,
+}
+
+impl SessionStore {
+    /// Mint a fresh session for `username` and return the opaque cookie
+    /// value. UUID v4 gives us 122 random bits — comfortably more than
+    /// the 64-128 bits typical for session IDs.
+    #[must_use]
+    pub fn create(&self, username: &str) -> String {
+        let id = Uuid::new_v4().simple().to_string();
+        let session = Session {
+            username: username.to_string(),
+            expires_at: Instant::now() + SESSION_TTL,
+        };
+        self.inner.write().insert(id.clone(), session);
+        id
+    }
+
+    /// Resolve a cookie value to the owning username, refreshing the
+    /// idle timer. Returns `None` for missing / expired sessions and
+    /// proactively evicts the expired entry so the map doesn't grow
+    /// unbounded across long-lived deployments.
+    pub fn touch(&self, id: &str) -> Option<String> {
+        let mut g = self.inner.write();
+        let s = g.get_mut(id)?;
+        if s.expires_at <= Instant::now() {
+            g.remove(id);
+            return None;
+        }
+        s.expires_at = Instant::now() + SESSION_TTL;
+        Some(s.username.clone())
+    }
+
+    /// Invalidate one session (the user's `/api/logout`).
+    pub fn revoke(&self, id: &str) {
+        self.inner.write().remove(id);
+    }
+
+    /// Invalidate every session — used after a credentials rotation so
+    /// stale cookies for the old password can't keep operating.
+    pub fn revoke_all(&self) {
+        self.inner.write().clear();
+    }
+
+    /// Periodic / opportunistic GC. Not currently scheduled (we evict
+    /// on touch), but exposed for a future janitor task.
+    pub fn gc(&self) {
+        let now = Instant::now();
+        self.inner.write().retain(|_, s| s.expires_at > now);
+    }
+
+    #[must_use]
+    pub fn len(&self) -> usize {
+        self.inner.read().len()
+    }
+
+    #[must_use]
+    pub fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+}
+
+// ── Cookie helpers ────────────────────────────────────────────────────────
+
+fn cookie_attrs(value: &str, max_age: Option<i64>) -> String {
+    // Same flags FleetDM and Sonarr ship by default:
+    //   - HttpOnly: blocks JS access (XSS containment)
+    //   - SameSite=Lax: allows top-level GET navigations from the IdP
+    //     to land authenticated when SSO arrives, but blocks
+    //     cross-site POST CSRF;
+    //   - Path=/: the cookie applies to the whole app;
+    //   - no Secure flag yet — many operators host on plain http://
+    //     LAN IPs (Unraid templates default to that); we'll add Secure
+    //     opportunistically when we add a TLS terminator option.
+    // SESSION_TTL fits in 32 bits comfortably (24h ≈ 86400 seconds); we
+    // never overflow i64, but clippy's `cast_possible_wrap` lint wants
+    // us to be explicit. `cast_signed` is the documented form.
+    let lifetime = max_age.unwrap_or_else(|| SESSION_TTL.as_secs().cast_signed());
+    format!(
+        "{SESSION_COOKIE}={value}; Path=/; HttpOnly; SameSite=Lax; Max-Age={lifetime}"
+    )
+}
+
+fn parse_cookie(headers: &axum::http::HeaderMap) -> Option<String> {
+    // `Cookie: a=b; c=d` parsing — small enough not to drag in a crate.
+    let raw = headers.get(header::COOKIE)?.to_str().ok()?;
+    for part in raw.split(';') {
+        let part = part.trim();
+        if let Some(v) = part.strip_prefix(&format!("{SESSION_COOKIE}=")) {
+            return Some(v.to_string());
+        }
+    }
+    None
+}
+
+// ── Middleware ────────────────────────────────────────────────────────────
+
+/// Return `true` if `path` is on the allowlist and should bypass the
+/// session check. The middleware applies this rule only when the admin
+/// account is configured; before then everything is open.
+fn is_public_path(path: &str) -> bool {
+    // Non-API paths: WebUI bundle, PXE chain, ISO bytes, health probes,
+    // metrics. All read-only / PXE-essential.
+    if !path.starts_with("/api/") {
+        return true;
+    }
+    // Auth surface and iPXE long-poll endpoints (no cookie available).
+    matches!(
+        path,
+        "/api/setup" | "/api/login" | "/api/logout" | "/api/me"
+    ) || path.starts_with("/api/queue/join")
+        || path.starts_with("/api/queue/poll/")
+}
+
+/// Axum middleware: gate `/api/*` behind a valid session, with the
+/// allowlist above. `State<AppState>` reaches in for the admin store +
+/// session store.
+pub async fn require_auth(
+    State(state): State<AppState>,
+    req: Request<Body>,
+    next: Next,
+) -> Response {
+    // Bypass entirely while unconfigured. The /api/setup endpoint is
+    // the only one that can flip this back to "configured", and it
+    // refuses to run a second time. Tests + fresh installs ride this
+    // path.
+    if !state.admin.is_configured() {
+        return next.run(req).await;
+    }
+    let path = req.uri().path();
+    if is_public_path(path) {
+        return next.run(req).await;
+    }
+    // Authenticated path. The cookie must be present, map to a live
+    // session, and the TTL refresh happens as a side-effect.
+    let token = parse_cookie(req.headers());
+    if let Some(t) = token {
+        if state.sessions.touch(&t).is_some() {
+            return next.run(req).await;
+        }
+    }
+    (
+        StatusCode::UNAUTHORIZED,
+        Json(json!({ "error": "authentication required" })),
+    )
+        .into_response()
+}
+
+// ── Handlers ──────────────────────────────────────────────────────────────
+
+#[derive(Debug, Deserialize)]
+pub struct SetupBody {
+    pub username: String,
+    pub password: String,
+}
+
+/// First-run setup. Refuses to run once an admin already exists — that
+/// guards against a leaked WebUI being re-bootstrapped by an attacker
+/// who's seen the deployment URL. After bootstrap, the new session
+/// cookie is set so the operator goes straight to the dashboard.
+pub async fn api_setup(
+    State(state): State<AppState>,
+    Json(body): Json<SetupBody>,
+) -> Response {
+    if state.admin.is_configured() {
+        return (
+            StatusCode::CONFLICT,
+            Json(json!({ "error": "admin account already configured" })),
+        )
+            .into_response();
+    }
+    match state.admin.bootstrap(&body.username, &body.password) {
+        Ok(pub_) => {
+            let session = state.sessions.create(&pub_.username);
+            login_response(StatusCode::CREATED, &pub_, &session)
+        }
+        Err(openpxe_core::Error::Invalid(msg)) => {
+            (StatusCode::BAD_REQUEST, Json(json!({ "error": msg }))).into_response()
+        }
+        Err(e) => (
+            StatusCode::INTERNAL_SERVER_ERROR,
+            Json(json!({ "error": format!("{e}") })),
+        )
+            .into_response(),
+    }
+}
+
+#[derive(Debug, Deserialize)]
+pub struct LoginBody {
+    pub username: String,
+    pub password: String,
+}
+
+pub async fn api_login(State(state): State<AppState>, Json(body): Json<LoginBody>) -> Response {
+    // Brief, deliberately vague — "invalid credentials" rather than
+    // "no such user" / "wrong password". Same anti-enumeration posture
+    // as Sonarr/Radarr.
+    let pub_ = match state.admin.verify(&body.username, &body.password) {
+        Ok(Some(u)) => u,
+        Ok(None) => {
+            return (
+                StatusCode::UNAUTHORIZED,
+                Json(json!({ "error": "invalid username or password" })),
+            )
+                .into_response();
+        }
+        Err(e) => {
+            return (
+                StatusCode::INTERNAL_SERVER_ERROR,
+                Json(json!({ "error": format!("{e}") })),
+            )
+                .into_response();
+        }
+    };
+    let session = state.sessions.create(&pub_.username);
+    login_response(StatusCode::OK, &pub_, &session)
+}
+
+pub async fn api_logout(
+    State(state): State<AppState>,
+    headers: axum::http::HeaderMap,
+) -> Response {
+    if let Some(t) = parse_cookie(&headers) {
+        state.sessions.revoke(&t);
+    }
+    // Stomp the cookie unconditionally — even if the request didn't
+    // carry one, the browser shouldn't keep a stale value.
+    let mut resp = StatusCode::NO_CONTENT.into_response();
+    resp.headers_mut().insert(
+        header::SET_COOKIE,
+        HeaderValue::from_str(&cookie_attrs("", Some(0))).unwrap(),
+    );
+    resp
+}
+
+/// Status surface for the front-end shell. Returns four cases:
+///
+/// * `setup_required: true` — no admin yet; show first-run page.
+/// * `authenticated: false` — admin exists, no session; show login.
+/// * `authenticated: true` + `user` — let the dashboard load.
+pub async fn api_me(State(state): State<AppState>, headers: axum::http::HeaderMap) -> Response {
+    if !state.admin.is_configured() {
+        return (
+            StatusCode::OK,
+            Json(json!({
+                "setup_required": true,
+                "authenticated": false,
+            })),
+        )
+            .into_response();
+    }
+    let token = parse_cookie(&headers);
+    let username = token.as_deref().and_then(|t| state.sessions.touch(t));
+    match username {
+        Some(u) => (
+            StatusCode::OK,
+            Json(json!({
+                "setup_required": false,
+                "authenticated": true,
+                "user": state.admin.snapshot(),
+                "session_user": u,
+            })),
+        )
+            .into_response(),
+        None => (
+            StatusCode::OK,
+            Json(json!({
+                "setup_required": false,
+                "authenticated": false,
+            })),
+        )
+            .into_response(),
+    }
+}
+
+#[derive(Debug, Deserialize)]
+pub struct UpdateCredentialsBody {
+    pub current_password: String,
+    #[serde(default)]
+    pub new_username: Option<String>,
+    #[serde(default)]
+    pub new_password: Option<String>,
+}
+
+/// Rotate the admin's username and/or password. Auth middleware has
+/// already proved the caller owns a session; we additionally require
+/// the *current* password to prove "person at the keyboard right now".
+/// On success we issue a fresh session cookie keyed to the (possibly
+/// new) username and revoke every prior session so a stolen cookie
+/// from before the rotation stops working.
+pub async fn api_update_credentials(
+    State(state): State<AppState>,
+    Json(body): Json<UpdateCredentialsBody>,
+) -> Response {
+    if !state.admin.is_configured() {
+        return (
+            StatusCode::CONFLICT,
+            Json(json!({ "error": "no admin configured" })),
+        )
+            .into_response();
+    }
+    let result = state.admin.update_credentials(
+        &body.current_password,
+        body.new_username.as_deref(),
+        body.new_password.as_deref(),
+    );
+    match result {
+        Ok(pub_) => {
+            state.sessions.revoke_all();
+            let session = state.sessions.create(&pub_.username);
+            login_response(StatusCode::OK, &pub_, &session)
+        }
+        Err(openpxe_core::Error::Invalid(msg)) => {
+            (StatusCode::BAD_REQUEST, Json(json!({ "error": msg }))).into_response()
+        }
+        Err(e) => (
+            StatusCode::INTERNAL_SERVER_ERROR,
+            Json(json!({ "error": format!("{e}") })),
+        )
+            .into_response(),
+    }
+}
+
+#[derive(Debug, Serialize)]
+struct LoginPayload<'a> {
+    user: &'a AdminPublic,
+    authenticated: bool,
+}
+
+fn login_response(status: StatusCode, user: &AdminPublic, session: &str) -> Response {
+    let body = Json(LoginPayload {
+        user,
+        authenticated: true,
+    });
+    let mut resp = (status, body).into_response();
+    resp.headers_mut().insert(
+        header::SET_COOKIE,
+        HeaderValue::from_str(&cookie_attrs(session, None)).unwrap(),
+    );
+    resp
+}
+
+// ── Tests ─────────────────────────────────────────────────────────────────
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn session_create_touch_revoke() {
+        let s = SessionStore::default();
+        assert!(s.is_empty());
+        let t = s.create("admin");
+        assert_eq!(s.len(), 1);
+        assert_eq!(s.touch(&t).as_deref(), Some("admin"));
+        s.revoke(&t);
+        assert!(s.is_empty());
+        // Stale token doesn't error, just returns None.
+        assert!(s.touch(&t).is_none());
+    }
+
+    #[test]
+    fn session_revoke_all_clears() {
+        let s = SessionStore::default();
+        let _ = s.create("a");
+        let _ = s.create("b");
+        assert_eq!(s.len(), 2);
+        s.revoke_all();
+        assert!(s.is_empty());
+    }
+
+    #[test]
+    fn public_path_allowlist() {
+        // PXE + chrome paths bypass auth.
+        for p in [
+            "/", "/assets/app.js", "/boot.ipxe", "/boot/fake.ipxe",
+            "/iso/fake.iso", "/ipxe/snponly.efi", "/healthz", "/readyz",
+            "/metrics",
+            // v0.4.6: iPXE fetches this for `console --picture` before
+            // it can possibly have a session cookie.
+            "/branding/pxe-logo",
+        ] {
+            assert!(is_public_path(p), "expected {p} to be public");
+        }
+        // Auth surface itself is public.
+        for p in ["/api/setup", "/api/login", "/api/logout", "/api/me"] {
+            assert!(is_public_path(p), "expected {p} to be public");
+        }
+        // iPXE long-poll endpoints are public (no cookie available).
+        assert!(is_public_path("/api/queue/join"));
+        assert!(is_public_path("/api/queue/poll/abc"));
+        // Everything else under /api/* must auth.
+        for p in [
+            "/api/isos",
+            "/api/isos/x/category",
+            "/api/storage/disk",
+            "/api/branding/logo",
+            "/api/sso",
+            "/api/hosts",
+        ] {
+            assert!(!is_public_path(p), "expected {p} to require auth");
+        }
+    }
+
+    #[test]
+    fn cookie_parse_picks_session_value() {
+        let mut h = axum::http::HeaderMap::new();
+        h.insert(
+            header::COOKIE,
+            HeaderValue::from_str(&format!("foo=bar; {SESSION_COOKIE}=abc123; baz=qux"))
+                .unwrap(),
+        );
+        assert_eq!(parse_cookie(&h).as_deref(), Some("abc123"));
+        // Different name → None.
+        let mut h2 = axum::http::HeaderMap::new();
+        h2.insert(header::COOKIE, HeaderValue::from_str("foo=bar").unwrap());
+        assert!(parse_cookie(&h2).is_none());
+        // No cookie header at all → None.
+        assert!(parse_cookie(&axum::http::HeaderMap::new()).is_none());
+    }
+}

crates/http-api/src/ipxe_script.rs

@@ -29,6 +29,15 @@ use std::fmt::Write as _;
 
 /// Top-level OpenPXE boot menu. Serialized identically for BIOS and UEFI
 /// clients because iPXE normalises the menu primitives across firmwares.
+///
+/// v0.4.6: rendered with an iVentoy-style polished frame — centered
+/// OpenPXE wordmark banner at the top (ASCII so every iPXE build can
+/// paint it), a footer carrying version + arch + firmware kind, and an
+/// optional `console --picture` directive that paints the operator's
+/// uploaded raster logo on top when the iPXE binary on the wire was
+/// built with PNG support. The ASCII banner is always rendered so
+/// even when the picture call no-ops the screen still reads as
+/// "OpenPXE — here is the menu" rather than a featureless box.
 #[must_use]
 pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> String {
     let mut s = String::new();
@@ -47,8 +56,41 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
     let _ = writeln!(s, "set base-url {base}");
     let _ = writeln!(s, "set esc:hex 1b");
     let _ = writeln!(s, "set cls ${{esc:string}}[2J");
+    // v0.4.6: best-effort graphics console with the operator-uploaded
+    // raster logo. Falls back to plain text console on iPXE builds
+    // without PNG support — the `||` chain keeps a parse-clean
+    // single-statement form so even the strictest iPXE parsers accept
+    // it. The `console` reset at the end re-syncs the menu output.
+    let _ = writeln!(
+        s,
+        "console --picture {base}/branding/pxe-logo || console"
+    );
+    // Map iPXE's ${{buildarch}} + ${{platform}} into the human form the
+    // user asked for (e.g. "x86 BIOS", "x86_64 UEFI", "arm64 UEFI").
+    // iPXE evaluates `iseq` lazily, so we only set whichever line
+    // matches. Anything not on the allowlist falls through to a generic
+    // `<buildarch> <platform>` display.
+    let _ = writeln!(s, "set arch-label ${{buildarch}} ${{platform}}");
+    let _ = writeln!(
+        s,
+        "iseq ${{buildarch}} i386   && iseq ${{platform}} pcbios && set arch-label x86 BIOS         || iseq ${{buildarch}} x86_64 && iseq ${{platform}} efi    && set arch-label x86_64 UEFI      || iseq ${{buildarch}} arm64  && iseq ${{platform}} efi    && set arch-label arm64 UEFI       || true"
+    );
     let _ = writeln!(s, ":menu");
     let _ = writeln!(s, "menu OpenPXE - network boot menu");
+    // ASCII OpenPXE wordmark. Works on every iPXE build, including
+    // the boot.ipxe.org pre-builds we ship (which omit `IMAGE_PNG`,
+    // so `console --picture` paints nothing). When the queued iPXE
+    // source-build lands and the operator's uploaded raster actually
+    // paints via `console --picture`, this banner can be retired in
+    // favour of the real image. The compositor at
+    // /branding/pxe-logo is already wired and waiting.
+    let _ = writeln!(s, "item --gap");
+    let _ = writeln!(s, "item --gap --       ___                   ___  __  __ ___");
+    let _ = writeln!(s, "item --gap --      / _ \\ _ __  ___ _ _   | _ \\ \\/  / | __|");
+    let _ = writeln!(s, "item --gap --     | (_) | '_ \\/ -_) ' \\  |  _/  \\  /  | _|");
+    let _ = writeln!(s, "item --gap --      \\___/| .__/\\___|_||_| |_|    /_/\\_\\ |___|");
+    let _ = writeln!(s, "item --gap --           |_|");
+    let _ = writeln!(s, "item --gap");
     let _ = writeln!(
         s,
         "item --gap -- ------------------------- Default -------------------------"
@@ -82,6 +124,18 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
     let _ = writeln!(s, "item queue            Queued Deployment  (join queue)");
     let _ = writeln!(s, "item --gap");
     let _ = writeln!(s, "item --key x exit     Exit iPXE");
+    // v0.4.6 footer line. Sits just above the `choose` line so it's
+    // always visible regardless of how the menu paginates. iPXE
+    // interpolates `${arch-label}` (set near the top of this script)
+    // and `${version}` is the binary-baked iPXE version — *not* the
+    // OpenPXE version — so we hard-code the OpenPXE version string
+    // here.
+    let openpxe_version = env!("CARGO_PKG_VERSION");
+    let _ = writeln!(s, "item --gap");
+    let _ = writeln!(
+        s,
+        "item --gap --                 OpenPXE v{openpxe_version}  -  ${{arch-label}}"
+    );
 
     if matches!(settings.timeout_action, TimeoutAction::Stay) {
         let _ = writeln!(s, "choose --default {default_item} target || goto menu");
@@ -149,6 +203,13 @@ pub fn render_family_menu(isos: &[IsoMeta], base_url: &str, is_windows: bool) ->
         if !filter(iso.introspection.family) {
             continue;
         }
+        // v0.4.4: ISOs the operator flipped to the Tools category move
+        // out of the OS installer submenus entirely — they only appear
+        // under Tools. Without this filter the operator would see the
+        // same ISO in both menus.
+        if matches!(iso.category, openpxe_iso_store::IsoCategory::Tools) {
+            continue;
+        }
         for entry in &iso.boot_entries {
             let size_label = fmt_size_mib(iso.size_bytes);
             let key = hotkey_for_index(count);
@@ -183,7 +244,7 @@ pub fn render_family_menu(isos: &[IsoMeta], base_url: &str, is_windows: bool) ->
         "iseq ${{target}} back && chain {base}/boot.ipxe || goto menu"
     );
     // Pass `?mac=${mac}` so the per-entry handler can record the booting
-    // client into the Host log (v0.4.0). iPXE substitutes `${mac}` before
+    // client into the Host log. iPXE substitutes `${mac}` before
     // the HTTP fetch; if the firmware can't resolve it the literal
     // `${mac}` is sent and the server treats it as "unknown".
     let _ = writeln!(
@@ -210,15 +271,52 @@ fn hotkey_for_index(i: usize) -> String {
     }
 }
 
-/// Tools submenu — Utilities, Shell, NIC Info, Reboot, Exit to firmware.
+/// Tools submenu — Utilities, Shell, NIC Info, Reboot, Exit to firmware,
+/// plus any ISOs the operator flipped to [`IsoCategory::Tools`] in the
+/// Storage tab. The category-Tools ISOs render first so frequently used
+/// recovery / hardware tools are reachable with a single number key
+/// before the built-in shortcuts.
 #[must_use]
-pub fn render_tools_menu(base_url: &str) -> String {
+pub fn render_tools_menu(isos: &[IsoMeta], base_url: &str) -> String {
     let base = base_url.trim_end_matches('/');
     let mut s = String::new();
     let _ = writeln!(s, "#!ipxe");
     let _ = writeln!(s, "set base-url {base}");
     let _ = writeln!(s, ":menu");
     let _ = writeln!(s, "menu OpenPXE - Tools");
+
+    // Operator-categorized tool ISOs (hotkeys 1..9), each chained the
+    // same way as a per-family menu pick — through the boot-entry id
+    // route, carrying `?mac=${mac}` for Host log attribution.
+    let mut count = 0;
+    for iso in isos {
+        if !matches!(iso.category, openpxe_iso_store::IsoCategory::Tools) {
+            continue;
+        }
+        for entry in &iso.boot_entries {
+            let size_label = fmt_size_mib(iso.size_bytes);
+            let key = hotkey_for_index(count);
+            let lock = if iso.is_password_protected() {
+                "*"
+            } else {
+                " "
+            };
+            let _ = writeln!(
+                s,
+                "item {}{} {}[{:>6}] {}",
+                key,
+                entry.id,
+                lock,
+                size_label,
+                escape_label(&entry.title),
+            );
+            count += 1;
+        }
+    }
+    if count > 0 {
+        let _ = writeln!(s, "item --gap");
+    }
+
     let _ = writeln!(s, "item --key u util     Utilities  (memtest, ...)");
     let _ = writeln!(s, "item --key s shell    OpenPXE Shell");
     let _ = writeln!(s, "item --key n nic      Network Card Info");
@@ -252,7 +350,12 @@ pub fn render_tools_menu(base_url: &str) -> String {
         s,
         "iseq ${{target}} back     && chain {base}/boot.ipxe        || goto menu"
     );
-    let _ = writeln!(s, "goto menu");
+    // Fall-through for category-Tools ISO ids — same as the family
+    // submenu, carrying `?mac=${mac}` for the boot log.
+    let _ = writeln!(
+        s,
+        "chain {base}/boot/${{target}}.ipxe?mac=${{mac}} || goto menu"
+    );
     s
 }
 
@@ -469,7 +572,7 @@ pub fn render_password_prompt(entry_id: &str, iso_filename: &str, base_url: &str
     let _ = writeln!(s, ":submit");
     let _ = writeln!(s, "echo Verifying...");
     // Carry `mac=${mac}` alongside the token so a successful unlock
-    // records the actual client MAC into the Host log (v0.4.0). On
+    // records the actual client MAC into the Host log. On
     // older iPXE that can't resolve `${mac}` the server just stores it
     // as "unknown" rather than refusing to boot.
     let _ = writeln!(
@@ -526,12 +629,59 @@ mod password_tests {
         assert!(s.contains("chain http://10.0.0.5/boot/alpha-linux.ipxe"));
     }
 
