v0.4.69: PNG boot-menu background (iPXE built from source), NFS AUTH_SYS, FleetDM logo

Three things, headlined by the long-blocked graphical PXE menu. ## 1. Graphical PXE boot background — the iVentoy feature, finally iVentoy paints a PNG background on the PXE screen using stock iPXE built with CONSOLE_FRAMEBUFFER + IMAGE_PNG + CONSOLE_CMD; the public iPXE binaries omit those, so `console --picture` is a no-op on them. We now build our own iPXE from upstream with that thin config delta (deploy/ipxe/local/{general,console}.h). The 8-release blocker was cc1 segfaulting when an amd64 gcc ran under QEMU emulation on the arm64 build host. Fix: a new `ipxe-build` Dockerfile stage pinned to $BUILDPLATFORM (native arch — no emulation) that cross-compiles x86_64 iPXE with CROSS_COMPILE=x86_64-linux-gnu-. The compiler runs native and emits x86_64. Validated end-to-end: png.o + fbcon.o + pixbuf.o all compile and link (confirmed via the linked-ELF symbol table, not just strings), ~112s, no segfault. Host tools needed libc6-dev (dropped by --no-install-recommends; without it the native host compile falls through to iPXE's freestanding headers and dies on bits/stdint.h — fixed). Server side: - pxe_logo.rs is now a full-screen background compositor: a dark field (matching the WebUI theme) with the operator's uploaded logo across the top, or — with no upload — a default OpenPXE rainbow disc drawn with pure pixel math (no font/SVG deps). Always 1024x768 (iPXE doesn't scale; this is the universal mode). WebP/JPEG/GIF/PNG in, PNG out (iPXE only eats PNG). - /branding/pxe-logo always returns a PNG now (default when no logo, default when SVG) so the menu always has a background. - render_menu uses `console --picture … --top 290 || console`: paints the background and reserves the logo band on PNG-capable binaries (x86_64 UEFI), cleanly falls back to text on the others. The ASCII wordmark is GONE. Only x86_64 UEFI is built from source (host-arch-agnostic cross build); BIOS/i386/arm64 keep upstream-fetched no-PNG binaries + text fallback. Modern clients are overwhelmingly x86_64 UEFI. ## 2. NFS AUTH_SYS credential — fixes NFS3ERR_ACCES v0.4.68's privileged-port fix got past MNT3ERR_ACCES (mount); operators then hit NFS3ERR_ACCES on READDIR because nfs3_client defaults to AUTH_NONE and virtually every server exports sec=sys. We now present an AUTH_UNIX credential (uid 0 / gid 0): no_root_squash servers treat us as root, root_squash servers map us to anon which reads any world-readable ISO share. Kept fixed (no UI knob) to stay dead-simple. Hint updated: a remaining NFS3ERR_ACCES is now a server-side permission/squash issue, not IP/auth-flavor. ## 3. FleetDM-style full-width logo (top-left) When a custom logo is uploaded the sidebar header drops the bundled mark + "OpenPXE" wordmark and lets the logo span the header (left-aligned, capped 200x50, contain). Rendered server-side via a brand-class in index_html (has_custom_logo) so there's no flash of the default. The bundled-default case is unchanged. Tests: 164 passing. clippy -D warnings clean. iPXE build stage validated in isolation before the full image build. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
v0.4.68: fix NFS secure-export mount, logo cache-bust, dashboard disk card, NFS form spacing
2026-05-29 03:11:35 -04:00 · 2026-05-28 21:34:41 -04:00 · 2026-05-28 12:56:46 -04:00 · 2026-05-28 11:58:51 -04:00 · 2026-05-28 11:19:47 -04:00 · 2026-05-28 10:47:17 -04:00
28 changed files with 4550 additions and 928 deletions
@@ -2,6 +2,12 @@
 # It is not intended for manual editing.
 version = 4
 [[package]]
 name = "adler2"
 version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
 [[package]]
 name = "aho-corasick"
 version = "1.1.4"
@@ -84,6 +90,12 @@ version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
 [[package]]
 name = "autocfg"
 version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 [[package]]
 name = "axum"
 version = "0.7.9"
@@ -212,12 +224,24 @@ version = "3.20.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5d20789868f4b01b2f2caec9f5c4e0213b41e3e5702a50157d699ae31ced2fcb"
 [[package]]
 name = "bytemuck"
 version = "1.25.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c8efb64bd706a16a1bdde310ae86b351e4d21550d98d056f22f8a7f7a2183fec"
 [[package]]
 name = "byteorder"
 version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 [[package]]
 name = "byteorder-lite"
 version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f1fe948ff07f4bd06c30984e69f5b4899c516a3ef74f34df92a2df2ab535495"
 [[package]]
 name = "bytes"
 version = "1.11.1"
@@ -280,6 +304,12 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
 [[package]]
 name = "color_quant"
 version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3d7b894f5411737b7867f4827955924d7c254fc9f4d91a6aad6b097804b1018b"
 [[package]]
 name = "colorchoice"
 version = "1.0.5"
@@ -295,6 +325,15 @@ dependencies = [
 "libc",
 ]
 [[package]]
 name = "crc32fast"
 version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
 dependencies = [
 "cfg-if",
 ]
 [[package]]
 name = "crypto-common"
 version = "0.1.7"
@@ -406,6 +445,25 @@ version = "2.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
 [[package]]
 name = "fdeflate"
 version = "0.3.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e6853b52649d4ac5c0bd02320cddc5ba956bdb407c4b75a2c6b75bf51500f8c"
 dependencies = [
 "simd-adler32",
 ]
 [[package]]
 name = "flate2"
 version = "1.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
 dependencies = [
 "crc32fast",
 "miniz_oxide",
 ]
 [[package]]
 name = "fnv"
 version = "1.0.7"
@@ -549,6 +607,16 @@ dependencies = [
 "wasip3",
 ]
 [[package]]
 name = "gif"
 version = "0.14.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ee8cfcc411d9adbbaba82fb72661cc1bcca13e8bba98b364e62b2dba8f960159"
 dependencies = [
 "color_quant",
 "weezl",
 ]
 [[package]]
 name = "globset"
 version = "0.4.18"
@@ -821,6 +889,34 @@ dependencies = [
 "icu_properties",
 ]
 [[package]]
 name = "image"
 version = "0.25.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "85ab80394333c02fe689eaf900ab500fbd0c2213da414687ebf995a65d5a6104"
 dependencies = [
 "bytemuck",
 "byteorder-lite",
 "color_quant",
 "gif",
 "image-webp",
 "moxcms",
 "num-traits",
 "png",
 "zune-core",
 "zune-jpeg",
 ]
 [[package]]
 name = "image-webp"
 version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "525e9ff3e1a4be2fbea1fdf0e98686a6d98b4d8f937e1bf7402245af1909e8c3"
 dependencies = [
 "byteorder-lite",
 "quick-error",
 ]
 [[package]]
 name = "indexmap"
 version = "2.14.0"
@@ -958,6 +1054,16 @@ dependencies = [
 "unicase",
 ]
 [[package]]
 name = "miniz_oxide"
 version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
 dependencies = [
 "adler2",
 "simd-adler32",
 ]
 [[package]]
 name = "mio"
 version = "1.2.0"
@@ -969,6 +1075,16 @@ dependencies = [
 "windows-sys 0.61.2",
 ]
 [[package]]
 name = "moxcms"
 version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bb85c154ba489f01b25c0d36ae69a87e4a1c73a72631fc6c0eb6dde34a73e44b"
 dependencies = [
 "num-traits",
 "pxfm",
 ]
 [[package]]
 name = "multer"
 version = "3.1.0"
@@ -986,6 +1102,37 @@ dependencies = [
 "version_check",
 ]
 [[package]]
 name = "nfs3_client"
 version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0ac227029a6127f3474b4fb61cbf2d3dddbe9424ad50c24fada68b633687a532"
 dependencies = [
 "fastrand",
 "nfs3_types",
 "tokio",
 ]
 [[package]]
 name = "nfs3_macros"
 version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "06d8fb377e6efeb91911a8ed962a69615535e167e675025a2be8fa109751426a"
 dependencies = [
 "proc-macro2",
 "quote",
 "syn 2.0.117",
 ]
 [[package]]
 name = "nfs3_types"
 version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b5d5ab1a9fdfeab2f03b36b6300dea4ea3806e6a057cb479628b41d65e356b94"
 dependencies = [
 "nfs3_macros",
 ]
 [[package]]
 name = "nu-ansi-term"
 version = "0.50.3"
@@ -1001,6 +1148,15 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c6673768db2d862beb9b39a78fdcb1a69439615d5794a1be50caa9bc92c81967"
 [[package]]
 name = "num-traits"
 version = "0.2.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
 dependencies = [
 "autocfg",
 ]
 [[package]]
 name = "once_cell"
 version = "1.21.4"
@@ -1015,7 +1171,7 @@ checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
 [[package]]
 name = "openpxe"
-version = "0.4.5"
+version = "0.4.69"
 dependencies = [
 "anyhow",
 "axum",
@@ -1037,7 +1193,7 @@ dependencies = [
 [[package]]
 name = "openpxe-core"
-version = "0.4.5"
+version = "0.4.69"
 dependencies = [
 "anyhow",
 "bcrypt",
@@ -1056,7 +1212,7 @@ dependencies = [
 [[package]]
 name = "openpxe-dhcp-proxy"
-version = "0.4.5"
+version = "0.4.69"
 dependencies = [
 "anyhow",
 "bytes",
@@ -1070,13 +1226,14 @@ dependencies = [
