v0.4.68: fix NFS secure-export mount, logo cache-bust, dashboard disk card, NFS form spacing

Four operator-reported issues from v0.4.67 validation. ## 1. NFS MNT3ERR_ACCES even with the host IP allow-listed Root cause: Linux kernel nfsd (what UniFi UNAS / Synology / TrueNAS all run underneath) exports with the `secure` option by default, which only accepts mount/NFS requests from a privileged source port (<1024). v0.4.67 explicitly connected from a non-privileged port on the mistaken assumption that uid 10001 can't bind low ports — but the binary carries CAP_NET_BIND_SERVICE (granted via setcap for the DHCP/TFTP/HTTP low-port binds), which also covers privileged *source* ports for outbound connects. Fix: build_connection now tries a privileged source port first (the common case for every appliance NAS), then falls back to a non-privileged port for `insecure` exports or capability-less environments. Each attempt has its own connect timeout; a timeout on the first attempt skips the fallback (the server isn't answering — a retry would just double the wait). Also: hint_for now recognizes MNT3ERR_ACCES distinctly from NFS3ERR_ACCES and explains both the allow-list and the secure/insecure angle, with the UniFi /var/nfs/shared/<share> path convention called out. ## 2. Custom logo didn't update the top-left brand mark The brand <img> and favicon were pinned to ?v=<app-version>, which only changes on upgrade — so uploading a new logo left the cached bundled SVG in place. Added a monotonic `rev` counter to BrandingStore that bumps on every set/clear, persisted across restarts, surfaced through index_html as an extra &r=<rev> cache-bust token on the brand mark + favicon URLs. Since index.html is served no-cache, the fresh token lands on the next reload after upload and the new logo appears immediately. (Note: this updates the WebUI brand mark. The PXE *boot menu* still shows the ASCII wordmark — painting the operator's PNG there needs the IMAGE_PNG-enabled iPXE rebuild that remains queued for native x86_64 hardware. The /branding/pxe-logo compositor is ready for when it lands.) ## 3. Disk-space card on the Dashboard Extracted the Storage tab's disk card into a shared diskSpaceCard(disk) helper and added it to the Dashboard grid under the stat strip. Dashboard fetches /api/storage/disk with the same graceful-degradation fallback the Storage tab uses. ## 4. NFS "Add share" button touching the form field The NFS card has a single form row (vs SMB's two), so the button butted right against it. Added margin-top:14px to match SMB's effective spacing. Tests: 162 passing (+2 — logo_rev bump, MNT3ERR_ACCES hint). clippy clean. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
v0.4.67: NFSv3 alongside SMB (in-process via nfs3_client crate)
2026-05-28 21:34:41 -04:00 · 2026-05-28 12:56:46 -04:00 · 2026-05-28 11:58:51 -04:00 · 2026-05-28 11:19:47 -04:00 · 2026-05-28 10:47:17 -04:00 · 2026-05-28 03:09:43 -04:00
29 changed files with 7583 additions and 888 deletions
@@ -2,6 +2,12 @@
 # It is not intended for manual editing.
 version = 4
 [[package]]
 name = "adler2"
 version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
 [[package]]
 name = "aho-corasick"
 version = "1.1.4"
@@ -84,6 +90,12 @@ version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
 [[package]]
 name = "autocfg"
 version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 [[package]]
 name = "axum"
 version = "0.7.9"
@@ -212,12 +224,24 @@ version = "3.20.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5d20789868f4b01b2f2caec9f5c4e0213b41e3e5702a50157d699ae31ced2fcb"
 [[package]]
 name = "bytemuck"
 version = "1.25.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c8efb64bd706a16a1bdde310ae86b351e4d21550d98d056f22f8a7f7a2183fec"
 [[package]]
 name = "byteorder"
 version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 [[package]]
 name = "byteorder-lite"
 version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f1fe948ff07f4bd06c30984e69f5b4899c516a3ef74f34df92a2df2ab535495"
 [[package]]
 name = "bytes"
 version = "1.11.1"
@@ -280,6 +304,12 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
 [[package]]
 name = "color_quant"
 version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3d7b894f5411737b7867f4827955924d7c254fc9f4d91a6aad6b097804b1018b"
 [[package]]
 name = "colorchoice"
 version = "1.0.5"
@@ -295,6 +325,15 @@ dependencies = [
 "libc",
 ]
 [[package]]
 name = "crc32fast"
 version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
 dependencies = [
 "cfg-if",
 ]
 [[package]]
 name = "crypto-common"
 version = "0.1.7"
@@ -406,6 +445,25 @@ version = "2.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
 [[package]]
 name = "fdeflate"
 version = "0.3.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e6853b52649d4ac5c0bd02320cddc5ba956bdb407c4b75a2c6b75bf51500f8c"
 dependencies = [
 "simd-adler32",
 ]
 [[package]]
 name = "flate2"
 version = "1.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
 dependencies = [
 "crc32fast",
 "miniz_oxide",
 ]
 [[package]]
 name = "fnv"
 version = "1.0.7"
@@ -549,6 +607,16 @@ dependencies = [
 "wasip3",
 ]
 [[package]]
 name = "gif"
 version = "0.14.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ee8cfcc411d9adbbaba82fb72661cc1bcca13e8bba98b364e62b2dba8f960159"
 dependencies = [
 "color_quant",
 "weezl",
 ]
 [[package]]
 name = "globset"
 version = "0.4.18"
@@ -821,6 +889,34 @@ dependencies = [
 "icu_properties",
 ]
 [[package]]
 name = "image"
 version = "0.25.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "85ab80394333c02fe689eaf900ab500fbd0c2213da414687ebf995a65d5a6104"
 dependencies = [
 "bytemuck",
 "byteorder-lite",
 "color_quant",
 "gif",
 "image-webp",
 "moxcms",
 "num-traits",
 "png",
 "zune-core",
 "zune-jpeg",
 ]
 [[package]]
 name = "image-webp"
 version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "525e9ff3e1a4be2fbea1fdf0e98686a6d98b4d8f937e1bf7402245af1909e8c3"
 dependencies = [
 "byteorder-lite",
 "quick-error",
 ]
 [[package]]
 name = "indexmap"
 version = "2.14.0"
@@ -958,6 +1054,16 @@ dependencies = [
 "unicase",
 ]
 [[package]]
 name = "miniz_oxide"
 version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
 dependencies = [
 "adler2",
 "simd-adler32",
 ]
 [[package]]
 name = "mio"
 version = "1.2.0"
@@ -969,6 +1075,16 @@ dependencies = [
 "windows-sys 0.61.2",
 ]
 [[package]]
 name = "moxcms"
 version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bb85c154ba489f01b25c0d36ae69a87e4a1c73a72631fc6c0eb6dde34a73e44b"
 dependencies = [
 "num-traits",
 "pxfm",
 ]
 [[package]]
 name = "multer"
 version = "3.1.0"
@@ -986,6 +1102,37 @@ dependencies = [
 "version_check",
 ]
 [[package]]
 name = "nfs3_client"
 version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0ac227029a6127f3474b4fb61cbf2d3dddbe9424ad50c24fada68b633687a532"
 dependencies = [
 "fastrand",
 "nfs3_types",
 "tokio",
 ]
 [[package]]
 name = "nfs3_macros"
 version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "06d8fb377e6efeb91911a8ed962a69615535e167e675025a2be8fa109751426a"
 dependencies = [
 "proc-macro2",
 "quote",
 "syn 2.0.117",
 ]
 [[package]]
 name = "nfs3_types"
 version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b5d5ab1a9fdfeab2f03b36b6300dea4ea3806e6a057cb479628b41d65e356b94"
 dependencies = [
 "nfs3_macros",
 ]
 [[package]]
 name = "nu-ansi-term"
 version = "0.50.3"
@@ -1001,6 +1148,15 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c6673768db2d862beb9b39a78fdcb1a69439615d5794a1be50caa9bc92c81967"
 [[package]]
 name = "num-traits"
 version = "0.2.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
 dependencies = [
 "autocfg",
 ]
 [[package]]
 name = "once_cell"
 version = "1.21.4"
@@ -1015,7 +1171,7 @@ checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
 [[package]]
 name = "openpxe"
-version = "0.4.1"
+version = "0.4.68"
 dependencies = [
 "anyhow",
 "axum",
@@ -1037,9 +1193,10 @@ dependencies = [
 [[package]]
 name = "openpxe-core"
-version = "0.4.1"
+version = "0.4.68"
 dependencies = [
 "anyhow",
 "bcrypt",
 "parking_lot",
 "serde",
 "serde_json",
@@ -1055,7 +1212,7 @@ dependencies = [
 [[package]]
 name = "openpxe-dhcp-proxy"
-version = "0.4.1"
+version = "0.4.68"
 dependencies = [
 "anyhow",
 "bytes",
@@ -1069,19 +1226,21 @@ dependencies = [
 [[package]]
 name = "openpxe-http-api"
-version = "0.4.1"
+version = "0.4.68"
 dependencies = [
 "anyhow",
 "axum",
 "bytes",
 "futures",
 "hyper",
 "image",
 "mime",
 "mime_guess",
 "openpxe-core",
 "openpxe-ipxe-assets",
 "openpxe-iso-store",
 "openpxe-webui",
 "parking_lot",
 "serde",
 "serde_json",
 "tempfile",
@@ -1098,7 +1257,7 @@ dependencies = [
 [[package]]
 name = "openpxe-ipxe-assets"
-version = "0.4.1"
+version = "0.4.68"
 dependencies = [
 "openpxe-core",
 "rust-embed",
@@ -1108,13 +1267,17 @@ dependencies = [
 [[package]]
 name = "openpxe-iso-store"
-version = "0.4.1"
+version = "0.4.68"
 dependencies = [
 "anyhow",
 "bcrypt",
 "bytes",
 "futures",
 "hex",
 "image",
 "libc",
 "nfs3_client",
 "nfs3_types",
 "openpxe-core",
 "parking_lot",
 "serde",
@@ -1131,7 +1294,7 @@ dependencies = [
 [[package]]
 name = "openpxe-tftp"
-version = "0.4.1"
+version = "0.4.68"
 dependencies = [
 "anyhow",
 "bytes",
@@ -1145,7 +1308,7 @@ dependencies = [
 [[package]]
 name = "openpxe-webui"
-version = "0.4.1"
+version = "0.4.68"
 [[package]]
 name = "parking_lot"
@@ -1182,6 +1345,19 @@ version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 [[package]]
 name = "png"
 version = "0.18.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "60769b8b31b2a9f263dae2776c37b1b28ae246943cf719eb6946a1db05128a61"
 dependencies = [
 "bitflags",
 "crc32fast",
 "fdeflate",
 "flate2",
 "miniz_oxide",
 ]
 [[package]]
 name = "potential_utf"
 version = "0.1.5"
@@ -1225,6 +1401,18 @@ dependencies = [
 "unicode-ident",
 ]
 [[package]]
 name = "pxfm"
 version = "0.1.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e0c5ccf5294c6ccd63a74f1565028353830a9c2f5eb0c682c355c471726a6e3f"
 [[package]]
 name = "quick-error"
 version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a993555f31e5a609f617c12db6250dedcac1b0a85076912c436e6fc9b2c8e6a3"
 [[package]]
 name = "quote"
 version = "1.0.45"
@@ -1482,6 +1670,12 @@ dependencies = [
 "libc",
 ]
 [[package]]
 name = "simd-adler32"
 version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "703d5c7ef118737c72f1af64ad2f6f8c5e1921f818cdcb97b8fe6fc69bf66214"
 [[package]]
 name = "slab"
 version = "0.4.12"
@@ -2122,6 +2316,12 @@ dependencies = [
 "semver",
 ]
 [[package]]
 name = "weezl"
 version = "0.1.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a28ac98ddc8b9274cb41bb4d9d4d5c425b6020c50c46f25559911905610b4a88"
 [[package]]
 name = "winapi-util"
 version = "0.1.11"
@@ -2436,3 +2636,18 @@ name = "zmij"
 version = "1.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
 [[package]]
 name = "zune-core"
 version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cb8a0807f7c01457d0379ba880ba6322660448ddebc890ce29bb64da71fb40f9"
 [[package]]
 name = "zune-jpeg"
 version = "0.5.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "27bc9d5b815bc103f142aa054f561d9187d191692ec7c2d1e2b4737f8dbd7296"
 dependencies = [
 "zune-core",
 ]
@@ -12,7 +12,7 @@ members = [
 ]
 [workspace.package]
-version = "0.4.1"
+version = "0.4.68"
 edition = "2021"
 rust-version = "1.95"
 license = "MIT OR Apache-2.0"
@@ -58,6 +58,14 @@ once_cell = "1.19"
 parking_lot = "0.12"
 rust-embed = { version = "8.5", features = ["include-exclude"] }
 # v0.4.67: pure-Rust NFSv3 client. Replaces the (deleted-in-v0.4.65)
 # kernel-mount NFS path with an in-process implementation that works
 # in any container — no kernel modules, no CAP_SYS_ADMIN, no
 # subprocess. Ships alongside the userspace SMB consumer; operators
 # pick whichever protocol their NAS prefers.
 nfs3_client = { version = "0.9", features = ["tokio"] }
 nfs3_types = "0.5"
 openpxe-core = { path = "crates/core" }
 openpxe-dhcp-proxy = { path = "crates/dhcp-proxy" }
 openpxe-tftp = { path = "crates/tftp" }
@@ -21,6 +21,9 @@ time.workspace = true
 uuid.workspace = true
 parking_lot.workspace = true
 tokio = { workspace = true, features = ["sync", "rt", "macros", "time"] }
 # bcrypt for the admin Forms auth (v0.4.5). Already in the workspace
 # for per-ISO boot passwords; just re-exported here.
 bcrypt.workspace = true
 [dev-dependencies]
 tempfile = "3.12"
@@ -0,0 +1,353 @@
 //! Operator authentication — Sonarr/Radarr-style single-admin Forms model.
 //!
 //! On a fresh install, no admin account exists; the WebUI's first-run
 //! flow prompts the operator to create one. After that the chosen
 //! credentials gate `/api/*` access. The admin can rotate username +
 //! password from Settings → Account.
 //!
 //! Multi-user RBAC isn't a goal for OpenPXE — the user explicitly asked
 //! for "you have access or you don't". When SSO is configured, additional
 //! users come in through the IdP; the locally-stored admin is the
 //! fallback owner who can change SSO config or the seal-breaker for an
 //! IdP outage. So one record is enough.
 //!
 //! Storage policy mirrors [`crate::host_bindings::HostBindings`] and
 //! [`crate::boot_log::BootLog`]: in-memory authoritative; disk is the
 //! crash-survival cache; a corrupt `auth.json` falls back to "no admin
 //! configured" rather than blocking startup, which puts the UI back
 //! into setup mode rather than locking the operator out.
 use parking_lot::RwLock;
 use serde::{Deserialize, Serialize};
 use std::path::PathBuf;
 use std::sync::Arc;
 use time::OffsetDateTime;
 use crate::{Error, Result};
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct AdminAccount {
    pub username: String,
    /// bcrypt hash (cost 10). The plaintext password never leaves the
    /// request that set it — same discipline as the per-ISO boot password.
    pub password_hash: String,
    #[serde(with = "time::serde::rfc3339")]
    pub created_at: OffsetDateTime,
    #[serde(with = "time::serde::rfc3339")]
    pub updated_at: OffsetDateTime,
 }
 /// Public projection — no hash, safe to ship to the WebUI.
 #[derive(Debug, Clone, Serialize)]
 pub struct AdminPublic {
    pub username: String,
    #[serde(with = "time::serde::rfc3339")]
    pub created_at: OffsetDateTime,
    #[serde(with = "time::serde::rfc3339")]
    pub updated_at: OffsetDateTime,
 }
 impl From<&AdminAccount> for AdminPublic {
    fn from(a: &AdminAccount) -> Self {
        Self {
            username: a.username.clone(),
            created_at: a.created_at,
            updated_at: a.updated_at,
        }
    }
 }
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 struct Inner {
    admin: Option<AdminAccount>,
 }
 /// In-memory + on-disk admin registry. Cheap to clone.
 #[derive(Debug, Clone)]
 pub struct AdminStore {
    path: Arc<PathBuf>,
    inner: Arc<RwLock<Inner>>,
 }
 impl AdminStore {
    /// Load from `<work_dir>/auth.json`, or start empty. A bad file
    /// logs a warning and falls back to "no admin configured" — better
    /// to surface the setup flow than lock the operator out of their
    /// own install.
    #[must_use]
    pub fn load_or_default(work_dir: &std::path::Path) -> Self {
        let path = work_dir.join("auth.json");
        let inner = match std::fs::read_to_string(&path) {
            Ok(text) => match serde_json::from_str::<Inner>(&text) {
                Ok(parsed) => parsed,
                Err(e) => {
                    tracing::warn!(
                        target: "openpxe::auth",
                        "auth.json present but unreadable ({e}); starting in setup mode"
                    );
                    Inner::default()
                }
            },
            Err(_) => Inner::default(),
        };
        Self {
            path: Arc::new(path),
            inner: Arc::new(RwLock::new(inner)),
        }
    }
    /// Has an admin been bootstrapped? Drives the first-run / login
    /// fork in the HTTP layer.
    #[must_use]
    pub fn is_configured(&self) -> bool {
        self.inner.read().admin.is_some()
    }
    /// Public-safe snapshot for the WebUI.
    #[must_use]
    pub fn snapshot(&self) -> Option<AdminPublic> {
        self.inner.read().admin.as_ref().map(AdminPublic::from)
    }
    /// First-run setup: create the admin account. Fails if one already
    /// exists — the HTTP layer surfaces that as 409.
    pub fn bootstrap(&self, username: &str, password: &str) -> Result<AdminPublic> {
        validate_username(username)?;
        validate_password(password)?;
        let hash = bcrypt_hash(password)?;
        let now = OffsetDateTime::now_utc();
        let admin = AdminAccount {
            username: username.trim().to_string(),
            password_hash: hash,
            created_at: now,
            updated_at: now,
        };
        {
            let mut g = self.inner.write();
            if g.admin.is_some() {
                return Err(Error::Invalid(
                    "admin account already configured".into(),
                ));
            }
            g.admin = Some(admin.clone());
        }
        self.persist();
        tracing::info!(
            target: "openpxe::auth",
            username = %admin.username,
            "admin account created (first-run setup)"
        );
        Ok((&admin).into())
    }
    /// Verify credentials. Returns the admin record (public projection)
    /// on success, `Ok(None)` on mismatch, `Err` on systemic bcrypt
    /// failure (treated as "auth not available right now" by callers).
    pub fn verify(&self, username: &str, password: &str) -> Result<Option<AdminPublic>> {
        let Some(admin) = self.inner.read().admin.clone() else {
            return Ok(None);
        };
        if username.trim() != admin.username {
            return Ok(None);
        }
        // bcrypt compares in constant time relative to the same hash.
        // Doing the username check first is fine — a username mismatch
        // returns immediately, but the only thing leaked is "this isn't
        // the admin's username" which the operator already knows.
        match bcrypt::verify(password, &admin.password_hash) {
            Ok(true) => Ok(Some((&admin).into())),
            Ok(false) => Ok(None),
            Err(e) => Err(Error::Other(e.into())),
        }
    }
    /// Rotate username and/or password. `current_password` must match
    /// the *existing* hash — same flow as Sonarr's "current password
    /// required to change". `new_username`/`new_password` are optional:
    /// pass only what you want to change.
    pub fn update_credentials(
        &self,
        current_password: &str,
        new_username: Option<&str>,
        new_password: Option<&str>,
    ) -> Result<AdminPublic> {
        // Re-check ownership before any state mutation.
        let existing = self
            .inner
            .read()
            .admin
            .clone()
            .ok_or_else(|| Error::Invalid("no admin configured".into()))?;
        match bcrypt::verify(current_password, &existing.password_hash) {
            Ok(true) => {}
            Ok(false) => return Err(Error::Invalid("current password is incorrect".into())),
            Err(e) => return Err(Error::Other(e.into())),
        }
        let mut updated = existing.clone();
        if let Some(u) = new_username {
            validate_username(u)?;
            updated.username = u.trim().to_string();
        }
        if let Some(p) = new_password {
            validate_password(p)?;
            updated.password_hash = bcrypt_hash(p)?;
        }
        updated.updated_at = OffsetDateTime::now_utc();
        {
            let mut g = self.inner.write();
            g.admin = Some(updated.clone());
        }
        self.persist();
        tracing::info!(
            target: "openpxe::auth",
            username = %updated.username,
            "admin credentials updated"
        );
        Ok((&updated).into())
    }
    fn persist(&self) {
        let snap = self.inner.read().clone();
        let body = match serde_json::to_vec_pretty(&snap) {
            Ok(b) => b,
            Err(e) => {
                tracing::warn!(target: "openpxe::auth", "serialize auth.json: {e}");
                return;
            }
        };
        if let Some(parent) = self.path.parent() {
            let _ = std::fs::create_dir_all(parent);
        }
        let tmp = self.path.with_extension("json.tmp");
        if let Err(e) = std::fs::write(&tmp, body) {
            tracing::warn!(target: "openpxe::auth", "write auth.json tmp: {e}");
            return;
        }
        if let Err(e) = std::fs::rename(&tmp, self.path.as_path()) {
            tracing::warn!(target: "openpxe::auth", "rename auth.json: {e}");
        }
    }
 }
 fn validate_username(u: &str) -> Result<()> {
    let u = u.trim();
    if u.is_empty() {
        return Err(Error::Invalid("username must not be empty".into()));
    }
    if u.len() > 64 {
        return Err(Error::Invalid("username must be 64 chars or fewer".into()));
    }
    if !u.chars().all(|c| c.is_ascii_graphic() && c != ':') {
        return Err(Error::Invalid(
            "username must be ASCII printable with no ':' character".into(),
        ));
    }
    Ok(())
 }
 fn validate_password(p: &str) -> Result<()> {
    if p.len() < 8 {
        return Err(Error::Invalid(
            "password must be at least 8 characters".into(),
        ));
    }
    if p.len() > 256 {
        return Err(Error::Invalid(
            "password must be 256 characters or fewer".into(),
        ));
    }
    Ok(())
 }
 fn bcrypt_hash(password: &str) -> Result<String> {
    bcrypt::hash(password, bcrypt::DEFAULT_COST).map_err(|e| Error::Other(e.into()))
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    use tempfile::tempdir;
    #[test]
    fn empty_after_load_when_no_file() {
        let dir = tempdir().unwrap();
        let s = AdminStore::load_or_default(dir.path());
        assert!(!s.is_configured());
        assert!(s.snapshot().is_none());
    }
    #[test]
    fn bootstrap_then_verify_round_trip() {
        let dir = tempdir().unwrap();
        let s = AdminStore::load_or_default(dir.path());
        let pub_ = s.bootstrap("admin", "hunter2hunter2").unwrap();
        assert_eq!(pub_.username, "admin");
        assert!(s.is_configured());
        // Correct creds match; wrong creds don't.
        assert!(s.verify("admin", "hunter2hunter2").unwrap().is_some());
        assert!(s.verify("admin", "wrong").unwrap().is_none());
        assert!(s.verify("nobody", "hunter2hunter2").unwrap().is_none());
    }
    #[test]
    fn bootstrap_rejects_second_call() {
        let dir = tempdir().unwrap();
        let s = AdminStore::load_or_default(dir.path());
        s.bootstrap("admin", "hunter2hunter2").unwrap();
        let r = s.bootstrap("other", "anotherpass1");
        assert!(matches!(r, Err(Error::Invalid(_))));
    }
    #[test]
    fn round_trip_survives_disk_reload() {
        let dir = tempdir().unwrap();
        let s = AdminStore::load_or_default(dir.path());
        s.bootstrap("admin", "hunter2hunter2").unwrap();
        drop(s);
        let s2 = AdminStore::load_or_default(dir.path());
        assert!(s2.is_configured());
        assert!(s2.verify("admin", "hunter2hunter2").unwrap().is_some());
    }
    #[test]
    fn update_credentials_requires_current_password() {
        let dir = tempdir().unwrap();
        let s = AdminStore::load_or_default(dir.path());
        s.bootstrap("admin", "hunter2hunter2").unwrap();
        // Wrong current password → no change.
        let r = s.update_credentials("nope", None, Some("newpassword1"));
        assert!(matches!(r, Err(Error::Invalid(_))));
        assert!(s.verify("admin", "hunter2hunter2").unwrap().is_some());
        // Correct current password rotates only what's supplied.
        s.update_credentials("hunter2hunter2", Some("alice"), Some("newpassword1"))
            .unwrap();
        assert!(s.verify("admin", "hunter2hunter2").unwrap().is_none());
        assert!(s.verify("alice", "newpassword1").unwrap().is_some());
    }
    #[test]
    fn update_credentials_partial_password_only_keeps_username() {
        let dir = tempdir().unwrap();
        let s = AdminStore::load_or_default(dir.path());
        s.bootstrap("admin", "hunter2hunter2").unwrap();
        s.update_credentials("hunter2hunter2", None, Some("newpassword1"))
            .unwrap();
        assert!(s.verify("admin", "newpassword1").unwrap().is_some());
    }
    #[test]
    fn validates_username_and_password() {
        let dir = tempdir().unwrap();
        let s = AdminStore::load_or_default(dir.path());
        assert!(s.bootstrap("", "hunter2hunter2").is_err());
        assert!(s.bootstrap("ad:min", "hunter2hunter2").is_err()); // ':' reserved
        assert!(s.bootstrap("admin", "short").is_err()); // <8 chars
        // 65-char username is too long.
        let long = "a".repeat(65);
        assert!(s.bootstrap(&long, "hunter2hunter2").is_err());
    }
 }
@@ -0,0 +1,375 @@
 //! Operator-controlled branding overrides.
 //!
 //! The browser tab's logo (`/assets/logo.svg`) defaults to the bundled
 //! rainbow-horizon mark. Operators who deploy OpenPXE behind their own
 //! branding can upload a replacement that lives at
 //! `<work_dir>/branding/logo.<ext>` and is served in preference to the
 //! bundled SVG when present. Borrowed-from-FleetDM: tenant chrome, same
 //! product.
 //!
 //! Storage policy mirrors `HostBindings` / `BootLog`: in-memory cache is
 //! authoritative for the current process, disk is the source of truth on
 //! restart, and a corrupt cache file falls back to the bundled default
 //! rather than blocking startup.
 use parking_lot::RwLock;
 use serde::{Deserialize, Serialize};
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
 /// Allowed MIME types for an uploaded logo. We deliberately keep this
 /// narrow — anything that can be `<img src="...">`'d into the brand
 /// block, no scripts. SVG carries the obvious XSS risk for raw inline
 /// HTML; we always serve the bytes as a separate asset with a strict
 /// content-type rather than inlining, so SVG is safe.
 pub const ALLOWED_LOGO_MIMES: &[&str] = &[
    "image/svg+xml",
    "image/png",
    "image/jpeg",
    "image/webp",
    "image/gif",
 ];
 /// Disk cap for an uploaded logo. PXE WebUIs are operator-facing — even
 /// a generous 2 MB cap is comfortable for any reasonable brand mark and
 /// puts a clear bound on memory + serialization cost.
 pub const MAX_LOGO_BYTES: usize = 2 * 1024 * 1024;
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 struct Inner {
    /// File name (relative to the branding dir) for the active logo, if
    /// any. Always under `<work_dir>/branding/`; never an absolute path
    /// from the operator.
    logo_filename: Option<String>,
    /// MIME of the active logo, mirroring `logo_filename`. Cached here
    /// so the HTTP layer can set Content-Type without re-sniffing.
    logo_mime: Option<String>,
    /// Monotonic counter bumped on every set/clear. Surfaces as a
    /// cache-bust token (`/assets/logo.svg?r=<rev>`) so the browser
    /// fetches the new bytes the moment the operator swaps the logo —
    /// the app version alone can't do this since it doesn't change on
    /// upload. Persisted so the token stays stable across restarts and
    /// keeps climbing across multiple swaps.
    #[serde(default)]
    rev: u64,
 }
 /// In-memory + on-disk override registry. Cheap to clone; locks are
 /// brief. The `branding.json` cache lives alongside the active asset
 /// inside `<work_dir>/branding/`.
 #[derive(Debug, Clone)]
 pub struct BrandingStore {
    /// Root directory: `<work_dir>/branding/`. Created on first write.
    dir: Arc<PathBuf>,
    inner: Arc<RwLock<Inner>>,
 }
 impl BrandingStore {
    /// Load (or initialise empty) from `<work_dir>/branding/`. Tolerates
    /// missing directories, partial state, and corrupt JSON — a bad
    /// cache should never block PXE for the network.
    #[must_use]
    pub fn load_or_default(work_dir: &Path) -> Self {
        let dir = work_dir.join("branding");
        let path = dir.join("branding.json");
        let mut inner = Inner::default();
        if let Ok(text) = std::fs::read_to_string(&path) {
            match serde_json::from_str::<Inner>(&text) {
                Ok(parsed) => {
                    // Sanity: if the JSON says we have a logo but the
                    // file is gone, clear the in-memory pointer so
                    // /assets/logo.svg falls back to the bundled SVG
                    // rather than 500ing on a missing file.
                    if let Some(name) = parsed.logo_filename.as_deref() {
                        if dir.join(name).is_file() {
                            inner = parsed;
                        } else {
                            tracing::warn!(
                                target: "openpxe::branding",
                                file = %name,
                                "branding.json points at missing file; clearing"
                            );
                        }
                    } else {
                        inner = parsed;
                    }
                }
                Err(e) => {
                    tracing::warn!(
                        target: "openpxe::branding",
                        "branding.json present but unreadable ({e}); starting empty"
                    );
                }
            }
        }
        Self {
            dir: Arc::new(dir),
            inner: Arc::new(RwLock::new(inner)),
        }
    }
    /// Absolute path to the active logo, if one is set and present on
    /// disk. `None` means the HTTP layer should serve the bundled SVG.
    #[must_use]
    pub fn logo_path(&self) -> Option<PathBuf> {
        let g = self.inner.read();
        g.logo_filename.as_deref().map(|n| self.dir.join(n))
    }
    /// MIME of the active logo, if any. The HTTP layer pairs this with
    /// the bytes returned by [`Self::logo_path`].
    #[must_use]
    pub fn logo_mime(&self) -> Option<String> {
        self.inner.read().logo_mime.clone()
    }
    /// Replace the active logo. Returns the chosen on-disk filename so
    /// the caller can echo it back in the API response. Old logos are
    /// removed best-effort.
    pub fn set_logo(&self, mime: &str, ext: &str, bytes: &[u8]) -> std::io::Result<String> {
        std::fs::create_dir_all(self.dir.as_path())?;
        // Single canonical filename per upload — overwriting the old one
        // (after clearing it) keeps the directory tidy and avoids any
        // path-traversal concern: the operator never supplies the name.
        let safe_ext = sanitize_ext(ext);
        let filename = format!("logo.{safe_ext}");
        let final_path = self.dir.join(&filename);
        // Atomic write: tmp -> rename. Guarantees the file is either
        // entirely the old logo or entirely the new one.
        let tmp = final_path.with_extension(format!("{safe_ext}.tmp"));
        std::fs::write(&tmp, bytes)?;
        std::fs::rename(&tmp, &final_path)?;
        // Clean up any sibling logo.<otherext> so there's exactly one
        // canonical file at any time.
        if let Ok(entries) = std::fs::read_dir(self.dir.as_path()) {
            for e in entries.flatten() {
                let p = e.path();
                let name = p
                    .file_name()
                    .and_then(|s| s.to_str())
                    .unwrap_or("");
                if name.starts_with("logo.") && name != filename {
                    let _ = std::fs::remove_file(&p);
                }
            }
        }
        {
            let mut g = self.inner.write();
            g.logo_filename = Some(filename.clone());
            g.logo_mime = Some(mime.to_string());
            g.rev = g.rev.wrapping_add(1);
        }
        self.persist();
        tracing::info!(
            target: "openpxe::branding",
            file = %filename, mime = %mime, size = bytes.len(),
            "custom logo installed"
        );
        Ok(filename)
    }
    /// Drop the override and return to the bundled SVG.
    pub fn clear_logo(&self) -> std::io::Result<()> {
        let removed = {
            let mut g = self.inner.write();
            let removed = g.logo_filename.take();
            g.logo_mime = None;
            g.rev = g.rev.wrapping_add(1);
            removed
        };
        if let Some(name) = removed {
            let p = self.dir.join(&name);
            let _ = std::fs::remove_file(&p);
            tracing::info!(target: "openpxe::branding", file = %name, "custom logo cleared");
        }
        self.persist();
        Ok(())
    }
    /// Convenience: true if a custom logo is configured. Surfaces on
    /// `/api/status` so the WebUI can show "Custom logo: yes" without
    /// fetching the asset itself.
    #[must_use]
    pub fn has_logo(&self) -> bool {
        self.inner.read().logo_filename.is_some()
    }
    /// Cache-bust token for the logo asset URL. Changes on every
    /// set/clear so `/assets/logo.svg?r=<rev>` resolves to a fresh URL
    /// whenever the operator swaps the brand mark. Stable otherwise.
    #[must_use]
    pub fn logo_rev(&self) -> u64 {
        self.inner.read().rev
    }
    fn persist(&self) {
        let snap = self.inner.read().clone();
        let body = match serde_json::to_vec_pretty(&snap) {
            Ok(b) => b,
            Err(e) => {
                tracing::warn!(target: "openpxe::branding", "serialize branding.json: {e}");
                return;
            }
        };
        if let Err(e) = std::fs::create_dir_all(self.dir.as_path()) {
            tracing::warn!(target: "openpxe::branding", "mkdir branding/: {e}");
            return;
        }
        let path = self.dir.join("branding.json");
        let tmp = path.with_extension("json.tmp");
        if let Err(e) = std::fs::write(&tmp, body) {
            tracing::warn!(target: "openpxe::branding", "write branding.json tmp: {e}");
            return;
        }
        if let Err(e) = std::fs::rename(&tmp, &path) {
            tracing::warn!(target: "openpxe::branding", "rename branding.json: {e}");
        }
    }
 }
 /// Trim arbitrary operator-supplied extension strings to a small, safe
 /// alphanumeric form. Anything weird collapses to `bin`. We never let
 /// the extension affect the path beyond the final segment of `logo.<x>`.
 fn sanitize_ext(ext: &str) -> String {
    let lc: String = ext
        .chars()
        .filter(char::is_ascii_alphanumeric)
        .map(|c| c.to_ascii_lowercase())
        .collect();
    if lc.is_empty() || lc.len() > 5 {
        "bin".into()
    } else {
        lc
    }
 }
 /// Pick a safe filesystem extension from a MIME type. Returns `None`
 /// if the MIME isn't on the [`ALLOWED_LOGO_MIMES`] allowlist.