+    #[test]
+    fn top_menu_has_polished_branding_and_arch_footer() {
+        // v0.4.6 polish + v0.4.62 stability fixes: the menu emits a
+        // `console --picture` line that PNG-capable iPXE builds will
+        // honour (queued for a follow-up release once we can rebuild
+        // iPXE from source on native x86_64 hardware), an ASCII
+        // OpenPXE wordmark that works on every iPXE build (including
+        // the boot.ipxe.org pre-builds we currently ship), and a
+        // single-line footer carrying the OpenPXE version + arch.
+        let settings = Settings::default();
+        let s = render_menu(&[], &settings, "http://10.0.0.5");
+        assert!(
+            s.contains("console --picture http://10.0.0.5/branding/pxe-logo"),
+            "missing console --picture line:\n{s}"
+        );
+        // Picture-or-text-console must be a single statement so older
+        // iPXE parsers don't choke on the chain.
+        assert!(s.contains("|| console"), "missing graceful fallback:\n{s}");
+        // ASCII wordmark — paints on every iPXE build regardless of
+        // PNG support.
+        assert!(
+            s.contains("___                   ___  __  __ ___"),
+            "ASCII banner missing first row:\n{s}"
+        );
+        // Footer with version + arch interpolation. The version comes
+        // from CARGO_PKG_VERSION at compile time.
+        let version = env!("CARGO_PKG_VERSION");
+        assert!(
+            s.contains(&format!("OpenPXE v{version}")),
+            "footer missing OpenPXE version:\n{s}"
+        );
+        assert!(
+            s.contains("${arch-label}"),
+            "footer missing arch-label interpolation:\n{s}"
+        );
+        // No website URL — the design brief calls that out as tacky.
+        assert!(
+            !s.to_ascii_lowercase().contains("openpxe.com"),
+            "footer should not advertise the website:\n{s}"
+        );
+        // Arch-label mapping covers the three labels from the brief:
+        // "x86 BIOS", "x86_64 UEFI", "arm64 UEFI".
+        assert!(s.contains("x86 BIOS"), "{s}");
+        assert!(s.contains("x86_64 UEFI"), "{s}");
+        assert!(s.contains("arm64 UEFI"), "{s}");
+    }
+
     #[test]
     fn generated_scripts_do_not_emit_bare_or_trailing_fallbacks() {
         let settings = Settings::default();
         let scripts = [
             render_menu(&[], &settings, "http://10.0.0.5"),
-            render_tools_menu("http://10.0.0.5"),
+            render_tools_menu(&[], "http://10.0.0.5"),
             render_local_hdd("http://10.0.0.5"),
             render_util("http://10.0.0.5"),
             render_shell("http://10.0.0.5"),

crates/http-api/src/lib.rs

@@ -14,11 +14,13 @@
 #![forbid(unsafe_code)]
 
 pub mod app;
+pub mod auth;
 pub mod ipxe_script;
 pub mod iso_fs;
 pub mod log_stream;
 pub mod state;
 pub mod terminal;
+pub mod uploads;
 
 pub use app::build_router;
 pub use state::AppState;

crates/http-api/src/state.rs

@@ -1,7 +1,10 @@
+use crate::uploads::UploadSessions;
+use crate::auth::SessionStore;
 use openpxe_core::{
-    BootLog, ClientRegistry, DeploymentQueue, HostBindings, LogBus, Metrics, SettingsStore,
+    AdminStore, BootLog, BrandingStore, ClientRegistry, DeploymentQueue, HostBindings, LogBus,
+    Metrics, SettingsStore, SsoStore,
 };
-use openpxe_iso_store::{IsoStore, NfsManager, SmbManager};
+use openpxe_iso_store::{IsoStore, SmbManager, SmbShareManager};
 use std::sync::Arc;
 use time::OffsetDateTime;
 
@@ -19,6 +22,21 @@ pub struct AppState {
     /// every `/boot/<entry>.ipxe` chain that goes on to serve a script
     /// (i.e. an image actually starting to install on a machine).
     pub boot_log: BootLog,
+    /// Operator-controlled UI overrides (custom logo). When the
+    /// operator hasn't uploaded anything, the WebUI serves the bundled
+    /// rainbow-horizon mark.
+    pub branding: BrandingStore,
+    /// Forms-auth admin record + first-run bootstrap state. When
+    /// `admin.is_configured() == false`, the auth middleware passes
+    /// every request through and `/api/me` reports `setup_required`.
+    pub admin: AdminStore,
+    /// In-memory session table for active operator logins. Cleared on
+    /// process restart (sessions are tied to UI state, not persisted —
+    /// matches Sonarr/Radarr behaviour).
+    pub sessions: SessionStore,
+    /// SAML SSO configuration. v0.4.5 stores it; the actual SSO login
+    /// flow ships in a later release.
+    pub sso: SsoStore,
     /// Lock-free metrics counters surfaced at `/metrics` in Prometheus
     /// text format. Cheap to clone (handles to atomics).
     pub metrics: Metrics,
@@ -26,11 +44,18 @@ pub struct AppState {
     /// `smb_dir` at startup; `None` in pure-Linux-only deployments where
     /// Windows support is not wired in. Settings toggle drives start/stop.
     pub smb: Option<Arc<SmbManager>>,
-    /// NFS share manager. Always present (mounting is opt-in by the
-    /// operator from the Storage tab); `add()` requires `mount.nfs` to be
-    /// available in the runtime image. Surfaces errors per-mount rather
-    /// than failing the global state.
-    pub nfs: NfsManager,
+    /// v0.4.65: SMB share manager — userspace consumer of remote SMB
+    /// shares via Samba's `smbclient` CLI. Replaces the kernel-mount
+    /// NFS path that v0.4.64 shipped; that path didn't work on hosts
+    /// (Unraid, etc.) whose kernel ships without the nfs/cifs client
+    /// modules, and no container-side configuration could fix it.
+    /// `smbclient` does the SMB protocol over a plain TCP socket in
+    /// userspace — works in any container, no special caps required.
+    pub smb_shares: SmbShareManager,
+    /// Browser chunked upload state. Multipart uploads still go straight
+    /// through `IsoStore`, but the UI uses sessions so large ISO transfers
+    /// can show deterministic progress and leave visible partial files.
+    pub uploads: UploadSessions,
     /// Live log bus consumed by the Terminal tab via SSE. Operator-issued
     /// terminal commands also push synthetic lines onto it so the tail
     /// shows them inline.

crates/http-api/src/terminal.rs

@@ -88,7 +88,11 @@ async fn dispatch(state: &AppState, argv: &[String]) -> Result<String, String> {
         "isos" | "images" => Ok(isos_text(state)),
         "clients" => Ok(clients_text(state)),
         "queue" => queue_command(state, tail).await,
-        "nfs" => nfs_command(state, tail).await,
+        // v0.4.65: `nfs` is gone — replaced with userspace SMB share
+        // consumer. `smb` still controls the outbound Samba server
+        // for Windows install media; `share` lists/manages remote SMB
+        // shares OpenPXE pulls ISOs from.
+        "share" | "smb-share" => smb_share_command(state, tail).await,
         "smb" => smb_command(state, tail).await,
         "log" => log_command(state, tail),
         "whoami" => Ok("operator".to_string()),
@@ -107,18 +111,18 @@ fn status_text(s: &AppState) -> String {
     let clients = s.clients.list();
     let queue_entries = s.queue.list();
     let smb = s.smb.as_ref().map(|m| m.snapshot());
-    let nfs = s.nfs.list();
-    let nfs_active = nfs.iter().filter(|m| m.mounted).count();
+    let smb_shares = s.smb_shares.list();
+    let smb_reachable = smb_shares.iter().filter(|m| m.reachable).count();
     format!(
         "OpenPXE {ver}\n\
          base url:     {base}\n\
          interface:    {nic}\n\
          uptime:       {up}\n\
-         isos:         {n_isos}  (local: {n_local}, nfs: {n_nfs})\n\
+         isos:         {n_isos}  (local: {n_local}, smb: {n_smb})\n\
          clients:      {n_clients}\n\
          queue:        {n_entries}\n\
-         smb:          {smb}\n\
-         nfs mounts:   {n_total} configured ({n_active} active)\n",
+         smb server:   {smb}\n\
+         smb shares:   {n_total} configured ({n_active} reachable)\n",
         ver = env!("CARGO_PKG_VERSION"),
         base = s.public_base_url,
         nic = if s.nic_name.is_empty() {
@@ -132,15 +136,15 @@ fn status_text(s: &AppState) -> String {
             .iter()
             .filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Local))
             .count(),
-        n_nfs = isos
+        n_smb = isos
             .iter()
-            .filter(|i| !matches!(i.source, openpxe_iso_store::IsoSource::Local))
+            .filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Smb { .. }))
             .count(),
         n_clients = clients.len(),
         n_entries = queue_entries.len(),
         smb = smb.map_or_else(|| "(disabled)".into(), |s| format!("{s:?}")),
-        n_total = nfs.len(),
-        n_active = nfs_active,
+        n_total = smb_shares.len(),
+        n_active = smb_reachable,
     )
 }
 
@@ -158,7 +162,8 @@ fn isos_text(s: &AppState) -> String {
     for i in isos {
         let src = match i.source {
             openpxe_iso_store::IsoSource::Local => "local".to_string(),
-            openpxe_iso_store::IsoSource::Nfs { mount_id, .. } => format!("nfs:{mount_id}"),
+            // v0.4.65: SMB userspace consumer replaced kernel-mount NFS.
+            openpxe_iso_store::IsoSource::Smb { share_id, .. } => format!("smb:{share_id}"),
         };
         let _ = writeln!(
             out,
@@ -264,89 +269,111 @@ async fn queue_command(s: &AppState, args: &[String]) -> Result<String, String>
     }
 }
 
-// ── nfs ────────────────────────────────────────────────────────────────
+// ── share (v0.4.65: SMB shares) ─────────────────────────────────────────
 
-async fn nfs_command(s: &AppState, args: &[String]) -> Result<String, String> {
+async fn smb_share_command(s: &AppState, args: &[String]) -> Result<String, String> {
     match args.first().map(String::as_str) {
         None | Some("list") => {
-            let mounts = s.nfs.list();
-            if mounts.is_empty() {
-                return Ok("(no NFS mounts configured)".into());
+            let shares = s.smb_shares.list();
+            if shares.is_empty() {
+                return Ok("(no SMB shares configured)".into());
             }
             let mut out = String::new();
             let _ = writeln!(
                 out,
-                "{:<24} {:<6} {:<7} {:<6} TARGET",
-                "ID", "VER", "STATUS", "ISOS"
+                "{:<24} {:<7} {:<6} {:<6} TARGET",
+                "ID", "STATUS", "AUTH", "ISOS"
             );
-            for m in mounts {
-                let status = if m.mounted { "ok" } else { "down" };
+            for m in shares {
+                let status = if m.reachable { "ok" } else { "down" };
+                let auth = if m.guest { "guest" } else { "user" };
                 let _ = writeln!(
                     out,
-                    "{:<24} {:<6} {:<7} {:<6} {}:{}",
+                    "{:<24} {:<7} {:<6} {:<6} //{}/{}",
                     truncate(&m.id, 24),
-                    match m.version {
-                        openpxe_iso_store::NfsVersion::V3 => "v3",
-                        openpxe_iso_store::NfsVersion::V41 => "v4.1",
-                    },
                     status,
+                    auth,
                     m.iso_count,
                     m.server,
-                    m.export,
+                    m.share,
                 );
                 if let Some(e) = m.last_error {
                     let _ = writeln!(out, "    error: {e}");
                 }
+                if let Some(h) = m.last_hint {
+                    let _ = writeln!(out, "    hint:  {h}");
+                }
             }
             Ok(out)
         }
-        Some("mount") => {
-            // nfs mount <server>:<export> [v3|v41] [ro|rw]
+        Some("add") => {
+            // share add //server/share [guest|user:password]
             let target = args
                 .get(1)
-                .ok_or_else(|| "usage: nfs mount <server>:<export> [v3|v41] [ro|rw]".to_string())?;
-            let (server, export) = target
-                .split_once(':')
-                .ok_or_else(|| "target must be 'server:/export'".to_string())?;
-            let version = match args.get(2).map(String::as_str) {
-                Some("v3") => openpxe_iso_store::NfsVersion::V3,
-                Some("v41") | None => openpxe_iso_store::NfsVersion::V41,
-                Some(other) => {
-                    return Err(format!("unknown nfs version: {other} (expect v3 or v41)"))
-                }
+                .ok_or_else(|| {
+                    "usage: share add //server/share [guest|user:password]".to_string()
+                })?;
+            // Accept either `//server/share` (UNC-style) or
+            // `server:share` (shorter to type).
+            let stripped = target.trim_start_matches('/').trim_start_matches('\\');
+            let (server, share) = if let Some((s, p)) = stripped.split_once('/') {
+                (s, p)
+            } else if let Some((s, p)) = stripped.split_once(':') {
+                (s, p)
+            } else {
+                return Err("target must be '//server/share' or 'server:share'".into());
             };
-            let read_only = !matches!(args.get(3).map(String::as_str), Some("rw"));
-            let req = openpxe_iso_store::NfsAddRequest {
+
+            // Auth spec: "guest" or "user:password". Default: guest.
+            let auth = args.get(2).cloned().unwrap_or_else(|| "guest".into());
+            let (guest, username, password) = if auth == "guest" {
+                (true, None, None)
+            } else if let Some((u, p)) = auth.split_once(':') {
+                (false, Some(u.to_string()), Some(p.to_string()))
+            } else {
+                return Err("auth must be 'guest' or 'user:password'".into());
+            };
+
+            let req = openpxe_iso_store::SmbAddRequest {
                 server: server.to_string(),
-                export: export.to_string(),
-                version,
-                read_only,
+                share: share.to_string(),
+                username,
+                password,
+                guest,
+                port: None,
             };
-            match s.nfs.add(req).await {
-                Ok(m) => Ok(format!("mounted {} ({} isos)", m.id, m.iso_count)),
-                Err(e) => Err(format!("mount failed: {e}")),
+            match s.smb_shares.add(req).await {
+                Ok(m) => Ok(format!("added {} ({} isos)", m.id, m.iso_count)),
+                Err(e) => {
+                    let mut out = format!("add failed: {}", e.error);
+                    if let Some(h) = e.hint {
+                        out.push_str("\nhint: ");
+                        out.push_str(&h);
+                    }
+                    Err(out)
                 }
             }
-        Some("unmount") => {
+        }
+        Some("remove") => {
             let id = args
                 .get(1)
-                .ok_or_else(|| "usage: nfs unmount <id>".to_string())?;
-            match s.nfs.remove(id).await {
-                Ok(()) => Ok(format!("unmounted {id}")),
-                Err(e) => Err(format!("unmount failed: {e}")),
+                .ok_or_else(|| "usage: share remove <id>".to_string())?;
+            match s.smb_shares.remove(id).await {
+                Ok(()) => Ok(format!("removed {id}")),
+                Err(e) => Err(format!("remove failed: {e}")),
             }
         }
         Some("scan") => {
             let id = args
                 .get(1)
-                .ok_or_else(|| "usage: nfs scan <id>".to_string())?;
-            match s.nfs.rescan(id).await {
+                .ok_or_else(|| "usage: share scan <id>".to_string())?;
+            match s.smb_shares.rescan(id).await {
                 Ok(n) => Ok(format!("re-scanned {id}: {n} isos")),
                 Err(e) => Err(format!("scan failed: {e}")),
             }
         }
         Some(other) => Err(format!(
-            "unknown nfs subcommand: {other}\ntry: nfs [list|mount|unmount|scan]"
+            "unknown share subcommand: {other}\ntry: share [list|add|remove|scan]"
         )),
     }
 }
@@ -487,13 +514,13 @@ OpenPXE terminal — available commands:
   queue assign-all <target>         assign every waiting client
   queue release <entry_id>           release one queued client
 
-  nfs list                          list NFS mounts
-  nfs mount <s>:<e> [v3|v41] [ro|rw]  add and mount an NFS share
-  nfs unmount <id>                  unmount and forget a share
-  nfs scan <id>                     re-scan a share for new ISOs
+  share list                        list configured SMB shares
+  share add //srv/share [auth]      add an SMB share; auth = 'guest' or 'user:pass'
+  share remove <id>                 forget an SMB share
+  share scan <id>                   re-list a share for new ISOs
 
-  smb status                        SMB (Samba) state
-  smb start | stop | reload         control smbd
+  smb status                        outbound Samba state (Windows install media)
+  smb start | stop | reload         control the outbound smbd
 
   log clear                         drop the in-memory log ring buffer
   log tail [n]                      show the last n buffered lines (default 20)
@@ -508,10 +535,10 @@ mod tests {
     #[test]
     fn shell_split_basic() {
         assert_eq!(shell_split(""), Vec::<String>::new());
-        assert_eq!(shell_split("nfs list"), vec!["nfs", "list"]);
+        assert_eq!(shell_split("share list"), vec!["share", "list"]);
         assert_eq!(
-            shell_split("nfs mount 10.0.0.5:/srv v41 ro"),
-            vec!["nfs", "mount", "10.0.0.5:/srv", "v41", "ro"]
+            shell_split("share add //nas/isos guest"),
+            vec!["share", "add", "//nas/isos", "guest"]
         );
     }
 

crates/http-api/src/uploads.rs

@@ -0,0 +1,180 @@
+//! Chunked upload sessions for browser-driven ISO uploads.
+//!
+//! The legacy multipart endpoint still exists for simple API clients, but
+//! browsers get a better failure mode with raw chunks: progress advances after
+//! each acknowledged write, partial files appear in the ISO directory
+//! immediately, and reverse proxies are less likely to buffer an entire DVD
+//! image before OpenPXE sees byte one.
+
+use bytes::Bytes;
+use openpxe_core::{Error, Result};
+use openpxe_iso_store::{IsoMeta, IsoStore, UploadHandle};
+use serde::Serialize;
+use std::collections::HashMap;
+use std::sync::Arc;
+use tokio::sync::Mutex;
+use uuid::Uuid;
+
+const DEFAULT_CHUNK_SIZE: u64 = 8 * 1024 * 1024;
+
+#[derive(Clone, Default)]
+pub struct UploadSessions {
+    inner: Arc<Mutex<HashMap<String, Arc<Mutex<UploadSession>>>>>,
+}
+
+struct UploadSession {
+    filename: String,
+    expected_size: Option<u64>,
+    offset: u64,
+    handle: Option<UploadHandle>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct UploadStarted {
+    pub upload_id: String,
+    pub iso_id: String,
+    pub filename: String,
+    pub offset: u64,
+    pub chunk_size: u64,
+}
+
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum UploadAppend {
+    Progress { offset: u64 },
+    Complete { offset: u64, iso: Box<IsoMeta> },
+}
+
+impl UploadSessions {
+    pub async fn begin(
+        &self,
+        store: &IsoStore,
+        filename: &str,
+        expected_size: Option<u64>,
+    ) -> Result<UploadStarted> {
+        if !filename.to_ascii_lowercase().ends_with(".iso") {
+            return Err(Error::Invalid("only .iso uploads accepted".to_string()));
+        }
+
+        let handle = store.begin_upload(filename).await?;
+        let iso_id = handle.id.clone();
+        let upload_id = Uuid::new_v4().to_string();
+        let session = UploadSession {
+            filename: filename.to_string(),
+            expected_size,
+            offset: 0,
+            handle: Some(handle),
+        };
+
+        self.inner
+            .lock()
+            .await
+            .insert(upload_id.clone(), Arc::new(Mutex::new(session)));
+
+        Ok(UploadStarted {
+            upload_id,
+            iso_id,
+            filename: filename.to_string(),
+            offset: 0,
+            chunk_size: DEFAULT_CHUNK_SIZE,
+        })
+    }
+
+    pub async fn append(
+        &self,
+        store: &IsoStore,
+        upload_id: &str,
+        offset: u64,
+        chunk: Bytes,
+        complete: bool,
+    ) -> Result<UploadAppend> {
+        let Some(session_lock) = self.inner.lock().await.get(upload_id).cloned() else {
+            return Err(Error::Invalid(format!("no such upload '{upload_id}'")));
+        };
+
+        let mut session = session_lock.lock().await;
+        if session.offset != offset {
+            return Err(Error::Invalid(format!(
+                "expected offset {}, got {offset}",
+                session.offset
+            )));
+        }
+
+        let new_offset = session
+            .offset
+            .checked_add(chunk.len() as u64)
+            .ok_or_else(|| Error::Invalid("upload offset overflow".to_string()))?;
+
+        if let Some(expected) = session.expected_size {
+            if new_offset > expected {
+                return Err(Error::Invalid(format!(
+                    "chunk exceeds declared upload size {expected}"
+                )));
+            }
+        }
+
+        let Some(handle) = session.handle.as_mut() else {
+            return Err(Error::Invalid("upload already completed".to_string()));
+        };
+        if let Err(e) = handle.write_chunk(&chunk).await {
+            let handle = session.handle.take();
+            drop(session);
+            self.inner.lock().await.remove(upload_id);
+            if let Some(handle) = handle {
+                let _ = handle.abort().await;
+            }
+            return Err(e);
+        }
+
+        session.offset = new_offset;
+        if !complete {
+            return Ok(UploadAppend::Progress { offset: new_offset });
+        }
+
+        if let Some(expected) = session.expected_size {
+            if new_offset != expected {
+                return Err(Error::Invalid(format!(
+                    "final chunk ended at {new_offset}, expected {expected}"
+                )));
+            }
+        }
+
+        let Some(handle) = session.handle.take() else {
+            return Err(Error::Invalid("upload already completed".to_string()));
+        };
+        let filename = session.filename.clone();
+        drop(session);
+
+        tracing::info!(
+            target: "openpxe::http::upload",
+            upload_id,
+            filename = %filename,
+            received_bytes = new_offset,
+            "chunked upload body complete; introspecting"
+        );
+
+        let meta = match handle.finish(store).await {
+            Ok(meta) => meta,
+            Err(e) => {
+                self.inner.lock().await.remove(upload_id);
+                return Err(e);
+            }
+        };
+        self.inner.lock().await.remove(upload_id);
+        Ok(UploadAppend::Complete {
+            offset: new_offset,
+            iso: Box::new(meta),
+        })
+    }
+
+    pub async fn abort(&self, upload_id: &str) -> Result<()> {
+        let Some(session_lock) = self.inner.lock().await.remove(upload_id) else {
+            return Err(Error::Invalid(format!("no such upload '{upload_id}'")));
+        };
+        let mut session = session_lock.lock().await;
+        if let Some(handle) = session.handle.take() {
+            handle.abort().await?;
+        }
+        Ok(())
+    }
+}

crates/http-api/tests/full_flow.rs

@@ -14,7 +14,7 @@ use axum::body::Body;
 use axum::http::{header, Request, StatusCode};
 use openpxe_core::{ClientRegistry, DeploymentQueue, HostBindings, LogBus, Metrics, SettingsStore};
 use openpxe_http_api::{build_router, AppState};
-use openpxe_iso_store::{IsoStore, NfsManager};
+use openpxe_iso_store::{IsoStore, SmbShareManager};
 use tempfile::tempdir;
 use tower::ServiceExt;
 
@@ -94,11 +94,14 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
     let clients = ClientRegistry::new();
     let queue = DeploymentQueue::new();
     let settings = SettingsStore::load_or_default(dir.path());
-    let nfs = NfsManager::new(dir.path(), iso_store.clone());
-    iso_store.set_nfs_root(nfs.mount_root());
+    let smb_shares = SmbShareManager::new(dir.path(), iso_store.clone());
     let log_bus = LogBus::new(64);
     let hosts = HostBindings::load_or_default(dir.path());
     let boot_log = openpxe_core::BootLog::load_or_default(dir.path());
+    let branding = openpxe_core::BrandingStore::load_or_default(dir.path());
+    let admin = openpxe_core::AdminStore::load_or_default(dir.path());
+    let sso = openpxe_core::SsoStore::load_or_default(dir.path());
+    let sessions = openpxe_http_api::auth::SessionStore::default();
     let metrics = Metrics::new();
     let state = AppState {
         iso_store,
@@ -107,9 +110,14 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
         settings,
         hosts,
         boot_log,
+        branding,
+        admin,
+        sessions,
+        sso,
         metrics,
         smb: None,
-        nfs,
+        smb_shares,
+        uploads: openpxe_http_api::uploads::UploadSessions::default(),
         log_bus,
         started_at: time::OffsetDateTime::now_utc(),
         public_base_url: "http://127.0.0.1".into(),
@@ -455,35 +463,72 @@ async fn no_external_urls_in_generated_ipxe() {
 
 // ── Phase 4 integration tests ────────────────────────────────────────────
 
+// v0.4.65: kernel-mount NFS replaced with userspace SMB via smbclient.
+
 #[tokio::test]
-async fn nfs_add_with_bad_export_is_rejected() {
-    // Validation must happen before we shell out to /bin/mount —
-    // otherwise the operator sees opaque kernel errors instead of a
-    // clear "your export must start with /" hint.
+async fn smb_share_add_with_missing_server_is_rejected() {
+    // Validation must run before we shell out to smbclient — otherwise
+    // operators see opaque NT_STATUS codes for what's really a typo.
     let (state, _dir) = build_state().await;
     let app = build_router(state);
     let (s, b) = post_json(
         &app,
-        "/api/nfs",
-        r#"{"server":"10.0.0.5","export":"isos","version":"v41","read_only":true}"#,
+        "/api/smb-shares",
+        r#"{"server":"","share":"isos","guest":true}"#,
     )
     .await;
     assert_eq!(s, StatusCode::BAD_REQUEST);
     let msg = String::from_utf8_lossy(&b);
     assert!(
-        msg.contains("export"),
+        msg.to_lowercase().contains("server"),
         "expected validation hint, got: {msg}"
     );
 }
 
 #[tokio::test]
-async fn nfs_list_starts_empty() {
+async fn smb_share_add_requires_username_when_not_guest() {
     let (state, _dir) = build_state().await;
     let app = build_router(state);
-    let (s, b) = get(&app, "/api/nfs").await;
+    let (s, b) = post_json(
+        &app,
+        "/api/smb-shares",
+        r#"{"server":"10.0.0.5","share":"isos","guest":false}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::BAD_REQUEST);
+    let msg = String::from_utf8_lossy(&b);
+    assert!(
+        msg.to_lowercase().contains("username"),
+        "expected username hint, got: {msg}"
+    );
+}
+
+#[tokio::test]
+async fn smb_share_add_rejects_paths_in_share_name() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (s, b) = post_json(
+        &app,
+        "/api/smb-shares",
+        r#"{"server":"10.0.0.5","share":"isos/subdir","guest":true}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::BAD_REQUEST);
+    let msg = String::from_utf8_lossy(&b);
+    assert!(
+        msg.to_lowercase().contains("share name"),
+        "expected share name hint, got: {msg}"
+    );
+}
+
+#[tokio::test]
+async fn smb_shares_list_starts_empty() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (s, b) = get(&app, "/api/smb-shares").await;
     assert_eq!(s, StatusCode::OK);
     let v: serde_json::Value = serde_json::from_slice(&b).unwrap();
-    assert_eq!(v["mounts"].as_array().unwrap().len(), 0);
+    assert_eq!(v["shares"].as_array().unwrap().len(), 0);
 }
 