 [[package]]
 name = "openpxe-http-api"
-version = "0.4.5"
+version = "0.4.69"
 dependencies = [
 "anyhow",
 "axum",
 "bytes",
 "futures",
 "hyper",
 "image",
 "mime",
 "mime_guess",
 "openpxe-core",
@@ -1100,7 +1257,7 @@ dependencies = [
 [[package]]
 name = "openpxe-ipxe-assets"
-version = "0.4.5"
+version = "0.4.69"
 dependencies = [
 "openpxe-core",
 "rust-embed",
@@ -1110,13 +1267,17 @@ dependencies = [
 [[package]]
 name = "openpxe-iso-store"
-version = "0.4.5"
+version = "0.4.69"
 dependencies = [
 "anyhow",
 "bcrypt",
 "bytes",
 "futures",
 "hex",
 "image",
 "libc",
 "nfs3_client",
 "nfs3_types",
 "openpxe-core",
 "parking_lot",
 "serde",
@@ -1133,7 +1294,7 @@ dependencies = [
 [[package]]
 name = "openpxe-tftp"
-version = "0.4.5"
+version = "0.4.69"
 dependencies = [
 "anyhow",
 "bytes",
@@ -1147,7 +1308,7 @@ dependencies = [
 [[package]]
 name = "openpxe-webui"
-version = "0.4.5"
+version = "0.4.69"
 [[package]]
 name = "parking_lot"
@@ -1184,6 +1345,19 @@ version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 [[package]]
 name = "png"
 version = "0.18.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "60769b8b31b2a9f263dae2776c37b1b28ae246943cf719eb6946a1db05128a61"
 dependencies = [
 "bitflags",
 "crc32fast",
 "fdeflate",
 "flate2",
 "miniz_oxide",
 ]
 [[package]]
 name = "potential_utf"
 version = "0.1.5"
@@ -1227,6 +1401,18 @@ dependencies = [
 "unicode-ident",
 ]
 [[package]]
 name = "pxfm"
 version = "0.1.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e0c5ccf5294c6ccd63a74f1565028353830a9c2f5eb0c682c355c471726a6e3f"
 [[package]]
 name = "quick-error"
 version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a993555f31e5a609f617c12db6250dedcac1b0a85076912c436e6fc9b2c8e6a3"
 [[package]]
 name = "quote"
 version = "1.0.45"
@@ -1484,6 +1670,12 @@ dependencies = [
 "libc",
 ]
 [[package]]
 name = "simd-adler32"
 version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "703d5c7ef118737c72f1af64ad2f6f8c5e1921f818cdcb97b8fe6fc69bf66214"
 [[package]]
 name = "slab"
 version = "0.4.12"
@@ -2124,6 +2316,12 @@ dependencies = [
 "semver",
 ]
 [[package]]
 name = "weezl"
 version = "0.1.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a28ac98ddc8b9274cb41bb4d9d4d5c425b6020c50c46f25559911905610b4a88"
 [[package]]
 name = "winapi-util"
 version = "0.1.11"
@@ -2438,3 +2636,18 @@ name = "zmij"
 version = "1.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
 [[package]]
 name = "zune-core"
 version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cb8a0807f7c01457d0379ba880ba6322660448ddebc890ce29bb64da71fb40f9"
 [[package]]
 name = "zune-jpeg"
 version = "0.5.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "27bc9d5b815bc103f142aa054f561d9187d191692ec7c2d1e2b4737f8dbd7296"
 dependencies = [
 "zune-core",
 ]
@@ -12,7 +12,7 @@ members = [
 ]
 [workspace.package]
-version = "0.4.5"
+version = "0.4.69"
 edition = "2021"
 rust-version = "1.95"
 license = "MIT OR Apache-2.0"
@@ -58,6 +58,14 @@ once_cell = "1.19"
 parking_lot = "0.12"
 rust-embed = { version = "8.5", features = ["include-exclude"] }
 # v0.4.67: pure-Rust NFSv3 client. Replaces the (deleted-in-v0.4.65)
 # kernel-mount NFS path with an in-process implementation that works
 # in any container — no kernel modules, no CAP_SYS_ADMIN, no
 # subprocess. Ships alongside the userspace SMB consumer; operators
 # pick whichever protocol their NAS prefers.
 nfs3_client = { version = "0.9", features = ["tokio"] }
 nfs3_types = "0.5"
 openpxe-core = { path = "crates/core" }
 openpxe-dhcp-proxy = { path = "crates/dhcp-proxy" }
 openpxe-tftp = { path = "crates/tftp" }
@@ -44,6 +44,14 @@ struct Inner {
    /// MIME of the active logo, mirroring `logo_filename`. Cached here
    /// so the HTTP layer can set Content-Type without re-sniffing.
    logo_mime: Option<String>,
    /// Monotonic counter bumped on every set/clear. Surfaces as a
    /// cache-bust token (`/assets/logo.svg?r=<rev>`) so the browser
    /// fetches the new bytes the moment the operator swaps the logo —
    /// the app version alone can't do this since it doesn't change on
    /// upload. Persisted so the token stays stable across restarts and
    /// keeps climbing across multiple swaps.
    #[serde(default)]
    rev: u64,
 }
 /// In-memory + on-disk override registry. Cheap to clone; locks are
@@ -150,6 +158,7 @@ impl BrandingStore {
            let mut g = self.inner.write();
            g.logo_filename = Some(filename.clone());
            g.logo_mime = Some(mime.to_string());
            g.rev = g.rev.wrapping_add(1);
        }
        self.persist();
        tracing::info!(
@@ -166,6 +175,7 @@ impl BrandingStore {
            let mut g = self.inner.write();
            let removed = g.logo_filename.take();
            g.logo_mime = None;
            g.rev = g.rev.wrapping_add(1);
            removed
        };
        if let Some(name) = removed {
@@ -185,6 +195,14 @@ impl BrandingStore {
        self.inner.read().logo_filename.is_some()
    }
    /// Cache-bust token for the logo asset URL. Changes on every
    /// set/clear so `/assets/logo.svg?r=<rev>` resolves to a fresh URL
    /// whenever the operator swaps the brand mark. Stable otherwise.
    #[must_use]
    pub fn logo_rev(&self) -> u64 {
        self.inner.read().rev
    }
    fn persist(&self) {
        let snap = self.inner.read().clone();
        let body = match serde_json::to_vec_pretty(&snap) {
@@ -292,6 +310,23 @@ mod tests {
        assert!(!entries.iter().any(|n| n == "logo.png"), "stale PNG left over: {entries:?}");
    }
    #[test]
    fn logo_rev_bumps_on_each_set_and_clear() {
        let dir = tempdir().unwrap();
        let b = BrandingStore::load_or_default(dir.path());
        assert_eq!(b.logo_rev(), 0);
        b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake").unwrap();
        assert_eq!(b.logo_rev(), 1);
        b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake2").unwrap();
        assert_eq!(b.logo_rev(), 2);
        b.clear_logo().unwrap();
        assert_eq!(b.logo_rev(), 3);
        // Survives a restart.
        drop(b);
        let b2 = BrandingStore::load_or_default(dir.path());
        assert_eq!(b2.logo_rev(), 3);
    }
    #[test]
    fn sanitize_ext_strips_separators_and_path_chars() {
        assert_eq!(sanitize_ext("svg"), "svg");
@@ -319,6 +354,7 @@ mod tests {
        let inner = Inner {
            logo_filename: Some("logo.png".into()),
            logo_mime: Some("image/png".into()),
            rev: 0,
        };
        std::fs::write(
            brand_dir.join("branding.json"),
@@ -33,6 +33,11 @@ pub struct SsoConfig {
    /// with X" button label. Empty/whitespace falls back to "SSO".
    #[serde(default)]
    pub idp_name: String,
    /// Optional HTTPS URL pointing at the IdP's brand logo. Rendered
    /// next to `idp_name` on the WebUI's login screen (FleetDM-style).
    /// Length-capped at [`MAX_URL_LEN`]; empty is fine.
    #[serde(default)]
    pub idp_logo_url: String,
    /// Raw SAML metadata XML pasted by the operator. Mutually exclusive
    /// with `metadata_url`; if both are set, the URL wins at apply time
    /// (operators typically forget about a stale XML paste).
@@ -100,6 +105,7 @@ impl SsoStore {
    /// but the server enforces a hard ceiling regardless.
    pub fn replace(&self, mut cfg: SsoConfig) -> Result<SsoConfig> {
        cfg.idp_name = cfg.idp_name.trim().to_string();
        cfg.idp_logo_url = cfg.idp_logo_url.trim().to_string();
        cfg.metadata = cfg.metadata.trim().to_string();
        cfg.metadata_url = cfg.metadata_url.trim().to_string();
        if cfg.metadata.len() > MAX_METADATA_BYTES {
@@ -112,6 +118,11 @@ impl SsoStore {
                "metadata_url exceeds {MAX_URL_LEN}-char cap"
            )));
        }
        if cfg.idp_logo_url.len() > MAX_URL_LEN {
            return Err(Error::Invalid(format!(
                "idp_logo_url exceeds {MAX_URL_LEN}-char cap"
            )));
        }
        if !cfg.metadata_url.is_empty()
            && !cfg.metadata_url.starts_with("http://")
            && !cfg.metadata_url.starts_with("https://")
@@ -120,6 +131,14 @@ impl SsoStore {
                "metadata_url must start with http:// or https://".into(),
            ));
        }
        if !cfg.idp_logo_url.is_empty()
            && !cfg.idp_logo_url.starts_with("http://")
            && !cfg.idp_logo_url.starts_with("https://")
        {
            return Err(Error::Invalid(
                "idp_logo_url must start with http:// or https://".into(),
            ));
        }
        // If they're trying to *enable* the integration but haven't
        // supplied either source, reject — saves a "configured but
        // unusable" surprise later.