 #[must_use]
 pub fn ext_for_mime(mime: &str) -> Option<&'static str> {
    match mime {
        "image/svg+xml" => Some("svg"),
        "image/png" => Some("png"),
        "image/jpeg" => Some("jpg"),
        "image/webp" => Some("webp"),
        "image/gif" => Some("gif"),
        _ => None,
    }
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    use tempfile::tempdir;
    #[test]
    fn empty_after_load_when_no_branding_dir() {
        let dir = tempdir().unwrap();
        let b = BrandingStore::load_or_default(dir.path());
        assert!(!b.has_logo());
        assert!(b.logo_path().is_none());
        assert!(b.logo_mime().is_none());
    }
    #[test]
    fn set_clear_round_trip_persists() {
        let dir = tempdir().unwrap();
        let b = BrandingStore::load_or_default(dir.path());
        let name = b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake").unwrap();
        assert_eq!(name, "logo.png");
        assert!(b.has_logo());
        assert_eq!(b.logo_mime().as_deref(), Some("image/png"));
        let p = b.logo_path().unwrap();
        assert!(p.is_file());
        // Re-open and confirm the override survives a restart.
        drop(b);
        let b2 = BrandingStore::load_or_default(dir.path());
        assert!(b2.has_logo());
        assert_eq!(b2.logo_mime().as_deref(), Some("image/png"));
        // Clear; the file goes away and has_logo flips off.
        b2.clear_logo().unwrap();
        assert!(!b2.has_logo());
        assert!(!p.exists());
    }
    #[test]
    fn replacing_logo_removes_old_extension_sibling() {
        // PNG then SVG; only the SVG should remain on disk.
        let dir = tempdir().unwrap();
        let b = BrandingStore::load_or_default(dir.path());
        b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake").unwrap();
        b.set_logo("image/svg+xml", "svg", br#"<svg xmlns="http://www.w3.org/2000/svg"/>"#).unwrap();
        let entries: Vec<_> = std::fs::read_dir(dir.path().join("branding"))
            .unwrap()
            .filter_map(|e| e.ok().map(|e| e.file_name().to_string_lossy().into_owned()))
            .collect();
        assert!(entries.iter().any(|n| n == "logo.svg"), "got {entries:?}");
        assert!(!entries.iter().any(|n| n == "logo.png"), "stale PNG left over: {entries:?}");
    }
    #[test]
    fn logo_rev_bumps_on_each_set_and_clear() {
        let dir = tempdir().unwrap();
        let b = BrandingStore::load_or_default(dir.path());
        assert_eq!(b.logo_rev(), 0);
        b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake").unwrap();
        assert_eq!(b.logo_rev(), 1);
        b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake2").unwrap();
        assert_eq!(b.logo_rev(), 2);
        b.clear_logo().unwrap();
        assert_eq!(b.logo_rev(), 3);
        // Survives a restart.
        drop(b);
        let b2 = BrandingStore::load_or_default(dir.path());
        assert_eq!(b2.logo_rev(), 3);
    }
    #[test]
    fn sanitize_ext_strips_separators_and_path_chars() {
        assert_eq!(sanitize_ext("svg"), "svg");
        // Path separators and non-alphanumerics filter out, leaving just
        // letters. The remaining "etcpasswd" exceeds the 5-char cap so
        // it collapses to `bin` rather than producing `etcpa`.
        assert_eq!(sanitize_ext("../etc/passwd"), "bin");
        // Short alphanumeric strip-through stays itself.
        assert_eq!(sanitize_ext("../svg"), "svg");
        assert_eq!(sanitize_ext(""), "bin");
        assert_eq!(sanitize_ext("PNG"), "png");
        // Anything past five chars is suspicious — collapse to `bin`.
        assert_eq!(sanitize_ext("svgvvvv"), "bin");
    }
    #[test]
    fn missing_file_referenced_by_json_resolves_to_empty() {
        // If the operator nukes the file out from under the JSON cache,
        // we should silently fall back to no-override rather than
        // hanging on to a bogus path.
        let dir = tempdir().unwrap();
        let brand_dir = dir.path().join("branding");
        std::fs::create_dir_all(&brand_dir).unwrap();
        // Hand-write a branding.json claiming logo.png exists.
        let inner = Inner {
            logo_filename: Some("logo.png".into()),
            logo_mime: Some("image/png".into()),
            rev: 0,
        };
        std::fs::write(
            brand_dir.join("branding.json"),
            serde_json::to_vec_pretty(&inner).unwrap(),
        )
        .unwrap();
        let b = BrandingStore::load_or_default(dir.path());
        assert!(!b.has_logo(), "should fall back when referenced file is missing");
    }
    #[test]
    fn ext_for_mime_only_accepts_known_types() {
        assert_eq!(ext_for_mime("image/png"), Some("png"));
        assert_eq!(ext_for_mime("image/svg+xml"), Some("svg"));
        assert_eq!(ext_for_mime("application/octet-stream"), None);
        assert_eq!(ext_for_mime("text/html"), None);
    }
 }
@@ -3,7 +3,9 @@
 #![forbid(unsafe_code)]
 pub mod arch;
 pub mod auth;
 pub mod boot_log;
 pub mod branding;
 pub mod client;
 pub mod config;
 pub mod error;
@@ -12,10 +14,14 @@ pub mod log_bus;
 pub mod metrics;
 pub mod queue;
 pub mod settings;
 pub mod sso;
 pub use arch::{ClientArch, FirmwareClass};
 pub use auth::{AdminAccount, AdminPublic, AdminStore};
 pub use boot_log::{BootEvent, BootLog};
 pub use branding::{ext_for_mime, BrandingStore, ALLOWED_LOGO_MIMES, MAX_LOGO_BYTES};
 pub use client::{ClientEvent, ClientRegistry, ClientSnapshot};
 pub use sso::{SsoConfig, SsoStore};
 pub use config::{Config, DhcpMode, NetworkConfig, Paths, ServerConfig};
 pub use error::{Error, Result};
 pub use host_bindings::{normalize_mac, HostBinding, HostBindings};
@@ -0,0 +1,318 @@
 //! SAML SSO configuration — FleetDM-shaped, storage-only for v0.4.5.
 //!
 //! The operator pastes their IdP's metadata XML (or its URL) and a
 //! human-readable label; v0.4.5 just persists it. The actual SAML
 //! response-validation / JIT-provisioning flow lands in a later release
 //! — for now we cover the "configurable" half so an operator can teach
 //! OpenPXE about their IdP today and flip the switch on next upgrade.
 //!
 //! Shape borrowed from <https://github.com/fleetdm/fleet>'s app-config
 //! SSO block, minus the user-RBAC fields (OpenPXE is single-tier: you
 //! have access or you don't). Entity ID is omitted from the operator
 //! UI per the v0.4.5 brief — it defaults to the advertised public base
 //! URL when SAML wiring lands, which is what most IdPs expect anyway.
 use parking_lot::RwLock;
 use serde::{Deserialize, Serialize};
 use std::path::PathBuf;
 use std::sync::Arc;
 use crate::{Error, Result};
 /// The configurable surface. `metadata` and `metadata_url` are mutually
 /// exclusive at apply time (one or the other identifies the IdP); the
 /// store keeps both fields so an operator can switch between them
 /// without losing the inactive one.
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 pub struct SsoConfig {
    /// Master switch — when false, all SSO machinery (planned for a
    /// later release) is skipped regardless of the rest of the fields.
    #[serde(default)]
    pub enabled: bool,
    /// Display name shown on the WebUI's login screen as the "Sign in
    /// with X" button label. Empty/whitespace falls back to "SSO".
    #[serde(default)]
    pub idp_name: String,
    /// Optional HTTPS URL pointing at the IdP's brand logo. Rendered
    /// next to `idp_name` on the WebUI's login screen (FleetDM-style).
    /// Length-capped at [`MAX_URL_LEN`]; empty is fine.
    #[serde(default)]
    pub idp_logo_url: String,
    /// Raw SAML metadata XML pasted by the operator. Mutually exclusive
    /// with `metadata_url`; if both are set, the URL wins at apply time
    /// (operators typically forget about a stale XML paste).
    #[serde(default)]
    pub metadata: String,
    /// HTTPS URL where the IdP serves its metadata. Loaded lazily by the
    /// future SAML flow; not validated here beyond a basic length cap.
    #[serde(default)]
    pub metadata_url: String,
 }
 impl SsoConfig {
    /// Returns `true` only when the config is *usable* — enabled, and
    /// at least one of metadata/metadata_url is present. The future
    /// login flow will key off this; for v0.4.5 the WebUI uses it to
    /// surface a yellow "configured but not live yet" hint.
    #[must_use]
    pub fn is_usable(&self) -> bool {
        self.enabled
            && (!self.metadata.trim().is_empty() || !self.metadata_url.trim().is_empty())
    }
 }
 /// In-memory + on-disk SSO settings registry.
 #[derive(Debug, Clone)]
 pub struct SsoStore {
    path: Arc<PathBuf>,
    inner: Arc<RwLock<SsoConfig>>,
 }
 impl SsoStore {
    /// Load from `<work_dir>/sso.json`, or start with the default empty
    /// (`enabled = false`) config. A corrupt file falls back to default
    /// rather than blocking startup.
    #[must_use]
    pub fn load_or_default(work_dir: &std::path::Path) -> Self {
        let path = work_dir.join("sso.json");
        let cfg = match std::fs::read_to_string(&path) {
            Ok(text) => match serde_json::from_str::<SsoConfig>(&text) {
                Ok(parsed) => parsed,
                Err(e) => {
                    tracing::warn!(
                        target: "openpxe::sso",
                        "sso.json present but unreadable ({e}); starting with default config"
                    );
                    SsoConfig::default()
                }
            },
            Err(_) => SsoConfig::default(),
        };
        Self {
            path: Arc::new(path),
            inner: Arc::new(RwLock::new(cfg)),
        }
    }
    #[must_use]
    pub fn snapshot(&self) -> SsoConfig {
        self.inner.read().clone()
    }
    /// Replace the whole config in one shot. Light validation: metadata
    /// XML and URL are length-capped so an operator can't OOM us by
    /// pasting a 10 GiB blob; the IdP UI tab clamps the input visually,
    /// but the server enforces a hard ceiling regardless.
    pub fn replace(&self, mut cfg: SsoConfig) -> Result<SsoConfig> {
        cfg.idp_name = cfg.idp_name.trim().to_string();
        cfg.idp_logo_url = cfg.idp_logo_url.trim().to_string();
        cfg.metadata = cfg.metadata.trim().to_string();
        cfg.metadata_url = cfg.metadata_url.trim().to_string();
        if cfg.metadata.len() > MAX_METADATA_BYTES {
            return Err(Error::Invalid(format!(
                "metadata XML exceeds {MAX_METADATA_BYTES}-byte cap"
            )));
        }
        if cfg.metadata_url.len() > MAX_URL_LEN {
            return Err(Error::Invalid(format!(
                "metadata_url exceeds {MAX_URL_LEN}-char cap"
            )));
        }
        if cfg.idp_logo_url.len() > MAX_URL_LEN {
            return Err(Error::Invalid(format!(
                "idp_logo_url exceeds {MAX_URL_LEN}-char cap"
            )));
        }
        if !cfg.metadata_url.is_empty()
            && !cfg.metadata_url.starts_with("http://")
            && !cfg.metadata_url.starts_with("https://")
        {
            return Err(Error::Invalid(
                "metadata_url must start with http:// or https://".into(),
            ));
        }
        if !cfg.idp_logo_url.is_empty()
            && !cfg.idp_logo_url.starts_with("http://")
            && !cfg.idp_logo_url.starts_with("https://")
        {
            return Err(Error::Invalid(
                "idp_logo_url must start with http:// or https://".into(),
            ));
        }
        // If they're trying to *enable* the integration but haven't
        // supplied either source, reject — saves a "configured but
        // unusable" surprise later.
        if cfg.enabled && cfg.metadata.is_empty() && cfg.metadata_url.is_empty() {
            return Err(Error::Invalid(
                "enable SSO requires either metadata XML or a metadata URL".into(),
            ));
        }
        {
            let mut g = self.inner.write();
            *g = cfg.clone();
        }
        self.persist();
        tracing::info!(
            target: "openpxe::sso",
            enabled = cfg.enabled,
            idp = %cfg.idp_name,
            has_xml = !cfg.metadata.is_empty(),
            has_url = !cfg.metadata_url.is_empty(),
            "sso configuration updated"
        );
        Ok(cfg)
    }
    fn persist(&self) {
        let snap = self.inner.read().clone();
        let body = match serde_json::to_vec_pretty(&snap) {
            Ok(b) => b,
            Err(e) => {
                tracing::warn!(target: "openpxe::sso", "serialize sso.json: {e}");
                return;
            }
        };
        if let Some(parent) = self.path.parent() {
            let _ = std::fs::create_dir_all(parent);
        }
        let tmp = self.path.with_extension("json.tmp");
        if let Err(e) = std::fs::write(&tmp, body) {
            tracing::warn!(target: "openpxe::sso", "write sso.json tmp: {e}");
            return;
        }
        if let Err(e) = std::fs::rename(&tmp, self.path.as_path()) {
            tracing::warn!(target: "openpxe::sso", "rename sso.json: {e}");
        }
    }
 }
 /// Saturation caps. The numbers are generous for any real IdP metadata
 /// document — Okta's largest is ~50 KB, Azure AD's ~30 KB.
 const MAX_METADATA_BYTES: usize = 1024 * 1024;
 const MAX_URL_LEN: usize = 2048;
 #[cfg(test)]
 mod tests {
    use super::*;
    use tempfile::tempdir;
    #[test]
    fn default_is_disabled_and_empty() {
        let dir = tempdir().unwrap();
        let s = SsoStore::load_or_default(dir.path());
        let cfg = s.snapshot();
        assert!(!cfg.enabled);
        assert!(cfg.metadata.is_empty());
        assert!(cfg.metadata_url.is_empty());
        assert!(!cfg.is_usable());
    }
    #[test]
    fn replace_metadata_url_round_trip_via_disk() {
        let dir = tempdir().unwrap();
        let s = SsoStore::load_or_default(dir.path());
        s.replace(SsoConfig {
            enabled: true,
            idp_name: "Okta".into(),
            metadata: String::new(),
            metadata_url: "https://idp.example.com/metadata".into(),
            idp_logo_url: String::new(),
        })
        .unwrap();
        drop(s);
        let s2 = SsoStore::load_or_default(dir.path());
        let cfg = s2.snapshot();
        assert!(cfg.enabled);
        assert!(cfg.is_usable());
        assert_eq!(cfg.idp_name, "Okta");
        assert_eq!(cfg.metadata_url, "https://idp.example.com/metadata");
    }
    #[test]
    fn replace_xml_paste_is_accepted() {
        let dir = tempdir().unwrap();
        let s = SsoStore::load_or_default(dir.path());
        let xml = r#"<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata">test</EntityDescriptor>"#;
        s.replace(SsoConfig {
            enabled: true,
            idp_name: "Test IdP".into(),
            metadata: xml.into(),
            metadata_url: String::new(),
            idp_logo_url: String::new(),
        })
        .unwrap();
        assert!(s.snapshot().is_usable());
    }
    #[test]
    fn enable_without_source_is_rejected() {
        let dir = tempdir().unwrap();
        let s = SsoStore::load_or_default(dir.path());
        let r = s.replace(SsoConfig {
            enabled: true,
            idp_name: "Okta".into(),
            metadata: String::new(),
            metadata_url: String::new(),
            idp_logo_url: String::new(),
        });
        assert!(matches!(r, Err(Error::Invalid(_))));
        // …and a disabled blank config is fine.
        s.replace(SsoConfig::default()).unwrap();
    }
    #[test]
    fn metadata_url_must_be_http_scheme() {
        let dir = tempdir().unwrap();
        let s = SsoStore::load_or_default(dir.path());
        let r = s.replace(SsoConfig {
            enabled: false,
            idp_name: String::new(),
            metadata: String::new(),
            metadata_url: "ftp://idp.example.com/metadata".into(),
            idp_logo_url: String::new(),
        });
        assert!(matches!(r, Err(Error::Invalid(_))));
    }
    #[test]
    fn idp_logo_url_must_be_http_scheme() {
        // v0.4.6: SSO settings learned an idp_logo_url so the login
        // screen can render the FleetDM-style "Sign in with <IdP-logo>"
        // affordance. Same scheme rule as metadata_url.
        let dir = tempdir().unwrap();
        let s = SsoStore::load_or_default(dir.path());
        let r = s.replace(SsoConfig {
            enabled: false,
            idp_name: "Okta".into(),
            metadata: String::new(),
            metadata_url: String::new(),
            idp_logo_url: "data:image/png;base64,...".into(),
        });
        assert!(matches!(r, Err(Error::Invalid(_))));
        // Real HTTPS URL is fine.
        s.replace(SsoConfig {
            enabled: false,
            idp_name: "Okta".into(),
            metadata: String::new(),
            metadata_url: String::new(),
            idp_logo_url: "https://idp.example.com/logo.png".into(),
        })
        .unwrap();
        assert_eq!(s.snapshot().idp_logo_url, "https://idp.example.com/logo.png");
    }
    #[test]
    fn metadata_size_cap_enforced() {
        let dir = tempdir().unwrap();
        let s = SsoStore::load_or_default(dir.path());
        let oversize = "a".repeat(MAX_METADATA_BYTES + 1);
        let r = s.replace(SsoConfig {
            enabled: false,
            idp_name: String::new(),
            metadata: oversize,
            metadata_url: String::new(),
            idp_logo_url: String::new(),
        });
        assert!(matches!(r, Err(Error::Invalid(_))));
    }
 }
@@ -32,6 +32,8 @@ futures.workspace = true
 mime.workspace = true
 mime_guess.workspace = true
 uuid.workspace = true
 # v0.4.5 Forms auth: lock-free session store and cookie helpers.
 parking_lot.workspace = true
 [dev-dependencies]
 tokio = { workspace = true, features = ["macros", "rt", "rt-multi-thread", "time"] }
@@ -39,3 +41,6 @@ tower = { workspace = true }
 tempfile = "3.12"
 serde_json = { workspace = true }
 time = { workspace = true }
 # v0.4.61: integration tests need to generate real PNG bytes for the
 # `/branding/pxe-logo` compositor; hand-rolled CRCs are too fragile.
 image = { version = "0.25", default-features = false, features = ["png"] }
@@ -13,6 +13,7 @@
 //! | `/iso/<id>/*`    | Files inside the ISO (for wimboot & kernel/initrd)    |
 //! | `/api/*`         | JSON/HTML API for the web UI                          |
 use crate::auth as auth_api;
 use crate::ipxe_script::{
    render_entry, render_family_menu, render_local_hdd, render_menu, render_nic_info,
    render_queue_entry, render_shell, render_tools_menu, render_util,
@@ -29,9 +30,12 @@ use axum::{
    routing::{delete, get, post, put},
    Json, Router,
 };
-use openpxe_core::{BootEvent, ClientEvent, Error, Settings};
+use openpxe_core::{
    ext_for_mime, BootEvent, ClientEvent, Error, Settings, SsoConfig, ALLOWED_LOGO_MIMES,
    MAX_LOGO_BYTES,
 };
 use openpxe_ipxe_assets::asset_bytes;
-use openpxe_iso_store::{IsoMeta, NfsAddRequest};
+use openpxe_iso_store::{IsoCategory, IsoMeta, IsoSource, NfsAddRequest, SmbAddRequest};
 use serde::Deserialize;
 use serde_json::json;
 use std::net::SocketAddr;
@@ -47,6 +51,13 @@ pub fn build_router(state: AppState) -> Router {
        .route("/assets/app.css", get(ui_css))
        .route("/assets/logo.svg", get(ui_logo))
        .route("/assets/loader.svg", get(ui_loader))
        // v0.4.6: PXE menu logo — the raster form of the operator's
        // uploaded mark, served so iPXE's `console --picture` can
        // overlay it on the boot menu. SVG uploads 404 here (iPXE
        // can't rasterize SVG); we deliberately don't bundle a
        // pre-rendered PNG fallback because iPXE's ASCII wordmark
        // banner already provides the always-visible branding.
        .route("/branding/pxe-logo", get(ui_pxe_logo))
        // iPXE script endpoints.
        .route("/boot.ipxe", get(boot_top_menu))
        .route("/boot/:filename", get(boot_sub))
@@ -73,6 +84,46 @@ pub fn build_router(state: AppState) -> Router {
            "/api/isos/:id/password",
            axum::routing::put(api_set_iso_password).delete(api_clear_iso_password),
        )
        // v0.4.4: per-ISO menu category (Os / Tools). Drives whether the
        // image appears under Linux/Windows Installers (default) or in
        // the Tools submenu next to memtest / shell / NIC info.
        .route(
            "/api/isos/:id/category",
            axum::routing::put(api_set_iso_category),
        )
        // v0.4.4: filesystem free-space telemetry for the ISO directory's
        // volume — surfaced as a small card on the Storage tab so the
        // operator knows when they're about to run out of room.
        .route("/api/storage/disk", get(api_storage_disk))
        // v0.4.4: operator-controlled WebUI branding overrides
        // (custom logo). Multipart upload to POST; DELETE clears.
        .route(
            "/api/branding/logo",
            post(api_branding_upload).delete(api_branding_clear),
        )
        // v0.4.4: self-rendered API reference, served as JSON so the UI
        // can format it consistently with the rest of the chrome. Lives
        // under the Settings tab — operators chasing an integration get
        // it in-product instead of having to fetch the OpenAPI YAML.
        .route("/api/docs", get(api_docs))
        // v0.4.5: Sonarr/Radarr-style admin Forms auth. First-run
        // /setup creates the single admin account; /login validates;
        // /logout revokes the session; /me powers the front-end's
        // "should I show the setup page, the login page, or the
        // dashboard?" decision. /me/credentials rotates the admin's
        // username/password.
        .route("/api/setup", post(auth_api::api_setup))
        .route("/api/login", post(auth_api::api_login))
        .route("/api/logout", post(auth_api::api_logout))
        .route("/api/me", get(auth_api::api_me))
        .route(
            "/api/me/credentials",
            put(auth_api::api_update_credentials),
        )
        // v0.4.5: SAML SSO configuration (FleetDM-shaped, storage-only).
        // The actual sign-in flow lands in a later release; this just
        // gives operators a place to paste their IdP metadata today.
        .route("/api/sso", get(api_sso_get).put(api_sso_put))
        .route("/api/clients", get(api_list_clients))
        .route("/api/status", get(api_status))
        .route("/api/settings", get(api_get_settings).put(api_put_settings))
@@ -81,10 +132,21 @@ pub fn build_router(state: AppState) -> Router {
        .route("/api/queue/poll/:entry_id", get(api_queue_poll))
        .route("/api/queue/assign", post(api_queue_assign))
        .route("/api/queue/:entry_id", delete(api_queue_release))
-        // Phase 4: NFS share manager.
+        // v0.4.65: SMB share manager (userspace via smbclient). The
-        .route("/api/nfs", get(api_nfs_list).post(api_nfs_add))
+        // kernel-mount NFS routes that v0.4.64 shipped are gone — they
-        .route("/api/nfs/:id", delete(api_nfs_remove))
+        // didn't work on hosts whose kernel lacked the nfs client
-        .route("/api/nfs/:id/scan", post(api_nfs_scan))
+        // modules (Unraid), and no container-side configuration could
        // load a host kernel module. `smbclient` speaks SMB over a
        // plain TCP socket in userspace, works in every container.
        .route("/api/smb-shares", get(api_smb_shares_list).post(api_smb_shares_add))
        .route("/api/smb-shares/:id", delete(api_smb_shares_remove))
        .route("/api/smb-shares/:id/scan", post(api_smb_shares_scan))
        // v0.4.67: NFSv3 share manager (pure-Rust in-process client).
        // Ships alongside SMB. Routes are parallel so the UI can
        // reuse the same form/error/hint rendering for both.
        .route("/api/nfs-shares", get(api_nfs_shares_list).post(api_nfs_shares_add))
        .route("/api/nfs-shares/:id", delete(api_nfs_shares_remove))
        .route("/api/nfs-shares/:id/scan", post(api_nfs_shares_scan))
        // Phase 4: Network info (read-only) + DNS edit.
        .route("/api/network", get(api_network).put(api_network_put))
        // Phase 4: live-log stream + recent buffer for the Terminal tab.
@@ -104,32 +166,92 @@ pub fn build_router(state: AppState) -> Router {
        // format. No auth — the metrics surface is intentionally
        // boring (counts, no payloads).
        .route("/metrics", get(api_metrics))
        // v0.4.5: Forms-auth middleware. Layered *after* `.route(...)`
        // calls so it applies uniformly; passes everything through when
        // no admin is configured (tests + fresh installs ride this path).
        // The allowlist inside `auth_api::require_auth` keeps PXE-essential
        // endpoints reachable for iPXE clients that can't authenticate.
        .layer(axum::middleware::from_fn_with_state(
            state.clone(),
            auth_api::require_auth,
        ))
        .layer(TraceLayer::new_for_http())
        // 16 GiB upload cap — ISOs are big; chunks stream so this isn't memory use.
        .layer(DefaultBodyLimit::max(16 * 1024 * 1024 * 1024))
        .with_state(state)
 }
 // ─── SSO config endpoints ─────────────────────────────────────────────────
 async fn api_sso_get(State(state): State<AppState>) -> Json<SsoConfig> {
    // We deliberately do not redact the metadata — the operator who's
    // signed in needs to be able to round-trip it. /api/sso requires
    // the auth middleware anyway, so unauthenticated callers can't see
    // it once admin is configured.
    Json(state.sso.snapshot())
 }
 async fn api_sso_put(State(state): State<AppState>, Json(body): Json<SsoConfig>) -> Response {
    match state.sso.replace(body) {
        Ok(cfg) => (StatusCode::OK, Json(cfg)).into_response(),
        Err(Error::Invalid(msg)) => {
            (StatusCode::BAD_REQUEST, msg).into_response()
        }
        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
    }
 }
 // ─── UI ────────────────────────────────────────────────────────────────────
 async fn index(State(state): State<AppState>) -> Response {
-    let html = openpxe_webui::index_html(&state.public_base_url);
+    // The asset version pin in index.html (`?v=…`) is what makes
    // browsers re-fetch JS/CSS after an upgrade. We use the OpenPXE
    // binary version — every release ships a new value, every release
    // forces a fresh URL on each asset.
    // logo_rev cache-busts the brand mark / favicon independently of
    // the release version, so an operator who swaps the custom logo
    // sees it update on the next reload without waiting for an upgrade.
    let html = openpxe_webui::index_html(
        &state.public_base_url,
        env!("CARGO_PKG_VERSION"),
        state.branding.logo_rev(),
    );
    (
-        [(
+        [
-            header::CONTENT_TYPE,
+            (
-            HeaderValue::from_static("text/html; charset=utf-8"),
+                header::CONTENT_TYPE,
-        )],
+                HeaderValue::from_static("text/html; charset=utf-8"),
            ),
            // index.html itself must never be cached — that's how the
            // browser learns about a new `?v=…` value for the assets.
            (
                header::CACHE_CONTROL,
                HeaderValue::from_static("no-cache, must-revalidate"),
            ),
        ],
        html,
    )
        .into_response()
 }
 /// Cache-Control header value used for the bundled JS/CSS/SVG assets.
 /// We pin a 1-day TTL so a long-lived deployment doesn't re-fetch the
 /// same bytes on every page-load, but require revalidation — combined
 /// with the `?v=<version>` query string in index.html, the practical
 /// upper bound on caching across an upgrade is "until the operator
 /// reloads".
 const ASSET_CACHE_CONTROL: HeaderValue =
    HeaderValue::from_static("no-cache, must-revalidate");
 async fn ui_js() -> Response {
    (
-        [(
+        [
-            header::CONTENT_TYPE,
+            (
-            HeaderValue::from_static("application/javascript"),
+                header::CONTENT_TYPE,
-        )],
+                HeaderValue::from_static("application/javascript"),
            ),
            (header::CACHE_CONTROL, ASSET_CACHE_CONTROL),
        ],
        openpxe_webui::app_js(),
    )
        .into_response()
@@ -137,29 +259,148 @@ async fn ui_js() -> Response {
 async fn ui_css() -> Response {
    (
-        [(header::CONTENT_TYPE, HeaderValue::from_static("text/css"))],
+        [
            (header::CONTENT_TYPE, HeaderValue::from_static("text/css")),
            (header::CACHE_CONTROL, ASSET_CACHE_CONTROL),
        ],
        openpxe_webui::app_css(),
    )
        .into_response()
 }
-async fn ui_logo() -> Response {
+async fn ui_logo(State(state): State<AppState>) -> Response {
    // Custom override first; fall back to the bundled rainbow-horizon
    // SVG. We resolve the override on each request rather than caching
    // because operators may upload/clear from the Settings tab while the
    // server is live, and we want them to see their change immediately
    // without bouncing the binary.
    if let Some(path) = state.branding.logo_path() {
        let mime = state
            .branding
            .logo_mime()
            .unwrap_or_else(|| "image/svg+xml".to_string());
        match tokio::fs::read(&path).await {
            Ok(bytes) => {
                let ct = match HeaderValue::from_str(&mime) {
                    Ok(v) => v,
                    Err(_) => HeaderValue::from_static("application/octet-stream"),
                };
                return (
                    [
                        (header::CONTENT_TYPE, ct),
                        (
                            header::CACHE_CONTROL,
                            HeaderValue::from_static("no-cache, max-age=0"),
                        ),
                    ],
                    bytes,
                )
                    .into_response();
            }
            Err(e) => {
                tracing::warn!(
                    target: "openpxe::http::branding",
                    error = %e, "failed to read custom logo; falling back to bundled"
                );
            }
        }
    }
    (
-        [(
+        [
-            header::CONTENT_TYPE,
+            (
-            HeaderValue::from_static("image/svg+xml"),
+                header::CONTENT_TYPE,
-        )],
+                HeaderValue::from_static("image/svg+xml"),
            ),
            (header::CACHE_CONTROL, ASSET_CACHE_CONTROL),
        ],
        openpxe_webui::logo_svg(),
    )
        .into_response()
 }
 /// v0.4.61: PXE menu logo composed for the iPXE `console --picture`
 /// call. The operator can upload any raster image (PNG / JPEG / WebP /
 /// GIF) of any aspect ratio; this handler decodes it, draws it
 /// centered-top onto a fixed 1024×768 canvas, and returns PNG bytes.
 /// That gives the same look as iVentoy regardless of what the operator
 /// uploaded — a portrait logo, a wide wordmark, a square monogram all
 /// land in the same place on the boot screen.
 ///
 /// SVG uploads still 404 here — iPXE can't rasterize SVG, and rather
 /// than haul in `resvg` we ask the operator to provide a raster when
 /// they want a custom PXE-side logo. (The WebUI keeps using the SVG.)
 async fn ui_pxe_logo(State(state): State<AppState>) -> Response {
    let Some(path) = state.branding.logo_path() else {
        return (StatusCode::NOT_FOUND, "no custom logo configured").into_response();
    };
    let Some(mime) = state.branding.logo_mime() else {
        return (StatusCode::NOT_FOUND, "no mime recorded").into_response();
    };
    if mime == "image/svg+xml" {
        return (
            StatusCode::NOT_FOUND,
            "operator-uploaded logo is SVG; PXE menu requires a raster (PNG / JPEG / WebP / GIF)",
        )
            .into_response();
    }
    let bytes = match tokio::fs::read(&path).await {
        Ok(b) => b,
        Err(e) => {
            return (
                StatusCode::NOT_FOUND,
                format!("custom logo unreadable: {e}"),
            )
                .into_response();
        }
    };
    // Compose to a fixed 1024×768 PNG so the PXE menu paints the logo
    // centered-top regardless of the operator's source dimensions. The
    // `image` crate is pure-Rust + sync; offload to a blocking task
    // because Lanczos resampling on a 4K source can take tens of
    // milliseconds and we don't want to block the executor.
    let composed =
        match tokio::task::spawn_blocking(move || openpxe_iso_store::pxe_logo::compose_pxe_logo(&bytes))
            .await
        {
            Ok(Ok(png)) => png,
            Ok(Err(e)) => {
                tracing::warn!(
                    target: "openpxe::http::branding",
                    error = %e, "failed to compose PXE logo PNG"
                );
                return (
                    StatusCode::INTERNAL_SERVER_ERROR,
                    format!("failed to compose PXE logo: {e}"),
                )
                    .into_response();
            }
            Err(e) => {
                return (
                    StatusCode::INTERNAL_SERVER_ERROR,
                    format!("pxe-logo task failed: {e}"),
                )
                    .into_response();
            }
        };
    (
        [
            (header::CONTENT_TYPE, HeaderValue::from_static("image/png")),
            (header::CACHE_CONTROL, ASSET_CACHE_CONTROL),
        ],
        composed,
    )
        .into_response()
 }
 async fn ui_loader() -> Response {
    (
-        [(
+        [
-            header::CONTENT_TYPE,
+            (
-            HeaderValue::from_static("image/svg+xml"),
+                header::CONTENT_TYPE,
-        )],
+                HeaderValue::from_static("image/svg+xml"),
            ),
            (header::CACHE_CONTROL, ASSET_CACHE_CONTROL),
        ],
        openpxe_webui::loader_svg(),
    )
        .into_response()
@@ -298,7 +539,7 @@ async fn boot_sub(
        "_local" => render_local_hdd(base),
        "_linux_menu" => render_family_menu(&isos, base, false),
        "_windows_menu" => render_family_menu(&isos, base, true),
-        "_tools_menu" => render_tools_menu(base),
+        "_tools_menu" => render_tools_menu(&isos, base),
        "_util" => render_util(base),
        "_shell" => render_shell(base),
        "_nic" => render_nic_info(base),
@@ -415,12 +656,111 @@ async fn iso_raw(
    headers: HeaderMap,
 ) -> Response {
    let id = filename.strip_suffix(".iso").unwrap_or(&filename);
-    let Some(path) = state.iso_store.iso_path_for(id) else {
+    // v0.4.65: SMB-sourced ISOs have no on-disk path — they're
    // streamed live from the remote share via `smbclient`. We look
    // up the meta first to decide whether to take the path-based
    // local route or the subprocess-based SMB route.
    let Some(meta) = state.iso_store.get(id) else {
        return (StatusCode::NOT_FOUND, "no such iso").into_response();
    };
-    match stream_file_range(&path, headers.get(header::RANGE)).await {
+    match &meta.source {
-        Ok(r) => r,
+        IsoSource::Local => {
-        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
+            let Some(path) = state.iso_store.iso_path_for(id) else {
                return (StatusCode::NOT_FOUND, "no such iso").into_response();
            };
            match stream_file_range(&path, headers.get(header::RANGE)).await {
                Ok(r) => r,
                Err(e) => {
                    (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response()
                }
            }
        }
        IsoSource::Smb {
            share_id,
            relative_path,
        } => {
            // Range requests aren't supported for SMB sources in
            // v0.4.65 — smbclient's CLI can't seek mid-stream. iPXE
            // chain loading and ISO sanboot do whole-file sequential
            // reads, so this works in practice. A 416 here lets the
            // client fall back to a full GET if it tried a range.
            if headers.get(header::RANGE).is_some() {
                return Response::builder()
                    .status(StatusCode::RANGE_NOT_SATISFIABLE)
                    .header(header::CONTENT_RANGE, format!("bytes */{}", meta.size_bytes))
                    .body(Body::empty())
                    .unwrap();
            }
            match state.smb_shares.stream_iso(share_id, relative_path).await {
                Ok(stream) => {
                    let reader = stream.stdout;
                    let body_stream = tokio_util::io::ReaderStream::new(reader);
                    Response::builder()
                        .status(StatusCode::OK)
                        .header(header::CONTENT_TYPE, "application/octet-stream")
                        .header(header::CONTENT_LENGTH, meta.size_bytes)
                        // Tell intermediaries we don't support
                        // ranges on this resource; saves them from
                        // even trying.
                        .header(header::ACCEPT_RANGES, "none")
                        .body(Body::from_stream(body_stream))
                        .unwrap()
                }
                Err(e) => (StatusCode::BAD_GATEWAY, format!("smb stream: {e}")).into_response(),
            }
        }
        IsoSource::Nfs {
            share_id,
            relative_path,
        } => {
            // v0.4.67: NFS sources support Range requests because
            // NFSv3 READ3 takes an explicit offset. We resolve the
            // requested byte range here and pass start/len down to
            // the streamer which seeks into the file via READ3.
            let total = meta.size_bytes;
            let range = match parse_range(headers.get(header::RANGE), total) {
                Some(triple) => triple,
                None if headers.get(header::RANGE).is_some() => {
                    return Response::builder()
                        .status(StatusCode::RANGE_NOT_SATISFIABLE)
                        .header(header::CONTENT_RANGE, format!("bytes */{total}"))
                        .body(Body::empty())
                        .unwrap();
                }
                // No Range header — serve the whole file.