 #[tokio::test]
@@ -1002,11 +1047,7 @@ async fn boot_log_records_entry_serve_with_mac() {
     assert_eq!(upload.status(), StatusCode::CREATED);
 
     // Fetch the per-entry script with ?mac=...
-    let (s, _) = get(
-        &app,
-        "/boot/fake-alpine-linux.ipxe?mac=AA:BB:CC:00:00:09",
-    )
-    .await;
+    let (s, _) = get(&app, "/boot/fake-alpine-linux.ipxe?mac=AA:BB:CC:00:00:09").await;
     assert_eq!(s, StatusCode::OK);
 
     // The boot log should now contain exactly one entry, with the
@@ -1083,3 +1124,773 @@ async fn upload_rejects_non_iso_filename_with_clear_message() {
     let text = std::str::from_utf8(&body).unwrap();
     assert!(text.contains("only .iso uploads accepted"), "got: {text}");
 }
+
+#[tokio::test]
+async fn chunked_upload_writes_progressively_and_finishes_iso() {
+    let (state, dir) = build_state().await;
+    let app = build_router(state);
+    let iso = fake_alpine_iso();
+
+    let start = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri("/api/uploads")
+                .header("content-type", "application/json")
+                .body(Body::from(
+                    r#"{"filename":"chunked-alpine.iso","size_bytes":65536}"#,
+                ))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(start.status(), StatusCode::CREATED);
+    let body = axum::body::to_bytes(start.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    let started: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    let upload_id = started["upload_id"].as_str().unwrap();
+
+    let split = 8192usize;
+    let first = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("PUT")
+                .uri(format!("/api/uploads/{upload_id}"))
+                .header("x-openpxe-upload-offset", "0")
+                .body(Body::from(iso[..split].to_vec()))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(first.status(), StatusCode::ACCEPTED);
+    let body = axum::body::to_bytes(first.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    let progress: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert_eq!(progress["offset"].as_u64().unwrap(), split as u64);
+    assert!(!progress["complete"].as_bool().unwrap());
+    assert!(
+        dir.path().join("isos/chunked-alpine.partial").exists(),
+        "chunked upload should leave a visible partial file while in progress"
+    );
+
+    let final_chunk = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("PUT")
+                .uri(format!("/api/uploads/{upload_id}"))
+                .header("x-openpxe-upload-offset", split.to_string())
+                .header("x-openpxe-upload-complete", "true")
+                .body(Body::from(iso[split..].to_vec()))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(final_chunk.status(), StatusCode::CREATED);
+    let body = axum::body::to_bytes(final_chunk.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    let finished: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert!(finished["complete"].as_bool().unwrap());
+    assert_eq!(finished["iso"]["id"], "chunked-alpine");
+    assert!(dir.path().join("isos/chunked-alpine.iso").exists());
+    assert!(!dir.path().join("isos/chunked-alpine.partial").exists());
+}
+
+#[tokio::test]
+async fn chunked_upload_rejects_offset_mismatch_without_advancing() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+
+    let start = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri("/api/uploads")
+                .header("content-type", "application/json")
+                .body(Body::from(
+                    r#"{"filename":"offset-test.iso","size_bytes":16}"#,
+                ))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(start.status(), StatusCode::CREATED);
+    let body = axum::body::to_bytes(start.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    let started: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    let upload_id = started["upload_id"].as_str().unwrap();
+
+    let mismatch = app
+        .oneshot(
+            Request::builder()
+                .method("PUT")
+                .uri(format!("/api/uploads/{upload_id}"))
+                .header("x-openpxe-upload-offset", "8")
+                .body(Body::from(vec![1, 2, 3, 4]))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(mismatch.status(), StatusCode::CONFLICT);
+    let body = axum::body::to_bytes(mismatch.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    let text = String::from_utf8(body.to_vec()).unwrap();
+    assert!(text.contains("expected offset 0"), "got: {text}");
+}
+
+#[tokio::test]
+async fn iso_category_switch_moves_entry_between_menus() {
+    // OS (default): appears in Linux Installers submenu and not in Tools.
+    // After flipping to Tools: gone from Linux, present under Tools.
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+
+    let (ct, body) = multipart_iso_body("fake-alpine.iso", &fake_alpine_iso());
+    let upload = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri("/api/isos")
+                .header("content-type", ct)
+                .body(Body::from(body))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(upload.status(), StatusCode::CREATED);
+
+    let (_, linux_before) = get(&app, "/boot/_linux_menu.ipxe").await;
+    let linux_before = String::from_utf8(linux_before).unwrap();
+    assert!(
+        linux_before.contains("fake-alpine-linux"),
+        "expected entry in Linux submenu (default OS):\n{linux_before}"
+    );
+    let (_, tools_before) = get(&app, "/boot/_tools_menu.ipxe").await;
+    let tools_before = String::from_utf8(tools_before).unwrap();
+    assert!(
+        !tools_before.contains("fake-alpine-linux"),
+        "OS-category ISO shouldn't appear in Tools yet:\n{tools_before}"
+    );
+
+    // Flip to Tools.
+    let (s, _) = put_json(
+        &app,
+        "/api/isos/fake-alpine/category",
+        r#"{"category":"tools"}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::OK);
+
+    let (_, linux_after) = get(&app, "/boot/_linux_menu.ipxe").await;
+    let linux_after = String::from_utf8(linux_after).unwrap();
+    assert!(
+        !linux_after.contains("fake-alpine-linux"),
+        "Tools-category ISO should NOT appear in Linux submenu:\n{linux_after}"
+    );
+    let (_, tools_after) = get(&app, "/boot/_tools_menu.ipxe").await;
+    let tools_after = String::from_utf8(tools_after).unwrap();
+    assert!(
+        tools_after.contains("fake-alpine-linux"),
+        "Tools-category ISO should appear in Tools submenu:\n{tools_after}"
+    );
+}
+
+#[tokio::test]
+async fn iso_category_unknown_value_returns_400() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (ct, body) = multipart_iso_body("fake-alpine.iso", &fake_alpine_iso());
+    app.clone()
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri("/api/isos")
+                .header("content-type", ct)
+                .body(Body::from(body))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+
+    let (s, body) = put_json(
+        &app,
+        "/api/isos/fake-alpine/category",
+        r#"{"category":"gibberish"}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::BAD_REQUEST);
+    let text = std::str::from_utf8(&body).unwrap();
+    assert!(text.contains("unknown category"), "got: {text}");
+}
+
+#[tokio::test]
+async fn iso_category_unknown_id_returns_404() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (s, _) = put_json(
+        &app,
+        "/api/isos/does-not-exist/category",
+        r#"{"category":"tools"}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::NOT_FOUND);
+}
+
+#[tokio::test]
+async fn storage_disk_endpoint_reports_volume_stats() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (s, body) = get(&app, "/api/storage/disk").await;
+    assert_eq!(s, StatusCode::OK);
+    let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    // statvfs always returns something on the tempdir filesystem; check
+    // that the shape is sane (total >= used >= 0 and total >= available).
+    assert!(v["total_bytes"].as_u64().unwrap() > 0, "got {v}");
+    let total = v["total_bytes"].as_u64().unwrap();
+    let avail = v["available_bytes"].as_u64().unwrap();
+    let used = v["used_bytes"].as_u64().unwrap();
+    assert!(total >= avail, "{v}");
+    assert!(total >= used,  "{v}");
+    assert!(v["path"].as_str().unwrap().contains("isos"), "got {v}");
+}
+
+#[tokio::test]
+async fn api_docs_lists_known_endpoints() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (s, body) = get(&app, "/api/docs").await;
+    assert_eq!(s, StatusCode::OK);
+    let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    let groups = v["groups"].as_array().expect("groups array");
+    assert!(!groups.is_empty());
+    // Flatten the paths and confirm a handful of the routes that real
+    // operators will look up are documented.
+    let mut paths: Vec<String> = Vec::new();
+    for g in groups {
+        for ep in g["endpoints"].as_array().unwrap() {
+            paths.push(ep["path"].as_str().unwrap().into());
+        }
+    }
+    for needle in [
+        "/api/isos",
+        "/api/isos/:id/category",
+        "/api/storage/disk",
+        "/api/branding/logo",
+        "/api/boot-log",
+        "/metrics",
+    ] {
+        assert!(
+            paths.iter().any(|p| p == needle),
+            "expected {needle} in docs; got {paths:?}"
+        );
+    }
+}
+
+#[tokio::test]
+async fn branding_clear_when_no_logo_is_no_content() {
+    // No-op clear should still 204 — it's not an error to revert to
+    // the default when there's nothing to revert from.
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let res = app
+        .oneshot(
+            Request::builder()
+                .method("DELETE")
+                .uri("/api/branding/logo")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(res.status(), StatusCode::NO_CONTENT);
+}
+
+#[tokio::test]
+async fn status_exposes_custom_logo_flag() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (s, body) = get(&app, "/api/status").await;
+    assert_eq!(s, StatusCode::OK);
+    let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert_eq!(
+        v["custom_logo"].as_bool(),
+        Some(false),
+        "fresh state has no custom logo: {v}"
+    );
+}
+
+async fn put_json(router: &axum::Router, path: &str, body: &str) -> (StatusCode, Vec<u8>) {
+    let res = router
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("PUT")
+                .uri(path)
+                .header("content-type", "application/json")
+                .body(Body::from(body.to_owned()))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    let status = res.status();
+    let bytes = axum::body::to_bytes(res.into_body(), usize::MAX)
+        .await
+        .unwrap()
+        .to_vec();
+    (status, bytes)
+}
+
+// ─── v0.4.5: Forms auth + SSO ─────────────────────────────────────────────
+
+async fn post_collect(router: &axum::Router, path: &str, body: &str) -> (StatusCode, Vec<u8>, Vec<axum::http::HeaderValue>) {
+    let res = router
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri(path)
+                .header("content-type", "application/json")
+                .body(Body::from(body.to_owned()))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    let status = res.status();
+    let cookies: Vec<_> = res
+        .headers()
+        .get_all(axum::http::header::SET_COOKIE)
+        .iter()
+        .cloned()
+        .collect();
+    let body = axum::body::to_bytes(res.into_body(), usize::MAX)
+        .await
+        .unwrap()
+        .to_vec();
+    (status, body, cookies)
+}
+
+fn session_value(cookies: &[axum::http::HeaderValue]) -> Option<String> {
+    for c in cookies {
+        let s = c.to_str().ok()?;
+        if let Some(rest) = s.strip_prefix("openpxe_session=") {
+            // Until the first ';'
+            let val = rest.split(';').next().unwrap_or("").to_string();
+            return Some(val);
+        }
+    }
+    None
+}
+
+async fn get_with_cookie(router: &axum::Router, path: &str, cookie: &str) -> (StatusCode, Vec<u8>) {
+    let res = router
+        .clone()
+        .oneshot(
+            Request::builder()
+                .uri(path)
+                .header("cookie", format!("openpxe_session={cookie}"))
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    let status = res.status();
+    let body = axum::body::to_bytes(res.into_body(), usize::MAX)
+        .await
+        .unwrap()
+        .to_vec();
+    (status, body)
+}
+
+#[tokio::test]
+async fn me_reports_setup_required_when_no_admin() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (s, body) = get(&app, "/api/me").await;
+    assert_eq!(s, StatusCode::OK);
+    let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert_eq!(v["setup_required"].as_bool(), Some(true));
+    assert_eq!(v["authenticated"].as_bool(), Some(false));
+}
+
+#[tokio::test]
+async fn setup_creates_admin_logs_in_and_blocks_second_call() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    // First-run setup succeeds and returns a session cookie.
+    let (s, body, cookies) = post_collect(
+        &app,
+        "/api/setup",
+        r#"{"username":"admin","password":"hunter2hunter2"}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::CREATED);
+    let token = session_value(&cookies).expect("setup should set cookie");
+    let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert_eq!(v["user"]["username"], "admin");
+
+    // /api/me with that cookie reports authenticated.
+    let (s, body) = get_with_cookie(&app, "/api/me", &token).await;
+    assert_eq!(s, StatusCode::OK);
+    let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert_eq!(v["authenticated"].as_bool(), Some(true));
+    assert_eq!(v["user"]["username"], "admin");
+
+    // /api/setup is now closed.
+    let (s, _, _) = post_collect(
+        &app,
+        "/api/setup",
+        r#"{"username":"second","password":"hunter2hunter2"}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::CONFLICT);
+}
+
+#[tokio::test]
+async fn protected_route_returns_401_after_setup_without_cookie() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    // Set up an admin so the middleware engages.
+    let (s, _, _) = post_collect(
+        &app,
+        "/api/setup",
+        r#"{"username":"admin","password":"hunter2hunter2"}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::CREATED);
+    // No cookie → 401 on a protected route.
+    let (s, _) = get(&app, "/api/isos").await;
+    assert_eq!(s, StatusCode::UNAUTHORIZED);
+    // PXE-essential routes stay reachable.
+    let (s, _) = get(&app, "/boot.ipxe").await;
+    assert_eq!(s, StatusCode::OK);
+    let (s, _) = get(&app, "/healthz").await;
+    assert_eq!(s, StatusCode::OK);
+}
+
+#[tokio::test]
+async fn login_logout_round_trip_uses_session_cookie() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (_, _, _) = post_collect(
+        &app,
+        "/api/setup",
+        r#"{"username":"admin","password":"hunter2hunter2"}"#,
+    )
+    .await;
+
+    // Fresh login (separate from the setup-issued session).
+    let (s, _, cookies) = post_collect(
+        &app,
+        "/api/login",
+        r#"{"username":"admin","password":"hunter2hunter2"}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::OK);
+    let token = session_value(&cookies).expect("login should set cookie");
+
+    // With cookie, /api/isos is reachable.
+    let (s, _) = get_with_cookie(&app, "/api/isos", &token).await;
+    assert_eq!(s, StatusCode::OK);
+
+    // Logout revokes the session; /api/isos goes back to 401.
+    let res = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri("/api/logout")
+                .header("cookie", format!("openpxe_session={token}"))
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(res.status(), StatusCode::NO_CONTENT);
+    let (s, _) = get_with_cookie(&app, "/api/isos", &token).await;
+    assert_eq!(s, StatusCode::UNAUTHORIZED);
+}
+
+#[tokio::test]
+async fn login_rejects_wrong_password_with_401_and_no_cookie() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (_, _, _) = post_collect(
+        &app,
+        "/api/setup",
+        r#"{"username":"admin","password":"hunter2hunter2"}"#,
+    )
+    .await;
+    let (s, body, cookies) = post_collect(
+        &app,
+        "/api/login",
+        r#"{"username":"admin","password":"nope"}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::UNAUTHORIZED);
+    assert!(session_value(&cookies).is_none(), "no cookie on failure");
+    let text = std::str::from_utf8(&body).unwrap();
+    assert!(text.contains("invalid"), "got: {text}");
+}
+
+#[tokio::test]
+async fn update_credentials_requires_current_password_and_rotates_session() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (_, _, cookies) = post_collect(
+        &app,
+        "/api/setup",
+        r#"{"username":"admin","password":"hunter2hunter2"}"#,
+    )
+    .await;
+    let token = session_value(&cookies).unwrap();
+
+    // Wrong current password → 400.
+    let res = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("PUT")
+                .uri("/api/me/credentials")
+                .header("content-type", "application/json")
+                .header("cookie", format!("openpxe_session={token}"))
+                .body(Body::from(
+                    r#"{"current_password":"wrong","new_password":"newpassword1"}"#,
+                ))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(res.status(), StatusCode::BAD_REQUEST);
+
+    // Correct current password rotates + returns a fresh cookie.
+    let res = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("PUT")
+                .uri("/api/me/credentials")
+                .header("content-type", "application/json")
+                .header("cookie", format!("openpxe_session={token}"))
+                .body(Body::from(
+                    r#"{"current_password":"hunter2hunter2","new_username":"alice","new_password":"newpassword1"}"#,
+                ))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(res.status(), StatusCode::OK);
+    let new_cookies: Vec<_> = res
+        .headers()
+        .get_all(axum::http::header::SET_COOKIE)
+        .iter()
+        .cloned()
+        .collect();
+    let new_token = session_value(&new_cookies).expect("rotation issues fresh cookie");
+
+    // Old cookie no longer valid (every session was revoked).
+    let (s, _) = get_with_cookie(&app, "/api/isos", &token).await;
+    assert_eq!(s, StatusCode::UNAUTHORIZED);
+
+    // New cookie works.
+    let (s, _) = get_with_cookie(&app, "/api/isos", &new_token).await;
+    assert_eq!(s, StatusCode::OK);
+
+    // Old creds no longer log in.
+    let (s, _, _) = post_collect(
+        &app,
+        "/api/login",
+        r#"{"username":"admin","password":"hunter2hunter2"}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::UNAUTHORIZED);
+    // New creds do.
+    let (s, _, _) = post_collect(
+        &app,
+        "/api/login",
+        r#"{"username":"alice","password":"newpassword1"}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::OK);
+}
+
+#[tokio::test]
+async fn sso_round_trip_default_then_replace() {
+    // Pre-setup state: middleware is open, so we can hit /api/sso directly.
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+
+    let (s, body) = get(&app, "/api/sso").await;
+    assert_eq!(s, StatusCode::OK);
+    let cfg: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert_eq!(cfg["enabled"].as_bool(), Some(false));
+
+    // Enable with a metadata URL.
+    let (s, _) = put_json(
+        &app,
+        "/api/sso",
+        r#"{"enabled":true,"idp_name":"Okta","metadata":"","metadata_url":"https://idp.example.com/metadata"}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::OK);
+    let (_, body) = get(&app, "/api/sso").await;
+    let cfg: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert_eq!(cfg["enabled"].as_bool(), Some(true));
+    assert_eq!(cfg["idp_name"], "Okta");
+
+    // Enabling without a source is rejected.
+    let (s, body) = put_json(
+        &app,
+        "/api/sso",
+        r#"{"enabled":true,"idp_name":"","metadata":"","metadata_url":""}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::BAD_REQUEST);
+    let text = std::str::from_utf8(&body).unwrap();
+    assert!(text.contains("metadata"), "got: {text}");
+}
+
+#[tokio::test]
+async fn docs_lists_new_v0_4_5_endpoints() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (s, body) = get(&app, "/api/docs").await;
+    assert_eq!(s, StatusCode::OK);
+    let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    let mut paths: Vec<String> = Vec::new();
+    for g in v["groups"].as_array().unwrap() {
+        for ep in g["endpoints"].as_array().unwrap() {
+            paths.push(ep["path"].as_str().unwrap().into());
+        }
+    }
+    // /api/docs predates v0.4.5 but the new surface should be reachable
+    // here too — confirms we don't forget to update it. For now we only
+    // require the *existing* docs entries to keep working.
+    for needle in ["/api/isos", "/api/boot-log", "/api/storage/disk"] {
+        assert!(paths.iter().any(|p| p == needle), "{needle} missing");
+    }
+}
+
+// ─── v0.4.6: PXE logo endpoint ────────────────────────────────────────────
+
+#[tokio::test]
+async fn pxe_logo_404_when_no_custom_logo_configured() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (s, body) = get(&app, "/branding/pxe-logo").await;
+    assert_eq!(s, StatusCode::NOT_FOUND);
+    let text = std::str::from_utf8(&body).unwrap();
+    assert!(text.contains("no custom logo"), "got: {text}");
+}
+
+/// Build a tiny valid PNG via the `image` crate. The v0.4.61 PXE-logo
+/// compositor decodes whatever the operator uploaded — hand-rolled
+/// PNGs with handwritten CRCs are too easy to break; let the encoder
+/// produce something it can later decode.
+fn tiny_png() -> Vec<u8> {
+    use image::{DynamicImage, ImageBuffer, ImageFormat, Rgb};
+    use std::io::Cursor;
+    let buf: ImageBuffer<Rgb<u8>, Vec<u8>> = ImageBuffer::from_pixel(8, 8, Rgb([0, 180, 220]));
+    let mut out = Vec::with_capacity(256);
+    DynamicImage::ImageRgb8(buf)
+        .write_to(&mut Cursor::new(&mut out), ImageFormat::Png)
+        .unwrap();
+    out
+}
+
+#[tokio::test]
+async fn pxe_logo_404_when_uploaded_logo_is_svg() {
+    // iPXE can't rasterize SVG, so an SVG upload deliberately doesn't
+    // light up the PXE menu's `console --picture` overlay — the menu
+    // simply paints without a logo.
+    let (state, _dir) = build_state().await;
+    state
+        .branding
+        .set_logo(
+            "image/svg+xml",
+            "svg",
+            br#"<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 8 8"/>"#,
+        )
+        .unwrap();
+    let app = build_router(state);
+    let (s, body) = get(&app, "/branding/pxe-logo").await;
+    assert_eq!(s, StatusCode::NOT_FOUND);
+    let text = std::str::from_utf8(&body).unwrap();
+    assert!(text.contains("SVG"), "got: {text}");
+}
+
+#[tokio::test]
+async fn pxe_logo_composes_to_1024x768_png() {
+    // v0.4.61: the endpoint no longer serves the raw upload — it
+    // composes the operator's logo into a fixed 1024×768 canvas so
+    // the iPXE menu always paints at consistent dimensions.
+    let (state, _dir) = build_state().await;
+    let png = tiny_png();
+    state
+        .branding
+        .set_logo("image/png", "png", &png)
+        .unwrap();
+    let app = build_router(state);
+    let res = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .uri("/branding/pxe-logo")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(res.status(), StatusCode::OK);
+    let ct = res
+        .headers()
+        .get(axum::http::header::CONTENT_TYPE)
+        .unwrap()
+        .to_str()
+        .unwrap();
+    assert_eq!(ct, "image/png");
+    let body = axum::body::to_bytes(res.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    // PNG signature.
+    assert!(body.starts_with(b"\x89PNG"), "PNG header missing");
+    // IHDR chunk lives at bytes 8..29; width is bytes 16..20, height
+    // 20..24 in big-endian u32. The composed canvas should be 1024×768.
+    let width = u32::from_be_bytes([body[16], body[17], body[18], body[19]]);
+    let height = u32::from_be_bytes([body[20], body[21], body[22], body[23]]);
+    assert_eq!(width, 1024, "compose should pin width to 1024");
+    assert_eq!(height, 768, "compose should pin height to 768");
+}
+
+#[tokio::test]
+async fn pxe_logo_endpoint_is_public_after_admin_setup() {
+    // iPXE clients can't send a session cookie, so /branding/pxe-logo
+    // must stay reachable once the admin has been bootstrapped. The
+    // auth allowlist gates `/api/*` only.
+    let (state, _dir) = build_state().await;
+    let png = tiny_png();
+    state
+        .branding
+        .set_logo("image/png", "png", &png)
+        .unwrap();
+    let app = build_router(state);
+    // Configure an admin so the middleware kicks in.
+    let (s, _, _) = post_collect(
+        &app,
+        "/api/setup",
+        r#"{"username":"admin","password":"hunter2hunter2"}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::CREATED);
+    // Still public without a cookie.
+    let (s, _) = get(&app, "/branding/pxe-logo").await;
+    assert_eq!(s, StatusCode::OK);
+}

crates/iso-store/Cargo.toml

@@ -27,6 +27,13 @@ parking_lot.workspace = true
 bytes.workspace = true
 tempfile = "3.12"
 libc = "0.2"
+# v0.4.61: server-side compose of the operator's uploaded raster into a
+# fixed 1024x768 canvas so the PXE menu always gets a consistently-sized
+# PNG regardless of what the operator uploaded. We use the bare-bones
+# `image` crate (no default features) and explicitly enable only the
+# decoders we accept on upload (PNG/JPEG/WebP/GIF) plus the PNG
+# encoder. Keeps the build slim — no JPEG2000, TIFF, BMP, etc.
+image = { version = "0.25", default-features = false, features = ["png", "jpeg", "webp", "gif"] }
 