@@ -197,6 +216,7 @@ mod tests {
            idp_name: "Okta".into(),
            metadata: String::new(),
            metadata_url: "https://idp.example.com/metadata".into(),
            idp_logo_url: String::new(),
        })
        .unwrap();
        drop(s);
@@ -218,6 +238,7 @@ mod tests {
            idp_name: "Test IdP".into(),
            metadata: xml.into(),
            metadata_url: String::new(),
            idp_logo_url: String::new(),
        })
        .unwrap();
        assert!(s.snapshot().is_usable());
@@ -232,6 +253,7 @@ mod tests {
            idp_name: "Okta".into(),
            metadata: String::new(),
            metadata_url: String::new(),
            idp_logo_url: String::new(),
        });
        assert!(matches!(r, Err(Error::Invalid(_))));
        // …and a disabled blank config is fine.
@@ -247,10 +269,38 @@ mod tests {
            idp_name: String::new(),
            metadata: String::new(),
            metadata_url: "ftp://idp.example.com/metadata".into(),
            idp_logo_url: String::new(),
        });
        assert!(matches!(r, Err(Error::Invalid(_))));
    }
    #[test]
    fn idp_logo_url_must_be_http_scheme() {
        // v0.4.6: SSO settings learned an idp_logo_url so the login
        // screen can render the FleetDM-style "Sign in with <IdP-logo>"
        // affordance. Same scheme rule as metadata_url.
        let dir = tempdir().unwrap();
        let s = SsoStore::load_or_default(dir.path());
        let r = s.replace(SsoConfig {
            enabled: false,
            idp_name: "Okta".into(),
            metadata: String::new(),
            metadata_url: String::new(),
            idp_logo_url: "data:image/png;base64,...".into(),
        });
        assert!(matches!(r, Err(Error::Invalid(_))));
        // Real HTTPS URL is fine.
        s.replace(SsoConfig {
            enabled: false,
            idp_name: "Okta".into(),
            metadata: String::new(),
            metadata_url: String::new(),
            idp_logo_url: "https://idp.example.com/logo.png".into(),
        })
        .unwrap();
        assert_eq!(s.snapshot().idp_logo_url, "https://idp.example.com/logo.png");
    }
    #[test]
    fn metadata_size_cap_enforced() {
        let dir = tempdir().unwrap();
@@ -261,6 +311,7 @@ mod tests {
            idp_name: String::new(),
            metadata: oversize,
            metadata_url: String::new(),
            idp_logo_url: String::new(),
        });
        assert!(matches!(r, Err(Error::Invalid(_))));
    }
@@ -41,3 +41,6 @@ tower = { workspace = true }
 tempfile = "3.12"
 serde_json = { workspace = true }
 time = { workspace = true }
 # v0.4.61: integration tests need to generate real PNG bytes for the
 # `/branding/pxe-logo` compositor; hand-rolled CRCs are too fragile.
 image = { version = "0.25", default-features = false, features = ["png"] }
@@ -35,7 +35,7 @@ use openpxe_core::{
    MAX_LOGO_BYTES,
 };
 use openpxe_ipxe_assets::asset_bytes;
-use openpxe_iso_store::{IsoCategory, IsoMeta, NfsAddRequest};
+use openpxe_iso_store::{IsoCategory, IsoMeta, IsoSource, NfsAddRequest, SmbAddRequest};
 use serde::Deserialize;
 use serde_json::json;
 use std::net::SocketAddr;
@@ -51,6 +51,13 @@ pub fn build_router(state: AppState) -> Router {
        .route("/assets/app.css", get(ui_css))
        .route("/assets/logo.svg", get(ui_logo))
        .route("/assets/loader.svg", get(ui_loader))
        // v0.4.6: PXE menu logo — the raster form of the operator's
        // uploaded mark, served so iPXE's `console --picture` can
        // overlay it on the boot menu. SVG uploads 404 here (iPXE
        // can't rasterize SVG); we deliberately don't bundle a
        // pre-rendered PNG fallback because iPXE's ASCII wordmark
        // banner already provides the always-visible branding.
        .route("/branding/pxe-logo", get(ui_pxe_logo))
        // iPXE script endpoints.
        .route("/boot.ipxe", get(boot_top_menu))
        .route("/boot/:filename", get(boot_sub))
@@ -125,10 +132,21 @@ pub fn build_router(state: AppState) -> Router {
        .route("/api/queue/poll/:entry_id", get(api_queue_poll))
        .route("/api/queue/assign", post(api_queue_assign))
        .route("/api/queue/:entry_id", delete(api_queue_release))
-        // Phase 4: NFS share manager.
+        // v0.4.65: SMB share manager (userspace via smbclient). The
-        .route("/api/nfs", get(api_nfs_list).post(api_nfs_add))
+        // kernel-mount NFS routes that v0.4.64 shipped are gone — they
-        .route("/api/nfs/:id", delete(api_nfs_remove))
+        // didn't work on hosts whose kernel lacked the nfs client
-        .route("/api/nfs/:id/scan", post(api_nfs_scan))
+        // modules (Unraid), and no container-side configuration could
        // load a host kernel module. `smbclient` speaks SMB over a
        // plain TCP socket in userspace, works in every container.
        .route("/api/smb-shares", get(api_smb_shares_list).post(api_smb_shares_add))
        .route("/api/smb-shares/:id", delete(api_smb_shares_remove))
        .route("/api/smb-shares/:id/scan", post(api_smb_shares_scan))
        // v0.4.67: NFSv3 share manager (pure-Rust in-process client).
        // Ships alongside SMB. Routes are parallel so the UI can
        // reuse the same form/error/hint rendering for both.
        .route("/api/nfs-shares", get(api_nfs_shares_list).post(api_nfs_shares_add))
        .route("/api/nfs-shares/:id", delete(api_nfs_shares_remove))
        .route("/api/nfs-shares/:id/scan", post(api_nfs_shares_scan))
        // Phase 4: Network info (read-only) + DNS edit.
        .route("/api/network", get(api_network).put(api_network_put))
        // Phase 4: live-log stream + recent buffer for the Terminal tab.
@@ -186,23 +204,55 @@ async fn api_sso_put(State(state): State<AppState>, Json(body): Json<SsoConfig>)
 // ─── UI ────────────────────────────────────────────────────────────────────
 async fn index(State(state): State<AppState>) -> Response {
-    let html = openpxe_webui::index_html(&state.public_base_url);
+    // The asset version pin in index.html (`?v=…`) is what makes
    // browsers re-fetch JS/CSS after an upgrade. We use the OpenPXE
    // binary version — every release ships a new value, every release
    // forces a fresh URL on each asset.
    // logo_rev cache-busts the brand mark / favicon independently of
    // the release version, so an operator who swaps the custom logo
    // sees it update on the next reload without waiting for an upgrade.
    let html = openpxe_webui::index_html(
        &state.public_base_url,
        env!("CARGO_PKG_VERSION"),
        state.branding.logo_rev(),
        state.branding.has_logo(),
    );
    (
-        [(
+        [
-            header::CONTENT_TYPE,
+            (
-            HeaderValue::from_static("text/html; charset=utf-8"),
+                header::CONTENT_TYPE,
-        )],
+                HeaderValue::from_static("text/html; charset=utf-8"),
            ),
            // index.html itself must never be cached — that's how the
            // browser learns about a new `?v=…` value for the assets.
            (
                header::CACHE_CONTROL,
                HeaderValue::from_static("no-cache, must-revalidate"),
            ),
        ],
        html,
    )
        .into_response()
 }
 /// Cache-Control header value used for the bundled JS/CSS/SVG assets.