                None => (0, total.saturating_sub(1), false),
            };
            let (start, end, partial) = range;
            let len = if total == 0 { 0 } else { end - start + 1 };
            let max_len = if total == 0 { None } else { Some(len) };
            match state
                .nfs_shares
                .stream_iso(share_id, relative_path, start, max_len)
                .await
            {
                Ok(stream) => {
                    let body = Body::from_stream(stream);
                    let status = if partial {
                        StatusCode::PARTIAL_CONTENT
                    } else {
                        StatusCode::OK
                    };
                    let mut builder = Response::builder()
                        .status(status)
                        .header(header::CONTENT_TYPE, "application/octet-stream")
                        .header(header::ACCEPT_RANGES, "bytes")
                        .header(header::CONTENT_LENGTH, len);
                    if partial {
                        builder = builder.header(
                            header::CONTENT_RANGE,
                            format!("bytes {start}-{end}/{total}"),
                        );
                    }
                    builder.body(body).unwrap()
                }
                Err(e) => (StatusCode::BAD_GATEWAY, format!("nfs stream: {e}")).into_response(),
            }
        }
    }
 }
@@ -428,6 +768,10 @@ async fn iso_file(
    State(state): State<AppState>,
    AxumPath((id, path)): AxumPath<(String, String)>,
 ) -> Response {
    // In-ISO file extraction is only supported for local ISOs — it
    // needs random-access reads into the ISO9660 directory tree, which
    // smbclient's whole-file streaming can't do efficiently. SMB-
    // sourced ISOs use the raw streaming endpoint above instead.
    let Some(iso_path) = state.iso_store.iso_path_for(&id) else {
        return (StatusCode::NOT_FOUND, "no such iso").into_response();
    };
@@ -620,6 +964,308 @@ async fn api_clear_iso_password(
    }
 }
 // ─── ISO category (OS / Tools) ────────────────────────────────────────────
 #[derive(Debug, Deserialize)]
 struct SetCategoryBody {
    /// `"os"` or `"tools"` — matches `IsoCategory`'s snake_case serde
    /// repr. Anything else returns 400 with the allowed set spelled out.
    category: String,
 }
 async fn api_set_iso_category(
    State(state): State<AppState>,
    AxumPath(id): AxumPath<String>,
    Json(body): Json<SetCategoryBody>,
 ) -> Response {
    let cat = match body.category.as_str() {
        "os" => IsoCategory::Os,
        "tools" => IsoCategory::Tools,
        other => {
            return (
                StatusCode::BAD_REQUEST,
                format!("unknown category '{other}'; expected one of: os, tools"),
            )
                .into_response();
        }
    };
    match state.iso_store.set_category(&id, cat).await {
        Ok(meta) => {
            tracing::info!(
                target: "openpxe::http::iso",
                iso = %id, category = ?cat,
                "iso category updated"
            );
            (StatusCode::OK, Json(meta)).into_response()
        }
        Err(Error::Invalid(msg)) => (StatusCode::NOT_FOUND, msg).into_response(),
        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
    }
 }
 // ─── Disk space (Storage tab) ─────────────────────────────────────────────
 async fn api_storage_disk(State(state): State<AppState>) -> Json<serde_json::Value> {
    // statvfs on the directory that holds the ISO store. We deliberately
    // don't walk the directory ourselves — the kernel already tracks
    // free/total at the volume level and that's the only number the
    // operator actually cares about for "do I have room for one more
    // 5 GB ISO?". `statvfs` itself lives in iso-store to keep the
    // http-api crate free of `unsafe`.
    let dir = state.iso_store.iso_dir();
    let (total, available) = state.iso_store.disk_usage().unwrap_or((0, 0));
    let used = total.saturating_sub(available);
    Json(json!({
        "path": dir.to_string_lossy(),
        "total_bytes": total,
        "available_bytes": available,
        "used_bytes": used,
    }))
 }
 // ─── Branding (custom logo) ───────────────────────────────────────────────
 async fn api_branding_upload(
    State(state): State<AppState>,
    mut multipart: Multipart,
 ) -> Response {
    while let Ok(Some(field)) = multipart.next_field().await {
        let name = field.name().unwrap_or("").to_string();
        if name != "file" && name != "logo" {
            continue;
        }
        let mime = field.content_type().unwrap_or("").to_string();
        if !ALLOWED_LOGO_MIMES.iter().any(|m| *m == mime) {
            return (
                StatusCode::BAD_REQUEST,
                format!(
                    "unsupported MIME '{mime}'. Allowed: {}",
                    ALLOWED_LOGO_MIMES.join(", ")
                ),
            )
                .into_response();
        }
        // Pre-read into memory so we can enforce the size cap before
        // hitting disk. Logos are tiny by definition.
        let bytes = match field.bytes().await {
            Ok(b) => b,
            Err(e) => {
                return (StatusCode::BAD_REQUEST, format!("read body: {e}")).into_response()
            }
        };
        if bytes.len() > MAX_LOGO_BYTES {
            return (
                StatusCode::PAYLOAD_TOO_LARGE,
                format!(
                    "logo too large ({} bytes, max {})",
                    bytes.len(),
                    MAX_LOGO_BYTES
                ),
            )
                .into_response();
        }
        let Some(ext) = ext_for_mime(&mime) else {
            return (StatusCode::BAD_REQUEST, "unsupported MIME").into_response();
        };
        match state.branding.set_logo(&mime, ext, &bytes) {
            Ok(filename) => {
                return (
                    StatusCode::OK,
                    Json(json!({
                        "filename": filename,
                        "mime": mime,
                        "size_bytes": bytes.len(),
                    })),
                )
                    .into_response()
            }
            Err(e) => {
                return (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response()
            }
        }
    }
    (StatusCode::BAD_REQUEST, "no 'file' part").into_response()
 }
 async fn api_branding_clear(State(state): State<AppState>) -> Response {
    match state.branding.clear_logo() {
        Ok(()) => StatusCode::NO_CONTENT.into_response(),
        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
    }
 }
 // ─── API reference (Settings → bottom) ────────────────────────────────────
 async fn api_docs() -> Json<serde_json::Value> {
    // Hand-curated rather than introspected from axum because:
    //   1. axum's runtime route table doesn't carry parameter docs;
    //   2. the WebUI surfaces this as a readable list, not as an OpenAPI
    //      spec — readers are operators chasing an integration, not
    //      machines.
    // Keep this in lockstep with `build_router` when adding endpoints.
    Json(json!({
        "version": env!("CARGO_PKG_VERSION"),
        "groups": [
            {
                "name": "Status & health",
                "endpoints": [
                    {"method": "GET", "path": "/healthz",
                     "summary": "Liveness — always 200 OK while the HTTP task is alive."},
                    {"method": "GET", "path": "/readyz",
                     "summary": "Readiness — 200 only when iPXE binaries are bundled and the ISO directory is readable."},
                    {"method": "GET", "path": "/api/status",
                     "summary": "Dashboard JSON — versions, counts, settings snapshot, uptime."},
                    {"method": "GET", "path": "/metrics",
                     "summary": "Prometheus text exposition (counters + gauges)."},
                ],
            },
            {
                "name": "ISO images",
                "endpoints": [
                    {"method": "GET", "path": "/api/isos",
                     "summary": "List ISOs (local + NFS) with size, family, boot entries, category."},
                    {"method": "POST", "path": "/api/isos",
                     "summary": "Legacy single-shot multipart upload. Prefer /api/uploads for big files."},
                    {"method": "DELETE", "path": "/api/isos/:id",
                     "summary": "Delete a local ISO and its sidecar metadata."},
                    {"method": "PUT", "path": "/api/isos/:id/password",
                     "summary": "Set or update an ISO's boot password (bcrypt-hashed; plaintext never stored)."},
                    {"method": "DELETE", "path": "/api/isos/:id/password",
                     "summary": "Clear an ISO's boot password."},
                    {"method": "PUT", "path": "/api/isos/:id/category",
                     "summary": "Set the menu category. Body: { \"category\": \"os\" | \"tools\" }."},
                ],
            },
            {
                "name": "Chunked uploads",
                "endpoints": [
                    {"method": "POST", "path": "/api/uploads",
                     "summary": "Begin a chunked upload session. Body: { \"filename\", \"size_bytes\" }."},
                    {"method": "PUT", "path": "/api/uploads/:upload_id",
                     "summary": "Append a chunk. Headers: x-openpxe-upload-offset, x-openpxe-upload-complete."},
                    {"method": "DELETE", "path": "/api/uploads/:upload_id",
                     "summary": "Abort a chunked upload session and remove the .partial file."},
                ],
            },
            {
                "name": "SMB shares",
                "endpoints": [
                    {"method": "GET", "path": "/api/smb-shares",
                     "summary": "List configured SMB shares with connection state and iso counts."},
                    {"method": "POST", "path": "/api/smb-shares",
                     "summary": "Register an SMB share. Body: { server, share, guest, username?, password?, port? }."},
                    {"method": "DELETE", "path": "/api/smb-shares/:id",
                     "summary": "Forget a share and drop its entries from the ISO store."},
                    {"method": "POST", "path": "/api/smb-shares/:id/scan",
                     "summary": "Re-list a share for new ISOs."},
                ],
            },
            {
                "name": "NFS shares",
                "endpoints": [
                    {"method": "GET", "path": "/api/nfs-shares",
                     "summary": "List configured NFSv3 shares with connection state and iso counts."},
                    {"method": "POST", "path": "/api/nfs-shares",
                     "summary": "Register an NFSv3 share. Body: { server, export, port? }. Auth is AUTH_SYS only; access control is by client IP on the server side."},
                    {"method": "DELETE", "path": "/api/nfs-shares/:id",
                     "summary": "Forget a share and drop its entries from the ISO store."},
                    {"method": "POST", "path": "/api/nfs-shares/:id/scan",
                     "summary": "Re-list a share for new ISOs."},
                ],
            },
            {
                "name": "Network",
                "endpoints": [
                    {"method": "GET", "path": "/api/network",
                     "summary": "Detected NIC, server IP, subnet, gateway, advertised base URL."},
                    {"method": "PUT", "path": "/api/network",
                     "summary": "Update the informational DNS server hint (does not run DNS)."},
                ],
            },
            {
                "name": "Settings",
                "endpoints": [
                    {"method": "GET", "path": "/api/settings",
                     "summary": "Current runtime settings (Windows toggle, timeout, dns hint, …)."},
                    {"method": "PUT", "path": "/api/settings",
                     "summary": "Replace runtime settings. Guards against enabling Windows when wimboot isn't bundled."},
                    {"method": "POST", "path": "/api/branding/logo",
                     "summary": "Upload a custom WebUI logo (multipart 'file', PNG/SVG/JPEG/WebP/GIF up to 2 MB)."},
                    {"method": "DELETE", "path": "/api/branding/logo",
                     "summary": "Remove the custom logo and revert to the bundled mark."},
                    {"method": "GET", "path": "/branding/pxe-logo",
                     "summary": "Raster form of the operator's logo for the iPXE menu's `console --picture`. SVG uploads 404 here."},
                    {"method": "GET", "path": "/api/sso",
                     "summary": "Current SAML SSO configuration."},
                    {"method": "PUT", "path": "/api/sso",
                     "summary": "Replace SAML SSO configuration. Body: { enabled, idp_name, metadata, metadata_url }."},
                    {"method": "GET", "path": "/api/docs",
                     "summary": "This API reference."},
                ],
            },
            {
                "name": "Auth (Forms)",
                "endpoints": [
                    {"method": "POST", "path": "/api/setup",
                     "summary": "First-run admin bootstrap. Body: { username, password }. Refuses after the admin exists."},
                    {"method": "POST", "path": "/api/login",
                     "summary": "Sign in. Body: { username, password }. Sets the openpxe_session cookie."},
                    {"method": "POST", "path": "/api/logout",
                     "summary": "Revoke the current session and clear the cookie."},
                    {"method": "GET", "path": "/api/me",
                     "summary": "Auth status — { setup_required, authenticated, user }. Always 200."},
                    {"method": "PUT", "path": "/api/me/credentials",
                     "summary": "Rotate the admin's credentials. Body: { current_password, new_username?, new_password? }. Revokes all other sessions on success."},
                ],
            },
            {
                "name": "Storage telemetry",
                "endpoints": [
                    {"method": "GET", "path": "/api/storage/disk",
                     "summary": "Free / used / total bytes for the volume hosting the ISO directory."},
                ],
            },
            {
                "name": "Queued Deployment",
                "endpoints": [
                    {"method": "GET", "path": "/api/queue",
                     "summary": "List queue entries (waiting + assigned)."},
                    {"method": "POST", "path": "/api/queue/assign",
                     "summary": "Assign a target image to queued clients. Body: { target, entry_ids }."},
                    {"method": "DELETE", "path": "/api/queue/:entry_id",
                     "summary": "Release a queue entry without assigning."},
                ],
            },
            {
                "name": "Hosts & boot log",
                "endpoints": [
                    {"method": "GET", "path": "/api/hosts",
                     "summary": "List per-MAC boot bindings."},
                    {"method": "POST", "path": "/api/hosts",
                     "summary": "Pin a MAC to a boot target. Body: { mac, target, label }."},
                    {"method": "DELETE", "path": "/api/hosts/:mac",
                     "summary": "Remove a binding."},
                    {"method": "GET", "path": "/api/boot-log",
                     "summary": "Ring of recent boot events (timestamp, mac, ip, target)."},
                ],
            },
            {
                "name": "Operator console",
                "endpoints": [
                    {"method": "GET", "path": "/api/clients",
                     "summary": "Live PXE-client registry — MAC, last IP, arch, events."},
                    {"method": "GET", "path": "/api/log/recent",
                     "summary": "Ring of recent server log lines for the Terminal tab."},
                    {"method": "GET", "path": "/api/log/stream",
                     "summary": "Server-Sent Events stream of log lines."},
                    {"method": "POST", "path": "/api/terminal",
                     "summary": "Run a whitelisted operator command. Body: { command }."},
                ],
            },
        ],
    }))
 }
 async fn api_upload_iso(State(state): State<AppState>, mut multipart: Multipart) -> Response {
    // Walk multipart parts until we find the file. Each branch logs so an
    // operator chasing a "stuck" upload in the Terminal tab can see
@@ -941,8 +1587,13 @@ async fn api_list_clients(State(state): State<AppState>) -> Json<serde_json::Val
 async fn api_status(State(state): State<AppState>) -> Json<serde_json::Value> {
    let smb = state.smb.as_ref().map(|s| s.snapshot());
-    let nfs = state.nfs.list();
+    // v0.4.65+v0.4.67: external storage shares — SMB (userspace
-    let nfs_active = nfs.iter().filter(|m| m.mounted).count();
+    // smbclient) and NFS (in-process nfs3_client). Dashboard tile
    // sums both so operators see a single "reachable shares" number.
    let smb_shares = state.smb_shares.list();
    let smb_reachable = smb_shares.iter().filter(|m| m.reachable).count();
    let nfs_shares = state.nfs_shares.list();
    let nfs_reachable = nfs_shares.iter().filter(|m| m.reachable).count();
    let isos = state.iso_store.list();
    let clients = state.clients.list();
    let queue_entries = state.queue.list();
@@ -961,7 +1612,9 @@ async fn api_status(State(state): State<AppState>) -> Json<serde_json::Value> {
    state
        .metrics
        .set_queue_counts(queue_entries.len() as u64, imaging as u64);
-    state.metrics.set_nfs_active(nfs_active as u64);
+    state
        .metrics
        .set_nfs_active((smb_reachable + nfs_reachable) as u64);
    state.metrics.record_http(openpxe_core::HttpRoute::Api);
    let now = time::OffsetDateTime::now_utc();
    let uptime_secs = (now - state.started_at).whole_seconds().max(0);
@@ -976,9 +1629,15 @@ async fn api_status(State(state): State<AppState>) -> Json<serde_json::Value> {
        "ipxe_assets": openpxe_ipxe_assets::list_assets(),
        "settings": state.settings.snapshot(),
        "smb": smb,
-        "nfs_count": nfs.len(),
+        "smb_share_count": smb_shares.len(),
-        "nfs_active": nfs_active,
+        "smb_share_reachable": smb_reachable,
        // v0.4.67: NFSv3 share counts. The dashboard tile sums these
        // with the SMB counts above ("N shares reachable") so the
        // top-line metric works regardless of protocol mix.
        "nfs_share_count": nfs_shares.len(),
        "nfs_share_reachable": nfs_reachable,
        "host_bindings": state.hosts.len(),
        "custom_logo": state.branding.has_logo(),
        "uptime_secs": uptime_secs,
        "started_at": state.started_at,
        "nic_name": state.nic_name,
@@ -1191,32 +1850,83 @@ async fn api_queue_release(
    }
 }
-// ─── NFS share API ─────────────────────────────────────────────────────────
+// ─── SMB share API (v0.4.65) ───────────────────────────────────────────────
 //
 // Replaces the NFS share manager from v0.4.64. The wire shape is similar
 // — a {shares: [...]} list, a POST that returns either the share or a
 // structured {error, stderr, hint} body — so the UI can render both the
 // same way.
-async fn api_nfs_list(State(state): State<AppState>) -> Json<serde_json::Value> {
+async fn api_smb_shares_list(State(state): State<AppState>) -> Json<serde_json::Value> {
-    Json(json!({ "mounts": state.nfs.list() }))
+    Json(json!({ "shares": state.smb_shares.list() }))
 }
-async fn api_nfs_add(State(state): State<AppState>, Json(req): Json<NfsAddRequest>) -> Response {
+async fn api_smb_shares_add(
-    match state.nfs.add(req).await {
+    State(state): State<AppState>,
-        Ok(m) => (StatusCode::CREATED, Json(m)).into_response(),
+    Json(req): Json<SmbAddRequest>,
-        // Anything from the manager surfaces as a user-fixable validation
+) -> Response {
-        // error — bad host, kernel without NFS support, missing
+    match state.smb_shares.add(req).await {
-        // `mount.nfs`, dead server. We pass the message through verbatim
+        Ok(s) => (StatusCode::CREATED, Json(s)).into_response(),
-        // so the UI can show it to the operator.
+        Err(err) => (StatusCode::BAD_REQUEST, Json(err)).into_response(),
        Err(e) => (StatusCode::BAD_REQUEST, format!("{e}")).into_response(),
    }
 }
-async fn api_nfs_remove(State(state): State<AppState>, AxumPath(id): AxumPath<String>) -> Response {
+async fn api_smb_shares_remove(
-    match state.nfs.remove(&id).await {
+    State(state): State<AppState>,
    AxumPath(id): AxumPath<String>,
 ) -> Response {
    match state.smb_shares.remove(&id).await {
        Ok(()) => StatusCode::NO_CONTENT.into_response(),
        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
    }
 }
-async fn api_nfs_scan(State(state): State<AppState>, AxumPath(id): AxumPath<String>) -> Response {
+async fn api_smb_shares_scan(
-    match state.nfs.rescan(&id).await {
+    State(state): State<AppState>,
    AxumPath(id): AxumPath<String>,
 ) -> Response {
    match state.smb_shares.rescan(&id).await {
        Ok(n) => Json(json!({ "ok": true, "iso_count": n })).into_response(),
        Err(e) => (StatusCode::BAD_REQUEST, format!("{e}")).into_response(),
    }
 }
 // ─── NFS share API (v0.4.67) ───────────────────────────────────────────────
 //
 // Parallel to the SMB shares API. The pure-Rust NFSv3 client
 // (`nfs3_client`) gives us in-process listing and streaming, no
 // subprocess. Unlike SMB, NFS-sourced ISOs support HTTP Range
 // requests — NFSv3 READ3 takes an explicit offset.
 async fn api_nfs_shares_list(State(state): State<AppState>) -> Json<serde_json::Value> {
    Json(json!({ "shares": state.nfs_shares.list() }))
 }
 async fn api_nfs_shares_add(
    State(state): State<AppState>,
    Json(req): Json<NfsAddRequest>,
 ) -> Response {
    match state.nfs_shares.add(req).await {
        Ok(s) => (StatusCode::CREATED, Json(s)).into_response(),
        Err(err) => (StatusCode::BAD_REQUEST, Json(err)).into_response(),
    }
 }
 async fn api_nfs_shares_remove(
    State(state): State<AppState>,
    AxumPath(id): AxumPath<String>,
 ) -> Response {
    match state.nfs_shares.remove(&id).await {
        Ok(()) => StatusCode::NO_CONTENT.into_response(),
        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
    }
 }
 async fn api_nfs_shares_scan(
    State(state): State<AppState>,
    AxumPath(id): AxumPath<String>,
 ) -> Response {
    match state.nfs_shares.rescan(&id).await {
        Ok(n) => Json(json!({ "ok": true, "iso_count": n })).into_response(),
        Err(e) => (StatusCode::BAD_REQUEST, format!("{e}")).into_response(),
    }
@@ -1336,9 +2046,21 @@ async fn api_metrics(State(state): State<AppState>) -> Response {
    state
        .metrics
        .set_queue_counts(queue_entries.len() as u64, imaging as u64);
-    state
+    // v0.4.67: gauge tracks reachable external-storage shares
-        .metrics
+    // across both protocols (SMB userspace + NFSv3 in-process).
-        .set_nfs_active(state.nfs.list().iter().filter(|m| m.mounted).count() as u64);
+    let smb_ok = state
        .smb_shares
        .list()
        .iter()
        .filter(|m| m.reachable)
        .count();
    let nfs_ok = state
        .nfs_shares
        .list()
        .iter()
        .filter(|m| m.reachable)
        .count();
    state.metrics.set_nfs_active((smb_ok + nfs_ok) as u64);
    let now = time::OffsetDateTime::now_utc();
    let uptime = (now - state.started_at).whole_seconds().max(0) as u64;
@@ -0,0 +1,485 @@
 //! Forms auth layer — sessions, login, setup, middleware.
 //!
 //! Three states:
 //!
 //! * **Unconfigured** (`AdminStore::is_configured() == false`). The
 //!   middleware passes every request through — there's no one to gate
 //!   against. The UI's `/api/me` returns `setup_required: true` and the
 //!   front-end pushes the operator into the first-run flow.
 //! * **Logged in**. The session cookie maps to an in-memory session
 //!   record with an idle expiry; `/api/me` returns the username.
 //! * **Logged out**. The middleware bounces `/api/*` (with the PXE
 //!   allowlist below) to `401 Unauthorized`; the front-end intercepts
 //!   that and shows `/login`.
 //!
 //! Allowlist for unauthenticated access *after* the admin is set up:
 //!
 //! * everything outside `/api/*` (the WebUI bundle, asset chrome, PXE
 //!   script endpoints, the bundled iPXE/wimboot binaries, ISO bytes,
 //!   liveness/readiness probes, the Prometheus scrape) — these are
 //!   read-only or PXE-essential and breaking them locks out booting
 //!   machines that have no way to authenticate;
 //! * `/api/setup`, `/api/login`, `/api/me` (the auth surface itself);
 //! * `/api/queue/join`, `/api/queue/poll/:entry_id` (iPXE long-poll for
 //!   Queued Deployment — the iPXE client can't send a session cookie).
 //!
 //! Everything else inside `/api/*` requires a valid session.
 use crate::state::AppState;
 use axum::{
    body::Body,
    extract::{Request, State},
    http::{header, HeaderValue, StatusCode},
    middleware::Next,
    response::{IntoResponse, Response},
    Json,
 };
 use openpxe_core::AdminPublic;
 use parking_lot::RwLock;
 use serde::{Deserialize, Serialize};
 use serde_json::json;
 use std::collections::HashMap;
 use std::sync::Arc;
 use std::time::{Duration, Instant};
 use uuid::Uuid;
 /// Idle session lifetime. Sliding — every authenticated request resets
 /// the expiry. 24h is the Sonarr default and matches what most operators
 /// expect for an on-prem admin console.
 const SESSION_TTL: Duration = Duration::from_hours(24);
 /// Name of the cookie we set/read. Distinct from a generic `session=`
 /// to avoid collisions with anything else sharing the host.
 pub const SESSION_COOKIE: &str = "openpxe_session";
 #[derive(Debug, Clone)]
 struct Session {
    username: String,
    expires_at: Instant,
 }
 /// In-memory session table. Cheap to clone (Arc-shared) and contention
 /// is rare — operators sign in once per browser session.
 #[derive(Debug, Clone, Default)]
 pub struct SessionStore {
    inner: Arc<RwLock<HashMap<String, Session>>>,
 }
 impl SessionStore {
    /// Mint a fresh session for `username` and return the opaque cookie
    /// value. UUID v4 gives us 122 random bits — comfortably more than
    /// the 64-128 bits typical for session IDs.
    #[must_use]
    pub fn create(&self, username: &str) -> String {
        let id = Uuid::new_v4().simple().to_string();
        let session = Session {
            username: username.to_string(),
            expires_at: Instant::now() + SESSION_TTL,
        };
        self.inner.write().insert(id.clone(), session);
        id
    }
    /// Resolve a cookie value to the owning username, refreshing the
    /// idle timer. Returns `None` for missing / expired sessions and
    /// proactively evicts the expired entry so the map doesn't grow
    /// unbounded across long-lived deployments.
    pub fn touch(&self, id: &str) -> Option<String> {
        let mut g = self.inner.write();
        let s = g.get_mut(id)?;
        if s.expires_at <= Instant::now() {
            g.remove(id);
            return None;
        }
        s.expires_at = Instant::now() + SESSION_TTL;
        Some(s.username.clone())
    }
    /// Invalidate one session (the user's `/api/logout`).
    pub fn revoke(&self, id: &str) {
        self.inner.write().remove(id);
    }
    /// Invalidate every session — used after a credentials rotation so
    /// stale cookies for the old password can't keep operating.
    pub fn revoke_all(&self) {
        self.inner.write().clear();
    }
    /// Periodic / opportunistic GC. Not currently scheduled (we evict
    /// on touch), but exposed for a future janitor task.
    pub fn gc(&self) {
        let now = Instant::now();
        self.inner.write().retain(|_, s| s.expires_at > now);
    }
    #[must_use]
    pub fn len(&self) -> usize {
        self.inner.read().len()
    }
    #[must_use]
    pub fn is_empty(&self) -> bool {
        self.len() == 0
    }
 }
 // ── Cookie helpers ────────────────────────────────────────────────────────
 fn cookie_attrs(value: &str, max_age: Option<i64>) -> String {
    // Same flags FleetDM and Sonarr ship by default:
    //   - HttpOnly: blocks JS access (XSS containment)
    //   - SameSite=Lax: allows top-level GET navigations from the IdP
    //     to land authenticated when SSO arrives, but blocks
    //     cross-site POST CSRF;
    //   - Path=/: the cookie applies to the whole app;
    //   - no Secure flag yet — many operators host on plain http://
    //     LAN IPs (Unraid templates default to that); we'll add Secure
    //     opportunistically when we add a TLS terminator option.
    // SESSION_TTL fits in 32 bits comfortably (24h ≈ 86400 seconds); we
    // never overflow i64, but clippy's `cast_possible_wrap` lint wants
    // us to be explicit. `cast_signed` is the documented form.
    let lifetime = max_age.unwrap_or_else(|| SESSION_TTL.as_secs().cast_signed());
    format!(
        "{SESSION_COOKIE}={value}; Path=/; HttpOnly; SameSite=Lax; Max-Age={lifetime}"
    )
 }
 fn parse_cookie(headers: &axum::http::HeaderMap) -> Option<String> {
    // `Cookie: a=b; c=d` parsing — small enough not to drag in a crate.
    let raw = headers.get(header::COOKIE)?.to_str().ok()?;
    for part in raw.split(';') {
        let part = part.trim();
        if let Some(v) = part.strip_prefix(&format!("{SESSION_COOKIE}=")) {
            return Some(v.to_string());
        }
    }
    None
 }
 // ── Middleware ────────────────────────────────────────────────────────────
 /// Return `true` if `path` is on the allowlist and should bypass the
 /// session check. The middleware applies this rule only when the admin
 /// account is configured; before then everything is open.
 fn is_public_path(path: &str) -> bool {
    // Non-API paths: WebUI bundle, PXE chain, ISO bytes, health probes,
    // metrics. All read-only / PXE-essential.
    if !path.starts_with("/api/") {
        return true;
    }
    // Auth surface and iPXE long-poll endpoints (no cookie available).
    matches!(
        path,
        "/api/setup" | "/api/login" | "/api/logout" | "/api/me"
    ) || path.starts_with("/api/queue/join")
        || path.starts_with("/api/queue/poll/")
 }
 /// Axum middleware: gate `/api/*` behind a valid session, with the
 /// allowlist above. `State<AppState>` reaches in for the admin store +
 /// session store.
 pub async fn require_auth(
    State(state): State<AppState>,
    req: Request<Body>,
    next: Next,
 ) -> Response {
    // Bypass entirely while unconfigured. The /api/setup endpoint is
    // the only one that can flip this back to "configured", and it
    // refuses to run a second time. Tests + fresh installs ride this
    // path.
    if !state.admin.is_configured() {
        return next.run(req).await;
    }
    let path = req.uri().path();
    if is_public_path(path) {
        return next.run(req).await;
    }
    // Authenticated path. The cookie must be present, map to a live
    // session, and the TTL refresh happens as a side-effect.
    let token = parse_cookie(req.headers());
    if let Some(t) = token {
        if state.sessions.touch(&t).is_some() {
            return next.run(req).await;
        }
    }
    (
        StatusCode::UNAUTHORIZED,
        Json(json!({ "error": "authentication required" })),
    )
        .into_response()
 }
 // ── Handlers ──────────────────────────────────────────────────────────────
 #[derive(Debug, Deserialize)]
 pub struct SetupBody {
    pub username: String,
    pub password: String,
 }
 /// First-run setup. Refuses to run once an admin already exists — that
 /// guards against a leaked WebUI being re-bootstrapped by an attacker
 /// who's seen the deployment URL. After bootstrap, the new session
 /// cookie is set so the operator goes straight to the dashboard.
 pub async fn api_setup(
    State(state): State<AppState>,
    Json(body): Json<SetupBody>,
 ) -> Response {
    if state.admin.is_configured() {
        return (
            StatusCode::CONFLICT,
            Json(json!({ "error": "admin account already configured" })),
        )
            .into_response();
    }
    match state.admin.bootstrap(&body.username, &body.password) {
        Ok(pub_) => {
            let session = state.sessions.create(&pub_.username);
            login_response(StatusCode::CREATED, &pub_, &session)
        }
        Err(openpxe_core::Error::Invalid(msg)) => {
            (StatusCode::BAD_REQUEST, Json(json!({ "error": msg }))).into_response()
        }
        Err(e) => (
            StatusCode::INTERNAL_SERVER_ERROR,
            Json(json!({ "error": format!("{e}") })),
        )
            .into_response(),
    }
 }
 #[derive(Debug, Deserialize)]
 pub struct LoginBody {
    pub username: String,
    pub password: String,
 }
 pub async fn api_login(State(state): State<AppState>, Json(body): Json<LoginBody>) -> Response {
    // Brief, deliberately vague — "invalid credentials" rather than
    // "no such user" / "wrong password". Same anti-enumeration posture
    // as Sonarr/Radarr.
    let pub_ = match state.admin.verify(&body.username, &body.password) {
        Ok(Some(u)) => u,
        Ok(None) => {
            return (
                StatusCode::UNAUTHORIZED,
                Json(json!({ "error": "invalid username or password" })),
            )
                .into_response();
        }
        Err(e) => {
            return (
                StatusCode::INTERNAL_SERVER_ERROR,
                Json(json!({ "error": format!("{e}") })),
            )
                .into_response();
        }
    };
    let session = state.sessions.create(&pub_.username);
    login_response(StatusCode::OK, &pub_, &session)
 }
 pub async fn api_logout(
    State(state): State<AppState>,
    headers: axum::http::HeaderMap,
 ) -> Response {
    if let Some(t) = parse_cookie(&headers) {
        state.sessions.revoke(&t);
    }
    // Stomp the cookie unconditionally — even if the request didn't
    // carry one, the browser shouldn't keep a stale value.
    let mut resp = StatusCode::NO_CONTENT.into_response();
    resp.headers_mut().insert(
        header::SET_COOKIE,
        HeaderValue::from_str(&cookie_attrs("", Some(0))).unwrap(),
    );
    resp
 }
 /// Status surface for the front-end shell. Returns four cases:
 ///
 /// * `setup_required: true` — no admin yet; show first-run page.
 /// * `authenticated: false` — admin exists, no session; show login.
 /// * `authenticated: true` + `user` — let the dashboard load.
 pub async fn api_me(State(state): State<AppState>, headers: axum::http::HeaderMap) -> Response {
    if !state.admin.is_configured() {
        return (
            StatusCode::OK,
            Json(json!({
                "setup_required": true,
                "authenticated": false,
            })),
        )
            .into_response();
    }
    let token = parse_cookie(&headers);
    let username = token.as_deref().and_then(|t| state.sessions.touch(t));
    match username {
        Some(u) => (
            StatusCode::OK,
            Json(json!({
                "setup_required": false,
                "authenticated": true,
                "user": state.admin.snapshot(),
                "session_user": u,
            })),
        )
            .into_response(),
        None => (
            StatusCode::OK,
            Json(json!({
                "setup_required": false,
                "authenticated": false,
            })),
        )
            .into_response(),
    }
 }
 #[derive(Debug, Deserialize)]
 pub struct UpdateCredentialsBody {
    pub current_password: String,
    #[serde(default)]
    pub new_username: Option<String>,
    #[serde(default)]
    pub new_password: Option<String>,
 }
 /// Rotate the admin's username and/or password. Auth middleware has
 /// already proved the caller owns a session; we additionally require
 /// the *current* password to prove "person at the keyboard right now".
 /// On success we issue a fresh session cookie keyed to the (possibly
 /// new) username and revoke every prior session so a stolen cookie
 /// from before the rotation stops working.
 pub async fn api_update_credentials(
    State(state): State<AppState>,
    Json(body): Json<UpdateCredentialsBody>,
 ) -> Response {
    if !state.admin.is_configured() {
        return (
            StatusCode::CONFLICT,
            Json(json!({ "error": "no admin configured" })),
        )
            .into_response();
    }
    let result = state.admin.update_credentials(
        &body.current_password,
        body.new_username.as_deref(),
        body.new_password.as_deref(),
    );
    match result {
        Ok(pub_) => {
            state.sessions.revoke_all();
            let session = state.sessions.create(&pub_.username);
            login_response(StatusCode::OK, &pub_, &session)
        }
        Err(openpxe_core::Error::Invalid(msg)) => {
            (StatusCode::BAD_REQUEST, Json(json!({ "error": msg }))).into_response()
        }
        Err(e) => (
            StatusCode::INTERNAL_SERVER_ERROR,
            Json(json!({ "error": format!("{e}") })),
        )
            .into_response(),
    }
 }
 #[derive(Debug, Serialize)]
 struct LoginPayload<'a> {
    user: &'a AdminPublic,
    authenticated: bool,
 }
 fn login_response(status: StatusCode, user: &AdminPublic, session: &str) -> Response {
    let body = Json(LoginPayload {
        user,
        authenticated: true,
    });
    let mut resp = (status, body).into_response();
    resp.headers_mut().insert(
        header::SET_COOKIE,
        HeaderValue::from_str(&cookie_attrs(session, None)).unwrap(),
    );
    resp
 }
 // ── Tests ─────────────────────────────────────────────────────────────────
 #[cfg(test)]
 mod tests {
    use super::*;
    #[test]
    fn session_create_touch_revoke() {
        let s = SessionStore::default();
        assert!(s.is_empty());
        let t = s.create("admin");
        assert_eq!(s.len(), 1);
        assert_eq!(s.touch(&t).as_deref(), Some("admin"));
        s.revoke(&t);
        assert!(s.is_empty());
        // Stale token doesn't error, just returns None.
        assert!(s.touch(&t).is_none());
    }
    #[test]
    fn session_revoke_all_clears() {
        let s = SessionStore::default();
        let _ = s.create("a");
        let _ = s.create("b");
        assert_eq!(s.len(), 2);
        s.revoke_all();
        assert!(s.is_empty());
    }
    #[test]
    fn public_path_allowlist() {
        // PXE + chrome paths bypass auth.
        for p in [
            "/", "/assets/app.js", "/boot.ipxe", "/boot/fake.ipxe",
            "/iso/fake.iso", "/ipxe/snponly.efi", "/healthz", "/readyz",
            "/metrics",
            // v0.4.6: iPXE fetches this for `console --picture` before
            // it can possibly have a session cookie.