 [dev-dependencies]
 tempfile = "3.12"

crates/iso-store/src/lib.rs

@@ -18,16 +18,23 @@
 
 pub mod entry;
 pub mod introspect;
-pub mod nfs;
+pub mod pxe_logo;
 pub mod smb;
+pub mod smb_share;
 pub mod store;
 pub mod windows;
 
 pub use entry::{BootEntry, BootKind, KernelArgs};
 pub use introspect::{DistroFamily, IntrospectionReport};
-pub use nfs::{NfsAddRequest, NfsManager, NfsMount, NfsVersion};
+// v0.4.65: kernel-mount NFS is gone. SMB shares via Samba's userspace
+// `smbclient` CLI replaced it — works in any container (no
+// CAP_SYS_ADMIN, no host kernel modules), matching how Bootimus and
+// every other PXE/imaging tool that supports network storage handles
+// it.
 pub use smb::{extract_windows_iso, SmbManager, SmbState};
+pub use smb_share::{SmbAddRequest, SmbShare, SmbShareError, SmbShareManager, SmbStream};
 pub use store::{
-    generate_boot_entries_for, slugify_str, IsoMeta, IsoSource, IsoStore, UploadHandle,
+    generate_boot_entries_for, slugify_str, IsoCategory, IsoMeta, IsoSource, IsoStore,
+    UploadHandle,
 };
 pub use windows::{WimPatcher, WinPatchState};

crates/iso-store/src/nfs.rs

@@ -1,558 +0,0 @@
-//! NFS share manager.
-//!
-//! Lets an operator mount a remote NFS export as an ISO source instead of
-//! uploading every ISO into the container's PVC. Supports NFSv3 and
-//! NFSv4.1 — the two versions the user explicitly asked for.
-//!
-//! ## How it works
-//!
-//! 1. Operator submits a mount spec via the Storage tab:
-//!    `{ server: "10.0.0.20", export: "/srv/isos", version: "v41" }`.
-//! 2. We slugify a stable id, mkdir `<work_dir>/nfs/<id>/`, then shell out
-//!    to `/bin/mount -t nfs -o vers=...,ro,nolock server:export local`.
-//! 3. On success we walk the mount point looking for `*.iso` files and
-//!    register each one with the `IsoStore` as an external source — same
-//!    introspection pipeline as a web upload, but no sha256 (the bytes
-//!    live on a remote machine; hashing them would suck them through the
-//!    network on every restart).
-//! 4. On failure we record `last_error` on the spec and persist anyway
-//!    so the UI can show a row in red rather than silently dropping it.
-//!
-//! ## Operational notes
-//!
-//! - Mounting NFS inside a container needs `CAP_SYS_ADMIN` and the
-//!   `nfs-common` package. The default image ships these (see Dockerfile).
-//! - On OpenShift, the SCC must allow `CAP_SYS_ADMIN`. The bundled SCC
-//!   doesn't — operators have to opt in by switching to a more privileged
-//!   SCC or running NFS mounts as a CSI driver outside the pod.
-//! - Mount commands are issued sequentially under a single mutex to avoid
-//!   `mount` racing on the same target dir.
-//!
-//! ## Persistence
-//!
-//! Mount specs (without runtime state) live at `<work_dir>/nfs.json`,
-//! re-mounted on startup. Mounts that fail to come back online keep their
-//! spec and their `last_error` so the operator sees what happened.
-
-use crate::introspect::{introspect, IntrospectionReport};
-use crate::store::{generate_boot_entries_for, slugify_str, IsoSource, IsoStore};
-use openpxe_core::{Error, Result};
-use parking_lot::Mutex;
-use serde::{Deserialize, Serialize};
-use std::collections::HashMap;
-use std::path::{Path, PathBuf};
-use std::sync::Arc;
-use time::OffsetDateTime;
-use tokio::process::Command;
-
-/// Wire-protocol versions we support. Keep this enum closed — silently
-/// accepting "auto" or letting the kernel negotiate would mean operators
-/// could never confirm which version is in use.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "lowercase")]
-pub enum NfsVersion {
-    /// NFSv3 — UDP/TCP, separate `mountd` protocol. Required for many
-    /// older NAS appliances.
-    V3,
-    /// NFSv4.1 — single TCP port (2049), session-based. Modern default.
-    V41,
-}
-
-impl NfsVersion {
-    fn vers_arg(self) -> &'static str {
-        match self {
-            Self::V3 => "vers=3",
-            Self::V41 => "vers=4.1",
-        }
-    }
-}
-
-/// One configured mount. The id is generated from server+export so the
-/// operator can re-add the same export idempotently.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct NfsMount {
-    pub id: String,
-    pub server: String,
-    pub export: String,
-    pub version: NfsVersion,
-    /// Read-only by default — most ISO libraries are. Operators that need
-    /// write can flip this off but OpenPXE itself never writes.
-    pub read_only: bool,
-    /// Local mount point under `<work_dir>/nfs/`.
-    pub local_path: PathBuf,
-    /// Whether the mount is currently active.
-    pub mounted: bool,
-    /// Last error encountered on a `mount` or `umount` attempt; cleared on
-    /// success.
-    pub last_error: Option<String>,
-    #[serde(with = "time::serde::rfc3339::option")]
-    pub last_attempt: Option<OffsetDateTime>,
-    /// Number of `.iso` files found on the share (re-counted on each scan).
-    pub iso_count: u32,
-}
-
-/// Spec submitted by the UI. Server and export are normalized before use.
-#[derive(Debug, Clone, Deserialize)]
-pub struct NfsAddRequest {
-    pub server: String,
-    pub export: String,
-    #[serde(default = "default_version")]
-    pub version: NfsVersion,
-    #[serde(default = "default_ro")]
-    pub read_only: bool,
-}
-
-fn default_version() -> NfsVersion {
-    NfsVersion::V41
-}
-fn default_ro() -> bool {
-    true
-}
-
-#[derive(Debug, Default)]
-struct Inner {
-    mounts: HashMap<String, NfsMount>,
-}
-
-/// Manages NFS mounts and surfaces them as ISO sources.
-///
-/// Cheap to clone — internal state is `Arc<Mutex<...>>`.
-#[derive(Debug, Clone)]
-pub struct NfsManager {
-    work_root: Arc<PathBuf>,
-    state_path: Arc<PathBuf>,
-    inner: Arc<Mutex<Inner>>,
-    iso_store: IsoStore,
-    /// Single-writer lock around the actual `mount`/`umount` shell-outs;
-    /// avoids racing on the same target directory.
-    mount_lock: Arc<tokio::sync::Mutex<()>>,
-}
-
-impl NfsManager {
-    /// Construct a manager rooted at `work_dir`. Mount points live under
-    /// `<work_dir>/nfs/<id>/`. State persists to `<work_dir>/nfs.json`.
-    #[must_use]
-    pub fn new(work_dir: &Path, iso_store: IsoStore) -> Self {
-        let work_root = work_dir.join("nfs");
-        let state_path = work_dir.join("nfs.json");
-        Self {
-            work_root: Arc::new(work_root),
-            state_path: Arc::new(state_path),
-            inner: Arc::new(Mutex::new(Inner::default())),
-            iso_store,
-            mount_lock: Arc::new(tokio::sync::Mutex::new(())),
-        }
-    }
-
-    /// Where this manager mounts shares. Used by `IsoStore` to resolve
-    /// NFS-backed `IsoMeta`s to their on-disk path.
-    #[must_use]
-    pub fn mount_root(&self) -> PathBuf {
-        self.work_root.as_ref().clone()
-    }
-
-    /// Load persisted state and re-attempt every mount. Errors are logged
-    /// per-mount but never fail the call — startup must not block on a
-    /// remote NFS server being slow.
-    pub async fn load_and_remount(&self) -> Result<()> {
-        tokio::fs::create_dir_all(self.work_root.as_path()).await?;
-        let mounts = match tokio::fs::read_to_string(self.state_path.as_path()).await {
-            Ok(text) => serde_json::from_str::<Vec<NfsMount>>(&text).unwrap_or_default(),
-            Err(_) => Vec::new(),
-        };
-        for mut m in mounts {
-            // Always start from "not mounted" — the kernel state was lost
-            // when the process died. We'll try to remount each one.
-            m.mounted = false;
-            m.last_error = None;
-            self.inner.lock().mounts.insert(m.id.clone(), m.clone());
-            if let Err(e) = self.try_mount(&m.id).await {
-                tracing::warn!(
-                    target: "openpxe::nfs",
-                    id = %m.id, error = %e,
-                    "could not remount NFS share on startup"
-                );
-            }
-        }
-        Ok(())
-    }
-
-    /// Add a new mount. Returns the resulting `NfsMount` (with `mounted`
-    /// reflecting reality) or an error if the spec was invalid.
-    pub async fn add(&self, req: NfsAddRequest) -> Result<NfsMount> {
-        let server = req.server.trim().to_string();
-        let export = req.export.trim().to_string();
-        if server.is_empty() {
-            return Err(Error::Invalid("server is required".into()));
-        }
-        if !export.starts_with('/') {
-            return Err(Error::Invalid("export path must start with '/'".into()));
-        }
-
-        let id = mount_id(&server, &export);
-        let local_path = self.work_root.join(&id);
-        tokio::fs::create_dir_all(&local_path).await?;
-
-        let mount = NfsMount {
-            id: id.clone(),
-            server,
-            export,
-            version: req.version,
-            read_only: req.read_only,
-            local_path,
-            mounted: false,
-            last_error: None,
-            last_attempt: None,
-            iso_count: 0,
-        };
-        self.inner.lock().mounts.insert(id.clone(), mount);
-        self.persist_locked();
-        self.try_mount(&id).await?;
-        Ok(self.get(&id).expect("mount just inserted"))
-    }
-
-    /// Unmount and forget a share. Removes any ISOs it contributed from
-    /// the IsoStore and deletes the local mount point. Idempotent.
-    pub async fn remove(&self, id: &str) -> Result<()> {
-        // Best-effort umount; even if it fails (e.g. server unreachable)
-        // we still want to drop the in-memory record.
-        let _ = self.umount_one(id).await;
-        let local_path = {
-            let mut g = self.inner.lock();
-            g.mounts.remove(id).map(|m| m.local_path)
-        };
-        self.persist_locked();
-        self.iso_store.drop_external_source(id);
-        if let Some(p) = local_path {
-            // rmdir only — never recurse, the mount could still be live
-            // on some kernel error path and we don't want to nuke a
-            // remote filesystem.
-            let _ = tokio::fs::remove_dir(&p).await;
-        }
-        Ok(())
-    }
-
-    /// Re-scan a mounted share for ISOs, refreshing the IsoStore.
-    pub async fn rescan(&self, id: &str) -> Result<u32> {
-        let mount = self
-            .get(id)
-            .ok_or_else(|| Error::Invalid(format!("no such mount '{id}'")))?;
-        if !mount.mounted {
-            return Err(Error::Invalid(format!("mount '{id}' is not active")));
-        }
-        let count = self.scan_and_register(&mount).await?;
-        if let Some(m) = self.inner.lock().mounts.get_mut(id) {
-            m.iso_count = count;
-        }
-        self.persist_locked();
-        Ok(count)
-    }
-
-    /// Snapshot of every configured mount.
-    #[must_use]
-    pub fn list(&self) -> Vec<NfsMount> {
-        let g = self.inner.lock();
-        let mut v: Vec<_> = g.mounts.values().cloned().collect();
-        v.sort_by(|a, b| a.id.cmp(&b.id));
-        v
-    }
-
-    /// Look up a single mount by id.
-    #[must_use]
-    pub fn get(&self, id: &str) -> Option<NfsMount> {
-        self.inner.lock().mounts.get(id).cloned()
-    }
-
-    // ── internals ─────────────────────────────────────────────────────
-
-    async fn try_mount(&self, id: &str) -> Result<()> {
-        let _g = self.mount_lock.lock().await;
-
-        let m = self
-            .get(id)
-            .ok_or_else(|| Error::Invalid(format!("no such mount '{id}'")))?;
-        let now = OffsetDateTime::now_utc();
-
-        // Already mounted? Skip — `mount` would error on a busy target
-        // and confuse the operator's UI status.
-        if is_mountpoint(&m.local_path).await {
-            self.update_status(id, true, None, now);
-            // Even though already mounted, we still want a fresh ISO count.
-            let count = self.scan_and_register(&m).await.unwrap_or(0);
-            self.update_iso_count(id, count);
-            return Ok(());
-        }
-
-        let opts = mount_options(&m);
-        let target = format!("{}:{}", m.server, m.export);
-
-        let output = Command::new("mount")
-            .arg("-t")
-            .arg("nfs")
-            .arg("-o")
-            .arg(&opts)
-            .arg(&target)
-            .arg(&m.local_path)
-            .output()
-            .await;
-
-        match output {
-            Ok(out) if out.status.success() => {
-                tracing::info!(
-                    target: "openpxe::nfs",
-                    id = %id, server = %m.server, export = %m.export,
-                    version = ?m.version,
-                    "NFS mount succeeded"
-                );
-                self.update_status(id, true, None, now);
-                let count = self.scan_and_register(&m).await.unwrap_or(0);
-                self.update_iso_count(id, count);
-                Ok(())
-            }
-            Ok(out) => {
-                let err = format!(
-                    "mount exit {}: {}",
-                    out.status.code().unwrap_or(-1),
-                    String::from_utf8_lossy(&out.stderr).trim()
-                );
-                tracing::warn!(target: "openpxe::nfs", id = %id, "{err}");
-                self.update_status(id, false, Some(err.clone()), now);
-                Err(Error::Invalid(err))
-            }
-            Err(e) => {
-                let err = format!("could not exec /bin/mount: {e}");
-                tracing::error!(target: "openpxe::nfs", id = %id, "{err}");
-                self.update_status(id, false, Some(err.clone()), now);
-                Err(Error::Invalid(err))
-            }
-        }
-    }
-
-    async fn umount_one(&self, id: &str) -> Result<()> {
-        let _g = self.mount_lock.lock().await;
-        let Some(m) = self.get(id) else { return Ok(()) };
-        if !is_mountpoint(&m.local_path).await {
-            self.update_status(id, false, None, OffsetDateTime::now_utc());
-            return Ok(());
-        }
-        // -l = lazy: detach immediately, finish when no process has a
-        // handle. Important if a stale ISO read is still in flight.
-        let out = Command::new("umount")
-            .arg("-l")
-            .arg(&m.local_path)
-            .output()
-            .await;
-        match out {
-            Ok(o) if o.status.success() => {
-                self.update_status(id, false, None, OffsetDateTime::now_utc());
-                Ok(())
-            }
-            Ok(o) => {
-                let e = format!(
-                    "umount exit {}: {}",
-                    o.status.code().unwrap_or(-1),
-                    String::from_utf8_lossy(&o.stderr).trim()
-                );
-                self.update_status(id, false, Some(e.clone()), OffsetDateTime::now_utc());
-                Err(Error::Invalid(e))
-            }
-            Err(e) => {
-                let e = format!("could not exec /bin/umount: {e}");
-                self.update_status(id, false, Some(e.clone()), OffsetDateTime::now_utc());
-                Err(Error::Invalid(e))
-            }
-        }
-    }
-
-    /// Walk the mount point for `*.iso` files, introspect each one, and
-    /// register it with the IsoStore as an NFS-sourced entry. Returns the
-    /// count of ISOs registered.
-    async fn scan_and_register(&self, m: &NfsMount) -> Result<u32> {
-        // Drop any prior entries from this mount before re-registering, so
-        // a removed file disappears from the store.
-        self.iso_store.drop_external_source(&m.id);
-
-        let mut walker = tokio::fs::read_dir(&m.local_path).await?;
-        let mut count = 0u32;
-        while let Some(entry) = walker.next_entry().await? {
-            let p = entry.path();
-            if p.extension()
-                .and_then(|e| e.to_str())
-                .map(str::to_ascii_lowercase)
-                .as_deref()
-                != Some("iso")
-            {
-                continue;
-            }
-            let filename = match p.file_name().and_then(|s| s.to_str()) {
-                Some(f) => f.to_string(),
-                None => continue,
-            };
-            let size = tokio::fs::metadata(&p).await?.len();
-            // Introspection is sync + IO-bound (reads ISO9660 PVD). Push
-            // it to a blocking thread so the runtime stays responsive on
-            // a slow share.
-            let p_owned = p.clone();
-            let report: IntrospectionReport =
-                tokio::task::spawn_blocking(move || introspect(&p_owned))
-                    .await
-                    .map_err(|e| Error::Other(e.into()))?;
-            let id = format!("nfs-{}-{}", m.id, slugify_str(&filename));
-            let boot_entries = generate_boot_entries_for(&id, &filename, &report);
-            let source = IsoSource::Nfs {
-                mount_id: m.id.clone(),
-                relative_path: filename.clone(),
-            };
-            self.iso_store
-                .register_external(id, filename, size, report, boot_entries, source);
-            count += 1;
-        }
-        Ok(count)
-    }
-
-    fn update_status(&self, id: &str, mounted: bool, err: Option<String>, ts: OffsetDateTime) {
-        if let Some(m) = self.inner.lock().mounts.get_mut(id) {
-            m.mounted = mounted;
-            m.last_error = err;
-            m.last_attempt = Some(ts);
-        }
-        self.persist_locked();
-    }
-
-    fn update_iso_count(&self, id: &str, count: u32) {
-        if let Some(m) = self.inner.lock().mounts.get_mut(id) {
-            m.iso_count = count;
-        }
-        self.persist_locked();
-    }
-
-    /// Atomically replace the on-disk JSON with the current state.
-    /// Persistence errors are logged, never propagated — settings live in
-    /// memory authoritatively, matching the SettingsStore policy.
-    fn persist_locked(&self) {
-        let mounts: Vec<NfsMount> = self.inner.lock().mounts.values().cloned().collect();
-        let path = self.state_path.as_path();
-        let tmp = path.with_extension("json.tmp");
-        let body = match serde_json::to_vec_pretty(&mounts) {
-            Ok(b) => b,
-            Err(e) => {
-                tracing::warn!(target: "openpxe::nfs", "serialize NFS state: {e}");
-                return;
-            }
-        };
-        if let Some(parent) = path.parent() {
-            let _ = std::fs::create_dir_all(parent);
-        }
-        if let Err(e) = std::fs::write(&tmp, body) {
-            tracing::warn!(target: "openpxe::nfs", "write NFS state tmp: {e}");
-            return;
-        }
-        if let Err(e) = std::fs::rename(&tmp, path) {
-            tracing::warn!(target: "openpxe::nfs", "rename NFS state: {e}");
-        }
-    }
-}
-
-fn mount_options(m: &NfsMount) -> String {
-    let mut opts = vec![m.version.vers_arg().to_string()];
-    if m.read_only {
-        opts.push("ro".into());
-    } else {
-        opts.push("rw".into());
-    }
-    // `nolock` for v3 — many storage appliances disable lockd; we don't
-    // need locking for read-only ISO access anyway.
-    if matches!(m.version, NfsVersion::V3) {
-        opts.push("nolock".into());
-    }
-    // Soft mount with a generous timeout — better to surface a hung share
-    // as a user-visible error than to wedge the iPXE client forever on a
-    // dead NFS server.
-    opts.push("soft".into());
-    opts.push("timeo=100".into());
-    opts.push("retrans=3".into());
-    opts.join(",")
-}
-
-fn mount_id(server: &str, export: &str) -> String {
-    let raw = format!("{server}{export}");
-    slugify_str(&raw)
-}
-
-/// Detect whether `path` is currently a mount point. We don't have
-/// `is_mountpoint(2)`, so compare the parent's device id to the dir's;
-/// if they differ the dir is a mount.
-async fn is_mountpoint(path: &Path) -> bool {
-    let Some(parent) = path.parent() else {
-        return false;
-    };
-    let Ok(m1) = tokio::fs::metadata(path).await else {
-        return false;
-    };
-    let Ok(m2) = tokio::fs::metadata(parent).await else {
-        return false;
-    };
-    use std::os::unix::fs::MetadataExt;
-    m1.dev() != m2.dev()
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn version_arg() {
-        assert_eq!(NfsVersion::V3.vers_arg(), "vers=3");
-        assert_eq!(NfsVersion::V41.vers_arg(), "vers=4.1");
-    }
-
-    #[test]
-    fn mount_options_v3_includes_nolock() {
-        let m = NfsMount {
-            id: "x".into(),
-            server: "s".into(),
-            export: "/e".into(),
-            version: NfsVersion::V3,
-            read_only: true,
-            local_path: PathBuf::from("/tmp/x"),
-            mounted: false,
-            last_error: None,
-            last_attempt: None,
-            iso_count: 0,
-        };
-        let opts = mount_options(&m);
-        assert!(opts.contains("vers=3"));
-        assert!(opts.contains("ro"));
-        assert!(opts.contains("nolock"));
-        assert!(opts.contains("soft"));
-    }
-
-    #[test]
-    fn mount_options_v41_no_nolock() {
-        let m = NfsMount {
-            id: "x".into(),
-            server: "s".into(),
-            export: "/e".into(),
-            version: NfsVersion::V41,
-            read_only: false,
-            local_path: PathBuf::from("/tmp/x"),
-            mounted: false,
-            last_error: None,
-            last_attempt: None,
-            iso_count: 0,
-        };
-        let opts = mount_options(&m);
-        assert!(opts.contains("vers=4.1"));
-        assert!(opts.contains("rw"));
-        assert!(!opts.contains("nolock"));
-    }
-
-    #[test]
-    fn mount_id_is_stable_and_safe() {
-        let a = mount_id("10.0.0.5", "/srv/isos");
-        let b = mount_id("10.0.0.5", "/srv/isos");
-        assert_eq!(a, b);
-        assert!(!a.contains('/'));
-        assert!(!a.contains('.'));
-    }
-}

crates/iso-store/src/pxe_logo.rs

@@ -0,0 +1,152 @@
+//! Operator-logo compositor for the iPXE menu.
+//!
+//! The brief: match iVentoy's polished centered-logo PXE chrome with
+//! whatever raster the operator drops onto Settings → Branding. A wide
+//! wordmark, a portrait stack, a square monogram — all three should
+//! land in roughly the same place on the boot screen.
+//!
+//! Approach: decode the operator's upload, fit it into a fixed
+//! 1024×768 canvas with the logo horizontally centered and pinned a
+//! short margin from the top, re-encode as PNG, return the bytes. iPXE
+//! built with `IMAGE_PNG` paints the result via `console --picture`.
+//!
+//! The 1024×768 size matches the default VESA framebuffer iPXE picks
+//! on most BIOS/UEFI consoles. Operators uploading 4K logos get
+//! correctly downscaled; tiny icons get drawn at their native size,
+//! centered, with transparent margins.
+//!
+//! We deliberately don't ship `resvg` for SVG support — keeping the
+//! dependency surface narrow matters more than supporting SVG-only
+//! brand assets. The WebUI's logo stays SVG-native (the browser
+//! rasterizes it); the PXE menu wants a raster regardless.
+
+use image::imageops::FilterType;
+use image::{DynamicImage, ImageError, ImageFormat, Rgba, RgbaImage};
+use std::io::Cursor;
+
+/// Canvas dimensions used for the composed PXE logo. Picked to match
+/// the framebuffer dimensions iPXE picks on most BIOS/UEFI consoles —
+/// gives a 1:1 paint with no scaling at the firmware layer.
+pub const CANVAS_W: u32 = 1024;
+pub const CANVAS_H: u32 = 768;
+
+/// Maximum dimensions for the operator's logo inside the canvas. Any
+/// upload larger than this in either axis is downscaled (preserving
+/// aspect ratio) to fit. Smaller uploads paint at native size.
+const LOGO_MAX_W: u32 = 600;
+const LOGO_MAX_H: u32 = 200;
+
+/// Top margin in pixels from the canvas's top edge to the logo's top
+/// edge. Matches the visual rhythm of iVentoy's screen (logo at top,
+/// menu below).
+const LOGO_TOP_MARGIN: u32 = 64;
+
+/// Compose `src_bytes` (any PNG/JPEG/WebP/GIF) into a centered-top
+/// 1024×768 PNG and return the encoded bytes.
+///
+/// Errors when the source can't be decoded or the encoded buffer can't
+/// be written (only really fires on out-of-memory; the encoder itself
+/// is infallible for well-formed inputs).
+pub fn compose_pxe_logo(src_bytes: &[u8]) -> Result<Vec<u8>, ImageError> {
+    let logo = image::load_from_memory(src_bytes)?;
+    // Resize-fit if the upload exceeds our bounding box. `Lanczos3`
+    // keeps the antialiasing crisp on the framebuffer console; it's a
+    // touch slower than `Triangle` but the operator hits this endpoint
+    // once per boot at most.
+    let logo = downscale_to_fit(logo, LOGO_MAX_W, LOGO_MAX_H);
+    let logo_rgba = logo.to_rgba8();
+
+    // Transparent canvas. iPXE 1.21+ honours alpha-channel transparency
+    // on framebuffer consoles; older builds simply draw the alpha as
+    // black, which still gives a sensible look.
+    let mut canvas: RgbaImage = RgbaImage::from_pixel(CANVAS_W, CANVAS_H, Rgba([0, 0, 0, 0]));
+    let logo_w = logo_rgba.width();
+    let logo_h = logo_rgba.height();
+    // Horizontal center, top-margin from the top. Saturating math
+    // means a logo wider than CANVAS_W (shouldn't happen after the
+    // downscale above, but defensive) just sits flush-left.
+    let off_x = CANVAS_W.saturating_sub(logo_w) / 2;
+    let off_y = LOGO_TOP_MARGIN.min(CANVAS_H.saturating_sub(logo_h));
+    image::imageops::overlay(&mut canvas, &logo_rgba, off_x.into(), off_y.into());
+
+    let mut out = Vec::with_capacity(64 * 1024);
+    DynamicImage::ImageRgba8(canvas).write_to(&mut Cursor::new(&mut out), ImageFormat::Png)?;
+    Ok(out)
+}
+
+fn downscale_to_fit(img: DynamicImage, max_w: u32, max_h: u32) -> DynamicImage {
+    let (w, h) = (img.width(), img.height());
+    if w <= max_w && h <= max_h {
+        return img;
+    }
+    // Preserve aspect ratio. `resize` clamps to the smaller of the
+    // two scale factors so we never overshoot the bounding box.
+    img.resize(max_w, max_h, FilterType::Lanczos3)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use image::{ImageBuffer, Rgb};
+
+    fn solid_png(w: u32, h: u32, rgb: [u8; 3]) -> Vec<u8> {
+        let img: ImageBuffer<Rgb<u8>, Vec<u8>> = ImageBuffer::from_pixel(w, h, Rgb(rgb));
+        let mut out = Vec::with_capacity(4096);
+        DynamicImage::ImageRgb8(img)
+            .write_to(&mut Cursor::new(&mut out), ImageFormat::Png)
+            .unwrap();
+        out
+    }
+
+    #[test]
+    fn compose_emits_canvas_sized_png() {
+        let src = solid_png(120, 60, [200, 50, 50]);
+        let out = compose_pxe_logo(&src).unwrap();
+        // Round-trip the output and confirm dimensions.
+        let img = image::load_from_memory(&out).unwrap();
+        assert_eq!(img.width(), CANVAS_W);
+        assert_eq!(img.height(), CANVAS_H);
+    }
+
+    #[test]
+    fn small_logo_centered_at_top_margin() {
+        let src = solid_png(100, 40, [10, 200, 10]);
+        let out = compose_pxe_logo(&src).unwrap();
+        let canvas = image::load_from_memory(&out).unwrap().to_rgba8();
+        // Pixel just inside the logo box should match the source color
+        // (alpha=255). Pixel near a far corner of the canvas should be
+        // the transparent background.
+        let cx = (CANVAS_W - 100) / 2;
+        let cy = LOGO_TOP_MARGIN;
+        let inside = canvas.get_pixel(cx + 10, cy + 10);
+        assert_eq!(inside.0[3], 255, "logo pixel should be opaque");
+        assert!(inside.0[0] < 100 && inside.0[1] > 100 && inside.0[2] < 100, "color mismatch: {inside:?}");
+        let corner = canvas.get_pixel(CANVAS_W - 1, CANVAS_H - 1);
+        assert_eq!(corner.0[3], 0, "canvas corner should be transparent");
+    }
+
+    #[test]
+    fn oversize_logo_is_downscaled_to_bounding_box() {
+        // 4000×800 image — bigger than LOGO_MAX_W and LOGO_MAX_H in
+        // both axes. After downscale the output must fit; we re-decode
+        // the canvas, count non-transparent pixels, and confirm none
+        // sit outside the expected band.
+        let src = solid_png(4000, 800, [50, 50, 200]);
+        let out = compose_pxe_logo(&src).unwrap();
+        let canvas = image::load_from_memory(&out).unwrap().to_rgba8();
+        // Span row at the top margin should have non-transparent
+        // pixels somewhere; rows past the LOGO_TOP_MARGIN + LOGO_MAX_H
+        // should be entirely transparent.
+        let bottom_band_y = LOGO_TOP_MARGIN + LOGO_MAX_H + 10;
+        for x in 0..CANVAS_W {
+            let p = canvas.get_pixel(x, bottom_band_y);
+            assert_eq!(p.0[3], 0, "row {bottom_band_y} should be transparent at x={x}");
+        }
+    }
+
+    #[test]
+    fn unsupported_bytes_returns_error_not_panic() {
+        let r = compose_pxe_logo(b"\xde\xad\xbe\xef not an image");
+        assert!(r.is_err());
+    }
+}