 /// We pin a 1-day TTL so a long-lived deployment doesn't re-fetch the
 /// same bytes on every page-load, but require revalidation — combined
 /// with the `?v=<version>` query string in index.html, the practical
 /// upper bound on caching across an upgrade is "until the operator
 /// reloads".
 const ASSET_CACHE_CONTROL: HeaderValue =
    HeaderValue::from_static("no-cache, must-revalidate");
 async fn ui_js() -> Response {
    (
-        [(
+        [
-            header::CONTENT_TYPE,
+            (
-            HeaderValue::from_static("application/javascript"),
+                header::CONTENT_TYPE,
-        )],
+                HeaderValue::from_static("application/javascript"),
            ),
            (header::CACHE_CONTROL, ASSET_CACHE_CONTROL),
        ],
        openpxe_webui::app_js(),
    )
        .into_response()
@@ -210,7 +260,10 @@ async fn ui_js() -> Response {
 async fn ui_css() -> Response {
    (
-        [(header::CONTENT_TYPE, HeaderValue::from_static("text/css"))],
+        [
            (header::CONTENT_TYPE, HeaderValue::from_static("text/css")),
            (header::CACHE_CONTROL, ASSET_CACHE_CONTROL),
        ],
        openpxe_webui::app_css(),
    )
        .into_response()
@@ -254,21 +307,102 @@ async fn ui_logo(State(state): State<AppState>) -> Response {
        }
    }
    (
-        [(
+        [
-            header::CONTENT_TYPE,
+            (
-            HeaderValue::from_static("image/svg+xml"),
+                header::CONTENT_TYPE,
-        )],
+                HeaderValue::from_static("image/svg+xml"),
            ),
            (header::CACHE_CONTROL, ASSET_CACHE_CONTROL),
        ],
        openpxe_webui::logo_svg(),
    )
        .into_response()
 }
 /// PXE boot-menu background, composed for the iPXE `console --picture`
 /// call. Returns a full-screen 1024×768 PNG: a dark field with the
 /// operator's uploaded logo across the top, or — when no logo is set —
 /// a default OpenPXE mark on the same dark field. Either way the
 /// endpoint *always* returns a valid PNG so the menu's `console
 /// --picture` paints a real background instead of falling through to
 /// bare text (v0.4.69 — replaces the old ASCII wordmark).
 ///
 /// Any raster the operator uploads (PNG / JPEG / WebP / GIF) is decoded
 /// and transcoded to PNG here, since iPXE only consumes PNG. SVG
 /// uploads can't be rasterized without hauling in `resvg`, so an SVG
 /// brand mark falls back to the *default* background for the PXE screen
 /// (the WebUI still renders the SVG natively in the top-left).
 async fn ui_pxe_logo(State(state): State<AppState>) -> Response {
    // Resolve the operator's raster upload, if any and if it's a format
    // iPXE/our compositor can consume. SVG (or a missing/unreadable
    // file) yields `None`, which composes the default background.
    let raster: Option<Vec<u8>> = match (state.branding.logo_path(), state.branding.logo_mime()) {
        (Some(path), Some(mime)) if mime != "image/svg+xml" => {
            tokio::fs::read(&path).await.ok()
        }
        _ => None,
    };
    let composed = match tokio::task::spawn_blocking(move || {
        openpxe_iso_store::pxe_logo::compose_pxe_background(raster.as_deref())
    })
    .await
    {
        Ok(Ok(png)) => png,
        Ok(Err(e)) => {
            // A decode failure on the operator's upload shouldn't blank
            // the boot screen — fall back to the default background.
            tracing::warn!(
                target: "openpxe::http::branding",
                error = %e, "PXE background compose failed on upload; using default"
            );
            match tokio::task::spawn_blocking(|| {
                openpxe_iso_store::pxe_logo::compose_pxe_background(None)
            })
            .await
            {
                Ok(Ok(png)) => png,
                _ => {
                    return (
                        StatusCode::INTERNAL_SERVER_ERROR,
                        "failed to compose PXE background",
                    )
                        .into_response();
                }
            }
        }
        Err(e) => {
            return (
                StatusCode::INTERNAL_SERVER_ERROR,
                format!("pxe-background task failed: {e}"),
            )
                .into_response();
        }
    };
    (
        [
            (header::CONTENT_TYPE, HeaderValue::from_static("image/png")),
            // No-cache so a freshly uploaded logo paints on the next
            // boot without a stale composite lingering.
            (
                header::CACHE_CONTROL,
                HeaderValue::from_static("no-cache, max-age=0"),
            ),
        ],
        composed,
    )
        .into_response()
 }
 async fn ui_loader() -> Response {
    (
-        [(
+        [
-            header::CONTENT_TYPE,
+            (
-            HeaderValue::from_static("image/svg+xml"),
+                header::CONTENT_TYPE,
-        )],
+                HeaderValue::from_static("image/svg+xml"),
            ),
            (header::CACHE_CONTROL, ASSET_CACHE_CONTROL),
        ],
        openpxe_webui::loader_svg(),
    )
        .into_response()
@@ -524,12 +658,111 @@ async fn iso_raw(
    headers: HeaderMap,
 ) -> Response {
    let id = filename.strip_suffix(".iso").unwrap_or(&filename);
-    let Some(path) = state.iso_store.iso_path_for(id) else {
+    // v0.4.65: SMB-sourced ISOs have no on-disk path — they're
    // streamed live from the remote share via `smbclient`. We look
    // up the meta first to decide whether to take the path-based
    // local route or the subprocess-based SMB route.
    let Some(meta) = state.iso_store.get(id) else {
        return (StatusCode::NOT_FOUND, "no such iso").into_response();
    };
-    match stream_file_range(&path, headers.get(header::RANGE)).await {
+    match &meta.source {
-        Ok(r) => r,
+        IsoSource::Local => {
-        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
+            let Some(path) = state.iso_store.iso_path_for(id) else {
                return (StatusCode::NOT_FOUND, "no such iso").into_response();
            };
            match stream_file_range(&path, headers.get(header::RANGE)).await {
                Ok(r) => r,
                Err(e) => {
                    (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response()
                }
            }
        }
        IsoSource::Smb {
            share_id,
            relative_path,
        } => {
            // Range requests aren't supported for SMB sources in
            // v0.4.65 — smbclient's CLI can't seek mid-stream. iPXE
            // chain loading and ISO sanboot do whole-file sequential
            // reads, so this works in practice. A 416 here lets the
            // client fall back to a full GET if it tried a range.
            if headers.get(header::RANGE).is_some() {
                return Response::builder()
                    .status(StatusCode::RANGE_NOT_SATISFIABLE)
                    .header(header::CONTENT_RANGE, format!("bytes */{}", meta.size_bytes))
                    .body(Body::empty())
                    .unwrap();
            }
            match state.smb_shares.stream_iso(share_id, relative_path).await {
                Ok(stream) => {
                    let reader = stream.stdout;
                    let body_stream = tokio_util::io::ReaderStream::new(reader);
                    Response::builder()
                        .status(StatusCode::OK)
                        .header(header::CONTENT_TYPE, "application/octet-stream")
                        .header(header::CONTENT_LENGTH, meta.size_bytes)
                        // Tell intermediaries we don't support
                        // ranges on this resource; saves them from
                        // even trying.
                        .header(header::ACCEPT_RANGES, "none")
                        .body(Body::from_stream(body_stream))
                        .unwrap()
                }
                Err(e) => (StatusCode::BAD_GATEWAY, format!("smb stream: {e}")).into_response(),
            }
        }
        IsoSource::Nfs {
            share_id,
            relative_path,
        } => {
            // v0.4.67: NFS sources support Range requests because
            // NFSv3 READ3 takes an explicit offset. We resolve the
            // requested byte range here and pass start/len down to
            // the streamer which seeks into the file via READ3.
            let total = meta.size_bytes;
            let range = match parse_range(headers.get(header::RANGE), total) {
                Some(triple) => triple,
                None if headers.get(header::RANGE).is_some() => {
                    return Response::builder()
                        .status(StatusCode::RANGE_NOT_SATISFIABLE)
                        .header(header::CONTENT_RANGE, format!("bytes */{total}"))
                        .body(Body::empty())
                        .unwrap();
                }
                // No Range header — serve the whole file.
                None => (0, total.saturating_sub(1), false),
            };
            let (start, end, partial) = range;
            let len = if total == 0 { 0 } else { end - start + 1 };
            let max_len = if total == 0 { None } else { Some(len) };
            match state
                .nfs_shares
                .stream_iso(share_id, relative_path, start, max_len)
                .await
            {
                Ok(stream) => {
                    let body = Body::from_stream(stream);
                    let status = if partial {
                        StatusCode::PARTIAL_CONTENT
                    } else {
                        StatusCode::OK
                    };
                    let mut builder = Response::builder()
                        .status(status)
                        .header(header::CONTENT_TYPE, "application/octet-stream")
                        .header(header::ACCEPT_RANGES, "bytes")
                        .header(header::CONTENT_LENGTH, len);
                    if partial {
                        builder = builder.header(
                            header::CONTENT_RANGE,
                            format!("bytes {start}-{end}/{total}"),
                        );
                    }
                    builder.body(body).unwrap()
                }
                Err(e) => (StatusCode::BAD_GATEWAY, format!("nfs stream: {e}")).into_response(),
            }
        }
    }
 }
@@ -537,6 +770,10 @@ async fn iso_file(
    State(state): State<AppState>,
    AxumPath((id, path)): AxumPath<(String, String)>,
 ) -> Response {
    // In-ISO file extraction is only supported for local ISOs — it
    // needs random-access reads into the ISO9660 directory tree, which
    // smbclient's whole-file streaming can't do efficiently. SMB-
    // sourced ISOs use the raw streaming endpoint above instead.