            "/branding/pxe-logo",
        ] {
            assert!(is_public_path(p), "expected {p} to be public");
        }
        // Auth surface itself is public.
        for p in ["/api/setup", "/api/login", "/api/logout", "/api/me"] {
            assert!(is_public_path(p), "expected {p} to be public");
        }
        // iPXE long-poll endpoints are public (no cookie available).
        assert!(is_public_path("/api/queue/join"));
        assert!(is_public_path("/api/queue/poll/abc"));
        // Everything else under /api/* must auth.
        for p in [
            "/api/isos",
            "/api/isos/x/category",
            "/api/storage/disk",
            "/api/branding/logo",
            "/api/sso",
            "/api/hosts",
        ] {
            assert!(!is_public_path(p), "expected {p} to require auth");
        }
    }
    #[test]
    fn cookie_parse_picks_session_value() {
        let mut h = axum::http::HeaderMap::new();
        h.insert(
            header::COOKIE,
            HeaderValue::from_str(&format!("foo=bar; {SESSION_COOKIE}=abc123; baz=qux"))
                .unwrap(),
        );
        assert_eq!(parse_cookie(&h).as_deref(), Some("abc123"));
        // Different name → None.
        let mut h2 = axum::http::HeaderMap::new();
        h2.insert(header::COOKIE, HeaderValue::from_str("foo=bar").unwrap());
        assert!(parse_cookie(&h2).is_none());
        // No cookie header at all → None.
        assert!(parse_cookie(&axum::http::HeaderMap::new()).is_none());
    }
 }
@@ -29,6 +29,15 @@ use std::fmt::Write as _;
 /// Top-level OpenPXE boot menu. Serialized identically for BIOS and UEFI
 /// clients because iPXE normalises the menu primitives across firmwares.
 ///
 /// v0.4.6: rendered with an iVentoy-style polished frame — centered
 /// OpenPXE wordmark banner at the top (ASCII so every iPXE build can
 /// paint it), a footer carrying version + arch + firmware kind, and an
 /// optional `console --picture` directive that paints the operator's
 /// uploaded raster logo on top when the iPXE binary on the wire was
 /// built with PNG support. The ASCII banner is always rendered so
 /// even when the picture call no-ops the screen still reads as
 /// "OpenPXE — here is the menu" rather than a featureless box.
 #[must_use]
 pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> String {
    let mut s = String::new();
@@ -47,8 +56,41 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
    let _ = writeln!(s, "set base-url {base}");
    let _ = writeln!(s, "set esc:hex 1b");
    let _ = writeln!(s, "set cls ${{esc:string}}[2J");
    // v0.4.6: best-effort graphics console with the operator-uploaded
    // raster logo. Falls back to plain text console on iPXE builds
    // without PNG support — the `||` chain keeps a parse-clean
    // single-statement form so even the strictest iPXE parsers accept
    // it. The `console` reset at the end re-syncs the menu output.
    let _ = writeln!(
        s,
        "console --picture {base}/branding/pxe-logo || console"
    );
    // Map iPXE's ${{buildarch}} + ${{platform}} into the human form the
    // user asked for (e.g. "x86 BIOS", "x86_64 UEFI", "arm64 UEFI").
    // iPXE evaluates `iseq` lazily, so we only set whichever line
    // matches. Anything not on the allowlist falls through to a generic
    // `<buildarch> <platform>` display.
    let _ = writeln!(s, "set arch-label ${{buildarch}} ${{platform}}");
    let _ = writeln!(
        s,
        "iseq ${{buildarch}} i386   && iseq ${{platform}} pcbios && set arch-label x86 BIOS         || iseq ${{buildarch}} x86_64 && iseq ${{platform}} efi    && set arch-label x86_64 UEFI      || iseq ${{buildarch}} arm64  && iseq ${{platform}} efi    && set arch-label arm64 UEFI       || true"
    );
    let _ = writeln!(s, ":menu");
    let _ = writeln!(s, "menu OpenPXE - network boot menu");
    // ASCII OpenPXE wordmark. Works on every iPXE build, including
    // the boot.ipxe.org pre-builds we ship (which omit `IMAGE_PNG`,
    // so `console --picture` paints nothing). When the queued iPXE
    // source-build lands and the operator's uploaded raster actually
    // paints via `console --picture`, this banner can be retired in
    // favour of the real image. The compositor at
    // /branding/pxe-logo is already wired and waiting.
    let _ = writeln!(s, "item --gap");
    let _ = writeln!(s, "item --gap --       ___                   ___  __  __ ___");
    let _ = writeln!(s, "item --gap --      / _ \\ _ __  ___ _ _   | _ \\ \\/  / | __|");
    let _ = writeln!(s, "item --gap --     | (_) | '_ \\/ -_) ' \\  |  _/  \\  /  | _|");
    let _ = writeln!(s, "item --gap --      \\___/| .__/\\___|_||_| |_|    /_/\\_\\ |___|");
    let _ = writeln!(s, "item --gap --           |_|");
    let _ = writeln!(s, "item --gap");
    let _ = writeln!(
        s,
        "item --gap -- ------------------------- Default -------------------------"
@@ -82,6 +124,18 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
    let _ = writeln!(s, "item queue            Queued Deployment  (join queue)");
    let _ = writeln!(s, "item --gap");
    let _ = writeln!(s, "item --key x exit     Exit iPXE");
    // v0.4.6 footer line. Sits just above the `choose` line so it's
    // always visible regardless of how the menu paginates. iPXE
    // interpolates `${arch-label}` (set near the top of this script)
    // and `${version}` is the binary-baked iPXE version — *not* the
    // OpenPXE version — so we hard-code the OpenPXE version string
    // here.
    let openpxe_version = env!("CARGO_PKG_VERSION");
    let _ = writeln!(s, "item --gap");
    let _ = writeln!(
        s,
        "item --gap --                 OpenPXE v{openpxe_version}  -  ${{arch-label}}"
    );
    if matches!(settings.timeout_action, TimeoutAction::Stay) {
        let _ = writeln!(s, "choose --default {default_item} target || goto menu");
@@ -149,6 +203,13 @@ pub fn render_family_menu(isos: &[IsoMeta], base_url: &str, is_windows: bool) ->
        if !filter(iso.introspection.family) {
            continue;
        }
        // v0.4.4: ISOs the operator flipped to the Tools category move
        // out of the OS installer submenus entirely — they only appear
        // under Tools. Without this filter the operator would see the
        // same ISO in both menus.
        if matches!(iso.category, openpxe_iso_store::IsoCategory::Tools) {
            continue;
        }
        for entry in &iso.boot_entries {
            let size_label = fmt_size_mib(iso.size_bytes);
            let key = hotkey_for_index(count);
@@ -210,15 +271,52 @@ fn hotkey_for_index(i: usize) -> String {
    }
 }
-/// Tools submenu — Utilities, Shell, NIC Info, Reboot, Exit to firmware.
+/// Tools submenu — Utilities, Shell, NIC Info, Reboot, Exit to firmware,
 /// plus any ISOs the operator flipped to [`IsoCategory::Tools`] in the
 /// Storage tab. The category-Tools ISOs render first so frequently used
 /// recovery / hardware tools are reachable with a single number key
 /// before the built-in shortcuts.
 #[must_use]
-pub fn render_tools_menu(base_url: &str) -> String {
+pub fn render_tools_menu(isos: &[IsoMeta], base_url: &str) -> String {
    let base = base_url.trim_end_matches('/');
    let mut s = String::new();
    let _ = writeln!(s, "#!ipxe");
    let _ = writeln!(s, "set base-url {base}");
    let _ = writeln!(s, ":menu");
    let _ = writeln!(s, "menu OpenPXE - Tools");
    // Operator-categorized tool ISOs (hotkeys 1..9), each chained the
    // same way as a per-family menu pick — through the boot-entry id
    // route, carrying `?mac=${mac}` for Host log attribution.
    let mut count = 0;
    for iso in isos {
        if !matches!(iso.category, openpxe_iso_store::IsoCategory::Tools) {
            continue;
        }
        for entry in &iso.boot_entries {
            let size_label = fmt_size_mib(iso.size_bytes);
            let key = hotkey_for_index(count);
            let lock = if iso.is_password_protected() {
                "*"
            } else {
                " "
            };
            let _ = writeln!(
                s,
                "item {}{} {}[{:>6}] {}",
                key,
                entry.id,
                lock,
                size_label,
                escape_label(&entry.title),
            );
            count += 1;
        }
    }
    if count > 0 {
        let _ = writeln!(s, "item --gap");
    }
    let _ = writeln!(s, "item --key u util     Utilities  (memtest, ...)");
    let _ = writeln!(s, "item --key s shell    OpenPXE Shell");
    let _ = writeln!(s, "item --key n nic      Network Card Info");
@@ -252,7 +350,12 @@ pub fn render_tools_menu(base_url: &str) -> String {
        s,
        "iseq ${{target}} back     && chain {base}/boot.ipxe        || goto menu"
    );
-    let _ = writeln!(s, "goto menu");
+    // Fall-through for category-Tools ISO ids — same as the family
    // submenu, carrying `?mac=${mac}` for the boot log.
    let _ = writeln!(
        s,
        "chain {base}/boot/${{target}}.ipxe?mac=${{mac}} || goto menu"
    );
    s
 }
@@ -526,12 +629,59 @@ mod password_tests {
        assert!(s.contains("chain http://10.0.0.5/boot/alpha-linux.ipxe"));
    }
    #[test]
    fn top_menu_has_polished_branding_and_arch_footer() {
        // v0.4.6 polish + v0.4.62 stability fixes: the menu emits a
        // `console --picture` line that PNG-capable iPXE builds will
        // honour (queued for a follow-up release once we can rebuild
        // iPXE from source on native x86_64 hardware), an ASCII
        // OpenPXE wordmark that works on every iPXE build (including
        // the boot.ipxe.org pre-builds we currently ship), and a
        // single-line footer carrying the OpenPXE version + arch.
        let settings = Settings::default();
        let s = render_menu(&[], &settings, "http://10.0.0.5");
        assert!(
            s.contains("console --picture http://10.0.0.5/branding/pxe-logo"),
            "missing console --picture line:\n{s}"
        );
        // Picture-or-text-console must be a single statement so older
        // iPXE parsers don't choke on the chain.
        assert!(s.contains("|| console"), "missing graceful fallback:\n{s}");
        // ASCII wordmark — paints on every iPXE build regardless of
        // PNG support.
        assert!(
            s.contains("___                   ___  __  __ ___"),
            "ASCII banner missing first row:\n{s}"
        );
        // Footer with version + arch interpolation. The version comes
        // from CARGO_PKG_VERSION at compile time.
        let version = env!("CARGO_PKG_VERSION");
        assert!(
            s.contains(&format!("OpenPXE v{version}")),
            "footer missing OpenPXE version:\n{s}"
        );
        assert!(
            s.contains("${arch-label}"),
            "footer missing arch-label interpolation:\n{s}"
        );
        // No website URL — the design brief calls that out as tacky.
        assert!(
            !s.to_ascii_lowercase().contains("openpxe.com"),
            "footer should not advertise the website:\n{s}"
        );
        // Arch-label mapping covers the three labels from the brief:
        // "x86 BIOS", "x86_64 UEFI", "arm64 UEFI".
        assert!(s.contains("x86 BIOS"), "{s}");
        assert!(s.contains("x86_64 UEFI"), "{s}");
        assert!(s.contains("arm64 UEFI"), "{s}");
    }
    #[test]
    fn generated_scripts_do_not_emit_bare_or_trailing_fallbacks() {
        let settings = Settings::default();
        let scripts = [
            render_menu(&[], &settings, "http://10.0.0.5"),
-            render_tools_menu("http://10.0.0.5"),
+            render_tools_menu(&[], "http://10.0.0.5"),
            render_local_hdd("http://10.0.0.5"),
            render_util("http://10.0.0.5"),
            render_shell("http://10.0.0.5"),
@@ -14,6 +14,7 @@
 #![forbid(unsafe_code)]
 pub mod app;
 pub mod auth;
 pub mod ipxe_script;
 pub mod iso_fs;
 pub mod log_stream;
@@ -1,8 +1,10 @@
 use crate::uploads::UploadSessions;
 use crate::auth::SessionStore;
 use openpxe_core::{
-    BootLog, ClientRegistry, DeploymentQueue, HostBindings, LogBus, Metrics, SettingsStore,
+    AdminStore, BootLog, BrandingStore, ClientRegistry, DeploymentQueue, HostBindings, LogBus,
    Metrics, SettingsStore, SsoStore,
 };
-use openpxe_iso_store::{IsoStore, NfsManager, SmbManager};
+use openpxe_iso_store::{IsoStore, NfsShareManager, SmbManager, SmbShareManager};
 use std::sync::Arc;
 use time::OffsetDateTime;
@@ -20,6 +22,21 @@ pub struct AppState {
    /// every `/boot/<entry>.ipxe` chain that goes on to serve a script
    /// (i.e. an image actually starting to install on a machine).
    pub boot_log: BootLog,
    /// Operator-controlled UI overrides (custom logo). When the
    /// operator hasn't uploaded anything, the WebUI serves the bundled
    /// rainbow-horizon mark.
    pub branding: BrandingStore,
    /// Forms-auth admin record + first-run bootstrap state. When
    /// `admin.is_configured() == false`, the auth middleware passes
    /// every request through and `/api/me` reports `setup_required`.
    pub admin: AdminStore,
    /// In-memory session table for active operator logins. Cleared on
    /// process restart (sessions are tied to UI state, not persisted —
    /// matches Sonarr/Radarr behaviour).
    pub sessions: SessionStore,
    /// SAML SSO configuration. v0.4.5 stores it; the actual SSO login
    /// flow ships in a later release.
    pub sso: SsoStore,
    /// Lock-free metrics counters surfaced at `/metrics` in Prometheus
    /// text format. Cheap to clone (handles to atomics).
    pub metrics: Metrics,
@@ -27,11 +44,20 @@ pub struct AppState {
    /// `smb_dir` at startup; `None` in pure-Linux-only deployments where
    /// Windows support is not wired in. Settings toggle drives start/stop.
    pub smb: Option<Arc<SmbManager>>,
-    /// NFS share manager. Always present (mounting is opt-in by the
+    /// v0.4.65: SMB share manager — userspace consumer of remote SMB
-    /// operator from the Storage tab); `add()` requires `mount.nfs` to be
+    /// shares via Samba's `smbclient` CLI. Replaces the kernel-mount
-    /// available in the runtime image. Surfaces errors per-mount rather
+    /// NFS path that v0.4.64 shipped; that path didn't work on hosts
-    /// than failing the global state.
+    /// (Unraid, etc.) whose kernel ships without the nfs/cifs client
-    pub nfs: NfsManager,
+    /// modules, and no container-side configuration could fix it.
    /// `smbclient` does the SMB protocol over a plain TCP socket in
    /// userspace — works in any container, no special caps required.
    pub smb_shares: SmbShareManager,
    /// v0.4.67: NFSv3 share manager — pure-Rust userspace consumer
    /// via the `nfs3_client` crate. Ships alongside the SMB manager
    /// so operators pick whichever protocol their NAS prefers.
    /// In-process (no subprocess); supports HTTP Range requests on
    /// NFS-sourced ISOs because NFSv3 READ3 takes an explicit offset.
    pub nfs_shares: NfsShareManager,
    /// Browser chunked upload state. Multipart uploads still go straight
    /// through `IsoStore`, but the UI uses sessions so large ISO transfers
    /// can show deterministic progress and leave visible partial files.
@@ -88,8 +88,14 @@ async fn dispatch(state: &AppState, argv: &[String]) -> Result<String, String> {
        "isos" | "images" => Ok(isos_text(state)),
        "clients" => Ok(clients_text(state)),
        "queue" => queue_command(state, tail).await,
-        "nfs" => nfs_command(state, tail).await,
+        // `smb` controls the outbound Samba server for Windows
        // install media. `share` lists/manages remote SMB shares
        // OpenPXE pulls ISOs from (v0.4.65). `nfs` is the parallel
        // command for remote NFSv3 shares (v0.4.67, in-process via
        // nfs3_client — not the v0.4.64 kernel-mount path).
        "share" | "smb-share" => smb_share_command(state, tail).await,
        "smb" => smb_command(state, tail).await,
        "nfs" => nfs_share_command(state, tail).await,
        "log" => log_command(state, tail),
        "whoami" => Ok("operator".to_string()),
        "echo" => Ok(tail.join(" ")),
@@ -107,18 +113,22 @@ fn status_text(s: &AppState) -> String {
    let clients = s.clients.list();
    let queue_entries = s.queue.list();
    let smb = s.smb.as_ref().map(|m| m.snapshot());
-    let nfs = s.nfs.list();
+    let smb_shares = s.smb_shares.list();
-    let nfs_active = nfs.iter().filter(|m| m.mounted).count();
+    let smb_reachable = smb_shares.iter().filter(|m| m.reachable).count();
    // v0.4.67: NFSv3 sources too.
    let nfs_shares = s.nfs_shares.list();
    let nfs_reachable = nfs_shares.iter().filter(|m| m.reachable).count();
    format!(
        "OpenPXE {ver}\n\
         base url:     {base}\n\
         interface:    {nic}\n\
         uptime:       {up}\n\
-         isos:         {n_isos}  (local: {n_local}, nfs: {n_nfs})\n\
+         isos:         {n_isos}  (local: {n_local}, smb: {n_smb}, nfs: {n_nfs})\n\
         clients:      {n_clients}\n\
         queue:        {n_entries}\n\
-         smb:          {smb}\n\
+         smb server:   {smb}\n\
-         nfs mounts:   {n_total} configured ({n_active} active)\n",
+         smb shares:   {n_smb_total} configured ({n_smb_active} reachable)\n\
         nfs shares:   {n_nfs_total} configured ({n_nfs_active} reachable)\n",
        ver = env!("CARGO_PKG_VERSION"),
        base = s.public_base_url,
        nic = if s.nic_name.is_empty() {
@@ -132,15 +142,21 @@ fn status_text(s: &AppState) -> String {
            .iter()
            .filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Local))
            .count(),
        n_smb = isos
            .iter()
            .filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Smb { .. }))
            .count(),
        n_nfs = isos
            .iter()
-            .filter(|i| !matches!(i.source, openpxe_iso_store::IsoSource::Local))
+            .filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Nfs { .. }))
            .count(),
        n_clients = clients.len(),
        n_entries = queue_entries.len(),
        smb = smb.map_or_else(|| "(disabled)".into(), |s| format!("{s:?}")),
-        n_total = nfs.len(),
+        n_smb_total = smb_shares.len(),
-        n_active = nfs_active,
+        n_smb_active = smb_reachable,
        n_nfs_total = nfs_shares.len(),
        n_nfs_active = nfs_reachable,
    )
 }
@@ -158,7 +174,9 @@ fn isos_text(s: &AppState) -> String {
    for i in isos {
        let src = match i.source {
            openpxe_iso_store::IsoSource::Local => "local".to_string(),
-            openpxe_iso_store::IsoSource::Nfs { mount_id, .. } => format!("nfs:{mount_id}"),
+            openpxe_iso_store::IsoSource::Smb { share_id, .. } => format!("smb:{share_id}"),
            // v0.4.67: NFSv3 via in-process nfs3_client.
            openpxe_iso_store::IsoSource::Nfs { share_id, .. } => format!("nfs:{share_id}"),
        };
        let _ = writeln!(
            out,
@@ -264,31 +282,136 @@ async fn queue_command(s: &AppState, args: &[String]) -> Result<String, String>
    }
 }
-// ── nfs ────────────────────────────────────────────────────────────────
+// ── share (v0.4.65: SMB shares) ─────────────────────────────────────────
-async fn nfs_command(s: &AppState, args: &[String]) -> Result<String, String> {
+async fn smb_share_command(s: &AppState, args: &[String]) -> Result<String, String> {
    match args.first().map(String::as_str) {
        None | Some("list") => {
-            let mounts = s.nfs.list();
+            let shares = s.smb_shares.list();
-            if mounts.is_empty() {
+            if shares.is_empty() {
-                return Ok("(no NFS mounts configured)".into());
+                return Ok("(no SMB shares configured)".into());
            }
            let mut out = String::new();
            let _ = writeln!(
                out,
-                "{:<24} {:<6} {:<7} {:<6} TARGET",
+                "{:<24} {:<7} {:<6} {:<6} TARGET",
-                "ID", "VER", "STATUS", "ISOS"
+                "ID", "STATUS", "AUTH", "ISOS"
            );
-            for m in mounts {
+            for m in shares {
-                let status = if m.mounted { "ok" } else { "down" };
+                let status = if m.reachable { "ok" } else { "down" };
                let auth = if m.guest { "guest" } else { "user" };
                let _ = writeln!(
                    out,
-                    "{:<24} {:<6} {:<7} {:<6} {}:{}",
+                    "{:<24} {:<7} {:<6} {:<6} //{}/{}",
                    truncate(&m.id, 24),
                    status,
                    auth,
                    m.iso_count,
                    m.server,
                    m.share,
                );
                if let Some(e) = m.last_error {
                    let _ = writeln!(out, "    error: {e}");
                }
                if let Some(h) = m.last_hint {
                    let _ = writeln!(out, "    hint:  {h}");
                }
            }
            Ok(out)
        }
        Some("add") => {
            // share add //server/share [guest|user:password]
            let target = args
                .get(1)
                .ok_or_else(|| {
                    "usage: share add //server/share [guest|user:password]".to_string()
                })?;
            // Accept either `//server/share` (UNC-style) or
            // `server:share` (shorter to type).
            let stripped = target.trim_start_matches('/').trim_start_matches('\\');
            let (server, share) = if let Some((s, p)) = stripped.split_once('/') {
                (s, p)
            } else if let Some((s, p)) = stripped.split_once(':') {
                (s, p)
            } else {
                return Err("target must be '//server/share' or 'server:share'".into());
            };
            // Auth spec: "guest" or "user:password". Default: guest.
            let auth = args.get(2).cloned().unwrap_or_else(|| "guest".into());
            let (guest, username, password) = if auth == "guest" {
                (true, None, None)
            } else if let Some((u, p)) = auth.split_once(':') {
                (false, Some(u.to_string()), Some(p.to_string()))
            } else {
                return Err("auth must be 'guest' or 'user:password'".into());
            };
            let req = openpxe_iso_store::SmbAddRequest {
                server: server.to_string(),
                share: share.to_string(),
                username,
                password,
                guest,
                port: None,
            };
            match s.smb_shares.add(req).await {
                Ok(m) => Ok(format!("added {} ({} isos)", m.id, m.iso_count)),
                Err(e) => {
                    let mut out = format!("add failed: {}", e.error);
                    if let Some(h) = e.hint {
                        out.push_str("\nhint: ");
                        out.push_str(&h);
                    }
                    Err(out)
                }
            }
        }
        Some("remove") => {
            let id = args
                .get(1)
                .ok_or_else(|| "usage: share remove <id>".to_string())?;
            match s.smb_shares.remove(id).await {
                Ok(()) => Ok(format!("removed {id}")),
                Err(e) => Err(format!("remove failed: {e}")),
            }
        }
        Some("scan") => {
            let id = args
                .get(1)
                .ok_or_else(|| "usage: share scan <id>".to_string())?;
            match s.smb_shares.rescan(id).await {
                Ok(n) => Ok(format!("re-scanned {id}: {n} isos")),
                Err(e) => Err(format!("scan failed: {e}")),
            }
        }
        Some(other) => Err(format!(
            "unknown share subcommand: {other}\ntry: share [list|add|remove|scan]"
        )),
    }
 }
 // ── nfs (v0.4.67: in-process NFSv3 via nfs3_client) ────────────────────
 async fn nfs_share_command(s: &AppState, args: &[String]) -> Result<String, String> {
    match args.first().map(String::as_str) {
        None | Some("list") => {
            let shares = s.nfs_shares.list();
            if shares.is_empty() {
                return Ok("(no NFS shares configured)".into());
            }
            let mut out = String::new();
            let _ = writeln!(
                out,
                "{:<24} {:<7} {:<6} TARGET",
                "ID", "STATUS", "ISOS"
            );
            for m in shares {
                let status = if m.reachable { "ok" } else { "down" };
                let _ = writeln!(
                    out,
                    "{:<24} {:<7} {:<6} {}:{}",
                    truncate(&m.id, 24),
                    match m.version {
                        openpxe_iso_store::NfsVersion::V3 => "v3",
                        openpxe_iso_store::NfsVersion::V41 => "v4.1",
                    },
                    status,
                    m.iso_count,
                    m.server,
@@ -297,56 +420,58 @@ async fn nfs_command(s: &AppState, args: &[String]) -> Result<String, String> {
                if let Some(e) = m.last_error {
                    let _ = writeln!(out, "    error: {e}");
                }
                if let Some(h) = m.last_hint {
                    let _ = writeln!(out, "    hint:  {h}");
                }
            }
            Ok(out)
        }
-        Some("mount") => {
+        Some("add") => {
-            // nfs mount <server>:<export> [v3|v41] [ro|rw]
+            // nfs add <server>:<export> [port]
            let target = args
                .get(1)
-                .ok_or_else(|| "usage: nfs mount <server>:<export> [v3|v41] [ro|rw]".to_string())?;
+                .ok_or_else(|| "usage: nfs add <server>:<export> [port]".to_string())?;
            let (server, export) = target
                .split_once(':')
                .ok_or_else(|| "target must be 'server:/export'".to_string())?;
-            let version = match args.get(2).map(String::as_str) {
+            let port = args.get(2).and_then(|s| s.parse::<u16>().ok());
                Some("v3") => openpxe_iso_store::NfsVersion::V3,
                Some("v41") | None => openpxe_iso_store::NfsVersion::V41,
                Some(other) => {
                    return Err(format!("unknown nfs version: {other} (expect v3 or v41)"))
                }
            };
            let read_only = !matches!(args.get(3).map(String::as_str), Some("rw"));
            let req = openpxe_iso_store::NfsAddRequest {
                server: server.to_string(),
                export: export.to_string(),
-                version,
+                port,
                read_only,
            };
-            match s.nfs.add(req).await {
+            match s.nfs_shares.add(req).await {
-                Ok(m) => Ok(format!("mounted {} ({} isos)", m.id, m.iso_count)),
+                Ok(m) => Ok(format!("added {} ({} isos)", m.id, m.iso_count)),
-                Err(e) => Err(format!("mount failed: {e}")),
+                Err(e) => {
                    let mut out = format!("add failed: {}", e.error);
                    if let Some(h) = e.hint {
                        out.push_str("\nhint: ");
                        out.push_str(&h);
                    }
                    Err(out)
                }
            }
        }
-        Some("unmount") => {
+        Some("remove") => {
            let id = args
                .get(1)
-                .ok_or_else(|| "usage: nfs unmount <id>".to_string())?;
+                .ok_or_else(|| "usage: nfs remove <id>".to_string())?;
-            match s.nfs.remove(id).await {
+            match s.nfs_shares.remove(id).await {
-                Ok(()) => Ok(format!("unmounted {id}")),
+                Ok(()) => Ok(format!("removed {id}")),
-                Err(e) => Err(format!("unmount failed: {e}")),
+                Err(e) => Err(format!("remove failed: {e}")),
            }
        }
        Some("scan") => {
            let id = args
                .get(1)
                .ok_or_else(|| "usage: nfs scan <id>".to_string())?;
-            match s.nfs.rescan(id).await {
+            match s.nfs_shares.rescan(id).await {
                Ok(n) => Ok(format!("re-scanned {id}: {n} isos")),
                Err(e) => Err(format!("scan failed: {e}")),
            }
        }
        Some(other) => Err(format!(
-            "unknown nfs subcommand: {other}\ntry: nfs [list|mount|unmount|scan]"
+            "unknown nfs subcommand: {other}\ntry: nfs [list|add|remove|scan]"
        )),
    }
 }
@@ -487,13 +612,18 @@ OpenPXE terminal — available commands:
  queue assign-all <target>         assign every waiting client
  queue release <entry_id>           release one queued client
-  nfs list                          list NFS mounts
+  share list                        list configured SMB shares
-  nfs mount <s>:<e> [v3|v41] [ro|rw]  add and mount an NFS share
+  share add //srv/share [auth]      add an SMB share; auth = 'guest' or 'user:pass'
-  nfs unmount <id>                  unmount and forget a share
+  share remove <id>                 forget an SMB share
-  nfs scan <id>                     re-scan a share for new ISOs
+  share scan <id>                   re-list a share for new ISOs
-  smb status                        SMB (Samba) state
+  nfs list                          list configured NFSv3 shares
-  smb start | stop | reload         control smbd
+  nfs add <srv>:<export> [port]     add an NFSv3 share
  nfs remove <id>                   forget an NFS share
  nfs scan <id>                     re-list an NFS share for new ISOs
  smb status                        outbound Samba state (Windows install media)
  smb start | stop | reload         control the outbound smbd
  log clear                         drop the in-memory log ring buffer
  log tail [n]                      show the last n buffered lines (default 20)
@@ -508,10 +638,10 @@ mod tests {
    #[test]
    fn shell_split_basic() {
        assert_eq!(shell_split(""), Vec::<String>::new());
-        assert_eq!(shell_split("nfs list"), vec!["nfs", "list"]);
+        assert_eq!(shell_split("share list"), vec!["share", "list"]);
        assert_eq!(
-            shell_split("nfs mount 10.0.0.5:/srv v41 ro"),
+            shell_split("share add //nas/isos guest"),
-            vec!["nfs", "mount", "10.0.0.5:/srv", "v41", "ro"]
+            vec!["share", "add", "//nas/isos", "guest"]
        );
    }
@@ -14,7 +14,7 @@ use axum::body::Body;
 use axum::http::{header, Request, StatusCode};
 use openpxe_core::{ClientRegistry, DeploymentQueue, HostBindings, LogBus, Metrics, SettingsStore};
 use openpxe_http_api::{build_router, AppState};
-use openpxe_iso_store::{IsoStore, NfsManager};
+use openpxe_iso_store::{IsoStore, NfsShareManager, SmbShareManager};
 use tempfile::tempdir;
 use tower::ServiceExt;
@@ -94,11 +94,15 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
    let clients = ClientRegistry::new();
    let queue = DeploymentQueue::new();
    let settings = SettingsStore::load_or_default(dir.path());
-    let nfs = NfsManager::new(dir.path(), iso_store.clone());
+    let smb_shares = SmbShareManager::new(dir.path(), iso_store.clone());
-    iso_store.set_nfs_root(nfs.mount_root());
+    let nfs_shares = NfsShareManager::new(dir.path(), iso_store.clone());
    let log_bus = LogBus::new(64);
    let hosts = HostBindings::load_or_default(dir.path());
    let boot_log = openpxe_core::BootLog::load_or_default(dir.path());
    let branding = openpxe_core::BrandingStore::load_or_default(dir.path());
    let admin = openpxe_core::AdminStore::load_or_default(dir.path());
    let sso = openpxe_core::SsoStore::load_or_default(dir.path());
    let sessions = openpxe_http_api::auth::SessionStore::default();
    let metrics = Metrics::new();
    let state = AppState {
        iso_store,
@@ -107,9 +111,14 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
        settings,
        hosts,
        boot_log,
        branding,
        admin,
        sessions,
        sso,
        metrics,
        smb: None,
-        nfs,
+        smb_shares,
        nfs_shares,
        uploads: openpxe_http_api::uploads::UploadSessions::default(),
        log_bus,
        started_at: time::OffsetDateTime::now_utc(),
@@ -456,35 +465,120 @@ async fn no_external_urls_in_generated_ipxe() {
 // ── Phase 4 integration tests ────────────────────────────────────────────
 // v0.4.65: kernel-mount NFS replaced with userspace SMB via smbclient.
 #[tokio::test]
-async fn nfs_add_with_bad_export_is_rejected() {
+async fn smb_share_add_with_missing_server_is_rejected() {
-    // Validation must happen before we shell out to /bin/mount —
+    // Validation must run before we shell out to smbclient — otherwise
-    // otherwise the operator sees opaque kernel errors instead of a
+    // operators see opaque NT_STATUS codes for what's really a typo.
    // clear "your export must start with /" hint.
    let (state, _dir) = build_state().await;
    let app = build_router(state);
    let (s, b) = post_json(
        &app,
-        "/api/nfs",
+        "/api/smb-shares",
-        r#"{"server":"10.0.0.5","export":"isos","version":"v41","read_only":true}"#,
+        r#"{"server":"","share":"isos","guest":true}"#,
    )
    .await;
    assert_eq!(s, StatusCode::BAD_REQUEST);
    let msg = String::from_utf8_lossy(&b);
    assert!(
-        msg.contains("export"),
+        msg.to_lowercase().contains("server"),
        "expected validation hint, got: {msg}"
    );
 }
 #[tokio::test]
-async fn nfs_list_starts_empty() {
+async fn smb_share_add_requires_username_when_not_guest() {
    let (state, _dir) = build_state().await;
    let app = build_router(state);
-    let (s, b) = get(&app, "/api/nfs").await;
+    let (s, b) = post_json(
        &app,
        "/api/smb-shares",
        r#"{"server":"10.0.0.5","share":"isos","guest":false}"#,
    )
    .await;
    assert_eq!(s, StatusCode::BAD_REQUEST);
    let msg = String::from_utf8_lossy(&b);
    assert!(
        msg.to_lowercase().contains("username"),
        "expected username hint, got: {msg}"
    );
 }
 #[tokio::test]
 async fn smb_share_add_rejects_paths_in_share_name() {
    let (state, _dir) = build_state().await;
    let app = build_router(state);
    let (s, b) = post_json(
        &app,
        "/api/smb-shares",
        r#"{"server":"10.0.0.5","share":"isos/subdir","guest":true}"#,
    )
    .await;
    assert_eq!(s, StatusCode::BAD_REQUEST);
    let msg = String::from_utf8_lossy(&b);
    assert!(
        msg.to_lowercase().contains("share name"),
        "expected share name hint, got: {msg}"
    );
 }
 #[tokio::test]
 async fn smb_shares_list_starts_empty() {
    let (state, _dir) = build_state().await;
    let app = build_router(state);
    let (s, b) = get(&app, "/api/smb-shares").await;
    assert_eq!(s, StatusCode::OK);
    let v: serde_json::Value = serde_json::from_slice(&b).unwrap();
-    assert_eq!(v["mounts"].as_array().unwrap().len(), 0);
+    assert_eq!(v["shares"].as_array().unwrap().len(), 0);
 }
 // v0.4.67: NFSv3 share manager (parallel to SMB).
 #[tokio::test]
 async fn nfs_shares_list_starts_empty() {
    let (state, _dir) = build_state().await;
    let app = build_router(state);
    let (s, b) = get(&app, "/api/nfs-shares").await;
    assert_eq!(s, StatusCode::OK);
    let v: serde_json::Value = serde_json::from_slice(&b).unwrap();
    assert_eq!(v["shares"].as_array().unwrap().len(), 0);
 }
 #[tokio::test]
 async fn nfs_shares_add_rejects_missing_server() {
    let (state, _dir) = build_state().await;
    let app = build_router(state);
    let (s, b) = post_json(
        &app,
        "/api/nfs-shares",
        r#"{"server":"","export":"/srv/isos"}"#,
    )
    .await;
    assert_eq!(s, StatusCode::BAD_REQUEST);
    let msg = String::from_utf8_lossy(&b);
    assert!(
        msg.to_lowercase().contains("server"),
        "expected server hint, got: {msg}"
    );
 }
 #[tokio::test]
 async fn nfs_shares_add_rejects_export_without_leading_slash() {
    let (state, _dir) = build_state().await;
    let app = build_router(state);
    let (s, b) = post_json(
        &app,
        "/api/nfs-shares",
        r#"{"server":"10.0.0.5","export":"srv/isos"}"#,
    )
    .await;
    assert_eq!(s, StatusCode::BAD_REQUEST);
    let msg = String::from_utf8_lossy(&b);
    assert!(
        msg.to_lowercase().contains("export"),
        "expected export-path hint, got: {msg}"
    );
 }
 #[tokio::test]
@@ -1201,3 +1295,652 @@ async fn chunked_upload_rejects_offset_mismatch_without_advancing() {
    let text = String::from_utf8(body.to_vec()).unwrap();
    assert!(text.contains("expected offset 0"), "got: {text}");
 }
 #[tokio::test]
 async fn iso_category_switch_moves_entry_between_menus() {
    // OS (default): appears in Linux Installers submenu and not in Tools.