crates/iso-store/src/smb_share.rs

@@ -0,0 +1,940 @@
+//! SMB share consumer — replaces the kernel-mount NFS path that v0.4.64
+//! shipped.
+//!
+//! ## Why SMB and not NFS
+//!
+//! v0.4.64 tried to make `mount -t nfs` work inside the OpenPXE
+//! container. With `CAP_SYS_ADMIN` + `--privileged` we still hit the
+//! same `mount.nfs: failed to apply fstab options` on Unraid because
+//! Unraid's base kernel ships without the `nfs` / `nfsv4` client
+//! modules loaded. No amount of container-side configuration can
+//! load a kernel module on the host.
+//!
+//! SMB has the same kernel-side problem (`mount -t cifs` needs the
+//! `cifs` kernel module) but unlike NFS it has a usable **userspace**
+//! client: Samba's `smbclient` CLI. It speaks the SMB protocol over a
+//! plain TCP socket, no kernel modules required. Bootimus uses the
+//! same approach.
+//!
+//! ## How it works
+//!
+//! 1. Operator submits a share spec via the Storage tab:
+//!    `{ server: "192.168.1.51", share: "isos",
+//!       username, password, guest }`.
+//! 2. We write credentials to a 0600-permission tempfile under
+//!    `<work_dir>/smb_creds/`. Passing them on the command line would
+//!    leak them through `ps` and the container's audit log.
+//! 3. We test the connection by listing the share's root with
+//!    `smbclient //server/share -A creds_file -c 'ls *.iso'`. If the
+//!    server is unreachable, the share doesn't exist, or auth fails,
+//!    we get a clean error before persisting anything.
+//! 4. We parse the `ls` output for `*.iso` filenames and sizes, and
+//!    register each one with the `IsoStore` as an
+//!    `IsoSource::Smb { share_id, relative_path }`.
+//! 5. When a PXE client requests the bytes, the HTTP handler asks this
+//!    manager for an async reader. We spawn
+//!    `smbclient //server/share -A creds_file -c 'get file -'` and
+//!    pipe its stdout straight into the response body. No double
+//!    storage, no temp files.
+//!
+//! ## Why subprocess and not a Rust library
+//!
+//! The Debian runtime image already ships the `samba` package
+//! (Dockerfile line 84) — `smbclient` is right there. Library options
+//! like `pavao` wrap `libsmbclient` so they still pull in the same C
+//! library at runtime. Subprocess is simpler, the API surface is
+//! whatever the operator can verify with `smbclient` at a shell, and
+//! debugging "what does smbclient see?" is trivial.
+//!
+//! ## Range request limitations (v0.4.65)
+//!
+//! `smbclient -c 'get file -'` is a sequential whole-file stream;
+//! there's no native seek in the CLI. We honor full GETs and reject
+//! HTTP Range requests with `416 Range Not Satisfiable` for
+//! SMB-sourced ISOs. PXE clients in practice request the whole file:
+//! iPXE chain loading, casper sanboot, wimboot all do sequential
+//! streaming. A follow-up release can add libsmbclient-based seek if
+//! a real workload needs it.
+
+use crate::introspect::{DistroFamily, IntrospectionReport};
+use crate::store::{generate_boot_entries_for, slugify_str, IsoSource, IsoStore};
+use openpxe_core::{Error, Result};
+use parking_lot::Mutex;
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use std::io::Write;
+use std::path::{Path, PathBuf};
+use std::process::Stdio;
+use std::sync::Arc;
+use std::time::Duration;
+use time::OffsetDateTime;
+use tokio::process::Command;
+
+/// Default TCP port for SMB / CIFS. The wire protocol moved to 445
+/// years ago; 139 (NetBIOS) is legacy and we don't expose it as an
+/// option.
+const DEFAULT_SMB_PORT: u16 = 445;
+
+/// Maximum time we wait for a TCP connection to the SMB server during
+/// the pre-flight probe. Same shape as the v0.4.64 NFS probe — short
+/// enough that a wrong IP doesn't make the UI hang for 30s, long
+/// enough that a slow appliance can still answer.
+const PROBE_TIMEOUT: Duration = Duration::from_secs(4);
+
+/// One configured SMB share. The id is derived from server+share so an
+/// operator pasting the same coordinates twice gets idempotent
+/// behaviour rather than a duplicate row.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SmbShare {
+    pub id: String,
+    pub server: String,
+    pub share: String,
+    /// Username used for the SMB connection. Empty when `guest` is
+    /// true. Stored so the UI can echo it back; the password lives in
+    /// the separate credentials file (see `creds_path`).
+    pub username: String,
+    /// True when we're connecting with `-N` (anonymous / guest mode).
+    /// Most NAS appliances that expose ISO libraries do so as
+    /// guest-readable; this is the common case.
+    pub guest: bool,
+    /// TCP port — 445 unless the operator overrode it. Persisted so
+    /// the UI can echo it back.
+    #[serde(default = "default_port")]
+    pub port: u16,
+    /// Most recent error encountered talking to the share, or `None`
+    /// on success. Cleared every successful operation.
+    pub last_error: Option<String>,
+    /// Operator-friendly translation of `last_error`. None when we
+    /// don't have a friendlier rendition.
+    pub last_hint: Option<String>,
+    #[serde(with = "time::serde::rfc3339::option")]
+    pub last_scan: Option<OffsetDateTime>,
+    /// Number of `*.iso` files we know about on the share as of the
+    /// most recent scan.
+    pub iso_count: u32,
+    /// Whether the connection's currently working. `true` after a
+    /// successful scan, `false` after a failure. Drives the UI dot.
+    pub reachable: bool,
+    /// Path to the credentials file on disk. Internal — not surfaced
+    /// in the API JSON; we serialize it for restart-survival but the
+    /// UI doesn't render it.
+    #[serde(default)]
+    #[serde(skip_serializing)]
+    pub(crate) creds_path: Option<PathBuf>,
+}
+
+/// Submission from the UI / API.
+#[derive(Debug, Clone, Deserialize)]
+pub struct SmbAddRequest {
+    pub server: String,
+    pub share: String,
+    #[serde(default)]
+    pub username: Option<String>,
+    #[serde(default)]
+    pub password: Option<String>,
+    #[serde(default)]
+    pub guest: bool,
+    #[serde(default)]
+    pub port: Option<u16>,
+}
+
+fn default_port() -> u16 {
+    DEFAULT_SMB_PORT
+}
+
+/// Structured error surfaced to the API and rendered in the UI as two
+/// lines: the raw `error` from smbclient + an actionable `hint`.
+/// Mirrors the v0.4.64 NFS error shape so the storage tab can use a
+/// single rendering path.
+#[derive(Debug, Clone, Serialize)]
+pub struct SmbShareError {
+    pub error: String,
+    pub stderr: String,
+    pub hint: Option<String>,
+}
+
+impl SmbShareError {
+    fn from_raw(error: impl Into<String>, stderr: impl Into<String>) -> Self {
+        let stderr = stderr.into();
+        let error = error.into();
+        let hint = hint_for(&stderr).or_else(|| hint_for(&error));
+        Self {
+            error,
+            stderr,
+            hint,
+        }
+    }
+}
+
+#[derive(Debug, Default)]
+struct Inner {
+    shares: HashMap<String, SmbShare>,
+}
+
+/// Manages SMB shares and surfaces their ISOs through the IsoStore.
+///
+/// Cheap to clone — internal state is `Arc<Mutex<...>>`.
+#[derive(Debug, Clone)]
+pub struct SmbShareManager {
+    creds_root: Arc<PathBuf>,
+    state_path: Arc<PathBuf>,
+    inner: Arc<Mutex<Inner>>,
+    iso_store: IsoStore,
+    /// Serializes scan/list/get against the same share. smbclient
+    /// itself is fine concurrent across processes, but bundling
+    /// operations through a single lock makes test ordering and log
+    /// output predictable.
+    op_lock: Arc<tokio::sync::Mutex<()>>,
+}
+
+impl SmbShareManager {
+    /// Construct a manager rooted at `work_dir`. Credentials files
+    /// live under `<work_dir>/smb_creds/` with 0600 permissions; state
+    /// persists to `<work_dir>/smb_shares.json`.
+    #[must_use]
+    pub fn new(work_dir: &Path, iso_store: IsoStore) -> Self {
+        let creds_root = work_dir.join("smb_creds");
+        let state_path = work_dir.join("smb_shares.json");
+        Self {
+            creds_root: Arc::new(creds_root),
+            state_path: Arc::new(state_path),
+            inner: Arc::new(Mutex::new(Inner::default())),
+            iso_store,
+            op_lock: Arc::new(tokio::sync::Mutex::new(())),
+        }
+    }
+
+    /// Load persisted state and re-scan every share. Errors per share
+    /// are logged and surfaced on the spec; the call itself never
+    /// fails — startup must not block on a single offline server.
+    pub async fn load_and_rescan(&self) -> Result<()> {
+        tokio::fs::create_dir_all(self.creds_root.as_path()).await?;
+        let shares = match tokio::fs::read_to_string(self.state_path.as_path()).await {
+            Ok(text) => serde_json::from_str::<Vec<SmbShare>>(&text).unwrap_or_default(),
+            Err(_) => Vec::new(),
+        };
+        for mut s in shares {
+            s.last_error = None;
+            s.last_hint = None;
+            s.reachable = false;
+            self.inner.lock().shares.insert(s.id.clone(), s.clone());
+            if let Err(e) = self.rescan_inner(&s.id).await {
+                tracing::warn!(
+                    target: "openpxe::smb",
+                    id = %s.id, server = %s.server, share = %s.share,
+                    "rescan on startup failed: {e}"
+                );
+            }
+        }
+        Ok(())
+    }
+
+    /// Add or refresh a share. Validates the input, writes a creds
+    /// file, probes connectivity, and scans for ISOs.
+    pub async fn add(
+        &self,
+        req: SmbAddRequest,
+    ) -> std::result::Result<SmbShare, SmbShareError> {
+        let server = normalize_server(&req.server);
+        let share = req.share.trim().trim_start_matches('/').to_string();
+        if server.is_empty() {
+            return Err(SmbShareError::from_raw("server is required", ""));
+        }
+        if share.is_empty() {
+            return Err(SmbShareError::from_raw("share name is required", ""));
+        }
+        if share.contains('/') {
+            return Err(SmbShareError::from_raw(
+                "share name should be the top-level share (e.g. 'isos'), not a path",
+                "",
+            ));
+        }
+        if server.contains('\0') || share.contains('\0') {
+            return Err(SmbShareError::from_raw("NUL bytes are not allowed", ""));
+        }
+
+        let guest = req.guest;
+        let username = req.username.unwrap_or_default().trim().to_string();
+        let password = req.password.unwrap_or_default();
+        if !guest && username.is_empty() {
+            return Err(SmbShareError::from_raw(
+                "username is required when 'guest' is unchecked",
+                "",
+            ));
+        }
+        let port = req.port.filter(|p| *p != 0).unwrap_or(DEFAULT_SMB_PORT);
+
+        let id = share_id(&server, &share);
+
+        // Pre-flight TCP probe so a wrong IP / firewall surfaces a
+        // clean error instead of one of smbclient's notoriously
+        // cryptic NT_STATUS codes.
+        if let Err((err, hint)) = tcp_probe(&server, port).await {
+            // No share is persisted yet; just return the error.
+            return Err(SmbShareError {
+                error: err,
+                stderr: String::new(),
+                hint: Some(hint),
+            });
+        }
+
+        // Write the creds file. Even guest mode gets a file (empty
+        // username/password) so the code path is uniform.
+        let creds_path = self.creds_root.join(format!("{id}.cred"));
+        if let Err(e) = self.write_creds(&creds_path, &username, &password).await {
+            return Err(SmbShareError::from_raw(
+                format!("could not write credentials file: {e}"),
+                "",
+            ));
+        }
+
+        let spec = SmbShare {
+            id: id.clone(),
+            server,
+            share,
+            username,
+            guest,
+            port,
+            last_error: None,
+            last_hint: None,
+            last_scan: None,
+            iso_count: 0,
+            reachable: false,
+            creds_path: Some(creds_path),
+        };
+        self.inner.lock().shares.insert(id.clone(), spec);
+        self.persist_locked();
+
+        // Now actually talk to the server.
+        if let Err(e) = self.rescan_inner(&id).await {
+            let m = self.get(&id);
+            return Err(SmbShareError {
+                error: m.as_ref().and_then(|m| m.last_error.clone())
+                    .unwrap_or_else(|| e.to_string()),
+                stderr: String::new(),
+                hint: m.and_then(|m| m.last_hint),
+            });
+        }
+        Ok(self.get(&id).expect("just inserted"))
+    }
+
+    /// Remove a share: drops every ISO sourced from it, scrubs the
+    /// creds file, and forgets the spec. Idempotent.
+    pub async fn remove(&self, id: &str) -> Result<()> {
+        let creds_path = {
+            let mut g = self.inner.lock();
+            g.shares.remove(id).and_then(|s| s.creds_path)
+        };
+        self.iso_store.drop_external_source(id);
+        if let Some(p) = creds_path {
+            // Overwrite-then-unlink would be more thorough but the
+            // file is 0600 in a non-root-owned dir; rm is sufficient.
+            let _ = tokio::fs::remove_file(&p).await;
+        }
+        self.persist_locked();
+        Ok(())
+    }
+
+    /// Re-list the share and refresh the IsoStore entries.
+    pub async fn rescan(&self, id: &str) -> Result<u32> {
+        self.rescan_inner(id).await
+    }
+
+    /// Snapshot of every configured share, sorted by id for stable UI
+    /// rendering.
+    #[must_use]
+    pub fn list(&self) -> Vec<SmbShare> {
+        let g = self.inner.lock();
+        let mut v: Vec<_> = g.shares.values().cloned().collect();
+        v.sort_by(|a, b| a.id.cmp(&b.id));
+        v
+    }
+
+    /// Look up a share by id.
+    #[must_use]
+    pub fn get(&self, id: &str) -> Option<SmbShare> {
+        self.inner.lock().shares.get(id).cloned()
+    }
+
+    /// Open an async reader streaming an ISO out of the share. Used
+    /// by the HTTP ISO download handler.
+    ///
+    /// Kept `async` for symmetry with the other I/O entrypoints —
+    /// spawning the child is sync today (no `.await` inside) but a
+    /// future addition (e.g. probing the share before spawn or
+    /// throttling concurrent smbclients) would need to await without
+    /// changing the call sites.
+    #[allow(clippy::unused_async)]
+    pub async fn stream_iso(
+        &self,
+        share_id: &str,
+        filename: &str,
+    ) -> Result<SmbStream> {
+        let share = self
+            .get(share_id)
+            .ok_or_else(|| Error::Invalid(format!("no such SMB share '{share_id}'")))?;
+        // Defensive: reject any filename that tries to escape the
+        // share root. smbclient itself accepts only filenames at the
+        // share root in our `get` form, but belt-and-suspenders.
+        if filename.contains('/') || filename.contains('\\') || filename.contains("..") {
+            return Err(Error::Invalid(format!(
+                "invalid filename '{filename}'"
+            )));
+        }
+        let creds = share
+            .creds_path
+            .as_deref()
+            .ok_or_else(|| Error::Invalid("share has no credentials file".into()))?;
+        let target = format!("//{}/{}", share.server, share.share);
+        let mut cmd = Command::new("smbclient");
+        cmd.arg(&target)
+            .arg("-A")
+            .arg(creds)
+            .arg("-p")
+            .arg(share.port.to_string())
+            .arg("-c")
+            .arg(format!("get \"{filename}\" -"))
+            .stdout(Stdio::piped())
+            .stderr(Stdio::piped())
+            .stdin(Stdio::null());
+        if share.guest {
+            cmd.arg("-N");
+        }
+        let mut child = cmd.spawn().map_err(|e| Error::Other(e.into()))?;
+        let stdout = child
+            .stdout
+            .take()
+            .ok_or_else(|| Error::Invalid("smbclient stdout missing".into()))?;
+        Ok(SmbStream { child, stdout })
+    }
+
+    // ── internals ─────────────────────────────────────────────────────
+
+    async fn rescan_inner(&self, id: &str) -> Result<u32> {
+        let _g = self.op_lock.lock().await;
+
+        let share = self
+            .get(id)
+            .ok_or_else(|| Error::Invalid(format!("no such share '{id}'")))?;
+        let now = OffsetDateTime::now_utc();
+
+        // Drop prior entries so a deleted file disappears from the
+        // store on the next scan.
+        self.iso_store.drop_external_source(id);
+
+        let listing = match self.list_isos(&share).await {
+            Ok(l) => l,
+            Err((err, stderr)) => {
+                let combined = if stderr.is_empty() {
+                    err.clone()
+                } else {
+                    format!("{err}: {stderr}")
+                };
+                let hint = hint_for(&stderr).or_else(|| hint_for(&err));
+                self.update_status(id, 0, false, Some(combined.clone()), hint, now);
+                return Err(Error::Invalid(combined));
+            }
+        };
+
+        // For each ISO we found, we still need its size + a quick
+        // introspection pass. The introspection pass needs random
+        // access into the ISO9660 PVD which lives at offset 0x8000.
+        // For SMB sources we can't seek without downloading the file
+        // first, so we use a degenerate "unknown family" introspection
+        // report for the listing pass. Operators can rescan after the
+        // first PXE boot has touched the file if they want a real
+        // family detection. (Better: a follow-up release adds a tiny
+        // `smbclient -c 'get file -'` bounded read to do introspection
+        // without storing the whole ISO.)
+        let mut count = 0u32;
+        for entry in listing {
+            let iso_id = format!("smb-{}-{}", share.id, slugify_str(&entry.filename));
+            // SMB sources don't get a real introspection pass — that
+            // would require seeking into the ISO9660 PVD over the
+            // network, and smbclient CLI doesn't seek. We register an
+            // `Unknown` family so the boot-entry generator falls back
+            // to generic sanboot/wimboot detection from the filename
+            // and the operator gets *something* bootable. A follow-up
+            // release can do a bounded `smbclient get` of the first
+            // 64 KiB for real detection.
+            let report = IntrospectionReport {
+                family: DistroFamily::Unknown,
+                volume_label: None,
+                kernel_path: None,
+                initrd_paths: Vec::new(),
+                has_boot_wim: false,
+            };
+            let boot_entries = generate_boot_entries_for(&iso_id, &entry.filename, &report);
+            let source = IsoSource::Smb {
+                share_id: share.id.clone(),
+                relative_path: entry.filename.clone(),
+            };
+            self.iso_store.register_external(
+                iso_id,
+                entry.filename,
+                entry.size,
+                report,
+                boot_entries,
+                source,
+            );
+            count += 1;
+        }
+
+        self.update_status(id, count, true, None, None, now);
+        tracing::info!(
+            target: "openpxe::smb",
+            id = %id, server = %share.server, share = %share.share,
+            iso_count = count,
+            "SMB share scanned"
+        );
+        Ok(count)
+    }
+
+    /// Spawn `smbclient //server/share -A creds -c "ls *.iso"` and
+    /// parse the output. Returns `(error_text, stderr_text)` on
+    /// failure so the caller can surface both.
+    async fn list_isos(
+        &self,
+        share: &SmbShare,
+    ) -> std::result::Result<Vec<SmbListEntry>, (String, String)> {
+        let target = format!("//{}/{}", share.server, share.share);
+        let mut cmd = Command::new("smbclient");
+        cmd.arg(&target)
+            .arg("-A")
+            .arg(
+                share
+                    .creds_path
+                    .as_deref()
+                    .ok_or_else(|| ("no credentials file".to_string(), String::new()))?,
+            )
+            .arg("-p")
+            .arg(share.port.to_string())
+            .arg("-c")
+            .arg("ls *.iso");
+        if share.guest {
+            cmd.arg("-N");
+        }
+        let output = match cmd.output().await {
+            Ok(o) => o,
+            Err(e) => {
+                return Err((
+                    format!("could not exec smbclient: {e}"),
+                    String::new(),
+                ));
+            }
+        };
+        if !output.status.success() {
+            let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
+            // smbclient writes most diagnostics to stdout too; merge
+            // them so we don't lose context.
+            let stdout = String::from_utf8_lossy(&output.stdout).trim().to_string();
+            let combined = if stderr.is_empty() { stdout } else { stderr };
+            return Err((
+                format!("smbclient exit {}", output.status.code().unwrap_or(-1)),
+                combined,
+            ));
+        }
+        let stdout = String::from_utf8_lossy(&output.stdout);
+        Ok(parse_ls_iso(&stdout))
+    }
+
+    async fn write_creds(
+        &self,
+        path: &Path,
+        username: &str,
+        password: &str,
+    ) -> std::io::Result<()> {
+        tokio::fs::create_dir_all(self.creds_root.as_path()).await?;
+        // Write the file with 0600 perms. `smbclient -A` accepts the
+        // standard pam_mount-style:
+        //   username = foo
+        //   password = bar
+        let body = format!(
+            "username = {}\npassword = {}\n",
+            username.replace('\n', ""),
+            password.replace('\n', ""),
+        );
+        // Synchronous file write to set perms atomically with the
+        // create — there's no async equivalent of OpenOptions+mode
+        // shared with the tokio API in std stable.
+        let path = path.to_path_buf();
+        tokio::task::spawn_blocking(move || -> std::io::Result<()> {
+            use std::os::unix::fs::OpenOptionsExt;
+            let mut f = std::fs::OpenOptions::new()
+                .write(true)
+                .create(true)
+                .truncate(true)
+                .mode(0o600)
+                .open(&path)?;
+            f.write_all(body.as_bytes())?;
+            Ok(())
+        })
+        .await
+        .map_err(std::io::Error::other)??;
+        Ok(())
+    }
+
+    fn update_status(
+        &self,
+        id: &str,
+        iso_count: u32,
+        reachable: bool,
+        err: Option<String>,
+        hint: Option<String>,
+        ts: OffsetDateTime,
+    ) {
+        if let Some(s) = self.inner.lock().shares.get_mut(id) {
+            s.iso_count = iso_count;
+            s.reachable = reachable;
+            s.last_error = err;
+            s.last_hint = hint;
+            s.last_scan = Some(ts);
+        }
+        self.persist_locked();
+    }
+
+    /// Atomically replace the on-disk JSON. Persistence errors are
+    /// logged, never propagated.
+    fn persist_locked(&self) {
+        let shares: Vec<SmbShare> = self.inner.lock().shares.values().cloned().collect();
+        let path = self.state_path.as_path();
+        let tmp = path.with_extension("json.tmp");
+        let body = match serde_json::to_vec_pretty(&shares) {
+            Ok(b) => b,
+            Err(e) => {
+                tracing::warn!(target: "openpxe::smb", "serialize: {e}");
+                return;
+            }
+        };
+        if let Some(parent) = path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        if let Err(e) = std::fs::write(&tmp, body) {
+            tracing::warn!(target: "openpxe::smb", "write tmp: {e}");
+            return;
+        }
+        if let Err(e) = std::fs::rename(&tmp, path) {
+            tracing::warn!(target: "openpxe::smb", "rename: {e}");
+        }
+    }
+}
+
+/// Async-reader handle for an in-flight `smbclient get file -` stream.
+/// Wraps the child process + its piped stdout; dropping it kills the
+/// child.
+#[derive(Debug)]
+pub struct SmbStream {
+    /// Kept alive so the child isn't reaped while we're reading. The
+    /// `Drop` impl on `tokio::process::Child` sends SIGKILL on drop
+    /// when `kill_on_drop` is set; we leave that to the default
+    /// (no-kill) so a slow client doesn't tear down the pipe before
+    /// the OS finishes the read. The child exits naturally when its
+    /// stdout closes.
+    #[allow(dead_code)]
+    child: tokio::process::Child,
+    pub stdout: tokio::process::ChildStdout,
+}
+
+#[derive(Debug, Clone)]
+struct SmbListEntry {
+    filename: String,
+    size: u64,
+}
+
+/// Parse `smbclient ls *.iso` output. The format is:
+///
+/// ```text
+///   .                                   D        0  Mon May 26 10:00:00 2026
+///   ..                                  D        0  Mon May 26 10:00:00 2026
+///   ubuntu-22.04-desktop.iso            A 3650912256  Mon May 26 11:00:00 2026
+///
+///         4096 blocks of size 1048576. 1234 blocks available
+/// ```
+///
+/// Each file line:
+///   - starts with whitespace
+///   - has the filename, then attribute flags (D=dir, A=archive, R=read-only,
+///     H=hidden, S=system, N=normal), then size, then date.
+///
+/// We accept any line where the attributes column doesn't contain `D`
+/// (i.e. not a directory) and the filename ends in `.iso` (case
+/// insensitive).
+fn parse_ls_iso(out: &str) -> Vec<SmbListEntry> {
+    let mut entries = Vec::new();
+    for raw in out.lines() {
+        let line = raw.trim();
+        // Skip blank lines, the connection-info banner, and the
+        // trailing "N blocks of size" summary. The actual filter for
+        // "is this a file listing?" is the attribute+size pattern
+        // detection below, which only matches real file rows.
+        if line.is_empty() || line.contains("blocks of size") {
+            continue;
+        }
+        // Find the attribute column: a short token of one or more of
+        // [DAHSRN] that follows a long-enough filename block.
+        // smbclient pads the filename to ~36 columns, so we can split
+        // on multiple consecutive spaces and then look for the
+        // attribute token.
+        let tokens: Vec<&str> = line.split_whitespace().collect();
+        if tokens.len() < 3 {
+            continue;
+        }
+        // The last 5 tokens are typically: ATTR SIZE Day Mon DD HH:MM:SS YYYY
+        // (sometimes Day is missing depending on locale). Walk
+        // backwards to find ATTR + SIZE: ATTR is 1-6 chars of [DAHSRN],
+        // SIZE is digits.
+        let attr_idx = tokens.iter().enumerate().rev().find_map(|(i, t)| {
+            if i == 0 {
+                return None;
+            }
+            let next = tokens.get(i + 1)?;
+            let is_attr = !t.is_empty() && t.chars().all(|c| "DAHSRN".contains(c));
+            let is_size = next.chars().all(|c| c.is_ascii_digit()) && !next.is_empty();
+            if is_attr && is_size {
+                Some(i)
+            } else {
+                None
+            }
+        });
+        let Some(attr_idx) = attr_idx else { continue };
+        let attr = tokens[attr_idx];
+        // Directories aren't ISO files.
+        if attr.contains('D') {
+            continue;
+        }
+        let size_tok = tokens[attr_idx + 1];
+        let Ok(size) = size_tok.parse::<u64>() else {
+            continue;
+        };
+        // The filename is everything before the attribute token in
+        // the original (un-tokenized) line — we need the original
+        // because filenames can contain spaces.
+        // Locate the attribute token's start column by counting
+        // characters in the prior tokens + separators. Simpler: find
+        // the index of the attribute in the trimmed line by joining
+        // and trimming again.
+        let joined_before: String = tokens[..attr_idx].join(" ");
+        let name = joined_before.trim().to_string();
+        if name.is_empty() || name == "." || name == ".." {
+            continue;
+        }
+        if !name.to_ascii_lowercase().ends_with(".iso") {
+            continue;
+        }
+        entries.push(SmbListEntry {
+            filename: name,
+            size,
+        });
+    }
+    entries
+}
+
+/// Pre-flight TCP probe to `server:port`. Format matches v0.4.64 NFS
+/// probe so the UI banner reads consistently.
+async fn tcp_probe(
+    server: &str,
+    port: u16,
+) -> std::result::Result<(), (String, String)> {
+    use tokio::net::TcpStream;
+    let addr = format!("{server}:{port}");
+    match tokio::time::timeout(PROBE_TIMEOUT, TcpStream::connect(&addr)).await {
+        Ok(Ok(_)) => Ok(()),
+        Ok(Err(e)) => Err((
+            format!("cannot reach SMB port: {addr}: {e}"),
+            format!(
+                "verify the SMB service is running on {server} and that port {port} is open"
+            ),
+        )),
+        Err(_) => Err((
+            format!(
+                "cannot reach SMB port: {addr}: timed out after {}s",
+                PROBE_TIMEOUT.as_secs()
+            ),
+            format!(
+                "no TCP answer from {server}:{port} within {}s — check the IP and any firewall in between",
+                PROBE_TIMEOUT.as_secs()
+            ),
+        )),
+    }
+}
+
+/// Translate well-known smbclient stderr patterns into actionable
+/// hints. Returns `None` when we don't have a translation.
+fn hint_for(text: &str) -> Option<String> {
+    let s = text.to_ascii_lowercase();
+    if s.contains("nt_status_logon_failure") || s.contains("logon_failure") {
+        Some(
+            "the server rejected the credentials. Double-check the username \
+             and password — many NAS appliances use a separate SMB account \
+             rather than the system login."
+                .into(),
+        )
+    } else if s.contains("nt_status_access_denied") || s.contains("access_denied") {
+        Some(
+            "the credentials worked but the account doesn't have read \
+             access to this share. Check the share's permissions on the \
+             server."
+                .into(),
+        )
+    } else if s.contains("nt_status_bad_network_name")
+        || s.contains("nt_status_bad_network_path")
+        || s.contains("bad_network_name")
+    {
+        Some(
+            "the share name doesn't exist on this server. Enter just the \
+             share name (e.g. 'isos'), not a path. Use `smbclient -L \
+             //server` to list shares manually."
+                .into(),
+        )
+    } else if s.contains("connection refused") {
+        Some(
+            "the SMB service isn't accepting connections on this port. \
+             Verify smbd / Samba is running on the server."
+                .into(),
+        )
+    } else if s.contains("connection timed out") || s.contains("no route to host") {
+        Some(
+            "the server isn't reachable on this network. Check the IP and \
+             any firewall in between."
+                .into(),
+        )
+    } else if s.contains("nt_status_network_unreachable") {
+        Some(
+            "the server's network is unreachable from this container — \
+             check the host networking setup."
+                .into(),
+        )
+    } else if s.contains("does not exist") || s.contains("not a directory") {
+        Some(
+            "the listed path doesn't exist on the share. Make sure the \
+             share name is the top-level share, not a sub-path."
+                .into(),
+        )
+    } else if s.contains("session setup failed") {
+        Some(
+            "session setup failed — usually a protocol / dialect mismatch. \
+             Most modern servers speak SMB2/3; very old shares (XP) may \
+             need legacy support enabled on the server."
+                .into(),
+        )
+    } else {
+        None
+    }
+}
+
+fn share_id(server: &str, share: &str) -> String {
+    slugify_str(&format!("{server}-{share}"))
+}
+
+/// Normalize a server input: trim, strip scheme prefix the operator
+/// may have pasted, and drop trailing slashes. UNC-style `\\server`
+/// and `//server` prefixes are also accepted.
+fn normalize_server(raw: &str) -> String {
+    let s = raw.trim();
+    let s = s
+        .strip_prefix("smb://")
+        .or_else(|| s.strip_prefix("cifs://"))
+        .or_else(|| s.strip_prefix("\\\\"))
+        .or_else(|| s.strip_prefix("//"))
+        .unwrap_or(s);
+    s.trim_end_matches('/').trim_end_matches('\\').to_string()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn share_id_is_stable_and_safe() {
+        let a = share_id("10.0.0.5", "isos");
+        let b = share_id("10.0.0.5", "isos");
+        assert_eq!(a, b);
+        assert!(!a.contains('/'));
+        assert!(!a.contains('.'));
+    }
+
+    #[test]
+    fn normalize_server_strips_url_and_unc_prefixes() {
+        assert_eq!(normalize_server("  10.0.0.5  "), "10.0.0.5");
+        assert_eq!(normalize_server("smb://nas.lan/"), "nas.lan");
+        assert_eq!(normalize_server("cifs://192.168.1.51"), "192.168.1.51");
+        assert_eq!(normalize_server("\\\\192.168.1.51\\"), "192.168.1.51");
+        assert_eq!(normalize_server("//nas.lan//"), "nas.lan");
+        assert_eq!(normalize_server("nas.lan"), "nas.lan");
+    }
+
+    #[test]
+    fn hint_for_logon_failure_calls_out_credentials() {
+        let h = hint_for("session setup failed: NT_STATUS_LOGON_FAILURE").unwrap();
+        assert!(h.to_lowercase().contains("credentials"));
+    }
+
+    #[test]
+    fn hint_for_bad_share_name_calls_out_share_lookup() {
+        let h = hint_for("tree connect failed: NT_STATUS_BAD_NETWORK_NAME").unwrap();
+        assert!(h.to_lowercase().contains("share"));
+    }
+
+    #[test]
+    fn hint_for_unknown_is_none() {
+        assert!(hint_for("some unrelated error text").is_none());
+    }
+
+    #[test]
+    fn parse_ls_iso_finds_one_iso_and_skips_directories() {
+        let out = "\
+\tDomain=[WORKGROUP] OS=[Windows] Server=[Samba]\n\
+  .                                   D        0  Mon May 26 10:00:00 2026\n\
+  ..                                  D        0  Mon May 26 10:00:00 2026\n\
+  ubuntu-22.04-desktop.iso            A 3650912256  Mon May 26 11:00:00 2026\n\
+\n\
+\t\t4096 blocks of size 1048576. 1234 blocks available\n\
+";
+        let entries = parse_ls_iso(out);
+        assert_eq!(entries.len(), 1);
+        assert_eq!(entries[0].filename, "ubuntu-22.04-desktop.iso");
+        assert_eq!(entries[0].size, 3_650_912_256);
+    }
+
+    #[test]
+    fn parse_ls_iso_handles_filenames_with_spaces() {
+        let out = "\
+  Windows Server 2025.iso             A 5000000000  Tue May 27 09:00:00 2026\n\
+";
+        let entries = parse_ls_iso(out);
+        assert_eq!(entries.len(), 1);
+        assert_eq!(entries[0].filename, "Windows Server 2025.iso");
+        assert_eq!(entries[0].size, 5_000_000_000);
+    }
+
+    #[test]
+    fn parse_ls_iso_skips_non_iso_files() {
+        let out = "\
+  readme.txt                          A      100  Tue May 27 09:00:00 2026\n\
+  archive.zip                         A     5000  Tue May 27 09:00:00 2026\n\
+";
+        let entries = parse_ls_iso(out);
+        assert!(entries.is_empty());
+    }
+
+    #[test]
+    fn add_request_requires_username_when_not_guest() {
+        // We can't easily test the add() path against a real SMB
+        // server in unit tests, but we can confirm the validation
+        // logic at least serializes the request shape we expect. The
+        // actual auth check happens in add() itself which we cover in
+        // integration tests against a stub server.
+        let req = SmbAddRequest {
+            server: "10.0.0.5".into(),
+            share: "isos".into(),
+            username: None,
+            password: None,
+            guest: false,
+            port: None,
+        };
+        // No SmbShareManager here — we just check the field shape
+        // matches what UI submits.
+        assert!(!req.guest);
+        assert!(req.username.is_none());
+    }
+}