    let Some(iso_path) = state.iso_store.iso_path_for(&id) else {
        return (StatusCode::NOT_FOUND, "no such iso").into_response();
    };
@@ -912,17 +1149,30 @@ async fn api_docs() -> Json<serde_json::Value> {
                     "summary": "Abort a chunked upload session and remove the .partial file."},
                ],
            },
            {
                "name": "SMB shares",
                "endpoints": [
                    {"method": "GET", "path": "/api/smb-shares",
                     "summary": "List configured SMB shares with connection state and iso counts."},
                    {"method": "POST", "path": "/api/smb-shares",
                     "summary": "Register an SMB share. Body: { server, share, guest, username?, password?, port? }."},
                    {"method": "DELETE", "path": "/api/smb-shares/:id",
                     "summary": "Forget a share and drop its entries from the ISO store."},
                    {"method": "POST", "path": "/api/smb-shares/:id/scan",
                     "summary": "Re-list a share for new ISOs."},
                ],
            },
            {
                "name": "NFS shares",
                "endpoints": [
-                    {"method": "GET", "path": "/api/nfs",
+                    {"method": "GET", "path": "/api/nfs-shares",
-                     "summary": "List configured NFS shares with mount state and iso counts."},
+                     "summary": "List configured NFSv3 shares with connection state and iso counts."},
-                    {"method": "POST", "path": "/api/nfs",
+                    {"method": "POST", "path": "/api/nfs-shares",
-                     "summary": "Mount an NFS share. Body: { server, export, version, read_only }."},
+                     "summary": "Register an NFSv3 share. Body: { server, export, port? }. Auth is AUTH_SYS only; access control is by client IP on the server side."},
-                    {"method": "DELETE", "path": "/api/nfs/:id",
+                    {"method": "DELETE", "path": "/api/nfs-shares/:id",
-                     "summary": "Unmount a share and drop its entries from the ISO store."},
+                     "summary": "Forget a share and drop its entries from the ISO store."},
-                    {"method": "POST", "path": "/api/nfs/:id/scan",
+                    {"method": "POST", "path": "/api/nfs-shares/:id/scan",
-                     "summary": "Re-walk a mounted share for ISOs."},
+                     "summary": "Re-list a share for new ISOs."},
                ],
            },
            {
@@ -945,6 +1195,8 @@ async fn api_docs() -> Json<serde_json::Value> {
                     "summary": "Upload a custom WebUI logo (multipart 'file', PNG/SVG/JPEG/WebP/GIF up to 2 MB)."},
                    {"method": "DELETE", "path": "/api/branding/logo",
                     "summary": "Remove the custom logo and revert to the bundled mark."},
                    {"method": "GET", "path": "/branding/pxe-logo",
                     "summary": "Raster form of the operator's logo for the iPXE menu's `console --picture`. SVG uploads 404 here."},
                    {"method": "GET", "path": "/api/sso",
                     "summary": "Current SAML SSO configuration."},
                    {"method": "PUT", "path": "/api/sso",
@@ -1337,8 +1589,13 @@ async fn api_list_clients(State(state): State<AppState>) -> Json<serde_json::Val
 async fn api_status(State(state): State<AppState>) -> Json<serde_json::Value> {
    let smb = state.smb.as_ref().map(|s| s.snapshot());
-    let nfs = state.nfs.list();
+    // v0.4.65+v0.4.67: external storage shares — SMB (userspace
-    let nfs_active = nfs.iter().filter(|m| m.mounted).count();
+    // smbclient) and NFS (in-process nfs3_client). Dashboard tile
    // sums both so operators see a single "reachable shares" number.
    let smb_shares = state.smb_shares.list();
    let smb_reachable = smb_shares.iter().filter(|m| m.reachable).count();
    let nfs_shares = state.nfs_shares.list();
    let nfs_reachable = nfs_shares.iter().filter(|m| m.reachable).count();
    let isos = state.iso_store.list();
    let clients = state.clients.list();
    let queue_entries = state.queue.list();
@@ -1357,7 +1614,9 @@ async fn api_status(State(state): State<AppState>) -> Json<serde_json::Value> {
    state
        .metrics
        .set_queue_counts(queue_entries.len() as u64, imaging as u64);
-    state.metrics.set_nfs_active(nfs_active as u64);
+    state
        .metrics
        .set_nfs_active((smb_reachable + nfs_reachable) as u64);
    state.metrics.record_http(openpxe_core::HttpRoute::Api);
    let now = time::OffsetDateTime::now_utc();
    let uptime_secs = (now - state.started_at).whole_seconds().max(0);
@@ -1372,8 +1631,13 @@ async fn api_status(State(state): State<AppState>) -> Json<serde_json::Value> {
        "ipxe_assets": openpxe_ipxe_assets::list_assets(),
        "settings": state.settings.snapshot(),
        "smb": smb,
-        "nfs_count": nfs.len(),
+        "smb_share_count": smb_shares.len(),
-        "nfs_active": nfs_active,
+        "smb_share_reachable": smb_reachable,
        // v0.4.67: NFSv3 share counts. The dashboard tile sums these
        // with the SMB counts above ("N shares reachable") so the
        // top-line metric works regardless of protocol mix.
        "nfs_share_count": nfs_shares.len(),
        "nfs_share_reachable": nfs_reachable,
        "host_bindings": state.hosts.len(),
        "custom_logo": state.branding.has_logo(),
        "uptime_secs": uptime_secs,
@@ -1588,32 +1852,83 @@ async fn api_queue_release(
    }
 }
-// ─── NFS share API ─────────────────────────────────────────────────────────
+// ─── SMB share API (v0.4.65) ───────────────────────────────────────────────
 //
 // Replaces the NFS share manager from v0.4.64. The wire shape is similar
 // — a {shares: [...]} list, a POST that returns either the share or a
 // structured {error, stderr, hint} body — so the UI can render both the
 // same way.
-async fn api_nfs_list(State(state): State<AppState>) -> Json<serde_json::Value> {
+async fn api_smb_shares_list(State(state): State<AppState>) -> Json<serde_json::Value> {
-    Json(json!({ "mounts": state.nfs.list() }))
+    Json(json!({ "shares": state.smb_shares.list() }))
 }
-async fn api_nfs_add(State(state): State<AppState>, Json(req): Json<NfsAddRequest>) -> Response {
+async fn api_smb_shares_add(
-    match state.nfs.add(req).await {
+    State(state): State<AppState>,
-        Ok(m) => (StatusCode::CREATED, Json(m)).into_response(),
+    Json(req): Json<SmbAddRequest>,
-        // Anything from the manager surfaces as a user-fixable validation
+) -> Response {
-        // error — bad host, kernel without NFS support, missing
+    match state.smb_shares.add(req).await {
-        // `mount.nfs`, dead server. We pass the message through verbatim
+        Ok(s) => (StatusCode::CREATED, Json(s)).into_response(),
-        // so the UI can show it to the operator.
+        Err(err) => (StatusCode::BAD_REQUEST, Json(err)).into_response(),
        Err(e) => (StatusCode::BAD_REQUEST, format!("{e}")).into_response(),
    }
 }
-async fn api_nfs_remove(State(state): State<AppState>, AxumPath(id): AxumPath<String>) -> Response {
+async fn api_smb_shares_remove(
-    match state.nfs.remove(&id).await {
+    State(state): State<AppState>,
    AxumPath(id): AxumPath<String>,
 ) -> Response {
    match state.smb_shares.remove(&id).await {
        Ok(()) => StatusCode::NO_CONTENT.into_response(),
        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
    }
 }
-async fn api_nfs_scan(State(state): State<AppState>, AxumPath(id): AxumPath<String>) -> Response {
+async fn api_smb_shares_scan(
-    match state.nfs.rescan(&id).await {
+    State(state): State<AppState>,
    AxumPath(id): AxumPath<String>,
 ) -> Response {
    match state.smb_shares.rescan(&id).await {
        Ok(n) => Json(json!({ "ok": true, "iso_count": n })).into_response(),
        Err(e) => (StatusCode::BAD_REQUEST, format!("{e}")).into_response(),
    }
 }
 // ─── NFS share API (v0.4.67) ───────────────────────────────────────────────
 //
 // Parallel to the SMB shares API. The pure-Rust NFSv3 client
 // (`nfs3_client`) gives us in-process listing and streaming, no
 // subprocess. Unlike SMB, NFS-sourced ISOs support HTTP Range
 // requests — NFSv3 READ3 takes an explicit offset.
 async fn api_nfs_shares_list(State(state): State<AppState>) -> Json<serde_json::Value> {
    Json(json!({ "shares": state.nfs_shares.list() }))
 }
 async fn api_nfs_shares_add(
    State(state): State<AppState>,
    Json(req): Json<NfsAddRequest>,
 ) -> Response {
    match state.nfs_shares.add(req).await {
        Ok(s) => (StatusCode::CREATED, Json(s)).into_response(),
        Err(err) => (StatusCode::BAD_REQUEST, Json(err)).into_response(),
    }
 }
 async fn api_nfs_shares_remove(
    State(state): State<AppState>,
    AxumPath(id): AxumPath<String>,
 ) -> Response {
    match state.nfs_shares.remove(&id).await {
        Ok(()) => StatusCode::NO_CONTENT.into_response(),
        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
    }
 }
 async fn api_nfs_shares_scan(
    State(state): State<AppState>,
    AxumPath(id): AxumPath<String>,
 ) -> Response {
    match state.nfs_shares.rescan(&id).await {
        Ok(n) => Json(json!({ "ok": true, "iso_count": n })).into_response(),
        Err(e) => (StatusCode::BAD_REQUEST, format!("{e}")).into_response(),
    }
@@ -1733,9 +2048,21 @@ async fn api_metrics(State(state): State<AppState>) -> Response {
    state
        .metrics
        .set_queue_counts(queue_entries.len() as u64, imaging as u64);
-    state
+    // v0.4.67: gauge tracks reachable external-storage shares
-        .metrics
+    // across both protocols (SMB userspace + NFSv3 in-process).