    // After flipping to Tools: gone from Linux, present under Tools.
    let (state, _dir) = build_state().await;
    let app = build_router(state);
    let (ct, body) = multipart_iso_body("fake-alpine.iso", &fake_alpine_iso());
    let upload = app
        .clone()
        .oneshot(
            Request::builder()
                .method("POST")
                .uri("/api/isos")
                .header("content-type", ct)
                .body(Body::from(body))
                .unwrap(),
        )
        .await
        .unwrap();
    assert_eq!(upload.status(), StatusCode::CREATED);
    let (_, linux_before) = get(&app, "/boot/_linux_menu.ipxe").await;
    let linux_before = String::from_utf8(linux_before).unwrap();
    assert!(
        linux_before.contains("fake-alpine-linux"),
        "expected entry in Linux submenu (default OS):\n{linux_before}"
    );
    let (_, tools_before) = get(&app, "/boot/_tools_menu.ipxe").await;
    let tools_before = String::from_utf8(tools_before).unwrap();
    assert!(
        !tools_before.contains("fake-alpine-linux"),
        "OS-category ISO shouldn't appear in Tools yet:\n{tools_before}"
    );
    // Flip to Tools.
    let (s, _) = put_json(
        &app,
        "/api/isos/fake-alpine/category",
        r#"{"category":"tools"}"#,
    )
    .await;
    assert_eq!(s, StatusCode::OK);
    let (_, linux_after) = get(&app, "/boot/_linux_menu.ipxe").await;
    let linux_after = String::from_utf8(linux_after).unwrap();
    assert!(
        !linux_after.contains("fake-alpine-linux"),
        "Tools-category ISO should NOT appear in Linux submenu:\n{linux_after}"
    );
    let (_, tools_after) = get(&app, "/boot/_tools_menu.ipxe").await;
    let tools_after = String::from_utf8(tools_after).unwrap();
    assert!(
        tools_after.contains("fake-alpine-linux"),
        "Tools-category ISO should appear in Tools submenu:\n{tools_after}"
    );
 }
 #[tokio::test]
 async fn iso_category_unknown_value_returns_400() {
    let (state, _dir) = build_state().await;
    let app = build_router(state);
    let (ct, body) = multipart_iso_body("fake-alpine.iso", &fake_alpine_iso());
    app.clone()
        .oneshot(
            Request::builder()
                .method("POST")
                .uri("/api/isos")
                .header("content-type", ct)
                .body(Body::from(body))
                .unwrap(),
        )
        .await
        .unwrap();
    let (s, body) = put_json(
        &app,
        "/api/isos/fake-alpine/category",
        r#"{"category":"gibberish"}"#,
    )
    .await;
    assert_eq!(s, StatusCode::BAD_REQUEST);
    let text = std::str::from_utf8(&body).unwrap();
    assert!(text.contains("unknown category"), "got: {text}");
 }
 #[tokio::test]
 async fn iso_category_unknown_id_returns_404() {
    let (state, _dir) = build_state().await;
    let app = build_router(state);
    let (s, _) = put_json(
        &app,
        "/api/isos/does-not-exist/category",
        r#"{"category":"tools"}"#,
    )
    .await;
    assert_eq!(s, StatusCode::NOT_FOUND);
 }
 #[tokio::test]
 async fn storage_disk_endpoint_reports_volume_stats() {
    let (state, _dir) = build_state().await;
    let app = build_router(state);
    let (s, body) = get(&app, "/api/storage/disk").await;
    assert_eq!(s, StatusCode::OK);
    let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
    // statvfs always returns something on the tempdir filesystem; check
    // that the shape is sane (total >= used >= 0 and total >= available).
    assert!(v["total_bytes"].as_u64().unwrap() > 0, "got {v}");
    let total = v["total_bytes"].as_u64().unwrap();
    let avail = v["available_bytes"].as_u64().unwrap();
    let used = v["used_bytes"].as_u64().unwrap();
    assert!(total >= avail, "{v}");
    assert!(total >= used,  "{v}");
    assert!(v["path"].as_str().unwrap().contains("isos"), "got {v}");
 }
 #[tokio::test]
 async fn api_docs_lists_known_endpoints() {
    let (state, _dir) = build_state().await;
    let app = build_router(state);
    let (s, body) = get(&app, "/api/docs").await;
    assert_eq!(s, StatusCode::OK);
    let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
    let groups = v["groups"].as_array().expect("groups array");
    assert!(!groups.is_empty());
    // Flatten the paths and confirm a handful of the routes that real
    // operators will look up are documented.
    let mut paths: Vec<String> = Vec::new();
    for g in groups {
        for ep in g["endpoints"].as_array().unwrap() {
            paths.push(ep["path"].as_str().unwrap().into());
        }
    }
    for needle in [
        "/api/isos",
        "/api/isos/:id/category",
        "/api/storage/disk",
        "/api/branding/logo",
        "/api/boot-log",
        "/metrics",
    ] {
        assert!(
            paths.iter().any(|p| p == needle),
            "expected {needle} in docs; got {paths:?}"
        );
    }
 }
 #[tokio::test]
 async fn branding_clear_when_no_logo_is_no_content() {
    // No-op clear should still 204 — it's not an error to revert to
    // the default when there's nothing to revert from.
    let (state, _dir) = build_state().await;
    let app = build_router(state);
    let res = app
        .oneshot(
            Request::builder()
                .method("DELETE")
                .uri("/api/branding/logo")
                .body(Body::empty())
                .unwrap(),
        )
        .await
        .unwrap();
    assert_eq!(res.status(), StatusCode::NO_CONTENT);
 }
 #[tokio::test]
 async fn status_exposes_custom_logo_flag() {
    let (state, _dir) = build_state().await;
    let app = build_router(state);
    let (s, body) = get(&app, "/api/status").await;
    assert_eq!(s, StatusCode::OK);
    let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
    assert_eq!(
        v["custom_logo"].as_bool(),
        Some(false),
        "fresh state has no custom logo: {v}"
    );
 }
 async fn put_json(router: &axum::Router, path: &str, body: &str) -> (StatusCode, Vec<u8>) {
    let res = router
        .clone()
        .oneshot(
            Request::builder()
                .method("PUT")
                .uri(path)
                .header("content-type", "application/json")
                .body(Body::from(body.to_owned()))
                .unwrap(),
        )
        .await
        .unwrap();
    let status = res.status();
    let bytes = axum::body::to_bytes(res.into_body(), usize::MAX)
        .await
        .unwrap()
        .to_vec();
    (status, bytes)
 }
 // ─── v0.4.5: Forms auth + SSO ─────────────────────────────────────────────
 async fn post_collect(router: &axum::Router, path: &str, body: &str) -> (StatusCode, Vec<u8>, Vec<axum::http::HeaderValue>) {
    let res = router
        .clone()
        .oneshot(
            Request::builder()
                .method("POST")
                .uri(path)
                .header("content-type", "application/json")
                .body(Body::from(body.to_owned()))
                .unwrap(),
        )
        .await
        .unwrap();
    let status = res.status();
    let cookies: Vec<_> = res
        .headers()
        .get_all(axum::http::header::SET_COOKIE)
        .iter()
        .cloned()
        .collect();
    let body = axum::body::to_bytes(res.into_body(), usize::MAX)
        .await
        .unwrap()
        .to_vec();
    (status, body, cookies)
 }
 fn session_value(cookies: &[axum::http::HeaderValue]) -> Option<String> {
    for c in cookies {
        let s = c.to_str().ok()?;
        if let Some(rest) = s.strip_prefix("openpxe_session=") {
            // Until the first ';'
            let val = rest.split(';').next().unwrap_or("").to_string();
            return Some(val);
        }
    }
    None
 }
 async fn get_with_cookie(router: &axum::Router, path: &str, cookie: &str) -> (StatusCode, Vec<u8>) {
    let res = router
        .clone()
        .oneshot(
            Request::builder()
                .uri(path)
                .header("cookie", format!("openpxe_session={cookie}"))
                .body(Body::empty())
                .unwrap(),
        )
        .await
        .unwrap();
    let status = res.status();
    let body = axum::body::to_bytes(res.into_body(), usize::MAX)
        .await
        .unwrap()
        .to_vec();
    (status, body)
 }
 #[tokio::test]
 async fn me_reports_setup_required_when_no_admin() {
    let (state, _dir) = build_state().await;
    let app = build_router(state);
    let (s, body) = get(&app, "/api/me").await;
    assert_eq!(s, StatusCode::OK);
    let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
    assert_eq!(v["setup_required"].as_bool(), Some(true));
    assert_eq!(v["authenticated"].as_bool(), Some(false));
 }
 #[tokio::test]
 async fn setup_creates_admin_logs_in_and_blocks_second_call() {
    let (state, _dir) = build_state().await;
    let app = build_router(state);
    // First-run setup succeeds and returns a session cookie.
    let (s, body, cookies) = post_collect(
        &app,
        "/api/setup",
        r#"{"username":"admin","password":"hunter2hunter2"}"#,
    )
    .await;
    assert_eq!(s, StatusCode::CREATED);
    let token = session_value(&cookies).expect("setup should set cookie");
    let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
    assert_eq!(v["user"]["username"], "admin");
    // /api/me with that cookie reports authenticated.
    let (s, body) = get_with_cookie(&app, "/api/me", &token).await;
    assert_eq!(s, StatusCode::OK);
    let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
    assert_eq!(v["authenticated"].as_bool(), Some(true));
    assert_eq!(v["user"]["username"], "admin");
    // /api/setup is now closed.
    let (s, _, _) = post_collect(
        &app,
        "/api/setup",
        r#"{"username":"second","password":"hunter2hunter2"}"#,
    )
    .await;
    assert_eq!(s, StatusCode::CONFLICT);
 }
 #[tokio::test]
 async fn protected_route_returns_401_after_setup_without_cookie() {
    let (state, _dir) = build_state().await;
    let app = build_router(state);
    // Set up an admin so the middleware engages.
    let (s, _, _) = post_collect(
        &app,
        "/api/setup",
        r#"{"username":"admin","password":"hunter2hunter2"}"#,
    )
    .await;
    assert_eq!(s, StatusCode::CREATED);
    // No cookie → 401 on a protected route.
    let (s, _) = get(&app, "/api/isos").await;
    assert_eq!(s, StatusCode::UNAUTHORIZED);
    // PXE-essential routes stay reachable.
    let (s, _) = get(&app, "/boot.ipxe").await;
    assert_eq!(s, StatusCode::OK);
    let (s, _) = get(&app, "/healthz").await;
    assert_eq!(s, StatusCode::OK);
 }
 #[tokio::test]
 async fn login_logout_round_trip_uses_session_cookie() {
    let (state, _dir) = build_state().await;
    let app = build_router(state);
    let (_, _, _) = post_collect(
        &app,
        "/api/setup",
        r#"{"username":"admin","password":"hunter2hunter2"}"#,
    )
    .await;
    // Fresh login (separate from the setup-issued session).
    let (s, _, cookies) = post_collect(
        &app,
        "/api/login",
        r#"{"username":"admin","password":"hunter2hunter2"}"#,
    )
    .await;
    assert_eq!(s, StatusCode::OK);
    let token = session_value(&cookies).expect("login should set cookie");
    // With cookie, /api/isos is reachable.
    let (s, _) = get_with_cookie(&app, "/api/isos", &token).await;
    assert_eq!(s, StatusCode::OK);
    // Logout revokes the session; /api/isos goes back to 401.
    let res = app
        .clone()
        .oneshot(
            Request::builder()
                .method("POST")
                .uri("/api/logout")
                .header("cookie", format!("openpxe_session={token}"))
                .body(Body::empty())
                .unwrap(),
        )
        .await
        .unwrap();
    assert_eq!(res.status(), StatusCode::NO_CONTENT);
    let (s, _) = get_with_cookie(&app, "/api/isos", &token).await;
    assert_eq!(s, StatusCode::UNAUTHORIZED);
 }
 #[tokio::test]
 async fn login_rejects_wrong_password_with_401_and_no_cookie() {
    let (state, _dir) = build_state().await;
    let app = build_router(state);
    let (_, _, _) = post_collect(
        &app,
        "/api/setup",
        r#"{"username":"admin","password":"hunter2hunter2"}"#,
    )
    .await;
    let (s, body, cookies) = post_collect(
        &app,
        "/api/login",
        r#"{"username":"admin","password":"nope"}"#,
    )
    .await;
    assert_eq!(s, StatusCode::UNAUTHORIZED);
    assert!(session_value(&cookies).is_none(), "no cookie on failure");
    let text = std::str::from_utf8(&body).unwrap();
    assert!(text.contains("invalid"), "got: {text}");
 }
 #[tokio::test]
 async fn update_credentials_requires_current_password_and_rotates_session() {
    let (state, _dir) = build_state().await;
    let app = build_router(state);
    let (_, _, cookies) = post_collect(
        &app,
        "/api/setup",
        r#"{"username":"admin","password":"hunter2hunter2"}"#,
    )
    .await;
    let token = session_value(&cookies).unwrap();
    // Wrong current password → 400.
    let res = app
        .clone()
        .oneshot(
            Request::builder()
                .method("PUT")
                .uri("/api/me/credentials")
                .header("content-type", "application/json")
                .header("cookie", format!("openpxe_session={token}"))
                .body(Body::from(
                    r#"{"current_password":"wrong","new_password":"newpassword1"}"#,
                ))
                .unwrap(),
        )
        .await
        .unwrap();
    assert_eq!(res.status(), StatusCode::BAD_REQUEST);
    // Correct current password rotates + returns a fresh cookie.
    let res = app
        .clone()
        .oneshot(
            Request::builder()
                .method("PUT")
                .uri("/api/me/credentials")
                .header("content-type", "application/json")
                .header("cookie", format!("openpxe_session={token}"))
                .body(Body::from(
                    r#"{"current_password":"hunter2hunter2","new_username":"alice","new_password":"newpassword1"}"#,
                ))
                .unwrap(),
        )
        .await
        .unwrap();
    assert_eq!(res.status(), StatusCode::OK);
    let new_cookies: Vec<_> = res
        .headers()
        .get_all(axum::http::header::SET_COOKIE)
        .iter()
        .cloned()
        .collect();
    let new_token = session_value(&new_cookies).expect("rotation issues fresh cookie");
    // Old cookie no longer valid (every session was revoked).
    let (s, _) = get_with_cookie(&app, "/api/isos", &token).await;
    assert_eq!(s, StatusCode::UNAUTHORIZED);
    // New cookie works.
    let (s, _) = get_with_cookie(&app, "/api/isos", &new_token).await;
    assert_eq!(s, StatusCode::OK);
    // Old creds no longer log in.
    let (s, _, _) = post_collect(
        &app,
        "/api/login",
        r#"{"username":"admin","password":"hunter2hunter2"}"#,
    )
    .await;
    assert_eq!(s, StatusCode::UNAUTHORIZED);
    // New creds do.
    let (s, _, _) = post_collect(
        &app,
        "/api/login",
        r#"{"username":"alice","password":"newpassword1"}"#,
    )
    .await;
    assert_eq!(s, StatusCode::OK);
 }
 #[tokio::test]
 async fn sso_round_trip_default_then_replace() {
    // Pre-setup state: middleware is open, so we can hit /api/sso directly.
    let (state, _dir) = build_state().await;
    let app = build_router(state);
    let (s, body) = get(&app, "/api/sso").await;
    assert_eq!(s, StatusCode::OK);
    let cfg: serde_json::Value = serde_json::from_slice(&body).unwrap();
    assert_eq!(cfg["enabled"].as_bool(), Some(false));
    // Enable with a metadata URL.
    let (s, _) = put_json(
        &app,
        "/api/sso",
        r#"{"enabled":true,"idp_name":"Okta","metadata":"","metadata_url":"https://idp.example.com/metadata"}"#,
    )
    .await;
    assert_eq!(s, StatusCode::OK);
    let (_, body) = get(&app, "/api/sso").await;
    let cfg: serde_json::Value = serde_json::from_slice(&body).unwrap();
    assert_eq!(cfg["enabled"].as_bool(), Some(true));
    assert_eq!(cfg["idp_name"], "Okta");
    // Enabling without a source is rejected.
    let (s, body) = put_json(
        &app,
        "/api/sso",
        r#"{"enabled":true,"idp_name":"","metadata":"","metadata_url":""}"#,
    )
    .await;
    assert_eq!(s, StatusCode::BAD_REQUEST);
    let text = std::str::from_utf8(&body).unwrap();
    assert!(text.contains("metadata"), "got: {text}");
 }
 #[tokio::test]
 async fn docs_lists_new_v0_4_5_endpoints() {
    let (state, _dir) = build_state().await;
    let app = build_router(state);
    let (s, body) = get(&app, "/api/docs").await;
    assert_eq!(s, StatusCode::OK);
    let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
    let mut paths: Vec<String> = Vec::new();
    for g in v["groups"].as_array().unwrap() {
        for ep in g["endpoints"].as_array().unwrap() {
            paths.push(ep["path"].as_str().unwrap().into());
        }
    }
    // /api/docs predates v0.4.5 but the new surface should be reachable
    // here too — confirms we don't forget to update it. For now we only
    // require the *existing* docs entries to keep working.
    for needle in ["/api/isos", "/api/boot-log", "/api/storage/disk"] {
        assert!(paths.iter().any(|p| p == needle), "{needle} missing");
    }
 }
 // ─── v0.4.6: PXE logo endpoint ────────────────────────────────────────────
 #[tokio::test]
 async fn pxe_logo_404_when_no_custom_logo_configured() {
    let (state, _dir) = build_state().await;
    let app = build_router(state);
    let (s, body) = get(&app, "/branding/pxe-logo").await;
    assert_eq!(s, StatusCode::NOT_FOUND);
    let text = std::str::from_utf8(&body).unwrap();
    assert!(text.contains("no custom logo"), "got: {text}");
 }
 /// Build a tiny valid PNG via the `image` crate. The v0.4.61 PXE-logo
 /// compositor decodes whatever the operator uploaded — hand-rolled
 /// PNGs with handwritten CRCs are too easy to break; let the encoder
 /// produce something it can later decode.
 fn tiny_png() -> Vec<u8> {
    use image::{DynamicImage, ImageBuffer, ImageFormat, Rgb};
    use std::io::Cursor;
    let buf: ImageBuffer<Rgb<u8>, Vec<u8>> = ImageBuffer::from_pixel(8, 8, Rgb([0, 180, 220]));
    let mut out = Vec::with_capacity(256);
    DynamicImage::ImageRgb8(buf)
        .write_to(&mut Cursor::new(&mut out), ImageFormat::Png)
        .unwrap();
    out
 }
 #[tokio::test]
 async fn pxe_logo_404_when_uploaded_logo_is_svg() {
    // iPXE can't rasterize SVG, so an SVG upload deliberately doesn't
    // light up the PXE menu's `console --picture` overlay — the menu
    // simply paints without a logo.
    let (state, _dir) = build_state().await;
    state
        .branding
        .set_logo(
            "image/svg+xml",
            "svg",
            br#"<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 8 8"/>"#,
        )
        .unwrap();
    let app = build_router(state);
    let (s, body) = get(&app, "/branding/pxe-logo").await;
    assert_eq!(s, StatusCode::NOT_FOUND);
    let text = std::str::from_utf8(&body).unwrap();
    assert!(text.contains("SVG"), "got: {text}");
 }
 #[tokio::test]
 async fn pxe_logo_composes_to_1024x768_png() {
    // v0.4.61: the endpoint no longer serves the raw upload — it
    // composes the operator's logo into a fixed 1024×768 canvas so
    // the iPXE menu always paints at consistent dimensions.
    let (state, _dir) = build_state().await;
    let png = tiny_png();
    state
        .branding
        .set_logo("image/png", "png", &png)
        .unwrap();
    let app = build_router(state);
    let res = app
        .clone()
        .oneshot(
            Request::builder()
                .uri("/branding/pxe-logo")
                .body(Body::empty())
                .unwrap(),
        )
        .await
        .unwrap();
    assert_eq!(res.status(), StatusCode::OK);
    let ct = res
        .headers()
        .get(axum::http::header::CONTENT_TYPE)
        .unwrap()
        .to_str()
        .unwrap();
    assert_eq!(ct, "image/png");
    let body = axum::body::to_bytes(res.into_body(), usize::MAX)
        .await
        .unwrap();
    // PNG signature.
    assert!(body.starts_with(b"\x89PNG"), "PNG header missing");
    // IHDR chunk lives at bytes 8..29; width is bytes 16..20, height
    // 20..24 in big-endian u32. The composed canvas should be 1024×768.
    let width = u32::from_be_bytes([body[16], body[17], body[18], body[19]]);
    let height = u32::from_be_bytes([body[20], body[21], body[22], body[23]]);
    assert_eq!(width, 1024, "compose should pin width to 1024");
    assert_eq!(height, 768, "compose should pin height to 768");
 }
 #[tokio::test]
 async fn pxe_logo_endpoint_is_public_after_admin_setup() {
    // iPXE clients can't send a session cookie, so /branding/pxe-logo
    // must stay reachable once the admin has been bootstrapped. The
    // auth allowlist gates `/api/*` only.
    let (state, _dir) = build_state().await;
    let png = tiny_png();
    state
        .branding
        .set_logo("image/png", "png", &png)
        .unwrap();
    let app = build_router(state);
    // Configure an admin so the middleware kicks in.
    let (s, _, _) = post_collect(
        &app,
        "/api/setup",
        r#"{"username":"admin","password":"hunter2hunter2"}"#,
    )
    .await;
    assert_eq!(s, StatusCode::CREATED);
    // Still public without a cookie.
    let (s, _) = get(&app, "/branding/pxe-logo").await;
    assert_eq!(s, StatusCode::OK);
 }
@@ -27,6 +27,21 @@ parking_lot.workspace = true
 bytes.workspace = true
 tempfile = "3.12"
 libc = "0.2"
 # v0.4.61: server-side compose of the operator's uploaded raster into a
 # fixed 1024x768 canvas so the PXE menu always gets a consistently-sized
 # PNG regardless of what the operator uploaded. We use the bare-bones
 # `image` crate (no default features) and explicitly enable only the
 # decoders we accept on upload (PNG/JPEG/WebP/GIF) plus the PNG
 # encoder. Keeps the build slim — no JPEG2000, TIFF, BMP, etc.
 image = { version = "0.25", default-features = false, features = ["png", "jpeg", "webp", "gif"] }
 # v0.4.67: pure-Rust NFSv3 client for reading remote ISOs without a
 # kernel mount. See crates/iso-store/src/nfs_share.rs for usage.
 nfs3_client = { workspace = true }
 nfs3_types = { workspace = true }
 # Needed for the Stream trait that wraps the mpsc receiver feeding
 # NFS read-loop bytes into axum's Body::from_stream.
 futures = { workspace = true }
 [dev-dependencies]
 tempfile = "3.12"
@@ -18,16 +18,29 @@
 pub mod entry;
 pub mod introspect;
-pub mod nfs;
+pub mod nfs_share;
 pub mod pxe_logo;
 pub mod smb;
 pub mod smb_share;
 pub mod store;
 pub mod windows;
 pub use entry::{BootEntry, BootKind, KernelArgs};
 pub use introspect::{DistroFamily, IntrospectionReport};
-pub use nfs::{NfsAddRequest, NfsManager, NfsMount, NfsVersion};
+// v0.4.65: kernel-mount NFS is gone. SMB shares via Samba's userspace
 // `smbclient` CLI replaced it — works in any container (no
 // CAP_SYS_ADMIN, no host kernel modules), matching how Bootimus and
 // every other PXE/imaging tool that supports network storage handles
 // it.
 pub use smb::{extract_windows_iso, SmbManager, SmbState};
 pub use smb_share::{SmbAddRequest, SmbShare, SmbShareError, SmbShareManager, SmbStream};
 // v0.4.67: NFS is back — this time as an in-process userspace NFSv3
 // client (the `nfs3_client` crate) rather than a kernel mount. Same
 // "works in any container" property as SMB, plus support for HTTP
 // Range requests because NFSv3 READ3 takes an explicit offset.
 pub use nfs_share::{NfsAddRequest, NfsShare, NfsShareError, NfsShareManager, NfsStream};
 pub use store::{
-    generate_boot_entries_for, slugify_str, IsoMeta, IsoSource, IsoStore, UploadHandle,
+    generate_boot_entries_for, slugify_str, IsoCategory, IsoMeta, IsoSource, IsoStore,
    UploadHandle,
 };
 pub use windows::{WimPatcher, WinPatchState};
@@ -1,558 +0,0 @@
 //! NFS share manager.
 //!
 //! Lets an operator mount a remote NFS export as an ISO source instead of
 //! uploading every ISO into the container's PVC. Supports NFSv3 and
 //! NFSv4.1 — the two versions the user explicitly asked for.
 //!
 //! ## How it works
 //!
 //! 1. Operator submits a mount spec via the Storage tab:
 //!    `{ server: "10.0.0.20", export: "/srv/isos", version: "v41" }`.
 //! 2. We slugify a stable id, mkdir `<work_dir>/nfs/<id>/`, then shell out
 //!    to `/bin/mount -t nfs -o vers=...,ro,nolock server:export local`.
 //! 3. On success we walk the mount point looking for `*.iso` files and
 //!    register each one with the `IsoStore` as an external source — same
 //!    introspection pipeline as a web upload, but no sha256 (the bytes
 //!    live on a remote machine; hashing them would suck them through the
 //!    network on every restart).
 //! 4. On failure we record `last_error` on the spec and persist anyway
 //!    so the UI can show a row in red rather than silently dropping it.
 //!
 //! ## Operational notes
 //!
 //! - Mounting NFS inside a container needs `CAP_SYS_ADMIN` and the
 //!   `nfs-common` package. The default image ships these (see Dockerfile).
 //! - On OpenShift, the SCC must allow `CAP_SYS_ADMIN`. The bundled SCC
 //!   doesn't — operators have to opt in by switching to a more privileged
 //!   SCC or running NFS mounts as a CSI driver outside the pod.
 //! - Mount commands are issued sequentially under a single mutex to avoid
 //!   `mount` racing on the same target dir.
 //!
 //! ## Persistence
 //!
 //! Mount specs (without runtime state) live at `<work_dir>/nfs.json`,
 //! re-mounted on startup. Mounts that fail to come back online keep their
 //! spec and their `last_error` so the operator sees what happened.
 use crate::introspect::{introspect, IntrospectionReport};
 use crate::store::{generate_boot_entries_for, slugify_str, IsoSource, IsoStore};
 use openpxe_core::{Error, Result};
 use parking_lot::Mutex;
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
 use time::OffsetDateTime;
 use tokio::process::Command;
 /// Wire-protocol versions we support. Keep this enum closed — silently
 /// accepting "auto" or letting the kernel negotiate would mean operators
 /// could never confirm which version is in use.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "lowercase")]
 pub enum NfsVersion {
    /// NFSv3 — UDP/TCP, separate `mountd` protocol. Required for many
    /// older NAS appliances.
    V3,
    /// NFSv4.1 — single TCP port (2049), session-based. Modern default.
    V41,
 }
 impl NfsVersion {
    fn vers_arg(self) -> &'static str {
        match self {
            Self::V3 => "vers=3",
            Self::V41 => "vers=4.1",
        }
    }
 }
 /// One configured mount. The id is generated from server+export so the
 /// operator can re-add the same export idempotently.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct NfsMount {
    pub id: String,
    pub server: String,
    pub export: String,
    pub version: NfsVersion,
    /// Read-only by default — most ISO libraries are. Operators that need
    /// write can flip this off but OpenPXE itself never writes.
    pub read_only: bool,
    /// Local mount point under `<work_dir>/nfs/`.
    pub local_path: PathBuf,
    /// Whether the mount is currently active.
    pub mounted: bool,
    /// Last error encountered on a `mount` or `umount` attempt; cleared on
    /// success.
    pub last_error: Option<String>,
    #[serde(with = "time::serde::rfc3339::option")]
    pub last_attempt: Option<OffsetDateTime>,
    /// Number of `.iso` files found on the share (re-counted on each scan).
    pub iso_count: u32,
 }
 /// Spec submitted by the UI. Server and export are normalized before use.
 #[derive(Debug, Clone, Deserialize)]
 pub struct NfsAddRequest {
    pub server: String,
    pub export: String,
    #[serde(default = "default_version")]
    pub version: NfsVersion,
    #[serde(default = "default_ro")]
    pub read_only: bool,
 }
 fn default_version() -> NfsVersion {
    NfsVersion::V41
 }
 fn default_ro() -> bool {
    true
 }
 #[derive(Debug, Default)]
 struct Inner {
    mounts: HashMap<String, NfsMount>,
 }
 /// Manages NFS mounts and surfaces them as ISO sources.
 ///
 /// Cheap to clone — internal state is `Arc<Mutex<...>>`.
 #[derive(Debug, Clone)]
 pub struct NfsManager {
    work_root: Arc<PathBuf>,
    state_path: Arc<PathBuf>,
    inner: Arc<Mutex<Inner>>,
    iso_store: IsoStore,
    /// Single-writer lock around the actual `mount`/`umount` shell-outs;
    /// avoids racing on the same target directory.
    mount_lock: Arc<tokio::sync::Mutex<()>>,
 }
 impl NfsManager {
    /// Construct a manager rooted at `work_dir`. Mount points live under
    /// `<work_dir>/nfs/<id>/`. State persists to `<work_dir>/nfs.json`.
    #[must_use]
    pub fn new(work_dir: &Path, iso_store: IsoStore) -> Self {
        let work_root = work_dir.join("nfs");
        let state_path = work_dir.join("nfs.json");
        Self {
            work_root: Arc::new(work_root),
            state_path: Arc::new(state_path),
            inner: Arc::new(Mutex::new(Inner::default())),
            iso_store,
            mount_lock: Arc::new(tokio::sync::Mutex::new(())),
        }
    }
    /// Where this manager mounts shares. Used by `IsoStore` to resolve
    /// NFS-backed `IsoMeta`s to their on-disk path.
    #[must_use]
    pub fn mount_root(&self) -> PathBuf {
        self.work_root.as_ref().clone()
    }
    /// Load persisted state and re-attempt every mount. Errors are logged
    /// per-mount but never fail the call — startup must not block on a
    /// remote NFS server being slow.
    pub async fn load_and_remount(&self) -> Result<()> {
        tokio::fs::create_dir_all(self.work_root.as_path()).await?;
        let mounts = match tokio::fs::read_to_string(self.state_path.as_path()).await {
            Ok(text) => serde_json::from_str::<Vec<NfsMount>>(&text).unwrap_or_default(),
            Err(_) => Vec::new(),
        };
        for mut m in mounts {
            // Always start from "not mounted" — the kernel state was lost
            // when the process died. We'll try to remount each one.
            m.mounted = false;
            m.last_error = None;
            self.inner.lock().mounts.insert(m.id.clone(), m.clone());
            if let Err(e) = self.try_mount(&m.id).await {
                tracing::warn!(
                    target: "openpxe::nfs",
                    id = %m.id, error = %e,
                    "could not remount NFS share on startup"
                );
            }
        }
        Ok(())
    }
    /// Add a new mount. Returns the resulting `NfsMount` (with `mounted`
    /// reflecting reality) or an error if the spec was invalid.
    pub async fn add(&self, req: NfsAddRequest) -> Result<NfsMount> {
        let server = req.server.trim().to_string();
        let export = req.export.trim().to_string();
        if server.is_empty() {
            return Err(Error::Invalid("server is required".into()));
        }
        if !export.starts_with('/') {
            return Err(Error::Invalid("export path must start with '/'".into()));
        }
        let id = mount_id(&server, &export);
        let local_path = self.work_root.join(&id);
        tokio::fs::create_dir_all(&local_path).await?;
        let mount = NfsMount {
            id: id.clone(),
            server,
            export,
            version: req.version,
            read_only: req.read_only,
            local_path,
            mounted: false,
            last_error: None,
            last_attempt: None,
            iso_count: 0,
        };
        self.inner.lock().mounts.insert(id.clone(), mount);
        self.persist_locked();
        self.try_mount(&id).await?;
        Ok(self.get(&id).expect("mount just inserted"))
    }
    /// Unmount and forget a share. Removes any ISOs it contributed from
    /// the IsoStore and deletes the local mount point. Idempotent.
    pub async fn remove(&self, id: &str) -> Result<()> {
        // Best-effort umount; even if it fails (e.g. server unreachable)
        // we still want to drop the in-memory record.
        let _ = self.umount_one(id).await;
        let local_path = {
            let mut g = self.inner.lock();
            g.mounts.remove(id).map(|m| m.local_path)
        };
        self.persist_locked();
        self.iso_store.drop_external_source(id);
        if let Some(p) = local_path {
            // rmdir only — never recurse, the mount could still be live
            // on some kernel error path and we don't want to nuke a
            // remote filesystem.
            let _ = tokio::fs::remove_dir(&p).await;
        }
        Ok(())
    }
    /// Re-scan a mounted share for ISOs, refreshing the IsoStore.
    pub async fn rescan(&self, id: &str) -> Result<u32> {
        let mount = self
            .get(id)
            .ok_or_else(|| Error::Invalid(format!("no such mount '{id}'")))?;
        if !mount.mounted {
            return Err(Error::Invalid(format!("mount '{id}' is not active")));
        }
        let count = self.scan_and_register(&mount).await?;
        if let Some(m) = self.inner.lock().mounts.get_mut(id) {
            m.iso_count = count;
        }
        self.persist_locked();
        Ok(count)
    }
    /// Snapshot of every configured mount.
    #[must_use]
    pub fn list(&self) -> Vec<NfsMount> {
        let g = self.inner.lock();
        let mut v: Vec<_> = g.mounts.values().cloned().collect();
        v.sort_by(|a, b| a.id.cmp(&b.id));
        v
    }
    /// Look up a single mount by id.