crates/iso-store/src/store.rs

@@ -16,21 +16,52 @@ use tokio::io::AsyncWriteExt;
 /// Where the bytes for an ISO actually live.
 ///
 /// The default is `Local` — uploaded ISOs sit in `<iso_dir>/<id>.iso`.
-/// `Nfs` entries point at a file inside a remote share that the
-/// `NfsManager` is keeping mounted. We resolve the on-disk path lazily
-/// in [`IsoStore::iso_path_for`] using the `nfs_root` set at startup.
+/// `Smb` entries (v0.4.65) point at a file inside a remote SMB share
+/// that the `SmbShareManager` knows how to stream via Samba's
+/// userspace `smbclient` CLI. The HTTP handler resolves the share by
+/// id at request time and pipes `smbclient -c 'get file -'` straight
+/// into the response body — no kernel mount, no local cache.
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(tag = "kind", rename_all = "snake_case")]
 pub enum IsoSource {
     #[default]
     Local,
-    Nfs {
-        mount_id: String,
-        /// Path relative to the mount point — typically just the filename.
+    /// v0.4.65: kernel-mount NFS is gone (it didn't work on Unraid
+    /// regardless of capabilities — the host kernel needs the nfs
+    /// client modules loaded). SMB via userspace `smbclient` works in
+    /// any container.
+    Smb {
+        share_id: String,
+        /// Filename at the share root. We don't support nested paths
+        /// in v0.4.65; ISOs live at the top of the share.
         relative_path: String,
     },
 }
 
+/// Where the ISO lands in the PXE menu hierarchy.
+///
+/// Auto-detected family (Debian, Windows, …) still drives BIOS/UEFI
+/// behaviour and per-entry boot args, but the *menu placement* is
+/// operator-controlled — an operator who's uploaded a TinyCore live ISO
+/// to use as a recovery shim, or a SystemRescue image, can flip its
+/// category to `Tools` so it lands next to memtest/shell instead of
+/// under Linux Installers.
+///
+/// Old `meta.json` files without this field deserialize as `Os`, which
+/// matches v0.4.1 behaviour (everything goes under OS Installers).
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum IsoCategory {
+    /// "OS Installer" — routed via the auto-detected family into the
+    /// Linux / Windows installer submenus.
+    #[default]
+    Os,
+    /// "Tool" — surfaced under the Tools menu next to memtest, shell,
+    /// NIC info, etc. Family detection still decides BIOS/UEFI vs
+    /// wimboot vs sanboot at boot time.
+    Tools,
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct IsoMeta {
     /// Stable slug used in URLs (derived from the uploaded filename).
@@ -56,6 +87,10 @@ pub struct IsoMeta {
     /// the common no-password case.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub password_hash: Option<String>,
+    /// Where the ISO sits in the PXE menu hierarchy — operator-controlled,
+    /// not driven by family detection. Defaults to [`IsoCategory::Os`].
+    #[serde(default)]
+    pub category: IsoCategory,
 }
 
 impl IsoMeta {
@@ -114,6 +149,7 @@ impl UploadHandle {
             boot_entries,
             source: IsoSource::Local,
             password_hash: None,
+            category: IsoCategory::default(),
         };
         store.persist_meta(&meta).await?;
         store.insert(meta.clone());
@@ -135,10 +171,6 @@ struct Inner {
 #[derive(Debug, Clone)]
 pub struct IsoStore {
     iso_dir: Arc<PathBuf>,
-    /// Where NFS mounts land on disk. Set at startup via
-    /// [`IsoStore::set_nfs_root`]; required for resolving any
-    /// `IsoSource::Nfs` entry.
-    nfs_root: Arc<RwLock<Option<PathBuf>>>,
     inner: Arc<RwLock<Inner>>,
 }
 
@@ -146,17 +178,10 @@ impl IsoStore {
     pub fn new(iso_dir: PathBuf) -> Self {
         Self {
             iso_dir: Arc::new(iso_dir),
-            nfs_root: Arc::new(RwLock::new(None)),
             inner: Arc::new(RwLock::new(Inner::default())),
         }
     }
 
-    /// Tell the store where NFS mounts live. Without this set,
-    /// `IsoSource::Nfs` entries cannot be resolved to a file path.
-    pub fn set_nfs_root(&self, root: PathBuf) {
-        *self.nfs_root.write() = Some(root);
-    }
-
     pub async fn ensure_dirs(&self) -> Result<()> {
         tokio::fs::create_dir_all(self.iso_dir.as_path()).await?;
         Ok(())
@@ -216,6 +241,9 @@ impl IsoStore {
             return Err(Error::Invalid(format!("iso '{id}' already exists")));
         }
         let partial_path = self.iso_dir.join(format!("{id}.partial"));
+        if partial_path.exists() {
+            return Err(Error::Invalid(format!("iso '{id}' is already uploading")));
+        }
         let file = tokio::fs::File::create(&partial_path).await?;
         Ok(UploadHandle {
             id,
@@ -249,33 +277,32 @@ impl IsoStore {
         self.inner.read().isos.get(id).cloned()
     }
 
-    /// Resolve an ISO id to its on-disk path, if any. For local entries
-    /// this is `<iso_dir>/<id>.iso`; for NFS entries it's
-    /// `<nfs_root>/<mount_id>/<relative_path>`. Returns None if the file
-    /// is missing or the source isn't resolvable (e.g. NFS share
-    /// unmounted).
+    /// Resolve an ISO id to its on-disk path, if any. For local
+    /// (uploaded) ISOs this is `<iso_dir>/<id>.iso`. For SMB-sourced
+    /// ISOs there is no on-disk path — the HTTP handler must stream
+    /// via `SmbShareManager::stream_iso` instead. Returns `None` for
+    /// SMB sources or when the file is missing.
     pub fn iso_path_for(&self, id: &str) -> Option<PathBuf> {
         let meta = self.get(id)?;
-        let path = match &meta.source {
-            IsoSource::Local => self.iso_path(id),
-            IsoSource::Nfs {
-                mount_id,
-                relative_path,
-            } => {
-                let root = self.nfs_root.read().clone()?;
-                root.join(mount_id).join(relative_path)
-            }
-        };
+        match &meta.source {
+            IsoSource::Local => {
+                let path = self.iso_path(id);
                 if path.exists() {
                     Some(path)
                 } else {
                     None
                 }
             }
+            // SMB sources have no local path — they're streamed via
+            // smbclient subprocess. Callers should check the source
+            // kind first and dispatch accordingly.
+            IsoSource::Smb { .. } => None,
+        }
+    }
 
-    /// Delete an ISO and its sidecar metadata. Only acts on local ISOs;
-    /// for NFS-backed ISOs the operator must remove the file from the
-    /// share or unmount the NFS share entirely.
+    /// Delete an ISO and its sidecar metadata. Only acts on local
+    /// (uploaded) ISOs; for SMB-backed ISOs the operator must remove
+    /// the file from the share or unregister the share entirely.
     pub async fn delete(&self, id: &str) -> Result<()> {
         let meta = self.get(id);
         let is_local = matches!(
@@ -292,10 +319,10 @@ impl IsoStore {
         Ok(())
     }
 
-    /// Register an externally-sourced ISO (e.g. NFS-mounted). Used by
-    /// `NfsManager` after walking a freshly-mounted share. We do **not**
-    /// persist a `meta.json` on disk for these — the source of truth is
-    /// the share itself, and the NFS manager re-scans on startup.
+    /// Register an externally-sourced ISO (SMB share, etc.). Used by
+    /// `SmbShareManager` after listing a share. We do **not** persist
+    /// a `meta.json` on disk for these — the source of truth is the
+    /// share itself, and the manager re-scans on startup.
     pub fn register_external(
         &self,
         id: String,
@@ -315,17 +342,18 @@ impl IsoStore {
             boot_entries,
             source,
             password_hash: None,
+            category: IsoCategory::default(),
         };
         self.inner.write().isos.insert(id, meta);
     }
 
-    /// Drop every entry that belongs to `mount_id`. Used by the NFS
-    /// manager when an operator removes a share, or before re-scanning
-    /// to clean out stale entries.
-    pub fn drop_external_source(&self, mount_id: &str) {
+    /// Drop every entry that belongs to `share_id`. Used by the SMB
+    /// share manager when an operator removes a share, or before
+    /// re-scanning to clean out stale entries.
+    pub fn drop_external_source(&self, share_id: &str) {
         let mut g = self.inner.write();
         g.isos.retain(
-            |_, m| !matches!(&m.source, IsoSource::Nfs { mount_id: mid, .. } if mid == mount_id),
+            |_, m| !matches!(&m.source, IsoSource::Smb { share_id: sid, .. } if sid == share_id),
         );
     }
 
@@ -374,6 +402,47 @@ impl IsoStore {
         Ok(())
     }
 
+    /// Flip an ISO's menu category. Persists to `meta.json` for local
+    /// ISOs; NFS-sourced ISOs keep the change in memory only (the next
+    /// re-scan would overwrite it anyway).
+    pub async fn set_category(&self, id: &str, category: IsoCategory) -> Result<IsoMeta> {
+        let updated = {
+            let mut g = self.inner.write();
+            let m = g
+                .isos
+                .get_mut(id)
+                .ok_or_else(|| Error::Invalid(format!("no such iso '{id}'")))?;
+            m.category = category;
+            m.clone()
+        };
+        if matches!(updated.source, IsoSource::Local) {
+            self.persist_meta(&updated).await?;
+        }
+        Ok(updated)
+    }
+
+    /// Absolute path to the directory holding local ISO uploads. Used
+    /// by the HTTP layer for the disk-space endpoint — the volume that
+    /// hosts this directory is what runs out of room first.
+    #[must_use]
+    pub fn iso_dir(&self) -> PathBuf {
+        self.iso_dir.as_path().to_path_buf()
+    }
+
+    /// `(total_bytes, available_bytes)` for the filesystem hosting the
+    /// ISO directory. Returns `None` if `statvfs` fails (read-only
+    /// filesystem with no quota, mount disappeared, …) — callers
+    /// should treat that as "unknown" rather than zero.
+    ///
+    /// Lives here rather than the HTTP crate because `http-api`'s
+    /// `#![forbid(unsafe_code)]` rules out the libc FFI directly, and
+    /// because this is naturally an `IsoStore` question — the volume
+    /// of interest is whatever's hosting the iso dir.
+    #[must_use]
+    pub fn disk_usage(&self) -> Option<(u64, u64)> {
+        disk_usage_for(self.iso_dir.as_path())
+    }
+
     /// Verify a candidate password against the stored bcrypt hash.
     /// Returns:
     /// - `Ok(true)`   — match (or the ISO has no password set; boot is open)
@@ -390,6 +459,33 @@ impl IsoStore {
     }
 }
 
+/// Resolve `(total, available)` bytes for the filesystem hosting `path`.
+/// Returns `None` if `statvfs` fails.
+#[allow(unsafe_code)]
+fn disk_usage_for(path: &std::path::Path) -> Option<(u64, u64)> {
+    use std::ffi::CString;
+    use std::os::unix::ffi::OsStrExt;
+    let c = CString::new(path.as_os_str().as_bytes()).ok()?;
+    // SAFETY: `statvfs` is repr(C); a zeroed value is a valid initial
+    // state per POSIX. The FFI call writes every field we then read.
+    let mut stat: libc::statvfs = unsafe { std::mem::zeroed() };
+    // SAFETY: `c` is a NUL-terminated C string pointing into a stack
+    // CString that outlives this call; `&mut stat` is a unique aligned
+    // pointer to a stack-local `statvfs`. The kernel writes through
+    // it but does not retain the pointer past return.
+    let rc = unsafe { libc::statvfs(c.as_ptr(), &raw mut stat) };
+    if rc != 0 {
+        return None;
+    }
+    // Use f_frsize (fundamental block size). f_bsize is "preferred I/O
+    // block" and doesn't always match the unit f_blocks is denominated
+    // in — on some BSDs it would over-report by a factor of 8.
+    let frsize = stat.f_frsize as u64;
+    let total = stat.f_blocks as u64 * frsize;
+    let avail = stat.f_bavail as u64 * frsize;
+    Some((total, avail))
+}
+
 fn slugify(filename: &str) -> String {
     let stem = Path::new(filename)
         .file_stem()
@@ -495,8 +591,17 @@ fn linux_cmdline(family: DistroFamily, id: &str) -> String {
     // The HTTP layer resolves `${base-url}` at render time.
     let iso_url = format!("${{base-url}}/iso/{id}.iso");
     match family {
+        // VMware-UEFI fix (v0.4.5, matching Bootimus v0.1.67's Casper
+        // patch): drop `netboot=url url=… ---` in favour of the
+        // canonical Casper option `iso-url=` and add `ds=nocloud` so
+        // cloud-init / subiquity (live-server) doesn't stall waiting on
+        // a metadata datasource that doesn't exist in PXE. Without
+        // `ds=nocloud`, Ubuntu live-server / Mint / Pop!_OS / elementary
+        // ISOs would boot fine on bare-metal UEFI but hang at "cloud-init
+        // running" on VMware-UEFI guests because the vmxnet3 driver's
+        // late-init upsets cloud-init's network probe.
         DistroFamily::DebianUbuntu => format!(
-            "boot=casper netboot=url url={iso_url} ip=dhcp ---"
+            "boot=casper initrd=initrd ds=nocloud ip=dhcp iso-url={iso_url}"
         ),
         DistroFamily::RhelFedora => format!(
             "inst.repo={iso_url} inst.stage2={iso_url} ip=dhcp"
@@ -531,6 +636,23 @@ mod tests {
         assert_eq!(slugify("/etc/passwd"), "passwd");
     }
 