-        .set_nfs_active(state.nfs.list().iter().filter(|m| m.mounted).count() as u64);
+    let smb_ok = state
        .smb_shares
        .list()
        .iter()
        .filter(|m| m.reachable)
        .count();
    let nfs_ok = state
        .nfs_shares
        .list()
        .iter()
        .filter(|m| m.reachable)
        .count();
    state.metrics.set_nfs_active((smb_ok + nfs_ok) as u64);
    let now = time::OffsetDateTime::now_utc();
    let uptime = (now - state.started_at).whole_seconds().max(0) as u64;
@@ -440,6 +440,9 @@ mod tests {
            "/", "/assets/app.js", "/boot.ipxe", "/boot/fake.ipxe",
            "/iso/fake.iso", "/ipxe/snponly.efi", "/healthz", "/readyz",
            "/metrics",
            // v0.4.6: iPXE fetches this for `console --picture` before
            // it can possibly have a session cookie.
            "/branding/pxe-logo",
        ] {
            assert!(is_public_path(p), "expected {p} to be public");
        }
@@ -29,6 +29,16 @@ use std::fmt::Write as _;
 /// Top-level OpenPXE boot menu. Serialized identically for BIOS and UEFI
 /// clients because iPXE normalises the menu primitives across firmwares.
 ///
 /// v0.4.69: rendered with an iVentoy-style graphical frame — a
 /// `console --picture` directive paints a full-screen PNG background
 /// (the operator's uploaded logo on a dark field, or the default
 /// OpenPXE mark) with the menu text overlaid below a reserved top
 /// margin, plus a footer carrying version + arch + firmware kind. On
 /// iPXE binaries built with `IMAGE_PNG` + `CONSOLE_FRAMEBUFFER` (our
 /// x86_64 UEFI binaries, compiled from source) the background paints;
 /// on binaries without PNG support the `|| console` fallback yields a
 /// clean text menu. The old ASCII wordmark has been removed.
 #[must_use]
 pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> String {
    let mut s = String::new();
@@ -47,8 +57,36 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
    let _ = writeln!(s, "set base-url {base}");
    let _ = writeln!(s, "set esc:hex 1b");
    let _ = writeln!(s, "set cls ${{esc:string}}[2J");
    // v0.4.69: graphical background. `/branding/pxe-logo` always
    // returns a full-screen 1024×768 PNG now — the operator's logo on a
    // dark field, or a default OpenPXE mark when none is uploaded. The
    // `--top 290` reserves the top band (where the logo paints) so the
    // menu text lands below it. On an iPXE build *with* `IMAGE_PNG` +
    // `CONSOLE_FRAMEBUFFER` (our x86_64 UEFI binaries, built from source
    // — see deploy/docker/Dockerfile) this paints the background and
    // overlays the menu. On a build *without* PNG support (the fetched
    // BIOS/i386/arm64 binaries) the whole `console --picture …` command
    // fails and the `|| console` resets to a clean full-screen text
    // menu. Either way there's no ASCII placeholder anymore.
    let _ = writeln!(
        s,
        "console --picture {base}/branding/pxe-logo --top 290 || console"
    );
    // Map iPXE's ${{buildarch}} + ${{platform}} into the human form the
    // user asked for (e.g. "x86 BIOS", "x86_64 UEFI", "arm64 UEFI").
    // iPXE evaluates `iseq` lazily, so we only set whichever line
    // matches. Anything not on the allowlist falls through to a generic
    // `<buildarch> <platform>` display.
    let _ = writeln!(s, "set arch-label ${{buildarch}} ${{platform}}");
    let _ = writeln!(
        s,
        "iseq ${{buildarch}} i386   && iseq ${{platform}} pcbios && set arch-label x86 BIOS         || iseq ${{buildarch}} x86_64 && iseq ${{platform}} efi    && set arch-label x86_64 UEFI      || iseq ${{buildarch}} arm64  && iseq ${{platform}} efi    && set arch-label arm64 UEFI       || true"
    );
    let _ = writeln!(s, ":menu");
    let _ = writeln!(s, "menu OpenPXE - network boot menu");
    // v0.4.69: the ASCII wordmark is gone — the graphical background
    // (set via `console --picture` above) carries the branding now.
    let _ = writeln!(s, "item --gap");
    let _ = writeln!(
        s,
        "item --gap -- ------------------------- Default -------------------------"
@@ -82,6 +120,18 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
    let _ = writeln!(s, "item queue            Queued Deployment  (join queue)");
    let _ = writeln!(s, "item --gap");
    let _ = writeln!(s, "item --key x exit     Exit iPXE");
    // v0.4.6 footer line. Sits just above the `choose` line so it's
    // always visible regardless of how the menu paginates. iPXE
    // interpolates `${arch-label}` (set near the top of this script)
    // and `${version}` is the binary-baked iPXE version — *not* the
    // OpenPXE version — so we hard-code the OpenPXE version string
    // here.
    let openpxe_version = env!("CARGO_PKG_VERSION");
    let _ = writeln!(s, "item --gap");
    let _ = writeln!(
        s,
        "item --gap --                 OpenPXE v{openpxe_version}  -  ${{arch-label}}"
    );
    if matches!(settings.timeout_action, TimeoutAction::Stay) {
        let _ = writeln!(s, "choose --default {default_item} target || goto menu");
@@ -575,6 +625,55 @@ mod password_tests {
        assert!(s.contains("chain http://10.0.0.5/boot/alpha-linux.ipxe"));
    }
    #[test]
    fn top_menu_has_polished_branding_and_arch_footer() {
        // v0.4.69: the menu emits a `console --picture` line that paints
        // a full-screen PNG background (the operator's logo, or the
        // default OpenPXE mark) reserving a top margin for it, then
        // falls back to a clean text console on iPXE builds without PNG
        // support. The ASCII wordmark is gone — the graphical
        // background carries the branding now. A single-line footer
        // still carries the OpenPXE version + arch.
        let settings = Settings::default();
        let s = render_menu(&[], &settings, "http://10.0.0.5");
        assert!(
            s.contains("console --picture http://10.0.0.5/branding/pxe-logo"),
            "missing console --picture line:\n{s}"
        );
        // The picture call reserves a top margin for the logo band.
        assert!(s.contains("--top 290"), "missing --top margin:\n{s}");
        // Picture-or-text-console must be a single statement so older
        // iPXE parsers don't choke on the chain.
        assert!(s.contains("|| console"), "missing graceful fallback:\n{s}");
        // The ASCII wordmark must be GONE — its removal is the whole
        // point of v0.4.69's graphical background.
        assert!(
            !s.contains("___                   ___  __  __ ___"),
            "ASCII banner should have been removed:\n{s}"
        );
        // Footer with version + arch interpolation. The version comes
        // from CARGO_PKG_VERSION at compile time.
        let version = env!("CARGO_PKG_VERSION");
        assert!(
            s.contains(&format!("OpenPXE v{version}")),
            "footer missing OpenPXE version:\n{s}"
        );
        assert!(
            s.contains("${arch-label}"),
            "footer missing arch-label interpolation:\n{s}"
        );
        // No website URL — the design brief calls that out as tacky.
        assert!(
            !s.to_ascii_lowercase().contains("openpxe.com"),
            "footer should not advertise the website:\n{s}"
        );
        // Arch-label mapping covers the three labels from the brief:
        // "x86 BIOS", "x86_64 UEFI", "arm64 UEFI".
        assert!(s.contains("x86 BIOS"), "{s}");
        assert!(s.contains("x86_64 UEFI"), "{s}");
        assert!(s.contains("arm64 UEFI"), "{s}");
    }
    #[test]
    fn generated_scripts_do_not_emit_bare_or_trailing_fallbacks() {
        let settings = Settings::default();
@@ -4,7 +4,7 @@ use openpxe_core::{
    AdminStore, BootLog, BrandingStore, ClientRegistry, DeploymentQueue, HostBindings, LogBus,
    Metrics, SettingsStore, SsoStore,
 };
-use openpxe_iso_store::{IsoStore, NfsManager, SmbManager};
+use openpxe_iso_store::{IsoStore, NfsShareManager, SmbManager, SmbShareManager};
 use std::sync::Arc;
 use time::OffsetDateTime;
@@ -44,11 +44,20 @@ pub struct AppState {
    /// `smb_dir` at startup; `None` in pure-Linux-only deployments where
    /// Windows support is not wired in. Settings toggle drives start/stop.
    pub smb: Option<Arc<SmbManager>>,
-    /// NFS share manager. Always present (mounting is opt-in by the
+    /// v0.4.65: SMB share manager — userspace consumer of remote SMB
-    /// operator from the Storage tab); `add()` requires `mount.nfs` to be
+    /// shares via Samba's `smbclient` CLI. Replaces the kernel-mount
-    /// available in the runtime image. Surfaces errors per-mount rather
+    /// NFS path that v0.4.64 shipped; that path didn't work on hosts
-    /// than failing the global state.
+    /// (Unraid, etc.) whose kernel ships without the nfs/cifs client
-    pub nfs: NfsManager,
+    /// modules, and no container-side configuration could fix it.
    /// `smbclient` does the SMB protocol over a plain TCP socket in
    /// userspace — works in any container, no special caps required.
    pub smb_shares: SmbShareManager,
    /// v0.4.67: NFSv3 share manager — pure-Rust userspace consumer
    /// via the `nfs3_client` crate. Ships alongside the SMB manager
    /// so operators pick whichever protocol their NAS prefers.