    #[must_use]
    pub fn get(&self, id: &str) -> Option<NfsMount> {
        self.inner.lock().mounts.get(id).cloned()
    }
    // ── internals ─────────────────────────────────────────────────────
    async fn try_mount(&self, id: &str) -> Result<()> {
        let _g = self.mount_lock.lock().await;
        let m = self
            .get(id)
            .ok_or_else(|| Error::Invalid(format!("no such mount '{id}'")))?;
        let now = OffsetDateTime::now_utc();
        // Already mounted? Skip — `mount` would error on a busy target
        // and confuse the operator's UI status.
        if is_mountpoint(&m.local_path).await {
            self.update_status(id, true, None, now);
            // Even though already mounted, we still want a fresh ISO count.
            let count = self.scan_and_register(&m).await.unwrap_or(0);
            self.update_iso_count(id, count);
            return Ok(());
        }
        let opts = mount_options(&m);
        let target = format!("{}:{}", m.server, m.export);
        let output = Command::new("mount")
            .arg("-t")
            .arg("nfs")
            .arg("-o")
            .arg(&opts)
            .arg(&target)
            .arg(&m.local_path)
            .output()
            .await;
        match output {
            Ok(out) if out.status.success() => {
                tracing::info!(
                    target: "openpxe::nfs",
                    id = %id, server = %m.server, export = %m.export,
                    version = ?m.version,
                    "NFS mount succeeded"
                );
                self.update_status(id, true, None, now);
                let count = self.scan_and_register(&m).await.unwrap_or(0);
                self.update_iso_count(id, count);
                Ok(())
            }
            Ok(out) => {
                let err = format!(
                    "mount exit {}: {}",
                    out.status.code().unwrap_or(-1),
                    String::from_utf8_lossy(&out.stderr).trim()
                );
                tracing::warn!(target: "openpxe::nfs", id = %id, "{err}");
                self.update_status(id, false, Some(err.clone()), now);
                Err(Error::Invalid(err))
            }
            Err(e) => {
                let err = format!("could not exec /bin/mount: {e}");
                tracing::error!(target: "openpxe::nfs", id = %id, "{err}");
                self.update_status(id, false, Some(err.clone()), now);
                Err(Error::Invalid(err))
            }
        }
    }
    async fn umount_one(&self, id: &str) -> Result<()> {
        let _g = self.mount_lock.lock().await;
        let Some(m) = self.get(id) else { return Ok(()) };
        if !is_mountpoint(&m.local_path).await {
            self.update_status(id, false, None, OffsetDateTime::now_utc());
            return Ok(());
        }
        // -l = lazy: detach immediately, finish when no process has a
        // handle. Important if a stale ISO read is still in flight.
        let out = Command::new("umount")
            .arg("-l")
            .arg(&m.local_path)
            .output()
            .await;
        match out {
            Ok(o) if o.status.success() => {
                self.update_status(id, false, None, OffsetDateTime::now_utc());
                Ok(())
            }
            Ok(o) => {
                let e = format!(
                    "umount exit {}: {}",
                    o.status.code().unwrap_or(-1),
                    String::from_utf8_lossy(&o.stderr).trim()
                );
                self.update_status(id, false, Some(e.clone()), OffsetDateTime::now_utc());
                Err(Error::Invalid(e))
            }
            Err(e) => {
                let e = format!("could not exec /bin/umount: {e}");
                self.update_status(id, false, Some(e.clone()), OffsetDateTime::now_utc());
                Err(Error::Invalid(e))
            }
        }
    }
    /// Walk the mount point for `*.iso` files, introspect each one, and
    /// register it with the IsoStore as an NFS-sourced entry. Returns the
    /// count of ISOs registered.
    async fn scan_and_register(&self, m: &NfsMount) -> Result<u32> {
        // Drop any prior entries from this mount before re-registering, so
        // a removed file disappears from the store.
        self.iso_store.drop_external_source(&m.id);
        let mut walker = tokio::fs::read_dir(&m.local_path).await?;
        let mut count = 0u32;
        while let Some(entry) = walker.next_entry().await? {
            let p = entry.path();
            if p.extension()
                .and_then(|e| e.to_str())
                .map(str::to_ascii_lowercase)
                .as_deref()
                != Some("iso")
            {
                continue;
            }
            let filename = match p.file_name().and_then(|s| s.to_str()) {
                Some(f) => f.to_string(),
                None => continue,
            };
            let size = tokio::fs::metadata(&p).await?.len();
            // Introspection is sync + IO-bound (reads ISO9660 PVD). Push
            // it to a blocking thread so the runtime stays responsive on
            // a slow share.
            let p_owned = p.clone();
            let report: IntrospectionReport =
                tokio::task::spawn_blocking(move || introspect(&p_owned))
                    .await
                    .map_err(|e| Error::Other(e.into()))?;
            let id = format!("nfs-{}-{}", m.id, slugify_str(&filename));
            let boot_entries = generate_boot_entries_for(&id, &filename, &report);
            let source = IsoSource::Nfs {
                mount_id: m.id.clone(),
                relative_path: filename.clone(),
            };
            self.iso_store
                .register_external(id, filename, size, report, boot_entries, source);
            count += 1;
        }
        Ok(count)
    }
    fn update_status(&self, id: &str, mounted: bool, err: Option<String>, ts: OffsetDateTime) {
        if let Some(m) = self.inner.lock().mounts.get_mut(id) {
            m.mounted = mounted;
            m.last_error = err;
            m.last_attempt = Some(ts);
        }
        self.persist_locked();
    }
    fn update_iso_count(&self, id: &str, count: u32) {
        if let Some(m) = self.inner.lock().mounts.get_mut(id) {
            m.iso_count = count;
        }
        self.persist_locked();
    }
    /// Atomically replace the on-disk JSON with the current state.
    /// Persistence errors are logged, never propagated — settings live in
    /// memory authoritatively, matching the SettingsStore policy.
    fn persist_locked(&self) {
        let mounts: Vec<NfsMount> = self.inner.lock().mounts.values().cloned().collect();
        let path = self.state_path.as_path();
        let tmp = path.with_extension("json.tmp");
        let body = match serde_json::to_vec_pretty(&mounts) {
            Ok(b) => b,
            Err(e) => {
                tracing::warn!(target: "openpxe::nfs", "serialize NFS state: {e}");
                return;
            }
        };
        if let Some(parent) = path.parent() {
            let _ = std::fs::create_dir_all(parent);
        }
        if let Err(e) = std::fs::write(&tmp, body) {
            tracing::warn!(target: "openpxe::nfs", "write NFS state tmp: {e}");
            return;
        }
        if let Err(e) = std::fs::rename(&tmp, path) {
            tracing::warn!(target: "openpxe::nfs", "rename NFS state: {e}");
        }
    }
 }
 fn mount_options(m: &NfsMount) -> String {
    let mut opts = vec![m.version.vers_arg().to_string()];
    if m.read_only {
        opts.push("ro".into());
    } else {
        opts.push("rw".into());
    }
    // `nolock` for v3 — many storage appliances disable lockd; we don't
    // need locking for read-only ISO access anyway.
    if matches!(m.version, NfsVersion::V3) {
        opts.push("nolock".into());
    }
    // Soft mount with a generous timeout — better to surface a hung share
    // as a user-visible error than to wedge the iPXE client forever on a
    // dead NFS server.
    opts.push("soft".into());
    opts.push("timeo=100".into());
    opts.push("retrans=3".into());
    opts.join(",")
 }
 fn mount_id(server: &str, export: &str) -> String {
    let raw = format!("{server}{export}");
    slugify_str(&raw)
 }
 /// Detect whether `path` is currently a mount point. We don't have
 /// `is_mountpoint(2)`, so compare the parent's device id to the dir's;
 /// if they differ the dir is a mount.
 async fn is_mountpoint(path: &Path) -> bool {
    let Some(parent) = path.parent() else {
        return false;
    };
    let Ok(m1) = tokio::fs::metadata(path).await else {
        return false;
    };
    let Ok(m2) = tokio::fs::metadata(parent).await else {
        return false;
    };
    use std::os::unix::fs::MetadataExt;
    m1.dev() != m2.dev()
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    #[test]
    fn version_arg() {
        assert_eq!(NfsVersion::V3.vers_arg(), "vers=3");
        assert_eq!(NfsVersion::V41.vers_arg(), "vers=4.1");
    }
    #[test]
    fn mount_options_v3_includes_nolock() {
        let m = NfsMount {
            id: "x".into(),
            server: "s".into(),
            export: "/e".into(),
            version: NfsVersion::V3,
            read_only: true,
            local_path: PathBuf::from("/tmp/x"),
            mounted: false,
            last_error: None,
            last_attempt: None,
            iso_count: 0,
        };
        let opts = mount_options(&m);
        assert!(opts.contains("vers=3"));
        assert!(opts.contains("ro"));
        assert!(opts.contains("nolock"));
        assert!(opts.contains("soft"));
    }
    #[test]
    fn mount_options_v41_no_nolock() {
        let m = NfsMount {
            id: "x".into(),
            server: "s".into(),
            export: "/e".into(),
            version: NfsVersion::V41,
            read_only: false,
            local_path: PathBuf::from("/tmp/x"),
            mounted: false,
            last_error: None,
            last_attempt: None,
            iso_count: 0,
        };
        let opts = mount_options(&m);
        assert!(opts.contains("vers=4.1"));
        assert!(opts.contains("rw"));
        assert!(!opts.contains("nolock"));
    }
    #[test]
    fn mount_id_is_stable_and_safe() {
        let a = mount_id("10.0.0.5", "/srv/isos");
        let b = mount_id("10.0.0.5", "/srv/isos");
        assert_eq!(a, b);
        assert!(!a.contains('/'));
        assert!(!a.contains('.'));
    }
 }
@@ -0,0 +1,992 @@
 //! NFSv3 share consumer — in-process userspace client.
 //!
 //! v0.4.67 brings NFS back, this time *the right way*: a pure-Rust
 //! NFSv3 client (`nfs3_client` from the xetdata family of crates)
 //! that speaks the NFS protocol entirely in userspace over TCP. No
 //! `mount.nfs`, no kernel modules, no `CAP_SYS_ADMIN`. Works in every
 //! container the SMB path (v0.4.65) works in, including Unraid and
 //! restricted-SCC OpenShift.
 //!
 //! ## How it differs from the v0.4.64 NFS path
 //!
 //! v0.4.64 shelled out to `mount(8)` and asked the kernel to attach
 //! the remote share to the local filesystem. That required nfs client
 //! modules on the **host** kernel. Containers that ran on hosts
 //! without those modules — Unraid being the dominant case — failed
 //! with `mount.nfs: failed to apply fstab options` no matter what
 //! capabilities they were granted.
 //!
 //! v0.4.67 doesn't touch the kernel. The client opens a TCP socket to
 //! the NFS server, performs the MOUNT3 RPC to get a root file handle,
 //! and uses NFSv3 READDIR3 / LOOKUP3 / READ3 / GETATTR3 to walk the
 //! share and stream files. The kernel sees plain TCP traffic, nothing
 //! else.
 //!
 //! ## How it differs from the v0.4.65 SMB path
 //!
 //! SMB ships in v0.4.65 via the `smbclient` CLI subprocess. NFS ships
 //! here via a Rust crate — no subprocess, no PATH lookup, no parsing
 //! of human-formatted output. That also means:
 //!
 //!   - **Range requests work** for NFS-sourced ISOs. NFSv3 READ3
 //!     takes an explicit offset, so the HTTP handler can seek into
 //!     the middle of a 5 GB ISO without downloading what comes
 //!     before. SMB-sourced ISOs still return 416 for ranges because
 //!     `smbclient -c 'get file -'` is a sequential stream.
 //!   - **Introspection could work** (we could LOOKUP the ISO9660 PVD
 //!     at offset 0x8000 and parse the volume label). For v0.4.67 we
 //!     don't yet — same as SMB, NFS-sourced ISOs register with an
 //!     `Unknown` family and fall back to generic sanboot. A follow-up
 //!     can add bounded read-based detection.
 //!
 //! ## How it's the same as SMB
 //!
 //! The public surface is deliberately parallel: `NfsShareManager`
 //! mirrors `SmbShareManager`, `NfsShare` mirrors `SmbShare`, the API
 //! responses use the same `{error, stderr, hint}` shape so the UI's
 //! storage tab renders both protocols through one code path. The
 //! state file (`<work_dir>/nfs_shares.json`) sits next to
 //! `smb_shares.json`.
 //!
 //! ## No auth
 //!
 //! NFSv3 uses AUTH_SYS by default — the client tells the server "I'm
 //! uid X, gid Y" and the server decides whether to trust that. Most
 //! NAS appliances exposing ISO libraries via NFS gate access by
 //! **client IP address** rather than uid, so there's nothing for the
 //! UI to ask for. (If a future server needs Kerberos or non-default
 //! uid mapping we can add those, but for ISO read access nobody does.)
 use crate::introspect::{DistroFamily, IntrospectionReport};
 use crate::store::{generate_boot_entries_for, slugify_str, IsoSource, IsoStore};
 use bytes::Bytes;
 use nfs3_client::tokio::TokioConnector;
 use nfs3_client::Nfs3ConnectionBuilder;
 use nfs3_types::nfs3::{
    self as nfs3, diropargs3, entry3, filename3, nfs_fh3, GETATTR3args, LOOKUP3args,
    Nfs3Result, READ3args, READDIR3args,
 };
 use nfs3_types::xdr_codec::Opaque;
 use openpxe_core::{Error, Result};
 use parking_lot::Mutex;
 use serde::{Deserialize, Serialize};
 use std::borrow::Cow;
 use std::collections::HashMap;
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
 use std::time::Duration;
 use time::OffsetDateTime;
 /// Default TCP port for the NFSv3 protocol. The classic split (111
 /// portmapper + dynamic mountd) is supported by the underlying crate;
 /// for direct connection-mode NAS appliances 2049 is what answers.
 const DEFAULT_NFS_PORT: u16 = 2049;
 /// How long we wait for the initial MOUNT3 + portmap handshake before
 /// giving up. Mirrors the SMB pre-flight probe shape so the UI's
 /// timeout banner reads consistently across protocols.
 const CONNECT_TIMEOUT: Duration = Duration::from_secs(8);
 /// NFSv3 READ3 chunk size. The protocol's hard cap is 1 MiB per
 /// reply; 64 KiB is a polite default that nearly every server hands
 /// back without fragmentation and keeps in-flight memory bounded
 /// during a streaming response.
 const READ_CHUNK_BYTES: u32 = 64 * 1024;
 /// Bound on the in-flight queue between the read-loop task and the
 /// HTTP body stream. 16 * 64 KiB ≈ 1 MiB max buffer per stream —
 /// enough to keep the network pipe full without letting a slow
 /// client park gigabytes of decoded ISO in RAM.
 const STREAM_BUFFER_DEPTH: usize = 16;
 /// One configured NFS share. The id is derived from server+export so
 /// re-adding the same coordinates is idempotent.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct NfsShare {
    pub id: String,
    pub server: String,
    /// Export path on the server (e.g. "/srv/isos"). Must start with
    /// "/" to match the NFS server's view; we validate on add.
    pub export: String,
    /// TCP port — 2049 unless the operator overrode it.
    #[serde(default = "default_port")]
    pub port: u16,
    /// Most recent error talking to the share, or `None` on success.
    pub last_error: Option<String>,
    /// Operator-friendly translation of `last_error`. None when we
    /// don't have a friendlier rendition.
    pub last_hint: Option<String>,
    #[serde(with = "time::serde::rfc3339::option")]
    pub last_scan: Option<OffsetDateTime>,
    pub iso_count: u32,
    /// True after a successful scan, false on failure. Drives the
    /// UI dot.
    pub reachable: bool,
 }
 /// Submission from the UI / API.
 #[derive(Debug, Clone, Deserialize)]
 pub struct NfsAddRequest {
    pub server: String,
    pub export: String,
    #[serde(default)]
    pub port: Option<u16>,
 }
 fn default_port() -> u16 {
    DEFAULT_NFS_PORT
 }
 /// Structured error surfaced to the API and rendered in the UI. Same
 /// shape as `SmbShareError` so the storage tab uses one rendering
 /// path for both protocols.
 #[derive(Debug, Clone, Serialize)]
 pub struct NfsShareError {
    pub error: String,
    pub stderr: String,
    pub hint: Option<String>,
 }
 impl NfsShareError {
    fn from_raw(error: impl Into<String>, stderr: impl Into<String>) -> Self {
        let stderr = stderr.into();
        let error = error.into();
        let hint = hint_for(&stderr).or_else(|| hint_for(&error));
        Self {
            error,
            stderr,
            hint,
        }
    }
 }
 #[derive(Debug, Default)]
 struct Inner {
    shares: HashMap<String, NfsShare>,
 }
 /// Manages NFS shares. Cheap to clone — internal state is
 /// `Arc<Mutex<...>>`.
 #[derive(Debug, Clone)]
 pub struct NfsShareManager {
    state_path: Arc<PathBuf>,
    inner: Arc<Mutex<Inner>>,
    iso_store: IsoStore,
    /// Serializes scan operations on the same manager. Each scan
    /// opens its own NFS connection so concurrency isn't a hard
    /// requirement, but serializing keeps log output predictable.
    op_lock: Arc<tokio::sync::Mutex<()>>,
 }
 impl NfsShareManager {
    /// Construct a manager. State persists to
    /// `<work_dir>/nfs_shares.json`.
    #[must_use]
    pub fn new(work_dir: &Path, iso_store: IsoStore) -> Self {
        let state_path = work_dir.join("nfs_shares.json");
        Self {
            state_path: Arc::new(state_path),
            inner: Arc::new(Mutex::new(Inner::default())),
            iso_store,
            op_lock: Arc::new(tokio::sync::Mutex::new(())),
        }
    }
    /// Load persisted state and re-scan every share. Per-share
    /// failures are logged but never propagated — startup must not
    /// block on a single offline server.
    pub async fn load_and_rescan(&self) -> Result<()> {
        let shares = match tokio::fs::read_to_string(self.state_path.as_path()).await {
            Ok(text) => serde_json::from_str::<Vec<NfsShare>>(&text).unwrap_or_default(),
            Err(_) => Vec::new(),
        };
        for mut s in shares {
            s.last_error = None;
            s.last_hint = None;
            s.reachable = false;
            self.inner.lock().shares.insert(s.id.clone(), s.clone());
            if let Err(e) = self.rescan_inner(&s.id).await {
                tracing::warn!(
                    target: "openpxe::nfs",
                    id = %s.id, server = %s.server, export = %s.export,
                    "rescan on startup failed: {e}"
                );
            }
        }
        Ok(())
    }
    /// Register an NFS share. Validates, probes connectivity by
    /// performing a real MOUNT3 + READDIR3, and registers the
    /// resulting ISOs with the store.
    pub async fn add(
        &self,
        req: NfsAddRequest,
    ) -> std::result::Result<NfsShare, NfsShareError> {
        let server = normalize_server(&req.server);
        let export = req.export.trim().to_string();
        if server.is_empty() {
            return Err(NfsShareError::from_raw("server is required", ""));
        }
        if !export.starts_with('/') {
            return Err(NfsShareError::from_raw(
                "export path must start with '/' (e.g. /srv/isos)",
                "",
            ));
        }
        if server.contains('\0') || export.contains('\0') {
            return Err(NfsShareError::from_raw("NUL bytes are not allowed", ""));
        }
        let port = req.port.filter(|p| *p != 0).unwrap_or(DEFAULT_NFS_PORT);
        let id = share_id(&server, &export);
        let spec = NfsShare {
            id: id.clone(),
            server,
            export,
            port,
            last_error: None,
            last_hint: None,
            last_scan: None,
            iso_count: 0,
            reachable: false,
        };
        self.inner.lock().shares.insert(id.clone(), spec);
        self.persist_locked();
        if let Err(e) = self.rescan_inner(&id).await {
            let m = self.get(&id);
            return Err(NfsShareError {
                error: m.as_ref().and_then(|m| m.last_error.clone())
                    .unwrap_or_else(|| e.to_string()),
                stderr: String::new(),
                hint: m.and_then(|m| m.last_hint),
            });
        }
        Ok(self.get(&id).expect("just inserted"))
    }
    /// Remove a share. Drops every ISO sourced from it. Idempotent.
    /// Async for symmetry with [`SmbShareManager::remove`] — the
    /// SMB version is async because it tears down a credentials
    /// file; NFS has nothing to clean up but we keep the signature
    /// uniform so the call sites in app.rs / terminal.rs match.
    #[allow(clippy::unused_async)]
    pub async fn remove(&self, id: &str) -> Result<()> {
        let removed = self.inner.lock().shares.remove(id).is_some();
        if removed {
            self.iso_store.drop_external_source(id);
            self.persist_locked();
        }
        Ok(())
    }
    /// Re-walk a share for new / removed ISOs.
    pub async fn rescan(&self, id: &str) -> Result<u32> {
        self.rescan_inner(id).await
    }
    #[must_use]
    pub fn list(&self) -> Vec<NfsShare> {
        let g = self.inner.lock();
        let mut v: Vec<_> = g.shares.values().cloned().collect();
        v.sort_by(|a, b| a.id.cmp(&b.id));
        v
    }
    #[must_use]
    pub fn get(&self, id: &str) -> Option<NfsShare> {
        self.inner.lock().shares.get(id).cloned()
    }
    /// Open a byte stream reading `filename` out of share `share_id`,
    /// starting at `start_offset` and reading at most `max_len`
    /// bytes. The returned stream yields `Bytes` chunks (≤
    /// `READ_CHUNK_BYTES`) and ends at EOF, after `max_len` bytes, or
    /// on the first transport error.
    ///
    /// Used by the HTTP ISO download handler. Supports HTTP Range
    /// requests because NFSv3 READ3 takes an explicit offset — this
    /// is the protocol-level advantage NFS has over the SMB
    /// userspace path.
    ///
    /// Kept `async` for symmetry with [`SmbShareManager::stream_iso`]
    /// even though the body doesn't await today — a future
    /// refinement (e.g. throttling, connection pooling) will need to
    /// await without changing call sites.
    #[allow(clippy::unused_async)]
    pub async fn stream_iso(
        &self,
        share_id: &str,
        filename: &str,
        start_offset: u64,
        max_len: Option<u64>,
    ) -> Result<NfsStream> {
        let share = self
            .get(share_id)
            .ok_or_else(|| Error::Invalid(format!("no such NFS share '{share_id}'")))?;
        // Defensive: NFSv3 LOOKUP3 takes a single name relative to
        // the export root, not a path. We don't support nested
        // directories in v0.4.67 — ISOs live at the top of the share.
        if filename.contains('/') || filename.contains('\\') || filename.contains("..") {
            return Err(Error::Invalid(format!("invalid filename '{filename}'")));
        }
        let (tx, rx) =
            tokio::sync::mpsc::channel::<std::io::Result<Bytes>>(STREAM_BUFFER_DEPTH);
        let server = share.server.clone();
        let export = share.export.clone();
        let port = share.port;
        let fname = filename.to_string();
        // Spawn a task that owns the NFS connection. Owning the
        // connection inside the spawn means we don't have to worry
        // about borrowing across awaits or sharing the connection
        // between scan and stream — each stream gets its own.
        let task = tokio::spawn(async move {
            let result = stream_loop(
                &server,
                &export,
                port,
                &fname,
                start_offset,
                max_len,
                tx.clone(),
            )
            .await;
            if let Err(e) = result {
                // Best-effort signal of the error to the consumer.
                // If the receiver has already dropped we just exit.
                let _ = tx
                    .send(Err(std::io::Error::other(e.to_string())))
                    .await;
            }
        });
        Ok(NfsStream {
            rx,
            _task: task,
        })
    }
    // ── internals ─────────────────────────────────────────────────────
    async fn rescan_inner(&self, id: &str) -> Result<u32> {
        let _g = self.op_lock.lock().await;
        let share = self
            .get(id)
            .ok_or_else(|| Error::Invalid(format!("no such share '{id}'")))?;
        let now = OffsetDateTime::now_utc();
        // Drop prior entries so a deleted file disappears from the
        // store on the next scan.
        self.iso_store.drop_external_source(id);
        let listing = match list_isos(&share.server, &share.export, share.port).await {
            Ok(l) => l,
            Err(err) => {
                let stderr = err.to_string();
                let hint = hint_for(&stderr);
                self.update_status(id, 0, false, Some(stderr.clone()), hint, now);
                return Err(Error::Invalid(stderr));
            }
        };
        let mut count = 0u32;
        for entry in listing {
            let iso_id = format!("nfs-{}-{}", share.id, slugify_str(&entry.filename));
            // Same approach as SMB: no real introspection over the
            // network in v0.4.67. The boot-entry generator falls back
            // to filename-based sanboot detection.
            let report = IntrospectionReport {
                family: DistroFamily::Unknown,
                volume_label: None,
                kernel_path: None,
                initrd_paths: Vec::new(),
                has_boot_wim: false,
            };
            let boot_entries = generate_boot_entries_for(&iso_id, &entry.filename, &report);
            let source = IsoSource::Nfs {
                share_id: share.id.clone(),
                relative_path: entry.filename.clone(),
            };
            self.iso_store.register_external(
                iso_id,
                entry.filename,
                entry.size,
                report,
                boot_entries,
                source,
            );
            count += 1;
        }
        self.update_status(id, count, true, None, None, now);
        tracing::info!(
            target: "openpxe::nfs",
            id = %id, server = %share.server, export = %share.export,
            iso_count = count,
            "NFS share scanned"
        );
        Ok(count)
    }
    fn update_status(
        &self,
        id: &str,
        iso_count: u32,
        reachable: bool,
        err: Option<String>,
        hint: Option<String>,
        ts: OffsetDateTime,
    ) {
        if let Some(s) = self.inner.lock().shares.get_mut(id) {
            s.iso_count = iso_count;
            s.reachable = reachable;
            s.last_error = err;
            s.last_hint = hint;
            s.last_scan = Some(ts);
        }
        self.persist_locked();
    }
    fn persist_locked(&self) {
        let shares: Vec<NfsShare> = self.inner.lock().shares.values().cloned().collect();
        let path = self.state_path.as_path();
        let tmp = path.with_extension("json.tmp");
        let body = match serde_json::to_vec_pretty(&shares) {
            Ok(b) => b,
            Err(e) => {
                tracing::warn!(target: "openpxe::nfs", "serialize: {e}");
                return;
            }
        };
        if let Some(parent) = path.parent() {
            let _ = std::fs::create_dir_all(parent);
        }
        if let Err(e) = std::fs::write(&tmp, body) {
            tracing::warn!(target: "openpxe::nfs", "write tmp: {e}");
            return;
        }
        if let Err(e) = std::fs::rename(&tmp, path) {
            tracing::warn!(target: "openpxe::nfs", "rename: {e}");
        }
    }
 }
 /// HTTP body stream for an NFS-sourced ISO read.
 ///
 /// Implements `Stream<Item = io::Result<Bytes>>` so axum can convert
 /// it into a response body via `Body::from_stream`.
 #[derive(Debug)]
 pub struct NfsStream {
    rx: tokio::sync::mpsc::Receiver<std::io::Result<Bytes>>,
    /// Kept alive so the read-loop task isn't dropped while the HTTP
    /// client is still consuming bytes. Dropping the stream cancels
    /// the task, which is the right behavior on client disconnect.
    _task: tokio::task::JoinHandle<()>,
 }
 impl futures::Stream for NfsStream {
    type Item = std::io::Result<Bytes>;
    fn poll_next(
        mut self: std::pin::Pin<&mut Self>,
        cx: &mut std::task::Context<'_>,
    ) -> std::task::Poll<Option<Self::Item>> {
        self.rx.poll_recv(cx)
    }
 }
 #[derive(Debug, Clone)]
 struct NfsListEntry {
    filename: String,
    size: u64,
 }
 /// Connect, READDIR the export root, look up each `*.iso` to get its
 /// size + file handle. Returns a flat list. Errors are returned with
 /// a human-readable message; the caller decides how to surface them.
 async fn list_isos(
    server: &str,
    export: &str,
    port: u16,
 ) -> std::result::Result<Vec<NfsListEntry>, NfsClientError> {
    // build_connection applies its own per-attempt timeout (privileged
    // source port first, then a non-privileged fallback).
    let mut conn = build_connection(server, export, port).await?;
    let root = conn.root_nfs_fh3();
    let mut entries = Vec::new();
    let mut cookie: u64 = 0;
    let mut cookieverf = nfs3::cookieverf3::default();
    loop {
        let res = conn
            .readdir(&READDIR3args {
                dir: root.clone(),
                cookie,
                cookieverf,
                count: 32 * 1024,
            })
            .await
            .map_err(NfsClientError::Rpc)?;
        let ok = match res {
            Nfs3Result::Ok(ok) => ok,
            Nfs3Result::Err((status, _)) => {
                return Err(NfsClientError::Nfsstat(status_label(status)));
            }
        };
        cookieverf = ok.cookieverf;
        let eof = ok.reply.eof;
        let dir_entries: Vec<entry3<'_>> = ok.reply.entries.0;
        let next_cookie = dir_entries.last().map(|e| e.cookie);
        for entry in dir_entries {
            // entry.name is `filename3<'a>(Opaque<'a>)` — XDR opaque
            // bytes. Decode to UTF-8 best-effort.
            let name_bytes = entry.name.0.as_ref();
            let Ok(name) = std::str::from_utf8(name_bytes) else {
                continue;
            };
            if name == "." || name == ".." {
                continue;
            }
            if !name.to_ascii_lowercase().ends_with(".iso") {
                continue;
            }
            // Look up the file to get its size + verify it's a
            // regular file (not a symlink / directory matching the
            // .iso pattern).
            let lookup = conn
                .lookup(&LOOKUP3args {
                    what: diropargs3 {
                        dir: root.clone(),
                        name: filename3(Opaque::borrowed(name_bytes)),
                    },
                })
                .await
                .map_err(NfsClientError::Rpc)?;
            let lookup_ok = match lookup {
                Nfs3Result::Ok(o) => o,
                Nfs3Result::Err(_) => continue,
            };
            let getattr = conn
                .getattr(&GETATTR3args {
                    object: lookup_ok.object,
                })
                .await
                .map_err(NfsClientError::Rpc)?;
            let attrs = match getattr {
                Nfs3Result::Ok(o) => o.obj_attributes,
                Nfs3Result::Err(_) => continue,
            };
            // ftype3::NF3REG == 1 (regular file). Skip everything
            // else — directories, symlinks, devices.
            if attrs.type_ as u32 != nfs3::ftype3::NF3REG as u32 {
                continue;
            }
            entries.push(NfsListEntry {
                filename: name.to_string(),
                size: attrs.size,
            });
        }
        if eof {
            break;
        }
        match next_cookie {
            Some(c) if c != 0 => cookie = c,
            _ => break,
        }
    }
    let _ = conn.unmount().await;
    Ok(entries)
 }
 async fn stream_loop(
    server: &str,
    export: &str,
    port: u16,
    filename: &str,
    start_offset: u64,
    max_len: Option<u64>,
    tx: tokio::sync::mpsc::Sender<std::io::Result<Bytes>>,
 ) -> std::result::Result<(), NfsClientError> {
    let mut conn = build_connection(server, export, port).await?;
    let root = conn.root_nfs_fh3();
    // Look up the file to get its handle.
    let name_bytes = filename.as_bytes();
    let lookup = conn
        .lookup(&LOOKUP3args {
            what: diropargs3 {
                dir: root,
                name: filename3(Opaque::borrowed(name_bytes)),
            },
        })
        .await
        .map_err(NfsClientError::Rpc)?;
    let lookup_ok = match lookup {
        Nfs3Result::Ok(o) => o,
        Nfs3Result::Err((status, _)) => {
            return Err(NfsClientError::Nfsstat(status_label(status)));
        }
    };
    let file_handle: nfs_fh3 = lookup_ok.object;
    let mut offset = start_offset;
    let mut remaining = max_len;
    loop {
        if let Some(r) = remaining {
            if r == 0 {
                break;
            }
        }
        // Cap the chunk at READ_CHUNK_BYTES and at the remaining budget.
        let chunk = match remaining {
            Some(r) if r < u64::from(READ_CHUNK_BYTES) => r as u32,
            _ => READ_CHUNK_BYTES,
        };
        let res = conn
            .read(&READ3args {
                file: file_handle.clone(),
                offset,
                count: chunk,
            })
            .await
            .map_err(NfsClientError::Rpc)?;
        let ok = match res {
            Nfs3Result::Ok(o) => o,
            Nfs3Result::Err((status, _)) => {
                return Err(NfsClientError::Nfsstat(status_label(status)));
            }
        };
        let bytes = Bytes::copy_from_slice(ok.data.as_ref());
        let bytes_len = bytes.len() as u64;
        if tx.send(Ok(bytes)).await.is_err() {
            // HTTP client dropped — abort gracefully.
            break;
        }
        offset += bytes_len;
        if let Some(r) = remaining.as_mut() {
            *r = r.saturating_sub(bytes_len);
        }
        if ok.eof {
            break;
        }
        // Defensive: a server that returns 0 bytes without EOF
        // would have us busy-looping. Bail out instead.
        if bytes_len == 0 {
            break;
        }
    }
    let _ = conn.unmount().await;
    Ok(())
 }
 /// Mount the export and return a live connection.
 ///
 /// ## Privileged source port (the v0.4.68 fix)
 ///
 /// Linux kernel `nfsd` — which is what UniFi UNAS, Synology, TrueNAS,
 /// and essentially every appliance NAS runs underneath — exports with
 /// the `secure` option **by default**. `secure` means the server only
 /// accepts MOUNT3 / NFS3 requests whose TCP **source** port is in the
 /// privileged range (< 1024). A client connecting from an ephemeral
 /// high port gets `MNT3ERR_ACCES` at mount time — which is exactly the
 /// error operators hit in v0.4.67 even with their host IP correctly in
 /// the export's allow-list.
 ///
 /// v0.4.67 disabled privileged source ports because the openpxe
 /// process runs as uid 10001 and "can't bind sub-1024 ports". That
 /// reasoning was wrong: the binary carries `CAP_NET_BIND_SERVICE`
 /// (granted via `setcap` in the Dockerfile so it can bind the DHCP /
 /// TFTP / HTTP low ports as non-root), and that capability also lets
 /// it bind a privileged *source* port for an outbound connection.
 ///
 /// So we now try a privileged source port first — the common case for
 /// real NAS appliances — and fall back to a non-privileged port for
 /// servers exported `insecure` (or environments where we genuinely
 /// can't grab a low port). Each attempt gets its own connect timeout.
 async fn build_connection(
    server: &str,
    export: &str,
    port: u16,
 ) -> std::result::Result<
    nfs3_client::Nfs3Connection<nfs3_client::tokio::TokioIo<tokio::net::TcpStream>>,
    NfsClientError,
 > {
    match connect_once(server, export, port, true).await {
        Ok(conn) => Ok(conn),
        // A timeout means the server didn't answer at all — a
        // non-privileged retry would just time out again and double
        // the operator's wait. Surface the timeout immediately.
        Err(primary @ NfsClientError::Timeout(..)) => Err(primary),
        Err(primary) => match connect_once(server, export, port, false).await {
            Ok(conn) => Ok(conn),
            // Surface the privileged-attempt error: for the dominant
            // `secure`-export case it's the one whose hint points at
            // the real fix.
            Err(_) => Err(primary),
        },
    }
 }
 /// One mount attempt with a specific source-port policy, bounded by
 /// [`CONNECT_TIMEOUT`].
 async fn connect_once(
    server: &str,
    export: &str,
    port: u16,
    privileged: bool,
 ) -> std::result::Result<
    nfs3_client::Nfs3Connection<nfs3_client::tokio::TokioIo<tokio::net::TcpStream>>,
    NfsClientError,
 > {
    let fut = Nfs3ConnectionBuilder::new(TokioConnector, server, export)
        .connect_from_privileged_port(privileged)
        .nfs3_port(port)
        .mount();
    match tokio::time::timeout(CONNECT_TIMEOUT, fut).await {
        Ok(Ok(conn)) => Ok(conn),
        Ok(Err(e)) => Err(NfsClientError::Connect(e.to_string())),
        Err(_) => Err(NfsClientError::Timeout(server.to_string(), port)),
    }
 }
 #[derive(Debug)]
 enum NfsClientError {
    Connect(String),
    Timeout(String, u16),
    Rpc(nfs3_client::RpcError),
    Nfsstat(String),
 }
 impl std::fmt::Display for NfsClientError {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self {
            Self::Connect(msg) => write!(f, "connect failed: {msg}"),
            Self::Timeout(host, port) => write!(
                f,
                "connect timed out after {}s talking to {host}:{port}",
                CONNECT_TIMEOUT.as_secs()
            ),
            Self::Rpc(e) => write!(f, "RPC failure: {e}"),
            Self::Nfsstat(s) => write!(f, "NFS server returned {s}"),
        }
    }
 }
 impl std::error::Error for NfsClientError {}
 /// Best-effort label for an `nfsstat3` so the UI shows a readable
 /// name like `NFS3ERR_ACCES` instead of a magic number.
 fn status_label(status: nfs3::nfsstat3) -> String {
    use nfs3::nfsstat3 as S;
    let name = match status {
        S::NFS3_OK => "NFS3_OK",
        S::NFS3ERR_PERM => "NFS3ERR_PERM",
        S::NFS3ERR_NOENT => "NFS3ERR_NOENT",
        S::NFS3ERR_IO => "NFS3ERR_IO",
        S::NFS3ERR_NXIO => "NFS3ERR_NXIO",
        S::NFS3ERR_ACCES => "NFS3ERR_ACCES",
        S::NFS3ERR_EXIST => "NFS3ERR_EXIST",
        S::NFS3ERR_XDEV => "NFS3ERR_XDEV",
        S::NFS3ERR_NODEV => "NFS3ERR_NODEV",
        S::NFS3ERR_NOTDIR => "NFS3ERR_NOTDIR",
        S::NFS3ERR_ISDIR => "NFS3ERR_ISDIR",
        S::NFS3ERR_INVAL => "NFS3ERR_INVAL",
        S::NFS3ERR_FBIG => "NFS3ERR_FBIG",
        S::NFS3ERR_NOSPC => "NFS3ERR_NOSPC",
        S::NFS3ERR_ROFS => "NFS3ERR_ROFS",
        S::NFS3ERR_MLINK => "NFS3ERR_MLINK",
        S::NFS3ERR_NAMETOOLONG => "NFS3ERR_NAMETOOLONG",
        S::NFS3ERR_NOTEMPTY => "NFS3ERR_NOTEMPTY",
        S::NFS3ERR_DQUOT => "NFS3ERR_DQUOT",
        S::NFS3ERR_STALE => "NFS3ERR_STALE",
        S::NFS3ERR_REMOTE => "NFS3ERR_REMOTE",
        S::NFS3ERR_BADHANDLE => "NFS3ERR_BADHANDLE",
        S::NFS3ERR_NOT_SYNC => "NFS3ERR_NOT_SYNC",
        S::NFS3ERR_BAD_COOKIE => "NFS3ERR_BAD_COOKIE",
        S::NFS3ERR_NOTSUPP => "NFS3ERR_NOTSUPP",
        S::NFS3ERR_TOOSMALL => "NFS3ERR_TOOSMALL",
        S::NFS3ERR_SERVERFAULT => "NFS3ERR_SERVERFAULT",
        S::NFS3ERR_BADTYPE => "NFS3ERR_BADTYPE",
        S::NFS3ERR_JUKEBOX => "NFS3ERR_JUKEBOX",
    };
    name.to_string()
 }
 /// Translate well-known NFS error strings into actionable hints for
 /// the UI. Mirrors the SMB hint table in spirit; the patterns are
 /// different because NFS errors travel via NFS3ERR_* codes plus
 /// transport-level messages from the Rust crate.
 fn hint_for(text: &str) -> Option<String> {
    let s = text.to_ascii_lowercase();
    if s.contains("mnt3err_acces") || s.contains("mount") && s.contains("acces") {
        // Mount-protocol access denial. Two common causes, in order of
        // likelihood for an appliance NAS: (1) the export requires a
        // privileged source port (`secure`, the Linux default) — we
        // already retry with one, so reaching here means even that was
        // refused; (2) the client IP isn't in the allow-list.