+    #[test]
+    fn casper_cmdline_vmware_uefi_safe() {
+        // v0.4.5 regression guard: the Debian/Ubuntu cmdline must use
+        // the canonical Casper `iso-url=` option and include
+        // `ds=nocloud` so VMware-UEFI guests don't hang at "cloud-init
+        // running" waiting on a metadata datasource that PXE can't
+        // provide. The legacy `netboot=url url=… ---` form is gone for
+        // good.
+        let s = linux_cmdline(DistroFamily::DebianUbuntu, "ubuntu-24-04");
+        assert!(s.contains("boot=casper"), "{s}");
+        assert!(s.contains("iso-url=${base-url}/iso/ubuntu-24-04.iso"), "{s}");
+        assert!(s.contains("ds=nocloud"), "{s}");
+        assert!(s.contains("ip=dhcp"), "{s}");
+        assert!(!s.contains("netboot=url"), "legacy option leaked: {s}");
+        assert!(!s.contains(" --- "), "stray ---: {s}");
+    }
+
     fn fake_meta(id: &str) -> IsoMeta {
         IsoMeta {
             id: id.into(),
@@ -548,6 +670,7 @@ mod tests {
             boot_entries: vec![],
             source: IsoSource::Local,
             password_hash: None,
+            category: IsoCategory::default(),
         }
     }
 
@@ -594,6 +717,19 @@ mod tests {
         assert!(matches!(r, Err(Error::Invalid(_))));
     }
 
+    #[tokio::test]
+    async fn begin_upload_rejects_existing_partial_file() {
+        let dir = tempdir().unwrap();
+        let store = IsoStore::new(dir.path().to_path_buf());
+        store.ensure_dirs().await.unwrap();
+        tokio::fs::write(dir.path().join("ubuntu.partial"), b"in-flight")
+            .await
+            .unwrap();
+
+        let r = store.begin_upload("ubuntu.iso").await;
+        assert!(matches!(r, Err(Error::Invalid(_))));
+    }
+
     #[tokio::test]
     async fn password_persists_via_meta_json_for_local_isos() {
         // Hash makes it onto disk so it survives a restart.

crates/openpxe/src/main.rs

@@ -9,7 +9,7 @@ use openpxe_core::{
 };
 use openpxe_dhcp_proxy::DhcpProxyServer;
 use openpxe_http_api::{build_router, AppState};
-use openpxe_iso_store::{IsoStore, NfsManager, SmbManager};
+use openpxe_iso_store::{IsoStore, SmbManager, SmbShareManager};
 use openpxe_tftp::TftpServer;
 use std::net::{Ipv4Addr, SocketAddr};
 use std::path::PathBuf;
@@ -39,7 +39,7 @@ enum Command {
     ///   docker run --rm \
     ///     -v /my/isos:/seed:ro \
     ///     -v openpxe-data:/var/lib/openpxe/isos \
-    ///     openpxe:0.3.2 seed --from /seed
+    ///     openpxe:0.4.1 seed --from /seed
     Seed {
         /// Source directory containing one or more `.iso` files.
         #[arg(long)]
@@ -104,6 +104,10 @@ async fn main() -> anyhow::Result<()> {
     let settings = SettingsStore::load_or_default(&config.paths.work_dir);
     let hosts = HostBindings::load_or_default(&config.paths.work_dir);
     let boot_log = openpxe_core::BootLog::load_or_default(&config.paths.work_dir);
+    let branding = openpxe_core::BrandingStore::load_or_default(&config.paths.work_dir);
+    let admin = openpxe_core::AdminStore::load_or_default(&config.paths.work_dir);
+    let sso = openpxe_core::SsoStore::load_or_default(&config.paths.work_dir);
+    let sessions = openpxe_http_api::auth::SessionStore::default();
     let metrics = Metrics::new();
 
     // Build the SMB manager unconditionally — it starts/stops on the
@@ -115,13 +119,18 @@ async fn main() -> anyhow::Result<()> {
         let _ = smb.start();
     }
 
-    // NFS manager. The mount root has to be set on the IsoStore *before*
-    // we replay any persisted mounts, otherwise an in-memory IsoMeta
-    // pointing at an NFS source can't resolve to a path.
-    let nfs = NfsManager::new(&config.paths.work_dir, iso_store.clone());
-    iso_store.set_nfs_root(nfs.mount_root());
-    if let Err(e) = nfs.load_and_remount().await {
-        tracing::warn!(target: "openpxe::nfs", "could not reload NFS mounts: {e}");
+    // v0.4.65: SMB share manager — Samba `smbclient` userspace
+    // consumer. Replaces the kernel-mount NFS path that v0.4.64
+    // shipped; that didn't work on hosts whose kernel lacked the nfs
+    // client modules (Unraid is the dominant case). `smbclient` does
+    // the SMB protocol entirely in userspace over TCP and works in
+    // any container regardless of capabilities or kernel modules.
+    let smb_shares = SmbShareManager::new(&config.paths.work_dir, iso_store.clone());
+    if let Err(e) = smb_shares.load_and_rescan().await {
+        tracing::warn!(
+            target: "openpxe::smb",
+            "could not reload SMB shares on startup: {e}"
+        );
     }
 
     // Sniff network details for the Network tab. None of these are
@@ -142,9 +151,14 @@ async fn main() -> anyhow::Result<()> {
         queue: queue.clone(),
         hosts: hosts.clone(),
         boot_log: boot_log.clone(),
+        branding: branding.clone(),
+        admin: admin.clone(),
+        sessions: sessions.clone(),
+        sso: sso.clone(),
         metrics: metrics.clone(),
         smb: Some(smb.clone()),
-        nfs: nfs.clone(),
+        smb_shares: smb_shares.clone(),
+        uploads: openpxe_http_api::uploads::UploadSessions::default(),
         log_bus: log_bus.clone(),
         started_at: time::OffsetDateTime::now_utc(),
         public_base_url: public_base_url.clone(),

crates/webui/src/app.css

@@ -9,10 +9,10 @@
 
 :root {
   /* Jet-black dark palette (default). Modelled on Netbox Labs's
-     near-black product chrome — surfaces step from #000 → #0d → #16 → #1c
+     near-black product chrome, with surfaces stepping subtly upward
      rather than the previous blue-tinted ramp, so the UI reads as a
      genuine "dark" rather than "dim navy". */
-  --bg:           #000000;
+  --bg:           #030303;
   --bg-panel:    #0a0a0a;
   --bg-panel-2:  #141414;
   --bg-elev:     #1c1c1c;
@@ -26,7 +26,7 @@
   --ok:           #4ade80;
   --border:       #1f1f1f;
   --border-soft: #141414;
-  --terminal-bg: #000000;
+  --terminal-bg: #050505;
   --shadow-card: 0 1px 0 rgba(255,255,255,0.02), 0 8px 24px rgba(0,0,0,0.55);
   --radius:      6px;
   --radius-lg:  10px;
@@ -34,14 +34,23 @@
   --topbar-h:   56px;
   --mono: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
   --sans: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, system-ui, sans-serif;
+  /* v0.4.63: tie native form-control rendering (checkboxes, scroll bars,
+     date pickers) to the active OpenPXE theme. Without this, the inline
+     `<meta name="color-scheme" content="dark light">` in index.html forces
+     dark form chrome in *both* themes — so the SSO "Enable single sign-on"
+     checkbox renders as an opaque black square against the light-mode
+     panel, ignoring our accent-color hint. CSS `color-scheme` overrides
+     the meta and tracks `data-theme` correctly. */
+  color-scheme: dark;
 }
 
 :root[data-theme="light"] {
+  color-scheme: light;
   /* Light palette — high-contrast neutral, accent unchanged for brand
      consistency. Designed against Netbox Labs's reference screenshot:
      near-white surfaces, soft grey dividers, dark text. */
   --bg:           #f6f8fb;
-  --bg-panel:    #ffffff;
+  --bg-panel:    #fbfcfe;
   --bg-panel-2:  #f0f3f8;
   --bg-elev:     #e6ebf2;
   --fg:           #1c2330;
@@ -54,7 +63,11 @@
   --ok:           #1f9b54;
   --border:       #d8dde6;
   --border-soft: #e7eaf0;
-  --terminal-bg: #0d1219; /* terminal stays dark even in light mode */
+  /* Light-mode terminal: the pane background and chrome track the rest
+     of the light theme. Per-level text colours below recolour-on-light
+     so log lines stay readable on a pale background — previously the
+     terminal was locked to dark and looked like a stuck panel. */
+  --terminal-bg: #ffffff;
   --shadow-card: 0 1px 0 rgba(0,0,0,0.02), 0 6px 18px rgba(20,28,52,0.06);
 }
 
@@ -87,14 +100,23 @@ code, kbd { font-family: var(--mono); font-size: 12.5px;
   border-right: 1px solid var(--border);
   display: flex; flex-direction: column;
 }
+/* The brand block sits flush with the topbar so the sidebar+topbar reads
+   as one continuous bar across the top of the app, rather than a chunky
+   2-line logo block plus a separate (smaller-typeface) page title. The
+   height/border-bottom match the topbar exactly so the divider runs
+   straight across without a step. */
 .sidebar .brand {
   display: flex; align-items: center; gap: 12px;
-  padding: 14px 18px;
+  padding: 0 18px;
+  height: var(--topbar-h);
   border-bottom: 1px solid var(--border);
 }
-.sidebar .brand img { width: 40px; height: auto; }
-.sidebar .brand strong { font-size: 16px; letter-spacing: 0.4px; }
-.sidebar .brand .sub { color: var(--fg-dim); font-size: 11px; }
+.sidebar .brand img { width: 26px; height: 26px; flex: none; }
+.sidebar .brand strong {
+  font-size: 15px; font-weight: 600;
+  letter-spacing: 0.2px;
+  color: var(--fg);
+}
 .sidebar nav { padding: 10px 0; flex: 1; overflow-y: auto; }
 .sidebar nav a {
   display: flex; align-items: center; gap: 10px;
@@ -140,6 +162,16 @@ code, kbd { font-family: var(--mono); font-size: 12.5px;
 .sidebar .footer .status-value.err  { color: var(--err); }
 .sidebar .footer .status-value.warn { color: var(--warn); }
 .sidebar .footer .footer-sub { color: var(--fg-dimmer); margin-top: 2px; }
+/* Persistent backend identity. Sits below the advertised URL so even
+   when an operator has uploaded their own logo, "what is this" stays
+   answerable from the bottom-left of every page. */
+.sidebar .footer .footer-version {
+  margin-top: 8px; padding-top: 8px;
+  border-top: 1px dashed var(--border-soft);
+  color: var(--fg-dim);
+  font-variant-numeric: tabular-nums;
+  letter-spacing: 0.2px;
+}
 
 /* ── Top bar ───────────────────────────────────────────────────────── */
 
@@ -253,7 +285,7 @@ button, .btn {
   cursor: pointer;
   transition: background 0.12s ease;
 }
-button:hover, .btn:hover { background: var(--accent-dim); color: #fff; }
+button:hover, .btn:hover { background: var(--accent-dim); color: #f4fffd; }
 button.ghost { background: transparent; color: var(--fg); border: 1px solid var(--border); }
 button.ghost:hover { background: var(--bg-panel-2); color: var(--fg); }
 button.danger { background: transparent; color: var(--err); border: 1px solid color-mix(in srgb, var(--err) 35%, transparent); }
@@ -264,23 +296,83 @@ label.field {
 }
 label.field .name { color: var(--fg-dim); font-size: 12px; }
 label.field .hint { color: var(--fg-dimmer); font-size: 11px; }
-label.field input[type="text"],
-label.field input[type="number"],
+/* All single-line inputs share one chrome rule. Pre-v0.4.6 we only
+   styled type=text/number, which left type=password fields rendering
+   with the default browser look — visibly off vs adjacent text fields
+   in the Account card. The negation list keeps `type=checkbox`,
+   `type=file`, and `type=range` (none of which we use inside
+   `label.field`) from picking up the padded-box look. */
+label.field input:not([type="checkbox"]):not([type="file"]):not([type="range"]),
 label.field select,
 label.field textarea {
   width: 100%; background: var(--bg); color: var(--fg);
   border: 1px solid var(--border); border-radius: var(--radius);
   padding: 7px 10px; font: inherit;
+  /* iOS/Safari shrinks password-field text by default; clamp it so
+     the password input matches the username input's metrics. */
+  font-size: 14px; line-height: 1.4;
+  box-shadow: none; -webkit-appearance: none; appearance: none;
+}
+/* v0.4.63: with `appearance: none`, the native <select> dropdown arrow
+   disappears, which makes the "Metadata source" pick-list look like a
+   plain (and slightly squished) text input. Paint our own chevron via
+   background-image so the control still reads as a dropdown, and reserve
+   right-padding for it. The data-URI SVG inherits currentColor via the
+   `stroke` attribute so the arrow follows light/dark theme without a
+   second declaration. */
+label.field select {
+  background-image: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 12 8' fill='none' stroke='%239aa0a6' stroke-width='1.6' stroke-linecap='round' stroke-linejoin='round'><polyline points='1.5,1.5 6,6 10.5,1.5'/></svg>");
+  background-repeat: no-repeat;
+  background-position: right 10px center;
+  background-size: 11px 7px;
+  padding-right: 30px;
+}
+:root[data-theme="light"] label.field select {
+  background-image: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 12 8' fill='none' stroke='%235a6377' stroke-width='1.6' stroke-linecap='round' stroke-linejoin='round'><polyline points='1.5,1.5 6,6 10.5,1.5'/></svg>");
 }
 label.field input:focus, label.field select:focus, label.field textarea:focus {
   outline: none; border-color: var(--accent);
+  box-shadow: 0 0 0 1px color-mix(in srgb, var(--accent) 35%, transparent);
 }
 label.check {
   display: flex; gap: 10px; align-items: center;
   padding: 8px 10px; margin-bottom: 6px;
   border: 1px solid var(--border-soft); border-radius: var(--radius);
 }
-label.check input { accent-color: var(--accent); }
+/* v0.4.63: native checkboxes used to render as opaque black squares in
+   light mode because the page meta declares `color-scheme: dark light`
+   and `accent-color` alone only repaints the *check mark* (not the
+   container). Take full control of the chrome so the box reads cleanly
+   on both palettes and the checked state lights up in our accent. */
+label.check input[type="checkbox"] {
+  appearance: none; -webkit-appearance: none;
+  width: 16px; height: 16px; flex: none;
+  background: var(--bg);
+  border: 1px solid var(--border);
+  border-radius: 3px;
+  display: inline-grid; place-content: center;
+  cursor: pointer; margin: 0;
+  transition: background 0.1s ease, border-color 0.1s ease;
+}
+label.check input[type="checkbox"]:hover { border-color: var(--accent); }
+label.check input[type="checkbox"]:checked {
+  background: var(--accent);
+  border-color: var(--accent);
+}
+label.check input[type="checkbox"]:checked::after {
+  /* Classic ✓ glyph built from a rotated rectangle border. Colour is
+     #002923 (the same near-black we use on solid-accent buttons) so the
+     tick stays legible against the teal fill in both themes. */
+  content: '';
+  width: 4px; height: 8px;
+  border: solid #002923;
+  border-width: 0 2px 2px 0;
+  transform: rotate(45deg) translate(-1px, -1px);
+}
+label.check input[type="checkbox"]:focus-visible {
+  outline: none;
+  box-shadow: 0 0 0 2px color-mix(in srgb, var(--accent) 35%, transparent);
+}
 
 /* ── Drop zone ────────────────────────────────────────────────────── */
 
@@ -398,9 +490,21 @@ tr.unbootable td:first-child { border-left: 3px solid var(--warn); }
 .dot.err  { background: var(--err); }
 .dot.warn { background: var(--warn); }
 
-/* Inline form rows. */
-.form-row { display: grid; grid-template-columns: repeat(4, 1fr); gap: 10px 14px; }
-@media (max-width: 900px) { .form-row { grid-template-columns: 1fr; } }
+/* Inline form rows. The default is a 4-column grid sized for the
+   Account card's "Current / New username / New password / Confirm"
+   quartet; the `.cols-3` modifier swaps to a 3-column layout for the
+   SSO header strip (display name / logo URL / metadata source). All
+   `.form-row > label.field` children share the same baseline because
+   their inner inputs share metrics via the global rule above. */
+.form-row { display: grid; grid-template-columns: repeat(4, 1fr); gap: 10px 14px; align-items: end; }
+.form-row.cols-3 { grid-template-columns: repeat(3, 1fr); }
+.form-row.cols-2 { grid-template-columns: repeat(2, 1fr); }
+.form-row label.field { margin-bottom: 0; }
+@media (max-width: 900px) {
+  .form-row,
+  .form-row.cols-3,
+  .form-row.cols-2 { grid-template-columns: 1fr; }
+}
 
 /* ── Queued deployment visual ────────────────────────────────────── */
 .queue-track {
@@ -436,26 +540,29 @@ tr.unbootable td:first-child { border-left: 3px solid var(--warn); }
   min-height: 480px;
   box-shadow: var(--shadow-card);
 }
+/* Terminal pane colours follow the active theme. Hard-coded hexes
+   (#050505, #181818, #cfd6e2 etc.) were leaving the light-mode pane
+   looking dark; we keep palette-aware vars instead so the toggle works. */
 .terminal .pane {
   flex: 1; overflow: auto;
   padding: 10px 14px;
   font-family: var(--mono); font-size: 12.5px; line-height: 1.5;
-  color: #cfd6e2;
+  color: var(--fg);
   white-space: pre-wrap; word-break: break-word;
 }
 .terminal .pane .lvl-error { color: var(--err); }
 .terminal .pane .lvl-warn  { color: var(--warn); }
-.terminal .pane .lvl-info  { color: #cfd6e2; }
-.terminal .pane .lvl-debug { color: #8b94a8; }
-.terminal .pane .lvl-trace { color: #5a6379; }
-.terminal .pane .ts        { color: #5a6379; }
-.terminal .pane .tg        { color: #7cd3ff; }
+.terminal .pane .lvl-info  { color: var(--fg); }
+.terminal .pane .lvl-debug { color: var(--fg-dim); }
+.terminal .pane .lvl-trace { color: var(--fg-dimmer); }
+.terminal .pane .ts        { color: var(--fg-dimmer); }
+.terminal .pane .tg        { color: var(--accent); }
 .terminal .pane .echo      { color: var(--accent); }
 .terminal .input-row {
   display: flex; align-items: center; gap: 8px;
   padding: 8px 14px;
-  background: #050505;
-  border-top: 1px solid #181818;
+  background: var(--bg-panel-2);
+  border-top: 1px solid var(--border);
 }
 .terminal .input-row .prompt { color: var(--accent); font-family: var(--mono); }
 .terminal .input-row input {
@@ -466,22 +573,205 @@ tr.unbootable td:first-child { border-left: 3px solid var(--warn); }
 .terminal .toolbar {
   display: flex; gap: 8px; align-items: center;
   padding: 8px 14px;
-  background: #050505;
-  border-bottom: 1px solid #181818;
+  background: var(--bg-panel-2);
+  border-bottom: 1px solid var(--border);
   font-size: 12px; color: var(--fg-dim);
 }
 .terminal .toolbar .right { margin-left: auto; display: flex; gap: 6px; }
 .terminal .toolbar button {
   padding: 3px 9px; font-size: 11px;
-  background: transparent; color: var(--fg-dim); border: 1px solid #181818;
+  background: transparent; color: var(--fg-dim); border: 1px solid var(--border);
   font-weight: 500;
 }
-.terminal .toolbar button:hover { color: var(--fg); background: #181818; }
+.terminal .toolbar button:hover { color: var(--fg); background: var(--bg-elev); }
+
+/* ── Auth screen (first-run setup + login) ───────────────────────
+   Used when /api/me reports setup_required or !authenticated. The
+   regular .shell is hidden; this overlay takes the full viewport so
+   the operator never sees half-loaded dashboard chrome while the auth
+   state is unknown. Same palette as the rest of the UI — borrows the
+   Sonarr/Radarr layout (centered narrow card on the page background).
+*/
+.auth-screen {
+  position: fixed; inset: 0;
+  display: flex; align-items: center; justify-content: center;
+  background: var(--bg);
+  padding: 24px;
+  z-index: 100;
+}
+.auth-card {
+  width: 100%; max-width: 380px;
+  background: var(--bg-panel);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-lg);
+  box-shadow: var(--shadow-card);
+  padding: 28px 28px 22px;
+}
+.auth-card .brand-row {
+  display: flex; align-items: center; gap: 12px;
+  margin-bottom: 18px;
+}
+.auth-card .brand-row img { width: 32px; height: 32px; flex: none; }
+.auth-card .brand-row .name { font-size: 17px; font-weight: 600; letter-spacing: 0.2px; color: var(--fg); }
+.auth-card h2 {
+  margin: 0 0 6px; font-size: 16px; font-weight: 600; color: var(--fg);
+}
+.auth-card .lede {
+  color: var(--fg-dim); font-size: 13px; margin: 0 0 18px;
+  line-height: 1.5;
+}
+.auth-card .field { margin-bottom: 12px; }
+.auth-card input[type="text"],
+.auth-card input[type="password"] {
+  width: 100%; background: var(--bg); color: var(--fg);
+  border: 1px solid var(--border); border-radius: var(--radius);
+  padding: 9px 11px; font: inherit; font-size: 13.5px;
+}
+.auth-card input:focus { outline: none; border-color: var(--accent); }
+.auth-card .submit { width: 100%; padding: 9px 12px; margin-top: 6px; }
+.auth-card .auth-err {
+  margin-top: 12px; color: var(--err); font-size: 12.5px;
+}
+.auth-card .auth-foot {
+  margin-top: 14px; padding-top: 12px;
+  border-top: 1px solid var(--border-soft);
+  color: var(--fg-dimmer); font-size: 11.5px; text-align: center;
+}
+.auth-card .sso-btn {
+  width: 100%; margin-top: 10px;
+  background: transparent; color: var(--fg);
+  border: 1px solid var(--border);
+  padding: 9px 12px;
+}
+.auth-card .sso-btn:hover {
+  background: var(--bg-panel-2); border-color: var(--accent); color: var(--fg);
+}
+.auth-card .sso-btn .meta { color: var(--fg-dim); font-size: 11px; margin-top: 2px; }
+
+/* ── Top-right user menu (v0.4.6) ────────────────────────────
+   The "signed in as X" identity + sign-out moved out of the sidebar
+   footer in v0.4.6 — the sidebar footer is now reserved for the
+   service-state trio (Service status / Advertised URL / Backend
+   version). The button matches the theme toggle's size + chrome so
+   the top-right reads as a tidy two-icon strip. */
+.user-menu { position: relative; }
+.user-btn {
+  display: inline-flex; align-items: center; justify-content: center;
+  width: 36px; height: 32px;
+  background: transparent; color: var(--fg);
+  border: 1px solid var(--border); border-radius: 8px;
+  cursor: pointer; padding: 0;
+  transition: background 0.15s ease, border-color 0.15s ease;
+}
+.user-btn:hover { background: var(--bg-panel-2); border-color: var(--accent); }
+.user-pop {
+  position: absolute; right: 0; top: 38px;
+  min-width: 200px;
+  background: var(--bg-panel);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-lg);
+  box-shadow: var(--shadow-card);
+  padding: 6px;
+  z-index: 60;
+  display: flex; flex-direction: column; gap: 2px;
+}
+.user-pop[hidden] { display: none; }
+.user-pop .user-pop-name {
+  padding: 8px 10px 6px;
+  border-bottom: 1px solid var(--border-soft);
+  margin-bottom: 4px;
+  color: var(--fg); font-weight: 600; font-size: 13px;
+  overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
+}
+.user-pop .user-pop-item {
+  text-align: left; width: 100%;
+  background: transparent; color: var(--fg);
+  border: 0; border-radius: var(--radius);
+  padding: 7px 10px; font: inherit; font-size: 13px; font-weight: 500;
+  cursor: pointer;
+}
+.user-pop .user-pop-item:hover {
+  background: var(--bg-panel-2); color: var(--fg);
+}
+.user-pop .user-pop-danger { color: var(--err); }
+.user-pop .user-pop-danger:hover {
+  background: color-mix(in srgb, var(--err) 12%, transparent);
+  color: var(--err);
+}
 