    /// In-process (no subprocess); supports HTTP Range requests on
    /// NFS-sourced ISOs because NFSv3 READ3 takes an explicit offset.
    pub nfs_shares: NfsShareManager,
    /// Browser chunked upload state. Multipart uploads still go straight
    /// through `IsoStore`, but the UI uses sessions so large ISO transfers
    /// can show deterministic progress and leave visible partial files.
@@ -88,8 +88,14 @@ async fn dispatch(state: &AppState, argv: &[String]) -> Result<String, String> {
        "isos" | "images" => Ok(isos_text(state)),
        "clients" => Ok(clients_text(state)),
        "queue" => queue_command(state, tail).await,
-        "nfs" => nfs_command(state, tail).await,
+        // `smb` controls the outbound Samba server for Windows
        // install media. `share` lists/manages remote SMB shares
        // OpenPXE pulls ISOs from (v0.4.65). `nfs` is the parallel
        // command for remote NFSv3 shares (v0.4.67, in-process via
        // nfs3_client — not the v0.4.64 kernel-mount path).
        "share" | "smb-share" => smb_share_command(state, tail).await,
        "smb" => smb_command(state, tail).await,
        "nfs" => nfs_share_command(state, tail).await,
        "log" => log_command(state, tail),
        "whoami" => Ok("operator".to_string()),
        "echo" => Ok(tail.join(" ")),
@@ -107,18 +113,22 @@ fn status_text(s: &AppState) -> String {
    let clients = s.clients.list();
    let queue_entries = s.queue.list();
    let smb = s.smb.as_ref().map(|m| m.snapshot());
-    let nfs = s.nfs.list();
+    let smb_shares = s.smb_shares.list();
-    let nfs_active = nfs.iter().filter(|m| m.mounted).count();
+    let smb_reachable = smb_shares.iter().filter(|m| m.reachable).count();
    // v0.4.67: NFSv3 sources too.
    let nfs_shares = s.nfs_shares.list();
    let nfs_reachable = nfs_shares.iter().filter(|m| m.reachable).count();
    format!(
        "OpenPXE {ver}\n\
         base url:     {base}\n\
         interface:    {nic}\n\
         uptime:       {up}\n\
-         isos:         {n_isos}  (local: {n_local}, nfs: {n_nfs})\n\
+         isos:         {n_isos}  (local: {n_local}, smb: {n_smb}, nfs: {n_nfs})\n\
         clients:      {n_clients}\n\
         queue:        {n_entries}\n\
-         smb:          {smb}\n\
+         smb server:   {smb}\n\
-         nfs mounts:   {n_total} configured ({n_active} active)\n",
+         smb shares:   {n_smb_total} configured ({n_smb_active} reachable)\n\
         nfs shares:   {n_nfs_total} configured ({n_nfs_active} reachable)\n",
        ver = env!("CARGO_PKG_VERSION"),
        base = s.public_base_url,
        nic = if s.nic_name.is_empty() {
@@ -132,15 +142,21 @@ fn status_text(s: &AppState) -> String {
            .iter()
            .filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Local))
            .count(),
        n_smb = isos
            .iter()
            .filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Smb { .. }))
            .count(),
        n_nfs = isos
            .iter()
-            .filter(|i| !matches!(i.source, openpxe_iso_store::IsoSource::Local))
+            .filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Nfs { .. }))
            .count(),
        n_clients = clients.len(),
        n_entries = queue_entries.len(),
        smb = smb.map_or_else(|| "(disabled)".into(), |s| format!("{s:?}")),
-        n_total = nfs.len(),
+        n_smb_total = smb_shares.len(),
-        n_active = nfs_active,
+        n_smb_active = smb_reachable,
        n_nfs_total = nfs_shares.len(),
        n_nfs_active = nfs_reachable,
    )
 }
@@ -158,7 +174,9 @@ fn isos_text(s: &AppState) -> String {
    for i in isos {
        let src = match i.source {
            openpxe_iso_store::IsoSource::Local => "local".to_string(),
-            openpxe_iso_store::IsoSource::Nfs { mount_id, .. } => format!("nfs:{mount_id}"),
+            openpxe_iso_store::IsoSource::Smb { share_id, .. } => format!("smb:{share_id}"),
            // v0.4.67: NFSv3 via in-process nfs3_client.
            openpxe_iso_store::IsoSource::Nfs { share_id, .. } => format!("nfs:{share_id}"),
        };
        let _ = writeln!(
            out,
@@ -264,31 +282,136 @@ async fn queue_command(s: &AppState, args: &[String]) -> Result<String, String>
    }
 }
-// ── nfs ────────────────────────────────────────────────────────────────
+// ── share (v0.4.65: SMB shares) ─────────────────────────────────────────
-async fn nfs_command(s: &AppState, args: &[String]) -> Result<String, String> {
+async fn smb_share_command(s: &AppState, args: &[String]) -> Result<String, String> {
    match args.first().map(String::as_str) {
        None | Some("list") => {
-            let mounts = s.nfs.list();
+            let shares = s.smb_shares.list();
-            if mounts.is_empty() {
+            if shares.is_empty() {
-                return Ok("(no NFS mounts configured)".into());
+                return Ok("(no SMB shares configured)".into());
            }
            let mut out = String::new();
            let _ = writeln!(
                out,
-                "{:<24} {:<6} {:<7} {:<6} TARGET",
+                "{:<24} {:<7} {:<6} {:<6} TARGET",
-                "ID", "VER", "STATUS", "ISOS"
+                "ID", "STATUS", "AUTH", "ISOS"
            );
-            for m in mounts {
+            for m in shares {
-                let status = if m.mounted { "ok" } else { "down" };
+                let status = if m.reachable { "ok" } else { "down" };
                let auth = if m.guest { "guest" } else { "user" };
                let _ = writeln!(
                    out,
-                    "{:<24} {:<6} {:<7} {:<6} {}:{}",
+                    "{:<24} {:<7} {:<6} {:<6} //{}/{}",
                    truncate(&m.id, 24),
                    status,
                    auth,
                    m.iso_count,
                    m.server,
                    m.share,
                );
                if let Some(e) = m.last_error {
                    let _ = writeln!(out, "    error: {e}");
                }
                if let Some(h) = m.last_hint {
                    let _ = writeln!(out, "    hint:  {h}");
                }
            }
            Ok(out)
        }
        Some("add") => {
            // share add //server/share [guest|user:password]
            let target = args
                .get(1)
                .ok_or_else(|| {
                    "usage: share add //server/share [guest|user:password]".to_string()
                })?;
            // Accept either `//server/share` (UNC-style) or
            // `server:share` (shorter to type).
            let stripped = target.trim_start_matches('/').trim_start_matches('\\');
            let (server, share) = if let Some((s, p)) = stripped.split_once('/') {
                (s, p)
            } else if let Some((s, p)) = stripped.split_once(':') {
                (s, p)
            } else {
                return Err("target must be '//server/share' or 'server:share'".into());
            };
            // Auth spec: "guest" or "user:password". Default: guest.