        Some(
            "the NFS server denied the mount (MNT3ERR_ACCES). Two things to \
             check on the server: (1) this OpenPXE host's IP is in the \
             export's allowed-clients list, and (2) if your export uses the \
             default `secure` option, OpenPXE already connects from a \
             privileged port — but if the server still refuses, add \
             `insecure` to the export. On UniFi UNAS, confirm the host IP is \
             listed under the share's NFS permissions and the export path is \
             /var/nfs/shared/<share> (not just /<share>)."
                .into(),
        )
    } else if s.contains("nfs3err_acces") || s.contains("permission denied") {
        Some(
            "the NFS server rejected this client. Most likely your export \
             is restricted by client IP — add this OpenPXE host (or its \
             subnet) to the export's allowed-clients list on the server."
                .into(),
        )
    } else if s.contains("nfs3err_noent")
        || s.contains("nfs3err_notdir")
        || s.contains("mnt3err_noent")
    {
        Some(
            "the export path doesn't exist on the server, or it isn't a \
             directory. Double-check the path (e.g. /srv/isos vs /isos — \
             UniFi UNAS Pro exposes shares under /var/nfs/shared/<name>)."
                .into(),
        )
    } else if s.contains("nfs3err_stale") || s.contains("nfs3err_badhandle") {
        Some(
            "the server's view of the share changed under us. Re-scan; \
             if that doesn't help, remove and re-add the share."
                .into(),
        )
    } else if s.contains("connect timed out")
        || s.contains("timed out")
        || s.contains("connection timed out")
    {
        Some(
            "no answer from the server within the connect timeout. \
             Verify the IP, the port (default 2049), and any firewall \
             between OpenPXE and the NAS."
                .into(),
        )
    } else if s.contains("connection refused") {
        Some(
            "the NFS service isn't accepting connections on this port. \
             Make sure nfsd is running on the server and (for v3) the \
             portmapper on port 111 is reachable."
                .into(),
        )
    } else if s.contains("no route to host") || s.contains("network is unreachable") {
        Some(
            "the server isn't reachable on this network. Check the IP \
             and routes."
                .into(),
        )
    } else if s.contains("mount") && s.contains("denied") {
        Some(
            "MOUNT3 was denied. The classic cause is that the export's \
             `rw=<host>` / `ro=<host>` list doesn't include this client. \
             Some servers also require `insecure` in /etc/exports for \
             non-privileged source ports — which is what this client \
             uses (we run as uid 10001, no privileged-port capability)."
                .into(),
        )
    } else {
        None
    }
 }
 fn share_id(server: &str, export: &str) -> String {
    slugify_str(&format!("{server}{export}"))
 }
 /// Normalize a server input: trim, strip schemes, drop trailing
 /// slashes. Matches the SMB normalizer so paste-from-anywhere works.
 fn normalize_server(raw: &str) -> String {
    let s = raw.trim();
    let s = s
        .strip_prefix("nfs://")
        .or_else(|| s.strip_prefix("http://"))
        .or_else(|| s.strip_prefix("https://"))
        .unwrap_or(s);
    s.trim_end_matches('/').to_string()
 }
 // Silence the unused-import warning on `Cow` — we use it implicitly
 // via `Opaque::borrowed` constructions in `list_isos`.
 #[allow(dead_code)]
 fn _unused() -> Cow<'static, str> {
    Cow::Borrowed("")
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    #[test]
    fn share_id_is_stable_and_safe() {
        let a = share_id("10.0.0.5", "/srv/isos");
        let b = share_id("10.0.0.5", "/srv/isos");
        assert_eq!(a, b);
        assert!(!a.contains('/'));
        assert!(!a.contains('.'));
    }
    #[test]
    fn normalize_server_strips_schemes() {
        assert_eq!(normalize_server("  10.0.0.5  "), "10.0.0.5");
        assert_eq!(normalize_server("nfs://nas.lan/"), "nas.lan");
        assert_eq!(normalize_server("http://192.168.1.51"), "192.168.1.51");
        assert_eq!(normalize_server("nas.lan"), "nas.lan");
    }
    #[test]
    fn hint_for_acces_points_to_exports_table() {
        let h = hint_for("NFS server returned NFS3ERR_ACCES").unwrap();
        assert!(
            h.to_lowercase().contains("export"),
            "expected exports guidance, got: {h}"
        );
    }
    #[test]
    fn hint_for_mount_acces_calls_out_privileged_port_and_allowlist() {
        // The dominant v0.4.67 field failure: mount denied even with the
        // host IP allow-listed, because the export is `secure` and the
        // client used a high source port. The hint should mention both
        // the allow-list and the secure/insecure angle.
        let h = hint_for("connect failed: MNT3ERR_ACCES").unwrap();
        let lc = h.to_lowercase();
        assert!(lc.contains("insecure") || lc.contains("privileged"), "got: {h}");
        assert!(lc.contains("allow") || lc.contains("permission"), "got: {h}");
    }
    #[test]
    fn hint_for_noent_points_to_export_path() {
        let h = hint_for("NFS server returned NFS3ERR_NOENT").unwrap();
        assert!(
            h.to_lowercase().contains("path") || h.to_lowercase().contains("directory"),
            "expected export-path guidance, got: {h}"
        );
    }
    #[test]
    fn hint_for_mount_denied_calls_out_insecure_option() {
        let h = hint_for("mount denied").unwrap();
        assert!(h.to_lowercase().contains("insecure"));
    }
    #[test]
    fn hint_for_unknown_is_none() {
        assert!(hint_for("some entirely unrelated string").is_none());
    }
    #[test]
    fn status_label_covers_common_codes() {
        assert_eq!(status_label(nfs3::nfsstat3::NFS3_OK), "NFS3_OK");
        assert_eq!(status_label(nfs3::nfsstat3::NFS3ERR_ACCES), "NFS3ERR_ACCES");
        assert_eq!(status_label(nfs3::nfsstat3::NFS3ERR_NOENT), "NFS3ERR_NOENT");
    }
 }
@@ -0,0 +1,152 @@
 //! Operator-logo compositor for the iPXE menu.
 //!
 //! The brief: match iVentoy's polished centered-logo PXE chrome with
 //! whatever raster the operator drops onto Settings → Branding. A wide
 //! wordmark, a portrait stack, a square monogram — all three should
 //! land in roughly the same place on the boot screen.
 //!
 //! Approach: decode the operator's upload, fit it into a fixed
 //! 1024×768 canvas with the logo horizontally centered and pinned a
 //! short margin from the top, re-encode as PNG, return the bytes. iPXE
 //! built with `IMAGE_PNG` paints the result via `console --picture`.
 //!
 //! The 1024×768 size matches the default VESA framebuffer iPXE picks
 //! on most BIOS/UEFI consoles. Operators uploading 4K logos get
 //! correctly downscaled; tiny icons get drawn at their native size,
 //! centered, with transparent margins.
 //!
 //! We deliberately don't ship `resvg` for SVG support — keeping the
 //! dependency surface narrow matters more than supporting SVG-only
 //! brand assets. The WebUI's logo stays SVG-native (the browser
 //! rasterizes it); the PXE menu wants a raster regardless.
 use image::imageops::FilterType;
 use image::{DynamicImage, ImageError, ImageFormat, Rgba, RgbaImage};
 use std::io::Cursor;
 /// Canvas dimensions used for the composed PXE logo. Picked to match
 /// the framebuffer dimensions iPXE picks on most BIOS/UEFI consoles —
 /// gives a 1:1 paint with no scaling at the firmware layer.
 pub const CANVAS_W: u32 = 1024;
 pub const CANVAS_H: u32 = 768;
 /// Maximum dimensions for the operator's logo inside the canvas. Any
 /// upload larger than this in either axis is downscaled (preserving
 /// aspect ratio) to fit. Smaller uploads paint at native size.
 const LOGO_MAX_W: u32 = 600;
 const LOGO_MAX_H: u32 = 200;
 /// Top margin in pixels from the canvas's top edge to the logo's top
 /// edge. Matches the visual rhythm of iVentoy's screen (logo at top,
 /// menu below).
 const LOGO_TOP_MARGIN: u32 = 64;
 /// Compose `src_bytes` (any PNG/JPEG/WebP/GIF) into a centered-top
 /// 1024×768 PNG and return the encoded bytes.
 ///
 /// Errors when the source can't be decoded or the encoded buffer can't
 /// be written (only really fires on out-of-memory; the encoder itself
 /// is infallible for well-formed inputs).
 pub fn compose_pxe_logo(src_bytes: &[u8]) -> Result<Vec<u8>, ImageError> {
    let logo = image::load_from_memory(src_bytes)?;
    // Resize-fit if the upload exceeds our bounding box. `Lanczos3`
    // keeps the antialiasing crisp on the framebuffer console; it's a
    // touch slower than `Triangle` but the operator hits this endpoint
    // once per boot at most.
    let logo = downscale_to_fit(logo, LOGO_MAX_W, LOGO_MAX_H);
    let logo_rgba = logo.to_rgba8();
    // Transparent canvas. iPXE 1.21+ honours alpha-channel transparency
    // on framebuffer consoles; older builds simply draw the alpha as
    // black, which still gives a sensible look.
    let mut canvas: RgbaImage = RgbaImage::from_pixel(CANVAS_W, CANVAS_H, Rgba([0, 0, 0, 0]));
    let logo_w = logo_rgba.width();
    let logo_h = logo_rgba.height();
    // Horizontal center, top-margin from the top. Saturating math
    // means a logo wider than CANVAS_W (shouldn't happen after the
    // downscale above, but defensive) just sits flush-left.
    let off_x = CANVAS_W.saturating_sub(logo_w) / 2;
    let off_y = LOGO_TOP_MARGIN.min(CANVAS_H.saturating_sub(logo_h));
    image::imageops::overlay(&mut canvas, &logo_rgba, off_x.into(), off_y.into());
    let mut out = Vec::with_capacity(64 * 1024);
    DynamicImage::ImageRgba8(canvas).write_to(&mut Cursor::new(&mut out), ImageFormat::Png)?;
    Ok(out)
 }
 fn downscale_to_fit(img: DynamicImage, max_w: u32, max_h: u32) -> DynamicImage {
    let (w, h) = (img.width(), img.height());
    if w <= max_w && h <= max_h {
        return img;
    }
    // Preserve aspect ratio. `resize` clamps to the smaller of the
    // two scale factors so we never overshoot the bounding box.
    img.resize(max_w, max_h, FilterType::Lanczos3)
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    use image::{ImageBuffer, Rgb};
    fn solid_png(w: u32, h: u32, rgb: [u8; 3]) -> Vec<u8> {
        let img: ImageBuffer<Rgb<u8>, Vec<u8>> = ImageBuffer::from_pixel(w, h, Rgb(rgb));
        let mut out = Vec::with_capacity(4096);
        DynamicImage::ImageRgb8(img)
            .write_to(&mut Cursor::new(&mut out), ImageFormat::Png)
            .unwrap();
        out
    }
    #[test]
    fn compose_emits_canvas_sized_png() {
        let src = solid_png(120, 60, [200, 50, 50]);
        let out = compose_pxe_logo(&src).unwrap();
        // Round-trip the output and confirm dimensions.
        let img = image::load_from_memory(&out).unwrap();
        assert_eq!(img.width(), CANVAS_W);
        assert_eq!(img.height(), CANVAS_H);
    }
    #[test]
    fn small_logo_centered_at_top_margin() {
        let src = solid_png(100, 40, [10, 200, 10]);
        let out = compose_pxe_logo(&src).unwrap();
        let canvas = image::load_from_memory(&out).unwrap().to_rgba8();
        // Pixel just inside the logo box should match the source color
        // (alpha=255). Pixel near a far corner of the canvas should be
        // the transparent background.
        let cx = (CANVAS_W - 100) / 2;
        let cy = LOGO_TOP_MARGIN;
        let inside = canvas.get_pixel(cx + 10, cy + 10);
        assert_eq!(inside.0[3], 255, "logo pixel should be opaque");
        assert!(inside.0[0] < 100 && inside.0[1] > 100 && inside.0[2] < 100, "color mismatch: {inside:?}");
        let corner = canvas.get_pixel(CANVAS_W - 1, CANVAS_H - 1);
        assert_eq!(corner.0[3], 0, "canvas corner should be transparent");
    }
    #[test]
    fn oversize_logo_is_downscaled_to_bounding_box() {
        // 4000×800 image — bigger than LOGO_MAX_W and LOGO_MAX_H in
        // both axes. After downscale the output must fit; we re-decode
        // the canvas, count non-transparent pixels, and confirm none
        // sit outside the expected band.
        let src = solid_png(4000, 800, [50, 50, 200]);
        let out = compose_pxe_logo(&src).unwrap();
        let canvas = image::load_from_memory(&out).unwrap().to_rgba8();
        // Span row at the top margin should have non-transparent
        // pixels somewhere; rows past the LOGO_TOP_MARGIN + LOGO_MAX_H
        // should be entirely transparent.
        let bottom_band_y = LOGO_TOP_MARGIN + LOGO_MAX_H + 10;
        for x in 0..CANVAS_W {
            let p = canvas.get_pixel(x, bottom_band_y);
            assert_eq!(p.0[3], 0, "row {bottom_band_y} should be transparent at x={x}");
        }
    }
    #[test]
    fn unsupported_bytes_returns_error_not_panic() {
        let r = compose_pxe_logo(b"\xde\xad\xbe\xef not an image");
        assert!(r.is_err());
    }
 }
@@ -15,20 +15,57 @@ use tokio::io::AsyncWriteExt;
 /// Where the bytes for an ISO actually live.
 ///
-/// The default is `Local` — uploaded ISOs sit in `<iso_dir>/<id>.iso`.
+/// `Local` — uploaded ISO, sits at `<iso_dir>/<id>.iso`.
-/// `Nfs` entries point at a file inside a remote share that the
+/// `Smb` (v0.4.65) — remote SMB share, streamed via Samba's
-/// `NfsManager` is keeping mounted. We resolve the on-disk path lazily
+/// userspace `smbclient` CLI subprocess. No kernel mount, no local
-/// in [`IsoStore::iso_path_for`] using the `nfs_root` set at startup.
+/// cache. Sequential whole-file streaming; HTTP Range requests
 /// return 416.
 /// `Nfs` (v0.4.67) — remote NFSv3 share, streamed via the pure-Rust
 /// `nfs3_client` crate (in-process, no subprocess). Same "works in
 /// any container" property as SMB, plus Range requests work because
 /// NFSv3 READ3 takes an explicit offset.
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(tag = "kind", rename_all = "snake_case")]
 pub enum IsoSource {
    #[default]
    Local,
-    Nfs {
+    /// v0.4.65: SMB via userspace `smbclient` works in any container.
-        mount_id: String,
+    Smb {
-        /// Path relative to the mount point — typically just the filename.
+        share_id: String,
        /// Filename at the share root. We don't support nested paths
        /// in v0.4.65; ISOs live at the top of the share.
        relative_path: String,
    },
    /// v0.4.67: NFSv3 via the in-process `nfs3_client` crate.
    Nfs {
        share_id: String,
        /// Filename at the export root.
        relative_path: String,
    },
 }
 /// Where the ISO lands in the PXE menu hierarchy.
 ///
 /// Auto-detected family (Debian, Windows, …) still drives BIOS/UEFI
 /// behaviour and per-entry boot args, but the *menu placement* is
 /// operator-controlled — an operator who's uploaded a TinyCore live ISO
 /// to use as a recovery shim, or a SystemRescue image, can flip its
 /// category to `Tools` so it lands next to memtest/shell instead of
 /// under Linux Installers.
 ///
 /// Old `meta.json` files without this field deserialize as `Os`, which
 /// matches v0.4.1 behaviour (everything goes under OS Installers).
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Serialize, Deserialize)]
 #[serde(rename_all = "snake_case")]
 pub enum IsoCategory {
    /// "OS Installer" — routed via the auto-detected family into the
    /// Linux / Windows installer submenus.
    #[default]
    Os,
    /// "Tool" — surfaced under the Tools menu next to memtest, shell,
    /// NIC info, etc. Family detection still decides BIOS/UEFI vs
    /// wimboot vs sanboot at boot time.
    Tools,
 }
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -56,6 +93,10 @@ pub struct IsoMeta {
    /// the common no-password case.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub password_hash: Option<String>,
    /// Where the ISO sits in the PXE menu hierarchy — operator-controlled,
    /// not driven by family detection. Defaults to [`IsoCategory::Os`].
    #[serde(default)]
    pub category: IsoCategory,
 }
 impl IsoMeta {
@@ -114,6 +155,7 @@ impl UploadHandle {
            boot_entries,
            source: IsoSource::Local,
            password_hash: None,
            category: IsoCategory::default(),
        };
        store.persist_meta(&meta).await?;
        store.insert(meta.clone());
@@ -135,10 +177,6 @@ struct Inner {
 #[derive(Debug, Clone)]
 pub struct IsoStore {
    iso_dir: Arc<PathBuf>,
    /// Where NFS mounts land on disk. Set at startup via
    /// [`IsoStore::set_nfs_root`]; required for resolving any
    /// `IsoSource::Nfs` entry.
    nfs_root: Arc<RwLock<Option<PathBuf>>>,
    inner: Arc<RwLock<Inner>>,
 }
@@ -146,17 +184,10 @@ impl IsoStore {
    pub fn new(iso_dir: PathBuf) -> Self {
        Self {
            iso_dir: Arc::new(iso_dir),
            nfs_root: Arc::new(RwLock::new(None)),
            inner: Arc::new(RwLock::new(Inner::default())),
        }
    }
    /// Tell the store where NFS mounts live. Without this set,
    /// `IsoSource::Nfs` entries cannot be resolved to a file path.
    pub fn set_nfs_root(&self, root: PathBuf) {
        *self.nfs_root.write() = Some(root);
    }
    pub async fn ensure_dirs(&self) -> Result<()> {
        tokio::fs::create_dir_all(self.iso_dir.as_path()).await?;
        Ok(())
@@ -252,33 +283,33 @@ impl IsoStore {
        self.inner.read().isos.get(id).cloned()
    }
-    /// Resolve an ISO id to its on-disk path, if any. For local entries
+    /// Resolve an ISO id to its on-disk path, if any. For local
-    /// this is `<iso_dir>/<id>.iso`; for NFS entries it's
+    /// (uploaded) ISOs this is `<iso_dir>/<id>.iso`. For SMB-sourced
-    /// `<nfs_root>/<mount_id>/<relative_path>`. Returns None if the file
+    /// ISOs there is no on-disk path — the HTTP handler must stream
-    /// is missing or the source isn't resolvable (e.g. NFS share
+    /// via `SmbShareManager::stream_iso` instead. Returns `None` for
-    /// unmounted).
+    /// SMB sources or when the file is missing.
    pub fn iso_path_for(&self, id: &str) -> Option<PathBuf> {
        let meta = self.get(id)?;
-        let path = match &meta.source {
+        match &meta.source {
-            IsoSource::Local => self.iso_path(id),
+            IsoSource::Local => {
-            IsoSource::Nfs {
+                let path = self.iso_path(id);
-                mount_id,
+                if path.exists() {
-                relative_path,
+                    Some(path)
-            } => {
+                } else {
-                let root = self.nfs_root.read().clone()?;
+                    None
-                root.join(mount_id).join(relative_path)
+                }
            }
-        };
+            // SMB and NFS sources have no local path — they're
-        if path.exists() {
+            // streamed in-process. Callers must inspect the source
-            Some(path)
+            // kind first and dispatch to the appropriate share
-        } else {
+            // manager.
-            None
+            IsoSource::Smb { .. } | IsoSource::Nfs { .. } => None,
        }
    }
-    /// Delete an ISO and its sidecar metadata. Only acts on local ISOs;
+    /// Delete an ISO and its sidecar metadata. Only acts on local
-    /// for NFS-backed ISOs the operator must remove the file from the
+    /// (uploaded) ISOs; for SMB-backed ISOs the operator must remove
-    /// share or unmount the NFS share entirely.
+    /// the file from the share or unregister the share entirely.
    pub async fn delete(&self, id: &str) -> Result<()> {
        let meta = self.get(id);
        let is_local = matches!(
@@ -295,10 +326,10 @@ impl IsoStore {
        Ok(())
    }
-    /// Register an externally-sourced ISO (e.g. NFS-mounted). Used by
+    /// Register an externally-sourced ISO (SMB share, etc.). Used by
-    /// `NfsManager` after walking a freshly-mounted share. We do **not**
+    /// `SmbShareManager` after listing a share. We do **not** persist
-    /// persist a `meta.json` on disk for these — the source of truth is
+    /// a `meta.json` on disk for these — the source of truth is the
-    /// the share itself, and the NFS manager re-scans on startup.
+    /// share itself, and the manager re-scans on startup.
    pub fn register_external(
        &self,
        id: String,
@@ -318,18 +349,25 @@ impl IsoStore {
            boot_entries,
            source,
            password_hash: None,
            category: IsoCategory::default(),
        };
        self.inner.write().isos.insert(id, meta);
    }
-    /// Drop every entry that belongs to `mount_id`. Used by the NFS
+    /// Drop every entry that belongs to `share_id`. Used by the SMB
-    /// manager when an operator removes a share, or before re-scanning
+    /// and NFS share managers when an operator removes a share, or
-    /// to clean out stale entries.
+    /// before re-scanning to clean out stale entries. The same id
-    pub fn drop_external_source(&self, mount_id: &str) {
+    /// space serves both protocols — share ids are slugified from
    /// `server+share` (SMB) or `server+export` (NFS) and the
    /// protocol-specific prefix prevents collisions.
    pub fn drop_external_source(&self, share_id: &str) {
        let mut g = self.inner.write();
-        g.isos.retain(
+        g.isos.retain(|_, m| match &m.source {
-            |_, m| !matches!(&m.source, IsoSource::Nfs { mount_id: mid, .. } if mid == mount_id),
+            IsoSource::Smb { share_id: sid, .. } | IsoSource::Nfs { share_id: sid, .. } => {
-        );
+                sid != share_id
            }
            IsoSource::Local => true,
        });
    }
    /// Set or clear an ISO's boot password.
@@ -377,6 +415,47 @@ impl IsoStore {
        Ok(())
    }
    /// Flip an ISO's menu category. Persists to `meta.json` for local
    /// ISOs; NFS-sourced ISOs keep the change in memory only (the next
    /// re-scan would overwrite it anyway).
    pub async fn set_category(&self, id: &str, category: IsoCategory) -> Result<IsoMeta> {
        let updated = {
            let mut g = self.inner.write();
            let m = g
                .isos
                .get_mut(id)
                .ok_or_else(|| Error::Invalid(format!("no such iso '{id}'")))?;
            m.category = category;
            m.clone()
        };
        if matches!(updated.source, IsoSource::Local) {
            self.persist_meta(&updated).await?;
        }
        Ok(updated)
    }
    /// Absolute path to the directory holding local ISO uploads. Used
    /// by the HTTP layer for the disk-space endpoint — the volume that
    /// hosts this directory is what runs out of room first.
    #[must_use]
    pub fn iso_dir(&self) -> PathBuf {
        self.iso_dir.as_path().to_path_buf()
    }
    /// `(total_bytes, available_bytes)` for the filesystem hosting the
    /// ISO directory. Returns `None` if `statvfs` fails (read-only
    /// filesystem with no quota, mount disappeared, …) — callers
    /// should treat that as "unknown" rather than zero.
    ///
    /// Lives here rather than the HTTP crate because `http-api`'s
    /// `#![forbid(unsafe_code)]` rules out the libc FFI directly, and
    /// because this is naturally an `IsoStore` question — the volume
    /// of interest is whatever's hosting the iso dir.
    #[must_use]
    pub fn disk_usage(&self) -> Option<(u64, u64)> {
        disk_usage_for(self.iso_dir.as_path())
    }
    /// Verify a candidate password against the stored bcrypt hash.
    /// Returns:
    /// - `Ok(true)`   — match (or the ISO has no password set; boot is open)
@@ -393,6 +472,33 @@ impl IsoStore {
    }
 }
 /// Resolve `(total, available)` bytes for the filesystem hosting `path`.
 /// Returns `None` if `statvfs` fails.
 #[allow(unsafe_code)]
 fn disk_usage_for(path: &std::path::Path) -> Option<(u64, u64)> {
    use std::ffi::CString;
    use std::os::unix::ffi::OsStrExt;
    let c = CString::new(path.as_os_str().as_bytes()).ok()?;
    // SAFETY: `statvfs` is repr(C); a zeroed value is a valid initial
    // state per POSIX. The FFI call writes every field we then read.
    let mut stat: libc::statvfs = unsafe { std::mem::zeroed() };
    // SAFETY: `c` is a NUL-terminated C string pointing into a stack
    // CString that outlives this call; `&mut stat` is a unique aligned
    // pointer to a stack-local `statvfs`. The kernel writes through
    // it but does not retain the pointer past return.
    let rc = unsafe { libc::statvfs(c.as_ptr(), &raw mut stat) };
    if rc != 0 {
        return None;
    }
    // Use f_frsize (fundamental block size). f_bsize is "preferred I/O
    // block" and doesn't always match the unit f_blocks is denominated
    // in — on some BSDs it would over-report by a factor of 8.
    let frsize = stat.f_frsize as u64;
    let total = stat.f_blocks as u64 * frsize;
    let avail = stat.f_bavail as u64 * frsize;
    Some((total, avail))
 }
 fn slugify(filename: &str) -> String {
    let stem = Path::new(filename)
        .file_stem()
@@ -498,8 +604,17 @@ fn linux_cmdline(family: DistroFamily, id: &str) -> String {
    // The HTTP layer resolves `${base-url}` at render time.
    let iso_url = format!("${{base-url}}/iso/{id}.iso");
    match family {
        // VMware-UEFI fix (v0.4.5, matching Bootimus v0.1.67's Casper
        // patch): drop `netboot=url url=… ---` in favour of the
        // canonical Casper option `iso-url=` and add `ds=nocloud` so
        // cloud-init / subiquity (live-server) doesn't stall waiting on
        // a metadata datasource that doesn't exist in PXE. Without
        // `ds=nocloud`, Ubuntu live-server / Mint / Pop!_OS / elementary
        // ISOs would boot fine on bare-metal UEFI but hang at "cloud-init
        // running" on VMware-UEFI guests because the vmxnet3 driver's
        // late-init upsets cloud-init's network probe.
        DistroFamily::DebianUbuntu => format!(
-            "boot=casper netboot=url url={iso_url} ip=dhcp ---"
+            "boot=casper initrd=initrd ds=nocloud ip=dhcp iso-url={iso_url}"
        ),
        DistroFamily::RhelFedora => format!(
            "inst.repo={iso_url} inst.stage2={iso_url} ip=dhcp"
@@ -534,6 +649,23 @@ mod tests {
        assert_eq!(slugify("/etc/passwd"), "passwd");
    }
    #[test]
    fn casper_cmdline_vmware_uefi_safe() {
        // v0.4.5 regression guard: the Debian/Ubuntu cmdline must use
        // the canonical Casper `iso-url=` option and include
        // `ds=nocloud` so VMware-UEFI guests don't hang at "cloud-init
        // running" waiting on a metadata datasource that PXE can't
        // provide. The legacy `netboot=url url=… ---` form is gone for
        // good.
        let s = linux_cmdline(DistroFamily::DebianUbuntu, "ubuntu-24-04");
        assert!(s.contains("boot=casper"), "{s}");
        assert!(s.contains("iso-url=${base-url}/iso/ubuntu-24-04.iso"), "{s}");
        assert!(s.contains("ds=nocloud"), "{s}");
        assert!(s.contains("ip=dhcp"), "{s}");
        assert!(!s.contains("netboot=url"), "legacy option leaked: {s}");
        assert!(!s.contains(" --- "), "stray ---: {s}");
    }
    fn fake_meta(id: &str) -> IsoMeta {
        IsoMeta {
            id: id.into(),
@@ -551,6 +683,7 @@ mod tests {
            boot_entries: vec![],
            source: IsoSource::Local,
            password_hash: None,
            category: IsoCategory::default(),
        }
    }
@@ -9,7 +9,7 @@ use openpxe_core::{
 };
 use openpxe_dhcp_proxy::DhcpProxyServer;
 use openpxe_http_api::{build_router, AppState};
-use openpxe_iso_store::{IsoStore, NfsManager, SmbManager};
+use openpxe_iso_store::{IsoStore, NfsShareManager, SmbManager, SmbShareManager};
 use openpxe_tftp::TftpServer;
 use std::net::{Ipv4Addr, SocketAddr};
 use std::path::PathBuf;
@@ -104,6 +104,10 @@ async fn main() -> anyhow::Result<()> {
    let settings = SettingsStore::load_or_default(&config.paths.work_dir);
    let hosts = HostBindings::load_or_default(&config.paths.work_dir);
    let boot_log = openpxe_core::BootLog::load_or_default(&config.paths.work_dir);
    let branding = openpxe_core::BrandingStore::load_or_default(&config.paths.work_dir);
    let admin = openpxe_core::AdminStore::load_or_default(&config.paths.work_dir);
    let sso = openpxe_core::SsoStore::load_or_default(&config.paths.work_dir);
    let sessions = openpxe_http_api::auth::SessionStore::default();
    let metrics = Metrics::new();
    // Build the SMB manager unconditionally — it starts/stops on the
@@ -115,13 +119,30 @@ async fn main() -> anyhow::Result<()> {
        let _ = smb.start();
    }
-    // NFS manager. The mount root has to be set on the IsoStore *before*
+    // v0.4.65: SMB share manager — Samba `smbclient` userspace
-    // we replay any persisted mounts, otherwise an in-memory IsoMeta
+    // consumer. Replaces the kernel-mount NFS path that v0.4.64
-    // pointing at an NFS source can't resolve to a path.
+    // shipped; that didn't work on hosts whose kernel lacked the nfs
-    let nfs = NfsManager::new(&config.paths.work_dir, iso_store.clone());
+    // client modules (Unraid is the dominant case). `smbclient` does
-    iso_store.set_nfs_root(nfs.mount_root());
+    // the SMB protocol entirely in userspace over TCP and works in
-    if let Err(e) = nfs.load_and_remount().await {
+    // any container regardless of capabilities or kernel modules.