 /* ── About card ─────────────────────────────────────────────────── */
 .about-hero { padding: 20px 24px; }
 .about-hero h2 { font-size: 22px; margin: 0 0 8px; color: var(--fg); }
-.about-hero .lead { color: var(--fg-dim); font-size: 14px; max-width: 60ch; }
+/* Span the full main column rather than capping at 60ch — the page is
+   read at typical desktop widths and the cap was leaving the right two
+   thirds of the panel awkwardly empty. */
+.about-hero .lead { color: var(--fg-dim); font-size: 14px; max-width: none; }
 .about-hero .who { margin-top: 18px; font-size: 13px; }
 .about-hero .who span { color: var(--fg-dim); }
 .about-hero .who strong { color: var(--accent); }
+.about-hero a { color: var(--accent); }
+
+/* ── API reference (Settings → bottom) ─────────────────────────── */
+.api-ref { display: grid; gap: 18px; padding: 16px; }
+.api-ref .group h3 {
+  margin: 0 0 8px; font-size: 13px; color: var(--fg-dim);
+  text-transform: uppercase; letter-spacing: 0.8px;
+}
+.api-ref .ep {
+  display: grid; grid-template-columns: 64px minmax(200px, 1fr) 2fr;
+  gap: 12px; align-items: baseline;
+  padding: 6px 0; border-top: 1px solid var(--border-soft);
+  font-size: 13px;
+}
+.api-ref .ep:first-child { border-top: 0; }
+.api-ref .ep .method {
+  font-family: var(--mono); font-weight: 600; font-size: 11px;
+  padding: 2px 6px; border-radius: 4px;
+  text-align: center; letter-spacing: 0.6px;
+}
+.api-ref .ep .method.get    { background: color-mix(in srgb, var(--ok) 22%, transparent);     color: var(--ok); }
+.api-ref .ep .method.post   { background: color-mix(in srgb, var(--accent) 22%, transparent); color: var(--accent); }
+.api-ref .ep .method.put    { background: color-mix(in srgb, var(--warn) 22%, transparent);   color: var(--warn); }
+.api-ref .ep .method.delete { background: color-mix(in srgb, var(--err) 22%, transparent);    color: var(--err); }
+.api-ref .ep .path { font-family: var(--mono); color: var(--fg); word-break: break-all; }
+.api-ref .ep .desc { color: var(--fg-dim); }
+@media (max-width: 900px) {
+  .api-ref .ep { grid-template-columns: 1fr; gap: 4px; }
+  .api-ref .ep .method { justify-self: start; }
+}
+
+/* ── Disk space card ───────────────────────────────────────────── */
+.diskbar {
+  height: 10px; border-radius: 5px;
+  background: var(--bg-elev);
+  overflow: hidden; margin-top: 8px;
+}
+.diskbar .fill {
+  height: 100%;
+  background: linear-gradient(90deg, var(--accent-dim), var(--accent));
+  transition: width 0.4s ease;
+}
+.diskbar.warn .fill { background: var(--warn); }
+.diskbar.full .fill { background: var(--err); }
+.disk-meta { display: flex; gap: 14px; font-size: 12px; color: var(--fg-dim); margin-top: 8px; flex-wrap: wrap; }
+.disk-meta strong { color: var(--fg); font-weight: 600; font-variant-numeric: tabular-nums; }
+
+/* ── Logo upload (Settings) ────────────────────────────────────── */
+.logo-preview {
+  display: flex; align-items: center; gap: 14px;
+  padding: 12px;
+  background: var(--bg-panel-2);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+}
+.logo-preview .swatch {
+  width: 56px; height: 56px;
+  display: flex; align-items: center; justify-content: center;
+  background: var(--bg); border: 1px solid var(--border);
+  border-radius: var(--radius);
+  flex: none;
+}
+.logo-preview .swatch img { max-width: 48px; max-height: 48px; }
+.logo-preview .info { flex: 1; min-width: 0; }
+.logo-preview .info .name { color: var(--fg); font-weight: 600; }
+.logo-preview .info .meta { color: var(--fg-dim); font-size: 12px; margin-top: 2px; }

crates/webui/src/index.html

@@ -5,8 +5,15 @@
   <meta name="viewport" content="width=device-width, initial-scale=1" />
   <meta name="color-scheme" content="dark light" />
   <title>OpenPXE</title>
-  <link rel="stylesheet" href="/assets/app.css" />
-  <link rel="icon" type="image/svg+xml" href="/assets/logo.svg" />
+  <!-- v0.4.61: the `?v=…` query string is replaced by the server at
+       request time with the running OpenPXE version. That guarantees a
+       fresh URL on every upgrade so browsers (and intermediary proxies)
+       can't keep serving stale JS / CSS / branding from before the
+       deploy. Combined with `Cache-Control: no-cache, must-revalidate`
+       on the asset handlers, the practical caching window is one
+       version. -->
+  <link rel="stylesheet" href="/assets/app.css?v={{ASSET_VERSION}}" />
+  <link rel="icon" type="image/svg+xml" href="/assets/logo.svg?v={{ASSET_VERSION}}" />
   <!-- Theme is read from localStorage *before* paint to avoid the
        dark→light flash on every navigation. Falls back to the OS
        preference and finally to dark. -->
@@ -26,11 +33,8 @@
 <div class="shell">
   <aside class="sidebar">
     <div class="brand">
-      <img src="/assets/logo.svg" alt="" />
-      <div>
+      <img src="/assets/logo.svg?v={{ASSET_VERSION}}" alt="OpenPXE" />
       <strong>OpenPXE</strong>
-        <div class="sub">v<span data-bind="version">0.4.0</span></div>
-      </div>
     </div>
     <nav>
       <a data-view="dashboard" class="active">Dashboard</a>
@@ -48,6 +52,7 @@
         <span class="count" data-bind="host_count">0</span>
       </a>
       <a data-view="terminal">Terminal</a>
+      <a data-view="settings">Settings</a>
       <a data-view="about">About</a>
     </nav>
     <div class="footer">
@@ -58,6 +63,10 @@
       </div>
       <div class="footer-sub">Advertised to clients</div>
       <code>{{BASE_URL}}</code>
+      <!-- The brand badge at the top can be overridden by operator-uploaded
+           logos; keep "OpenPXE v…" pinned in the footer so the backend
+           identity is always visible regardless of branding. -->
+      <div class="footer-version">OpenPXE&nbsp;v<span data-bind="version">0.4.63</span></div>
     </div>
   </aside>
 
@@ -87,11 +96,32 @@
         <path d="M20.5 14A8 8 0 0 1 10 3.5 a8 8 0 1 0 10.5 10.5z"/>
       </svg>
     </button>
+
+    <!-- v0.4.6: signed-in operator menu. Sits next to the theme toggle
+         in the top-right corner so the sidebar footer stays clean for
+         the "Service status / Advertised URL / Backend version" trio.
+         The whole block is hidden until /api/me confirms a session. -->
+    <div class="user-menu" data-bind="user_menu_wrap" style="display:none">
+      <button id="user-menu-btn" class="user-btn" type="button"
+              aria-label="Account menu" aria-haspopup="true" aria-expanded="false"
+              title="Account">
+        <svg viewBox="0 0 24 24" width="18" height="18" fill="none"
+             stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+          <circle cx="12" cy="8" r="3.6"/>
+          <path d="M4.5 20a7.5 7.5 0 0 1 15 0"/>
+        </svg>
+      </button>
+      <div id="user-menu-pop" class="user-pop" data-bind="user_menu_pop" hidden>
+        <div class="user-pop-name" data-bind="user_pop_name">—</div>
+        <button type="button" class="user-pop-item" data-bind="user_pop_edit">Edit account</button>
+        <button type="button" class="user-pop-item user-pop-danger" data-bind="user_pop_logout">Sign out</button>
+      </div>
+    </div>
   </header>
 
   <main class="main" id="view-root"></main>
 </div>
 
-<script src="/assets/app.js"></script>
+<script src="/assets/app.js?v={{ASSET_VERSION}}"></script>
 </body>
 </html>

crates/webui/src/lib.rs

@@ -7,11 +7,21 @@
 //! nav, top bar with secondary tabs, card-dense content panels.
 #![forbid(unsafe_code)]
 
-/// Render the top-level page. `base_url` is interpolated into the footer
-/// so operators can see at a glance what URL clients are PXE-booting from.
+/// Render the top-level page.
+///
+/// * `base_url` is interpolated into the footer so operators can see at
+///   a glance what URL clients are PXE-booting from.
+/// * `asset_version` is appended as `?v=…` to every asset URL so each
+///   release ships with brand-new asset URLs — browsers (and any
+///   intermediary proxy) can't keep serving last release's `app.js`
+///   when we know the new one is incompatible. Combined with
+///   `Cache-Control: no-cache, must-revalidate` on the asset handlers,
+///   the worst-case caching window is one version.
 #[must_use]
-pub fn index_html(base_url: &str) -> String {
-    INDEX_HTML.replace("{{BASE_URL}}", base_url)
+pub fn index_html(base_url: &str, asset_version: &str) -> String {
+    INDEX_HTML
+        .replace("{{BASE_URL}}", base_url)
+        .replace("{{ASSET_VERSION}}", asset_version)
 }
 
 #[must_use]

deploy/docker/Dockerfile

@@ -14,9 +14,17 @@
 # Debian slim at ~75 MB + binary ~25 MB is fine for a PXE server that
 # spends most of its life idle.
 
-ARG RUST_VERSION=1.82
+ARG RUST_VERSION=1.95
 
-########## fetch iPXE binaries ##########
+########## fetch iPXE binaries + wimboot ##########
+# v0.4.62: kept on the boot.ipxe.org pre-builds for the moment. We
+# want PNG support (so `console --picture` paints the operator's logo
+# on the PXE menu) but the obvious path — adding a new `ipxe-build`
+# stage that compiles iPXE from source with `IMAGE_PNG` enabled —
+# runs into a QEMU/gcc instability when cross-emulating x86_64 on
+# arm64 build hosts (intermittent `cc1` segfaults). The compositor
+# at /branding/pxe-logo is already wired so when the iPXE rebuild
+# lands (on native x86_64 hardware), no other code change is needed.
 FROM debian:12-slim AS fetch
 RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates \
  && rm -rf /var/lib/apt/lists/*
@@ -28,23 +36,44 @@ RUN mkdir -p assets/ipxe && bash scripts/fetch-ipxe.sh
 FROM rust:${RUST_VERSION}-bookworm AS build
 WORKDIR /src
 
+# v0.4.5: build a fully static musl binary (matches Bootimus v0.1.70's
+# move). The resulting `/openpxe` has no glibc dependency at all, which:
+#   - Lets the runtime stage be any Linux distro (we still ship Debian
+#     slim for the `samba` / `wimtools` / `nfs-common` shellouts, but a
+#     scratch/distroless variant becomes a one-line swap).
+#   - Cuts a class of "GLIBC_2.39 not found" surprises when running on
+#     older RHEL/Rocky hosts that don't match Debian 12's libc version.
+#   - Sidesteps cross-compilation snags (the binary is its own world).
+#
+# x86_64-unknown-linux-musl is fully static by default (no extra
+# RUSTFLAGS needed). musl-tools provides the linker.
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends musl-tools \
+ && rm -rf /var/lib/apt/lists/* \
+ && rustup target add x86_64-unknown-linux-musl
+
 # Copy the whole workspace in one go. We used to do a two-pass "cache-prime
 # with stubs, then real build" dance for dep-compile reuse; that turned out
 # to silently serve stale stub binaries when cargo's fingerprint didn't
 # notice the source swap. A single build is ~1.5 min longer on cold cache
 # but guarantees the binary reflects the sources we copied.
-COPY Cargo.toml rust-toolchain.toml ./
+# Do not copy rust-toolchain.toml into the image. The local workspace pins
+# developer tooling, but inside Docker we intentionally use the Rust version
+# selected by the base image. Copying rust-toolchain.toml with
+# `channel = "stable"` makes rustup download a second full toolchain during
+# `cargo build`, which is slow and can exhaust small Colima/CI disks.
+COPY Cargo.toml Cargo.lock ./
 COPY crates/ crates/
 COPY --from=fetch /src/assets/ipxe /src/assets/ipxe
 
-# Cache cargo registry + target across builds. The `--no-edit` touch is
+# Cache cargo registry + target across builds. The mtime touch is
 # belt-and-suspenders: cargo occasionally misses mtime-only changes on
 # networked FS; this forces a fingerprint check.
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
     --mount=type=cache,target=/src/target,sharing=locked \
     find crates -name '*.rs' -exec touch {} + && \
-    cargo build --release --bin openpxe && \
-    cp target/release/openpxe /openpxe && \
+    cargo build --release --target x86_64-unknown-linux-musl --bin openpxe && \
+    cp target/x86_64-unknown-linux-musl/release/openpxe /openpxe && \
     ls -l /openpxe
 
 ########## runtime ##########
@@ -57,22 +86,28 @@ RUN apt-get update \
  && useradd --system --uid 10001 --home-dir /var/lib/openpxe --shell /usr/sbin/nologin openpxe \
  && mkdir -p /var/lib/openpxe/isos /var/lib/openpxe/work /var/lib/openpxe/smb \
  && chown -R openpxe:openpxe /var/lib/openpxe
-# Runtime deps explained:
-#   wimtools  - provides `wimlib-imagex`, used to inject startnet.cmd into boot.wim.
-#   samba     - `smbd` serves extracted Windows install media on :445 for WinPE
-#               to `net use`. Guest read-only, scoped to /var/lib/openpxe/smb.
-#   nfs-common - provides `mount.nfs` / `mount.nfs4` for the Storage tab's
-#               NFS share manager. Mount also requires the container to run
-#               with CAP_SYS_ADMIN — without it, mount(2) returns EPERM and
-#               the manager surfaces a clear error in the UI instead of
-#               failing silently.
-#   iproute2  - `ip addr` / `ip route` for the auto-detected Network tab
-#               fields (NIC name, subnet mask, default gateway). Tiny,
-#               always available; we don't pull in netlink crates for
-#               this one-shot startup probe.
-#   gosu      - drops privileges cleanly from root after the entrypoint fixes
-#               bind-mount ownership (common OpenShift/Docker UX issue).
-# Windows-specific tools only activate when the WebUI toggle is on.
+# v0.4.5: the openpxe binary itself is now built against musl and is
+# fully static — no glibc dependency. The runtime stage still ships
+# Debian slim because OpenPXE shells out to the four packages below for
+# functionality we deliberately don't reimplement in-process:
+#   wimtools   - `wimlib-imagex`, used to inject startnet.cmd into boot.wim.
+#   samba      - `smbd` serves extracted Windows install media on :445 so
+#                WinPE can `net use`. Guest read-only, scoped to
+#                /var/lib/openpxe/smb.
+#   nfs-common - `mount.nfs` / `mount.nfs4` for the Storage tab's NFS
+#                share manager. Mount requires CAP_SYS_ADMIN; without it
+#                mount(2) returns EPERM and the manager surfaces a clear
+#                error in the UI.
+#   iproute2   - `ip addr` / `ip route` for the auto-detected Network
+#                tab fields (NIC name, subnet mask, default gateway).
+#                Tiny, always available; we don't pull in netlink crates
+#                for this one-shot startup probe.
+#   gosu       - drops privileges cleanly from root after the entrypoint
+#                fixes bind-mount ownership (common OpenShift/Docker UX
+#                issue).
+# A future "openpxe-static" variant could drop everything except the
+# binary onto distroless once we move the Windows + NFS legs to
+# in-process Rust crates.
 
 COPY --from=build /openpxe /usr/local/bin/openpxe
 COPY deploy/docker/entrypoint.sh /usr/local/bin/entrypoint.sh

deploy/openshift/30-deployment.yaml

@@ -34,7 +34,7 @@ spec:
         fsGroup: 10001
       containers:
         - name: openpxe
-          image: gitea.milesward.dev/mward4/openpxe:0.3.2
+          image: gitea.milesward.dev/mward4/openpxe:0.4.1
           imagePullPolicy: IfNotPresent
           ports:
             - name: dhcp

deploy/unraid/README.md

@@ -6,7 +6,7 @@ boot from OpenPXE". Pick the one that matches what you have.
 ## Path A — build on Unraid, push to Gitea registry, pull by tag
 
 Recommended once you've done it once. Image is published to
-`gitea.milesward.dev/mward4/openpxe:0.3.2` (or your equivalent) and
+`gitea.milesward.dev/mward4/openpxe:0.4.1` (or your equivalent) and
 every Unraid template / docker-compose just references the tag.
 
 Pre-flight:
@@ -40,14 +40,14 @@ What it does:
 3. `docker build` against `deploy/docker/Dockerfile`.
 4. `docker login gitea.milesward.dev:3000` using a temp `DOCKER_CONFIG`
    so the credential never lands in your real `~/.docker/config.json`.
-5. `docker push` both `:0.3.2` and `:latest`.
+5. `docker push` both `:0.4.1` and `:latest`.
 6. Logout, scrub the temp config, delete the workspace.
 
 After it finishes, in Unraid → Docker → Add Container, set:
 
 | Field      | Value                                           |
 |------------|-------------------------------------------------|
-| Repository | `gitea.milesward.dev/mward4/openpxe:0.3.2`     |
+| Repository | `gitea.milesward.dev/mward4/openpxe:0.4.1`     |
 | Network    | `host`                                          |
 | Extra args | `--cap-add=NET_BIND_SERVICE`                    |
 
@@ -88,14 +88,14 @@ then:
 
 ```bash
 # On the build host
-docker save openpxe:0.3.2 | gzip > openpxe-0.3.2.tar.gz
+docker save openpxe:0.4.1 | gzip > openpxe-0.4.1.tar.gz
 
 # Transfer (rsync / scp / SMB / ZFS-replicate / sneakernet)
-scp openpxe-0.3.2.tar.gz root@unraid:/tmp/
+scp openpxe-0.4.1.tar.gz root@unraid:/tmp/
 
 # On Unraid
-gunzip -c /tmp/openpxe-0.3.2.tar.gz | docker load
-docker tag openpxe:0.3.2 gitea.milesward.dev/mward4/openpxe:0.3.2
+gunzip -c /tmp/openpxe-0.4.1.tar.gz | docker load
+docker tag openpxe:0.4.1 gitea.milesward.dev/mward4/openpxe:0.4.1
 ```
 
 If you want it pullable by tag from other Unraid templates, push to

docs/NEXT_PHASE.md

@@ -1,6 +1,6 @@
 # Phase 6 — recommendations
 
-The v0.3.2 cut leaves OpenPXE in a state where the entire protocol stack
+The v0.4.1 cut leaves OpenPXE in a state where the entire protocol stack
 and operator UI are exercised by the automated test suite, the container is
 multi-arch buildable, and the image ships at ~97 MB. What's left before
 this looks and feels like a 1.0 product is mostly **real-hardware

docs/architecture.md

@@ -265,10 +265,9 @@ tab is one click from the brand bar.
 - Persisted to `<work_dir>/hosts.json`. Like `SettingsStore`, in-memory
   is authoritative — disk corruption falls back to empty rather than
   failing startup.
-- Inspired by Tinkerbell `smee`'s MAC-prepended URL pattern. The DHCP
-  reply now embeds `?mac=${mac}` in the boot.ipxe URL; iPXE substitutes
-  the literal MAC client-side, so the HTTP layer can short-circuit
-  past the menu when a binding exists.
+- The DHCP reply embeds `?mac=${mac}` in the boot.ipxe URL; iPXE
+  substitutes the literal MAC client-side, so the HTTP layer can
+  short-circuit past the menu when a binding exists.
 - `/api/hosts` GET / POST / DELETE drives the **Hosts** tab.
 
 **Prometheus metrics** (`crates/core/src/metrics.rs`):

docs/queued/ipxe-pxe-menu-theme-research.md

@@ -0,0 +1,106 @@
+# PXE menu theme — research for next-release follow-up
+
+Status: queued. v0.4.63 keeps the ASCII-banner fallback + `console --picture`
+compositor wired; this note captures the design for the menu-theming work
+that lands once iPXE rebuilt with `IMAGE_PNG` is published.
+
+## How iVentoy actually does it
+
+iVentoy is closed-source for its menu, but the supporting bits are
+public at https://github.com/ventoy/PXE — a vanilla iPXE snapshot
+(`iPXE/ipxe-bd13697`) used to produce the loader binaries iVentoy
+serves over TFTP (`pxeboot.efi`, `iventoy_loader_16000`,
+`iventoy_loader_16000_uefi`).
+
+The graphical menu itself is rendered by iPXE's framebuffer console
+with a baked-in PNG background via `console --picture` — same
+primitive OpenPXE already uses in `crates/http-api/src/ipxe_script.rs`.
+Evidence:
+
+- The iPXE build in `ventoy/PXE` is configured with `CONSOLE_FRAMEBUFFER`
+  + `IMAGE_PNG` + `CONSOLE_CMD` (the three flags `console --picture`
+  needs).
+- iVentoy issue #11 confirms "iventoy using default 1024x768"; users
+  report 800x600 / 1024x768 / 1280x720 / 1280x1024 / 1920x1080 as
+  selectable resolutions from the iVentoy web UI **Configuration tab**,
+  not via EDID auto-detect. iPXE has no EDID parsing; the daemon writes
+  a resolution-tagged script per boot and serves the matching PNG.
+- iVentoy docs explicitly state both Free and Pro editions **do not
+  support** modifying the boot background/title — it's baked into the
+  shipped PNG assets.
+- Chrome is iPXE's native `menu` / `item` / `choose` widgets (single
+  highlight bar, no borders) painted on top of the PNG, with margins
+  set via `console --left/--right/--top/--bottom` to keep the text off
+  the logo. Not GRUB, not syslinux — UEFI iVentoy uses iPXE's
+  `snponly.efi` / `pxeboot.efi`, and `--picture` does work under UEFI
+  GOP despite older folklore.
+
+Do not conflate this with Ventoy-USB, which is a separate codebase and
+uses GRUB2 themes (`theme.txt`, `background_ventoy.png`, `select_c.png`).
+
+## Rust ingredients to replicate / surpass
+
+Most of these already exist in the workspace.
+
+1. **Compositor (extend, don't replace)** — extend
+   `crates/iso-store/src/pxe_logo.rs` to emit per-resolution PNGs
+   (1024x768, 1280x1024, 1920x1080 as the v1 set). `image` +
+   `imageproc` crates handle scaling; `ab_glyph` / `fontdue` for raster
+   text (subtitle, hostname, version). One source SVG/logo, three to
+   five rendered PNGs cached on disk.
+2. **Script generator** — `ipxe_script.rs` already emits
+   `console --picture … || console`. Add a `?res=` query param (or
+   per-MAC client hint persisted in `hosts.json`) and serve the matching
+   PNG plus matching `console --x --y` line. Keep the text-console
+   fallback already in place.
+3. **Resolution selection** — iPXE exposes `${vesa-x}` / `${vesa-y}` on
+   BIOS; UEFI side we can probe firmware vars at chain-time. The simpler
+   v1 is a "low-res / hi-res" toggle in Settings plus a per-host
+   override — mirrors iVentoy's UX, no kernel helper needed. True EDID
+   parsing is overkill for the first cut.
+4. **Chrome upgrades over iVentoy** — iPXE menus are limited (single
+   highlight, no borders). To look distinctly cooler without leaving
+   iPXE: paint border / title / footer **into the PNG**, leave a window
+   in the middle, then `console --left/--right/--top/--bottom` to inset
+   the iPXE menu exactly into that window. ASCII box-drawing inside the
+   menu remains fragile (iPXE mangles non-ASCII on some builds — already
+   noted in `ipxe_script.rs`).
+
+## Recommended architecture for the next OpenPXE release
+
+- Build a `pxe_theme` module beside `pxe_logo.rs`: takes operator logo
+  + theme tokens (accent colour, title, footer) and renders a layered
+  PNG (background gradient → framing chrome → logo → title bar → footer
+  with `${hostname}` / `${version}` / `${ip}`) at the three target
+  resolutions. Cache by hash of inputs.
+- Serve at `/branding/pxe-menu-{w}x{h}.png`. Default 1024x768; expose a
+  Settings dropdown.
+- In `ipxe_script.rs`, emit
+  `console --picture …/pxe-menu-1024x768.png --left 80 --right 80 --top 180 --bottom 60 || console`,
+  then the existing `menu` / `item` / `choose` block — text now lands
+  inside the framed window.
+- Compile iPXE with `CONSOLE_FRAMEBUFFER`, `IMAGE_PNG`, `CONSOLE_CMD`,
+  `CONSOLE_VESAFB` (BIOS) and `CONSOLE_EFIFB` (UEFI). The v0.4.61 image
+  attempted this in-Docker via QEMU emulation and hit `cc1` segfaults.
+  The follow-up will use a Gitea Actions runner pinned to native
+  `linux/amd64` (an Unraid host already exists for this).
+- Stretch goal: a second "theme pack" that ships a layered PNG with
+  subtle scanlines / grid — iPXE can't animate, but a well-designed
+  static composite beats iVentoy's plain centered logo handily.
+
+## Source URLs
+
+- https://github.com/ventoy/PXE
+- https://github.com/ventoy/PXE/tree/master/iPXE
+- https://github.com/ventoy/PXE/issues/11 — 1024x768 default
+- https://github.com/ventoy/PXE/issues/59 — iVentoy iPXE EFI loader
+- https://ipxe.org/cmd/console — `--picture` and compile flags
+- https://github.com/ipxe/ipxe/discussions/945 — background image how-to
+- https://github.com/ipxe/ipxe/discussions/802 — `CONSOLE_FRAMEBUFFER`
+  requirement
+- https://github.com/ipxe/ipxe/discussions/1006 — picture resolution
+  behaviour
+- https://www.iventoy.com/en/doc_edition.html — background / title not
+  user-customisable
+- https://kingtam.win/archives/iventoy.html — third-party iPXE-based
+  iVentoy alternative