-        tracing::warn!(target: "openpxe::nfs", "could not reload NFS mounts: {e}");
+    let smb_shares = SmbShareManager::new(&config.paths.work_dir, iso_store.clone());
    if let Err(e) = smb_shares.load_and_rescan().await {
        tracing::warn!(
            target: "openpxe::smb",
            "could not reload SMB shares on startup: {e}"
        );
    }
    // v0.4.67: NFSv3 share manager — pure-Rust in-process consumer
    // via the `nfs3_client` crate. Sits alongside the SMB manager;
    // operators pick whichever protocol their NAS prefers, or use
    // both. No subprocess, no kernel mount, works in any container.
    let nfs_shares = NfsShareManager::new(&config.paths.work_dir, iso_store.clone());
    if let Err(e) = nfs_shares.load_and_rescan().await {
        tracing::warn!(
            target: "openpxe::nfs",
            "could not reload NFS shares on startup: {e}"
        );
    }
    // Sniff network details for the Network tab. None of these are
@@ -142,9 +163,14 @@ async fn main() -> anyhow::Result<()> {
        queue: queue.clone(),
        hosts: hosts.clone(),
        boot_log: boot_log.clone(),
        branding: branding.clone(),
        admin: admin.clone(),
        sessions: sessions.clone(),
        sso: sso.clone(),
        metrics: metrics.clone(),
        smb: Some(smb.clone()),
-        nfs: nfs.clone(),
+        smb_shares: smb_shares.clone(),
        nfs_shares: nfs_shares.clone(),
        uploads: openpxe_http_api::uploads::UploadSessions::default(),
        log_bus: log_bus.clone(),
        started_at: time::OffsetDateTime::now_utc(),
@@ -34,9 +34,18 @@
  --topbar-h:   56px;
  --mono: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
  --sans: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, system-ui, sans-serif;
  /* v0.4.63: tie native form-control rendering (checkboxes, scroll bars,
     date pickers) to the active OpenPXE theme. Without this, the inline
     `<meta name="color-scheme" content="dark light">` in index.html forces
     dark form chrome in *both* themes — so the SSO "Enable single sign-on"
     checkbox renders as an opaque black square against the light-mode
     panel, ignoring our accent-color hint. CSS `color-scheme` overrides
     the meta and tracks `data-theme` correctly. */
  color-scheme: dark;
 }
 :root[data-theme="light"] {
  color-scheme: light;
  /* Light palette — high-contrast neutral, accent unchanged for brand
     consistency. Designed against Netbox Labs's reference screenshot:
     near-white surfaces, soft grey dividers, dark text. */
@@ -54,7 +63,11 @@
  --ok:           #1f9b54;
  --border:       #d8dde6;
  --border-soft: #e7eaf0;
-  --terminal-bg: #0d1219; /* terminal stays dark even in light mode */
+  /* Light-mode terminal: the pane background and chrome track the rest
     of the light theme. Per-level text colours below recolour-on-light
     so log lines stay readable on a pale background — previously the
     terminal was locked to dark and looked like a stuck panel. */
  --terminal-bg: #ffffff;
  --shadow-card: 0 1px 0 rgba(0,0,0,0.02), 0 6px 18px rgba(20,28,52,0.06);
 }
@@ -87,14 +100,23 @@ code, kbd { font-family: var(--mono); font-size: 12.5px;
  border-right: 1px solid var(--border);
  display: flex; flex-direction: column;
 }
 /* The brand block sits flush with the topbar so the sidebar+topbar reads
   as one continuous bar across the top of the app, rather than a chunky
   2-line logo block plus a separate (smaller-typeface) page title. The
   height/border-bottom match the topbar exactly so the divider runs
   straight across without a step. */
 .sidebar .brand {
  display: flex; align-items: center; gap: 12px;
-  padding: 14px 18px;
+  padding: 0 18px;
  height: var(--topbar-h);
  border-bottom: 1px solid var(--border);
 }
-.sidebar .brand img { width: 40px; height: auto; }
+.sidebar .brand img { width: 26px; height: 26px; flex: none; }
-.sidebar .brand strong { font-size: 16px; letter-spacing: 0.4px; }
+.sidebar .brand strong {
-.sidebar .brand .sub { color: var(--fg-dim); font-size: 11px; }
+  font-size: 15px; font-weight: 600;
  letter-spacing: 0.2px;
  color: var(--fg);
 }
 .sidebar nav { padding: 10px 0; flex: 1; overflow-y: auto; }
 .sidebar nav a {
  display: flex; align-items: center; gap: 10px;
@@ -140,6 +162,16 @@ code, kbd { font-family: var(--mono); font-size: 12.5px;
 .sidebar .footer .status-value.err  { color: var(--err); }
 .sidebar .footer .status-value.warn { color: var(--warn); }
 .sidebar .footer .footer-sub { color: var(--fg-dimmer); margin-top: 2px; }
 /* Persistent backend identity. Sits below the advertised URL so even
   when an operator has uploaded their own logo, "what is this" stays
   answerable from the bottom-left of every page. */
 .sidebar .footer .footer-version {
  margin-top: 8px; padding-top: 8px;
  border-top: 1px dashed var(--border-soft);
  color: var(--fg-dim);
  font-variant-numeric: tabular-nums;
  letter-spacing: 0.2px;
 }
 /* ── Top bar ───────────────────────────────────────────────────────── */
@@ -264,23 +296,83 @@ label.field {
 }
 label.field .name { color: var(--fg-dim); font-size: 12px; }
 label.field .hint { color: var(--fg-dimmer); font-size: 11px; }
-label.field input[type="text"],
+/* All single-line inputs share one chrome rule. Pre-v0.4.6 we only
-label.field input[type="number"],
+   styled type=text/number, which left type=password fields rendering
   with the default browser look — visibly off vs adjacent text fields
   in the Account card. The negation list keeps `type=checkbox`,
   `type=file`, and `type=range` (none of which we use inside
   `label.field`) from picking up the padded-box look. */
 label.field input:not([type="checkbox"]):not([type="file"]):not([type="range"]),
 label.field select,
 label.field textarea {
  width: 100%; background: var(--bg); color: var(--fg);
  border: 1px solid var(--border); border-radius: var(--radius);
  padding: 7px 10px; font: inherit;
  /* iOS/Safari shrinks password-field text by default; clamp it so
     the password input matches the username input's metrics. */
  font-size: 14px; line-height: 1.4;
  box-shadow: none; -webkit-appearance: none; appearance: none;
 }
 /* v0.4.63: with `appearance: none`, the native <select> dropdown arrow
   disappears, which makes the "Metadata source" pick-list look like a
   plain (and slightly squished) text input. Paint our own chevron via
   background-image so the control still reads as a dropdown, and reserve
   right-padding for it. The data-URI SVG inherits currentColor via the
   `stroke` attribute so the arrow follows light/dark theme without a
   second declaration. */
 label.field select {
  background-image: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 12 8' fill='none' stroke='%239aa0a6' stroke-width='1.6' stroke-linecap='round' stroke-linejoin='round'><polyline points='1.5,1.5 6,6 10.5,1.5'/></svg>");
  background-repeat: no-repeat;
  background-position: right 10px center;
  background-size: 11px 7px;
  padding-right: 30px;
 }
 :root[data-theme="light"] label.field select {
  background-image: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 12 8' fill='none' stroke='%235a6377' stroke-width='1.6' stroke-linecap='round' stroke-linejoin='round'><polyline points='1.5,1.5 6,6 10.5,1.5'/></svg>");
 }
 label.field input:focus, label.field select:focus, label.field textarea:focus {
  outline: none; border-color: var(--accent);
  box-shadow: 0 0 0 1px color-mix(in srgb, var(--accent) 35%, transparent);
 }
 label.check {
  display: flex; gap: 10px; align-items: center;
  padding: 8px 10px; margin-bottom: 6px;
  border: 1px solid var(--border-soft); border-radius: var(--radius);
 }
-label.check input { accent-color: var(--accent); }
+/* v0.4.63: native checkboxes used to render as opaque black squares in
   light mode because the page meta declares `color-scheme: dark light`
   and `accent-color` alone only repaints the *check mark* (not the
   container). Take full control of the chrome so the box reads cleanly
   on both palettes and the checked state lights up in our accent. */
 label.check input[type="checkbox"] {
  appearance: none; -webkit-appearance: none;
  width: 16px; height: 16px; flex: none;
  background: var(--bg);
  border: 1px solid var(--border);
  border-radius: 3px;
  display: inline-grid; place-content: center;
  cursor: pointer; margin: 0;
  transition: background 0.1s ease, border-color 0.1s ease;
 }
 label.check input[type="checkbox"]:hover { border-color: var(--accent); }
 label.check input[type="checkbox"]:checked {
  background: var(--accent);
  border-color: var(--accent);
 }
 label.check input[type="checkbox"]:checked::after {
  /* Classic ✓ glyph built from a rotated rectangle border. Colour is
     #002923 (the same near-black we use on solid-accent buttons) so the
     tick stays legible against the teal fill in both themes. */
  content: '';
  width: 4px; height: 8px;
  border: solid #002923;
  border-width: 0 2px 2px 0;
  transform: rotate(45deg) translate(-1px, -1px);
 }
 label.check input[type="checkbox"]:focus-visible {
  outline: none;
  box-shadow: 0 0 0 2px color-mix(in srgb, var(--accent) 35%, transparent);
 }
 /* ── Drop zone ────────────────────────────────────────────────────── */
@@ -398,9 +490,21 @@ tr.unbootable td:first-child { border-left: 3px solid var(--warn); }
 .dot.err  { background: var(--err); }
 .dot.warn { background: var(--warn); }
-/* Inline form rows. */
+/* Inline form rows. The default is a 4-column grid sized for the
-.form-row { display: grid; grid-template-columns: repeat(4, 1fr); gap: 10px 14px; }
+   Account card's "Current / New username / New password / Confirm"
-@media (max-width: 900px) { .form-row { grid-template-columns: 1fr; } }
+   quartet; the `.cols-3` modifier swaps to a 3-column layout for the
   SSO header strip (display name / logo URL / metadata source). All
   `.form-row > label.field` children share the same baseline because
   their inner inputs share metrics via the global rule above. */
 .form-row { display: grid; grid-template-columns: repeat(4, 1fr); gap: 10px 14px; align-items: end; }
 .form-row.cols-3 { grid-template-columns: repeat(3, 1fr); }
 .form-row.cols-2 { grid-template-columns: repeat(2, 1fr); }
 .form-row label.field { margin-bottom: 0; }
@media (max-width: 900px) {
  .form-row,
  .form-row.cols-3,
  .form-row.cols-2 { grid-template-columns: 1fr; }
 }
 /* ── Queued deployment visual ────────────────────────────────────── */
 .queue-track {
@@ -436,26 +540,29 @@ tr.unbootable td:first-child { border-left: 3px solid var(--warn); }
  min-height: 480px;
  box-shadow: var(--shadow-card);
 }
 /* Terminal pane colours follow the active theme. Hard-coded hexes
   (#050505, #181818, #cfd6e2 etc.) were leaving the light-mode pane
   looking dark; we keep palette-aware vars instead so the toggle works. */
 .terminal .pane {
  flex: 1; overflow: auto;
  padding: 10px 14px;
  font-family: var(--mono); font-size: 12.5px; line-height: 1.5;
-  color: #cfd6e2;
+  color: var(--fg);
  white-space: pre-wrap; word-break: break-word;
 }
 .terminal .pane .lvl-error { color: var(--err); }
 .terminal .pane .lvl-warn  { color: var(--warn); }
-.terminal .pane .lvl-info  { color: #cfd6e2; }
+.terminal .pane .lvl-info  { color: var(--fg); }
-.terminal .pane .lvl-debug { color: #8b94a8; }
+.terminal .pane .lvl-debug { color: var(--fg-dim); }
-.terminal .pane .lvl-trace { color: #5a6379; }
+.terminal .pane .lvl-trace { color: var(--fg-dimmer); }
-.terminal .pane .ts        { color: #5a6379; }
+.terminal .pane .ts        { color: var(--fg-dimmer); }
-.terminal .pane .tg        { color: #7cd3ff; }
+.terminal .pane .tg        { color: var(--accent); }
 .terminal .pane .echo      { color: var(--accent); }
 .terminal .input-row {
  display: flex; align-items: center; gap: 8px;
  padding: 8px 14px;
-  background: #050505;
+  background: var(--bg-panel-2);
-  border-top: 1px solid #181818;
+  border-top: 1px solid var(--border);
 }
 .terminal .input-row .prompt { color: var(--accent); font-family: var(--mono); }
 .terminal .input-row input {
@@ -466,22 +573,205 @@ tr.unbootable td:first-child { border-left: 3px solid var(--warn); }
 .terminal .toolbar {
  display: flex; gap: 8px; align-items: center;
  padding: 8px 14px;
-  background: #050505;
+  background: var(--bg-panel-2);
-  border-bottom: 1px solid #181818;
+  border-bottom: 1px solid var(--border);
  font-size: 12px; color: var(--fg-dim);
 }
 .terminal .toolbar .right { margin-left: auto; display: flex; gap: 6px; }
 .terminal .toolbar button {
  padding: 3px 9px; font-size: 11px;
-  background: transparent; color: var(--fg-dim); border: 1px solid #181818;
+  background: transparent; color: var(--fg-dim); border: 1px solid var(--border);
  font-weight: 500;
 }
-.terminal .toolbar button:hover { color: var(--fg); background: #181818; }
+.terminal .toolbar button:hover { color: var(--fg); background: var(--bg-elev); }
 /* ── Auth screen (first-run setup + login) ───────────────────────
   Used when /api/me reports setup_required or !authenticated. The
   regular .shell is hidden; this overlay takes the full viewport so
   the operator never sees half-loaded dashboard chrome while the auth
   state is unknown. Same palette as the rest of the UI — borrows the
   Sonarr/Radarr layout (centered narrow card on the page background).
 */
 .auth-screen {
  position: fixed; inset: 0;
  display: flex; align-items: center; justify-content: center;
  background: var(--bg);
  padding: 24px;
  z-index: 100;
 }
 .auth-card {
  width: 100%; max-width: 380px;
  background: var(--bg-panel);
  border: 1px solid var(--border);
  border-radius: var(--radius-lg);
  box-shadow: var(--shadow-card);
  padding: 28px 28px 22px;
 }
 .auth-card .brand-row {
  display: flex; align-items: center; gap: 12px;
  margin-bottom: 18px;
 }
 .auth-card .brand-row img { width: 32px; height: 32px; flex: none; }
 .auth-card .brand-row .name { font-size: 17px; font-weight: 600; letter-spacing: 0.2px; color: var(--fg); }
 .auth-card h2 {
  margin: 0 0 6px; font-size: 16px; font-weight: 600; color: var(--fg);
 }
 .auth-card .lede {
  color: var(--fg-dim); font-size: 13px; margin: 0 0 18px;
  line-height: 1.5;
 }
 .auth-card .field { margin-bottom: 12px; }
 .auth-card input[type="text"],
 .auth-card input[type="password"] {
  width: 100%; background: var(--bg); color: var(--fg);
  border: 1px solid var(--border); border-radius: var(--radius);
  padding: 9px 11px; font: inherit; font-size: 13.5px;
 }
 .auth-card input:focus { outline: none; border-color: var(--accent); }
 .auth-card .submit { width: 100%; padding: 9px 12px; margin-top: 6px; }
 .auth-card .auth-err {
  margin-top: 12px; color: var(--err); font-size: 12.5px;
 }
 .auth-card .auth-foot {
  margin-top: 14px; padding-top: 12px;
  border-top: 1px solid var(--border-soft);
  color: var(--fg-dimmer); font-size: 11.5px; text-align: center;
 }
 .auth-card .sso-btn {
  width: 100%; margin-top: 10px;
  background: transparent; color: var(--fg);
  border: 1px solid var(--border);
  padding: 9px 12px;
 }
 .auth-card .sso-btn:hover {
  background: var(--bg-panel-2); border-color: var(--accent); color: var(--fg);
 }
 .auth-card .sso-btn .meta { color: var(--fg-dim); font-size: 11px; margin-top: 2px; }
 /* ── Top-right user menu (v0.4.6) ────────────────────────────
   The "signed in as X" identity + sign-out moved out of the sidebar
   footer in v0.4.6 — the sidebar footer is now reserved for the
   service-state trio (Service status / Advertised URL / Backend
   version). The button matches the theme toggle's size + chrome so
   the top-right reads as a tidy two-icon strip. */
 .user-menu { position: relative; }
 .user-btn {
  display: inline-flex; align-items: center; justify-content: center;
  width: 36px; height: 32px;
  background: transparent; color: var(--fg);
  border: 1px solid var(--border); border-radius: 8px;
  cursor: pointer; padding: 0;
  transition: background 0.15s ease, border-color 0.15s ease;
 }
 .user-btn:hover { background: var(--bg-panel-2); border-color: var(--accent); }
 .user-pop {
  position: absolute; right: 0; top: 38px;
  min-width: 200px;
  background: var(--bg-panel);
  border: 1px solid var(--border);
  border-radius: var(--radius-lg);
  box-shadow: var(--shadow-card);
  padding: 6px;
  z-index: 60;
  display: flex; flex-direction: column; gap: 2px;
 }
 .user-pop[hidden] { display: none; }
 .user-pop .user-pop-name {
  padding: 8px 10px 6px;
  border-bottom: 1px solid var(--border-soft);
  margin-bottom: 4px;
  color: var(--fg); font-weight: 600; font-size: 13px;
  overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
 }
 .user-pop .user-pop-item {
  text-align: left; width: 100%;
  background: transparent; color: var(--fg);
  border: 0; border-radius: var(--radius);
  padding: 7px 10px; font: inherit; font-size: 13px; font-weight: 500;
  cursor: pointer;
 }
 .user-pop .user-pop-item:hover {
  background: var(--bg-panel-2); color: var(--fg);
 }
 .user-pop .user-pop-danger { color: var(--err); }
 .user-pop .user-pop-danger:hover {
  background: color-mix(in srgb, var(--err) 12%, transparent);
  color: var(--err);
 }
 /* ── About card ─────────────────────────────────────────────────── */
 .about-hero { padding: 20px 24px; }
 .about-hero h2 { font-size: 22px; margin: 0 0 8px; color: var(--fg); }
-.about-hero .lead { color: var(--fg-dim); font-size: 14px; max-width: 60ch; }
+/* Span the full main column rather than capping at 60ch — the page is
   read at typical desktop widths and the cap was leaving the right two
   thirds of the panel awkwardly empty. */
 .about-hero .lead { color: var(--fg-dim); font-size: 14px; max-width: none; }
 .about-hero .who { margin-top: 18px; font-size: 13px; }
 .about-hero .who span { color: var(--fg-dim); }
 .about-hero .who strong { color: var(--accent); }
 .about-hero a { color: var(--accent); }
 /* ── API reference (Settings → bottom) ─────────────────────────── */
 .api-ref { display: grid; gap: 18px; padding: 16px; }
 .api-ref .group h3 {
  margin: 0 0 8px; font-size: 13px; color: var(--fg-dim);
  text-transform: uppercase; letter-spacing: 0.8px;
 }
 .api-ref .ep {
  display: grid; grid-template-columns: 64px minmax(200px, 1fr) 2fr;
  gap: 12px; align-items: baseline;
  padding: 6px 0; border-top: 1px solid var(--border-soft);
  font-size: 13px;
 }
 .api-ref .ep:first-child { border-top: 0; }
 .api-ref .ep .method {
  font-family: var(--mono); font-weight: 600; font-size: 11px;
  padding: 2px 6px; border-radius: 4px;
  text-align: center; letter-spacing: 0.6px;
 }
 .api-ref .ep .method.get    { background: color-mix(in srgb, var(--ok) 22%, transparent);     color: var(--ok); }
 .api-ref .ep .method.post   { background: color-mix(in srgb, var(--accent) 22%, transparent); color: var(--accent); }
 .api-ref .ep .method.put    { background: color-mix(in srgb, var(--warn) 22%, transparent);   color: var(--warn); }
 .api-ref .ep .method.delete { background: color-mix(in srgb, var(--err) 22%, transparent);    color: var(--err); }
 .api-ref .ep .path { font-family: var(--mono); color: var(--fg); word-break: break-all; }
 .api-ref .ep .desc { color: var(--fg-dim); }
@media (max-width: 900px) {
  .api-ref .ep { grid-template-columns: 1fr; gap: 4px; }
  .api-ref .ep .method { justify-self: start; }
 }
 /* ── Disk space card ───────────────────────────────────────────── */
 .diskbar {
  height: 10px; border-radius: 5px;
  background: var(--bg-elev);
  overflow: hidden; margin-top: 8px;
 }
 .diskbar .fill {
  height: 100%;
  background: linear-gradient(90deg, var(--accent-dim), var(--accent));
  transition: width 0.4s ease;
 }
 .diskbar.warn .fill { background: var(--warn); }
 .diskbar.full .fill { background: var(--err); }
 .disk-meta { display: flex; gap: 14px; font-size: 12px; color: var(--fg-dim); margin-top: 8px; flex-wrap: wrap; }
 .disk-meta strong { color: var(--fg); font-weight: 600; font-variant-numeric: tabular-nums; }
 /* ── Logo upload (Settings) ────────────────────────────────────── */
 .logo-preview {
  display: flex; align-items: center; gap: 14px;
  padding: 12px;
  background: var(--bg-panel-2);
  border: 1px solid var(--border);
  border-radius: var(--radius);
 }
 .logo-preview .swatch {
  width: 56px; height: 56px;
  display: flex; align-items: center; justify-content: center;
  background: var(--bg); border: 1px solid var(--border);
  border-radius: var(--radius);
  flex: none;
 }
 .logo-preview .swatch img { max-width: 48px; max-height: 48px; }
 .logo-preview .info { flex: 1; min-width: 0; }
 .logo-preview .info .name { color: var(--fg); font-weight: 600; }
 .logo-preview .info .meta { color: var(--fg-dim); font-size: 12px; margin-top: 2px; }
@@ -5,8 +5,15 @@
  <meta name="viewport" content="width=device-width, initial-scale=1" />
  <meta name="color-scheme" content="dark light" />
  <title>OpenPXE</title>
-  <link rel="stylesheet" href="/assets/app.css" />
+  <!-- v0.4.61: the `?v=…` query string is replaced by the server at
-  <link rel="icon" type="image/svg+xml" href="/assets/logo.svg" />
+       request time with the running OpenPXE version. That guarantees a
       fresh URL on every upgrade so browsers (and intermediary proxies)
       can't keep serving stale JS / CSS / branding from before the
       deploy. Combined with `Cache-Control: no-cache, must-revalidate`
       on the asset handlers, the practical caching window is one
       version. -->
  <link rel="stylesheet" href="/assets/app.css?v={{ASSET_VERSION}}" />
  <link rel="icon" type="image/svg+xml" href="/assets/logo.svg?v={{ASSET_VERSION}}&r={{LOGO_REV}}" />
  <!-- Theme is read from localStorage *before* paint to avoid the
       dark→light flash on every navigation. Falls back to the OS
       preference and finally to dark. -->
@@ -26,11 +33,8 @@
 <div class="shell">
  <aside class="sidebar">
    <div class="brand">
-      <img src="/assets/logo.svg" alt="" />
+      <img src="/assets/logo.svg?v={{ASSET_VERSION}}&r={{LOGO_REV}}" alt="OpenPXE" />
-      <div>
+      <strong>OpenPXE</strong>
        <strong>OpenPXE</strong>
        <div class="sub">v<span data-bind="version">0.4.1</span></div>
      </div>
    </div>
    <nav>
      <a data-view="dashboard" class="active">Dashboard</a>
@@ -48,6 +52,7 @@
        <span class="count" data-bind="host_count">0</span>
      </a>
      <a data-view="terminal">Terminal</a>
      <a data-view="settings">Settings</a>
      <a data-view="about">About</a>
    </nav>
    <div class="footer">
@@ -58,6 +63,10 @@
      </div>
      <div class="footer-sub">Advertised to clients</div>
      <code>{{BASE_URL}}</code>
      <!-- The brand badge at the top can be overridden by operator-uploaded
           logos; keep "OpenPXE v…" pinned in the footer so the backend
           identity is always visible regardless of branding. -->
      <div class="footer-version">OpenPXE&nbsp;v<span data-bind="version">0.4.63</span></div>
    </div>
  </aside>
@@ -87,11 +96,32 @@
        <path d="M20.5 14A8 8 0 0 1 10 3.5 a8 8 0 1 0 10.5 10.5z"/>
      </svg>
    </button>
    <!-- v0.4.6: signed-in operator menu. Sits next to the theme toggle
         in the top-right corner so the sidebar footer stays clean for
         the "Service status / Advertised URL / Backend version" trio.
         The whole block is hidden until /api/me confirms a session. -->
    <div class="user-menu" data-bind="user_menu_wrap" style="display:none">
      <button id="user-menu-btn" class="user-btn" type="button"
              aria-label="Account menu" aria-haspopup="true" aria-expanded="false"
              title="Account">
        <svg viewBox="0 0 24 24" width="18" height="18" fill="none"
             stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
          <circle cx="12" cy="8" r="3.6"/>
          <path d="M4.5 20a7.5 7.5 0 0 1 15 0"/>
        </svg>
      </button>
      <div id="user-menu-pop" class="user-pop" data-bind="user_menu_pop" hidden>
        <div class="user-pop-name" data-bind="user_pop_name">—</div>
        <button type="button" class="user-pop-item" data-bind="user_pop_edit">Edit account</button>
        <button type="button" class="user-pop-item user-pop-danger" data-bind="user_pop_logout">Sign out</button>
      </div>
    </div>
  </header>
  <main class="main" id="view-root"></main>
 </div>
-<script src="/assets/app.js"></script>
+<script src="/assets/app.js?v={{ASSET_VERSION}}"></script>
 </body>
 </html>
@@ -7,11 +7,29 @@
 //! nav, top bar with secondary tabs, card-dense content panels.
 #![forbid(unsafe_code)]
-/// Render the top-level page. `base_url` is interpolated into the footer
+/// Render the top-level page.
-/// so operators can see at a glance what URL clients are PXE-booting from.
+///
 /// * `base_url` is interpolated into the footer so operators can see at
 ///   a glance what URL clients are PXE-booting from.
 /// * `asset_version` is appended as `?v=…` to every asset URL so each
 ///   release ships with brand-new asset URLs — browsers (and any
 ///   intermediary proxy) can't keep serving last release's `app.js`
 ///   when we know the new one is incompatible. Combined with
 ///   `Cache-Control: no-cache, must-revalidate` on the asset handlers,
 ///   the worst-case caching window is one version.
 /// * `logo_rev` is appended to the brand-mark and favicon URLs as an
 ///   extra `&r=…` token. Unlike `asset_version` it changes every time
 ///   the operator swaps the custom logo, so the top-left mark updates
 ///   immediately on the next page load instead of being pinned to the
 ///   release version (which only changes on upgrade). `index.html`
 ///   itself is served `no-cache`, so the fresh token lands as soon as
 ///   the operator reloads after an upload.
 #[must_use]
-pub fn index_html(base_url: &str) -> String {
+pub fn index_html(base_url: &str, asset_version: &str, logo_rev: u64) -> String {
-    INDEX_HTML.replace("{{BASE_URL}}", base_url)
+    INDEX_HTML
        .replace("{{BASE_URL}}", base_url)
        .replace("{{ASSET_VERSION}}", asset_version)
        .replace("{{LOGO_REV}}", &logo_rev.to_string())
 }
 #[must_use]
@@ -16,7 +16,15 @@
 ARG RUST_VERSION=1.95
-########## fetch iPXE binaries ##########
+########## fetch iPXE binaries + wimboot ##########
 # v0.4.62: kept on the boot.ipxe.org pre-builds for the moment. We
 # want PNG support (so `console --picture` paints the operator's logo
 # on the PXE menu) but the obvious path — adding a new `ipxe-build`
 # stage that compiles iPXE from source with `IMAGE_PNG` enabled —
 # runs into a QEMU/gcc instability when cross-emulating x86_64 on
 # arm64 build hosts (intermittent `cc1` segfaults). The compositor
 # at /branding/pxe-logo is already wired so when the iPXE rebuild
 # lands (on native x86_64 hardware), no other code change is needed.
 FROM debian:12-slim AS fetch
 RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates \
 && rm -rf /var/lib/apt/lists/*
@@ -28,6 +36,22 @@ RUN mkdir -p assets/ipxe && bash scripts/fetch-ipxe.sh
 FROM rust:${RUST_VERSION}-bookworm AS build
 WORKDIR /src
 # v0.4.5: build a fully static musl binary (matches Bootimus v0.1.70's
 # move). The resulting `/openpxe` has no glibc dependency at all, which:
 #   - Lets the runtime stage be any Linux distro (we still ship Debian
 #     slim for the `samba` / `wimtools` / `nfs-common` shellouts, but a
 #     scratch/distroless variant becomes a one-line swap).
 #   - Cuts a class of "GLIBC_2.39 not found" surprises when running on
 #     older RHEL/Rocky hosts that don't match Debian 12's libc version.
 #   - Sidesteps cross-compilation snags (the binary is its own world).
 #
 # x86_64-unknown-linux-musl is fully static by default (no extra
 # RUSTFLAGS needed). musl-tools provides the linker.
 RUN apt-get update \
 && apt-get install -y --no-install-recommends musl-tools \
 && rm -rf /var/lib/apt/lists/* \
 && rustup target add x86_64-unknown-linux-musl
 # Copy the whole workspace in one go. We used to do a two-pass "cache-prime
 # with stubs, then real build" dance for dep-compile reuse; that turned out
 # to silently serve stale stub binaries when cargo's fingerprint didn't
@@ -42,14 +66,14 @@ COPY Cargo.toml Cargo.lock ./
 COPY crates/ crates/
 COPY --from=fetch /src/assets/ipxe /src/assets/ipxe
-# Cache cargo registry + target across builds. The `--no-edit` touch is
+# Cache cargo registry + target across builds. The mtime touch is
 # belt-and-suspenders: cargo occasionally misses mtime-only changes on
 # networked FS; this forces a fingerprint check.
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
    --mount=type=cache,target=/src/target,sharing=locked \
    find crates -name '*.rs' -exec touch {} + && \
-    cargo build --release --bin openpxe && \
+    cargo build --release --target x86_64-unknown-linux-musl --bin openpxe && \
-    cp target/release/openpxe /openpxe && \
+    cp target/x86_64-unknown-linux-musl/release/openpxe /openpxe && \
    ls -l /openpxe
 ########## runtime ##########
@@ -57,27 +81,45 @@ FROM debian:12-slim AS runtime
 RUN apt-get update \
 && apt-get install -y --no-install-recommends \
        ca-certificates libcap2-bin tini gosu iproute2 \
-        wimtools samba nfs-common \
+        wimtools samba smbclient \
 && rm -rf /var/lib/apt/lists/* \
 && useradd --system --uid 10001 --home-dir /var/lib/openpxe --shell /usr/sbin/nologin openpxe \
 && mkdir -p /var/lib/openpxe/isos /var/lib/openpxe/work /var/lib/openpxe/smb \
 && chown -R openpxe:openpxe /var/lib/openpxe
-# Runtime deps explained:
+# v0.4.5: the openpxe binary itself is now built against musl and is
-#   wimtools  - provides `wimlib-imagex`, used to inject startnet.cmd into boot.wim.
+# fully static — no glibc dependency. The runtime stage still ships
-#   samba     - `smbd` serves extracted Windows install media on :445 for WinPE
+# Debian slim because OpenPXE shells out to the packages below for
-#               to `net use`. Guest read-only, scoped to /var/lib/openpxe/smb.
+# functionality we deliberately don't reimplement in-process:
-#   nfs-common - provides `mount.nfs` / `mount.nfs4` for the Storage tab's
+#
-#               NFS share manager. Mount also requires the container to run
+#   wimtools   - `wimlib-imagex`, used to inject startnet.cmd into boot.wim.
-#               with CAP_SYS_ADMIN — without it, mount(2) returns EPERM and
+#   samba      - `smbd` serves extracted Windows install media on :445 so
-#               the manager surfaces a clear error in the UI instead of
+#                WinPE can `net use`. Guest read-only, scoped to
-#               failing silently.
+#                /var/lib/openpxe/smb. This package provides the SERVER
-#   iproute2  - `ip addr` / `ip route` for the auto-detected Network tab
+#                side only; the client CLI is a separate package below.
-#               fields (NIC name, subnet mask, default gateway). Tiny,
+#   smbclient  - v0.4.66: Samba's `smbclient` userspace CLI, used by
-#               always available; we don't pull in netlink crates for
+#                the Storage tab's SMB shares manager to list and stream
-#               this one-shot startup probe.
+#                ISOs from remote SMB servers without ever mounting them
-#   gosu      - drops privileges cleanly from root after the entrypoint fixes
+#                in the kernel. In Debian 12 `smbclient` is NOT pulled
-#               bind-mount ownership (common OpenShift/Docker UX issue).
+#                in by the `samba` package — they're siblings, not
-# Windows-specific tools only activate when the WebUI toggle is on.
+#                parent/child. v0.4.65 shipped without this line and
 #                every "Add share" attempt surfaced
 #                `could not exec smbclient: No such file or directory`
 #                until this landed.
 #   iproute2   - `ip addr` / `ip route` for the auto-detected Network
 #                tab fields (NIC name, subnet mask, default gateway).
 #                Tiny, always available; we don't pull in netlink crates
 #                for this one-shot startup probe.
 #   gosu       - drops privileges cleanly from root after the entrypoint
 #                fixes bind-mount ownership (common OpenShift/Docker UX
 #                issue).
 #
 # v0.4.65 dropped `nfs-common` — kernel-mount NFS is gone. The SMB
 # shares replacement uses userspace `smbclient` and needs no kernel
 # helpers.
 #
 # A future "openpxe-static" variant could drop everything except the
 # binary onto distroless once we move the Windows + SMB legs to
 # in-process Rust crates.
 COPY --from=build /openpxe /usr/local/bin/openpxe
 COPY deploy/docker/entrypoint.sh /usr/local/bin/entrypoint.sh
@@ -0,0 +1,106 @@
 # PXE menu theme — research for next-release follow-up
 Status: queued. v0.4.63 keeps the ASCII-banner fallback + `console --picture`
 compositor wired; this note captures the design for the menu-theming work
 that lands once iPXE rebuilt with `IMAGE_PNG` is published.
 ## How iVentoy actually does it
 iVentoy is closed-source for its menu, but the supporting bits are
 public at https://github.com/ventoy/PXE — a vanilla iPXE snapshot
 (`iPXE/ipxe-bd13697`) used to produce the loader binaries iVentoy
 serves over TFTP (`pxeboot.efi`, `iventoy_loader_16000`,
 `iventoy_loader_16000_uefi`).
 The graphical menu itself is rendered by iPXE's framebuffer console
 with a baked-in PNG background via `console --picture` — same
 primitive OpenPXE already uses in `crates/http-api/src/ipxe_script.rs`.
 Evidence:
 - The iPXE build in `ventoy/PXE` is configured with `CONSOLE_FRAMEBUFFER`
  + `IMAGE_PNG` + `CONSOLE_CMD` (the three flags `console --picture`
  needs).
 - iVentoy issue #11 confirms "iventoy using default 1024x768"; users
  report 800x600 / 1024x768 / 1280x720 / 1280x1024 / 1920x1080 as
  selectable resolutions from the iVentoy web UI **Configuration tab**,
  not via EDID auto-detect. iPXE has no EDID parsing; the daemon writes
  a resolution-tagged script per boot and serves the matching PNG.
 - iVentoy docs explicitly state both Free and Pro editions **do not
  support** modifying the boot background/title — it's baked into the
  shipped PNG assets.
 - Chrome is iPXE's native `menu` / `item` / `choose` widgets (single
  highlight bar, no borders) painted on top of the PNG, with margins
  set via `console --left/--right/--top/--bottom` to keep the text off
  the logo. Not GRUB, not syslinux — UEFI iVentoy uses iPXE's
  `snponly.efi` / `pxeboot.efi`, and `--picture` does work under UEFI
  GOP despite older folklore.
 Do not conflate this with Ventoy-USB, which is a separate codebase and
 uses GRUB2 themes (`theme.txt`, `background_ventoy.png`, `select_c.png`).
 ## Rust ingredients to replicate / surpass
 Most of these already exist in the workspace.
 1. **Compositor (extend, don't replace)** — extend
   `crates/iso-store/src/pxe_logo.rs` to emit per-resolution PNGs
   (1024x768, 1280x1024, 1920x1080 as the v1 set). `image` +
   `imageproc` crates handle scaling; `ab_glyph` / `fontdue` for raster
   text (subtitle, hostname, version). One source SVG/logo, three to
   five rendered PNGs cached on disk.
 2. **Script generator** — `ipxe_script.rs` already emits
   `console --picture … || console`. Add a `?res=` query param (or
   per-MAC client hint persisted in `hosts.json`) and serve the matching
   PNG plus matching `console --x --y` line. Keep the text-console
   fallback already in place.
 3. **Resolution selection** — iPXE exposes `${vesa-x}` / `${vesa-y}` on
   BIOS; UEFI side we can probe firmware vars at chain-time. The simpler
   v1 is a "low-res / hi-res" toggle in Settings plus a per-host
   override — mirrors iVentoy's UX, no kernel helper needed. True EDID
   parsing is overkill for the first cut.
 4. **Chrome upgrades over iVentoy** — iPXE menus are limited (single
   highlight, no borders). To look distinctly cooler without leaving
   iPXE: paint border / title / footer **into the PNG**, leave a window
   in the middle, then `console --left/--right/--top/--bottom` to inset
   the iPXE menu exactly into that window. ASCII box-drawing inside the
   menu remains fragile (iPXE mangles non-ASCII on some builds — already
   noted in `ipxe_script.rs`).
 ## Recommended architecture for the next OpenPXE release
 - Build a `pxe_theme` module beside `pxe_logo.rs`: takes operator logo
  + theme tokens (accent colour, title, footer) and renders a layered
  PNG (background gradient → framing chrome → logo → title bar → footer
  with `${hostname}` / `${version}` / `${ip}`) at the three target
  resolutions. Cache by hash of inputs.
 - Serve at `/branding/pxe-menu-{w}x{h}.png`. Default 1024x768; expose a
  Settings dropdown.
 - In `ipxe_script.rs`, emit
  `console --picture …/pxe-menu-1024x768.png --left 80 --right 80 --top 180 --bottom 60 || console`,
  then the existing `menu` / `item` / `choose` block — text now lands
  inside the framed window.
 - Compile iPXE with `CONSOLE_FRAMEBUFFER`, `IMAGE_PNG`, `CONSOLE_CMD`,
  `CONSOLE_VESAFB` (BIOS) and `CONSOLE_EFIFB` (UEFI). The v0.4.61 image
  attempted this in-Docker via QEMU emulation and hit `cc1` segfaults.
  The follow-up will use a Gitea Actions runner pinned to native
  `linux/amd64` (an Unraid host already exists for this).
 - Stretch goal: a second "theme pack" that ships a layered PNG with
  subtle scanlines / grid — iPXE can't animate, but a well-designed
  static composite beats iVentoy's plain centered logo handily.
 ## Source URLs
 - https://github.com/ventoy/PXE
 - https://github.com/ventoy/PXE/tree/master/iPXE
 - https://github.com/ventoy/PXE/issues/11 — 1024x768 default
 - https://github.com/ventoy/PXE/issues/59 — iVentoy iPXE EFI loader
 - https://ipxe.org/cmd/console — `--picture` and compile flags
 - https://github.com/ipxe/ipxe/discussions/945 — background image how-to
 - https://github.com/ipxe/ipxe/discussions/802 — `CONSOLE_FRAMEBUFFER`
  requirement
 - https://github.com/ipxe/ipxe/discussions/1006 — picture resolution
  behaviour
 - https://www.iventoy.com/en/doc_edition.html — background / title not
  user-customisable
 - https://kingtam.win/archives/iventoy.html — third-party iPXE-based
  iVentoy alternative