            let auth = args.get(2).cloned().unwrap_or_else(|| "guest".into());
            let (guest, username, password) = if auth == "guest" {
                (true, None, None)
            } else if let Some((u, p)) = auth.split_once(':') {
                (false, Some(u.to_string()), Some(p.to_string()))
            } else {
                return Err("auth must be 'guest' or 'user:password'".into());
            };
            let req = openpxe_iso_store::SmbAddRequest {
                server: server.to_string(),
                share: share.to_string(),
                username,
                password,
                guest,
                port: None,
            };
            match s.smb_shares.add(req).await {
                Ok(m) => Ok(format!("added {} ({} isos)", m.id, m.iso_count)),
                Err(e) => {
                    let mut out = format!("add failed: {}", e.error);
                    if let Some(h) = e.hint {
                        out.push_str("\nhint: ");
                        out.push_str(&h);
                    }
                    Err(out)
                }
            }
        }
        Some("remove") => {
            let id = args
                .get(1)
                .ok_or_else(|| "usage: share remove <id>".to_string())?;
            match s.smb_shares.remove(id).await {
                Ok(()) => Ok(format!("removed {id}")),
                Err(e) => Err(format!("remove failed: {e}")),
            }
        }
        Some("scan") => {
            let id = args
                .get(1)
                .ok_or_else(|| "usage: share scan <id>".to_string())?;
            match s.smb_shares.rescan(id).await {
                Ok(n) => Ok(format!("re-scanned {id}: {n} isos")),
                Err(e) => Err(format!("scan failed: {e}")),
            }
        }
        Some(other) => Err(format!(
            "unknown share subcommand: {other}\ntry: share [list|add|remove|scan]"
        )),
    }
 }
 // ── nfs (v0.4.67: in-process NFSv3 via nfs3_client) ────────────────────
 async fn nfs_share_command(s: &AppState, args: &[String]) -> Result<String, String> {
    match args.first().map(String::as_str) {
        None | Some("list") => {
            let shares = s.nfs_shares.list();
            if shares.is_empty() {
                return Ok("(no NFS shares configured)".into());
            }
            let mut out = String::new();
            let _ = writeln!(
                out,
                "{:<24} {:<7} {:<6} TARGET",
                "ID", "STATUS", "ISOS"
            );
            for m in shares {
                let status = if m.reachable { "ok" } else { "down" };
                let _ = writeln!(
                    out,
                    "{:<24} {:<7} {:<6} {}:{}",
                    truncate(&m.id, 24),
                    match m.version {
                        openpxe_iso_store::NfsVersion::V3 => "v3",
                        openpxe_iso_store::NfsVersion::V41 => "v4.1",
                    },
                    status,
                    m.iso_count,
                    m.server,
@@ -297,56 +420,58 @@ async fn nfs_command(s: &AppState, args: &[String]) -> Result<String, String> {
                if let Some(e) = m.last_error {
                    let _ = writeln!(out, "    error: {e}");
                }
                if let Some(h) = m.last_hint {
                    let _ = writeln!(out, "    hint:  {h}");
                }
            }
            Ok(out)
        }
-        Some("mount") => {
+        Some("add") => {
-            // nfs mount <server>:<export> [v3|v41] [ro|rw]
+            // nfs add <server>:<export> [port]
            let target = args
                .get(1)
-                .ok_or_else(|| "usage: nfs mount <server>:<export> [v3|v41] [ro|rw]".to_string())?;
+                .ok_or_else(|| "usage: nfs add <server>:<export> [port]".to_string())?;
            let (server, export) = target
                .split_once(':')
                .ok_or_else(|| "target must be 'server:/export'".to_string())?;
-            let version = match args.get(2).map(String::as_str) {
+            let port = args.get(2).and_then(|s| s.parse::<u16>().ok());
                Some("v3") => openpxe_iso_store::NfsVersion::V3,
                Some("v41") | None => openpxe_iso_store::NfsVersion::V41,
                Some(other) => {
                    return Err(format!("unknown nfs version: {other} (expect v3 or v41)"))
                }
            };
            let read_only = !matches!(args.get(3).map(String::as_str), Some("rw"));
            let req = openpxe_iso_store::NfsAddRequest {
                server: server.to_string(),
                export: export.to_string(),
-                version,
+                port,
                read_only,
            };
-            match s.nfs.add(req).await {
+            match s.nfs_shares.add(req).await {
-                Ok(m) => Ok(format!("mounted {} ({} isos)", m.id, m.iso_count)),
+                Ok(m) => Ok(format!("added {} ({} isos)", m.id, m.iso_count)),
-                Err(e) => Err(format!("mount failed: {e}")),
+                Err(e) => {
                    let mut out = format!("add failed: {}", e.error);
                    if let Some(h) = e.hint {
                        out.push_str("\nhint: ");
                        out.push_str(&h);
                    }
                    Err(out)
                }
            }
        }
-        Some("unmount") => {
+        Some("remove") => {
            let id = args
                .get(1)
-                .ok_or_else(|| "usage: nfs unmount <id>".to_string())?;
+                .ok_or_else(|| "usage: nfs remove <id>".to_string())?;
-            match s.nfs.remove(id).await {
+            match s.nfs_shares.remove(id).await {
-                Ok(()) => Ok(format!("unmounted {id}")),
+                Ok(()) => Ok(format!("removed {id}")),
-                Err(e) => Err(format!("unmount failed: {e}")),
+                Err(e) => Err(format!("remove failed: {e}")),
            }
        }
        Some("scan") => {
            let id = args
                .get(1)
                .ok_or_else(|| "usage: nfs scan <id>".to_string())?;
-            match s.nfs.rescan(id).await {
+            match s.nfs_shares.rescan(id).await {
                Ok(n) => Ok(format!("re-scanned {id}: {n} isos")),
                Err(e) => Err(format!("scan failed: {e}")),
            }
        }
        Some(other) => Err(format!(
-            "unknown nfs subcommand: {other}\ntry: nfs [list|mount|unmount|scan]"
+            "unknown nfs subcommand: {other}\ntry: nfs [list|add|remove|scan]"
        )),
    }
 }
@@ -487,13 +612,18 @@ OpenPXE terminal — available commands:
  queue assign-all <target>         assign every waiting client
  queue release <entry_id>           release one queued client
-  nfs list                          list NFS mounts
+  share list                        list configured SMB shares
-  nfs mount <s>:<e> [v3|v41] [ro|rw]  add and mount an NFS share
+  share add //srv/share [auth]      add an SMB share; auth = 'guest' or 'user:pass'
-  nfs unmount <id>                  unmount and forget a share
+  share remove <id>                 forget an SMB share
-  nfs scan <id>                     re-scan a share for new ISOs
+  share scan <id>                   re-list a share for new ISOs
-  smb status                        SMB (Samba) state
+  nfs list                          list configured NFSv3 shares
-  smb start | stop | reload         control smbd
+  nfs add <srv>:<export> [port]     add an NFSv3 share
  nfs remove <id>                   forget an NFS share
  nfs scan <id>                     re-list an NFS share for new ISOs
  smb status                        outbound Samba state (Windows install media)
  smb start | stop | reload         control the outbound smbd
  log clear                         drop the in-memory log ring buffer
  log tail [n]                      show the last n buffered lines (default 20)
@@ -508,10 +638,10 @@ mod tests {
    #[test]
    fn shell_split_basic() {
        assert_eq!(shell_split(""), Vec::<String>::new());
-        assert_eq!(shell_split("nfs list"), vec!["nfs", "list"]);
+        assert_eq!(shell_split("share list"), vec!["share", "list"]);
        assert_eq!(
-            shell_split("nfs mount 10.0.0.5:/srv v41 ro"),
+            shell_split("share add //nas/isos guest"),
-            vec!["nfs", "mount", "10.0.0.5:/srv", "v41", "ro"]
+            vec!["share", "add", "//nas/isos", "guest"]
        );
    }
@@ -14,7 +14,7 @@ use axum::body::Body;
 use axum::http::{header, Request, StatusCode};
 use openpxe_core::{ClientRegistry, DeploymentQueue, HostBindings, LogBus, Metrics, SettingsStore};
 use openpxe_http_api::{build_router, AppState};
-use openpxe_iso_store::{IsoStore, NfsManager};
+use openpxe_iso_store::{IsoStore, NfsShareManager, SmbShareManager};
 use tempfile::tempdir;
 use tower::ServiceExt;
@@ -94,8 +94,8 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
    let clients = ClientRegistry::new();
    let queue = DeploymentQueue::new();
    let settings = SettingsStore::load_or_default(dir.path());
-    let nfs = NfsManager::new(dir.path(), iso_store.clone());
+    let smb_shares = SmbShareManager::new(dir.path(), iso_store.clone());
-    iso_store.set_nfs_root(nfs.mount_root());
+    let nfs_shares = NfsShareManager::new(dir.path(), iso_store.clone());
    let log_bus = LogBus::new(64);
    let hosts = HostBindings::load_or_default(dir.path());
    let boot_log = openpxe_core::BootLog::load_or_default(dir.path());
@@ -117,7 +117,8 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
        sso,
        metrics,
        smb: None,
-        nfs,
+        smb_shares,
        nfs_shares,
        uploads: openpxe_http_api::uploads::UploadSessions::default(),
        log_bus,
        started_at: time::OffsetDateTime::now_utc(),
@@ -464,35 +465,120 @@ async fn no_external_urls_in_generated_ipxe() {
 // ── Phase 4 integration tests ────────────────────────────────────────────
 // v0.4.65: kernel-mount NFS replaced with userspace SMB via smbclient.
 #[tokio::test]
-async fn nfs_add_with_bad_export_is_rejected() {
+async fn smb_share_add_with_missing_server_is_rejected() {
-    // Validation must happen before we shell out to /bin/mount —
+    // Validation must run before we shell out to smbclient — otherwise
-    // otherwise the operator sees opaque kernel errors instead of a
+    // operators see opaque NT_STATUS codes for what's really a typo.
    // clear "your export must start with /" hint.
    let (state, _dir) = build_state().await;
    let app = build_router(state);
    let (s, b) = post_json(
        &app,
-        "/api/nfs",
+        "/api/smb-shares",
-        r#"{"server":"10.0.0.5","export":"isos","version":"v41","read_only":true}"#,
+        r#"{"server":"","share":"isos","guest":true}"#,
    )
    .await;
    assert_eq!(s, StatusCode::BAD_REQUEST);
    let msg = String::from_utf8_lossy(&b);
    assert!(
-        msg.contains("export"),
+        msg.to_lowercase().contains("server"),
        "expected validation hint, got: {msg}"
    );
 }
 #[tokio::test]
-async fn nfs_list_starts_empty() {
+async fn smb_share_add_requires_username_when_not_guest() {
    let (state, _dir) = build_state().await;
    let app = build_router(state);
-    let (s, b) = get(&app, "/api/nfs").await;
+    let (s, b) = post_json(
        &app,
        "/api/smb-shares",
        r#"{"server":"10.0.0.5","share":"isos","guest":false}"#,
    )
    .await;
    assert_eq!(s, StatusCode::BAD_REQUEST);
    let msg = String::from_utf8_lossy(&b);
    assert!(
        msg.to_lowercase().contains("username"),
        "expected username hint, got: {msg}"
    );
 }
 #[tokio::test]
 async fn smb_share_add_rejects_paths_in_share_name() {
    let (state, _dir) = build_state().await;
    let app = build_router(state);
    let (s, b) = post_json(
        &app,
        "/api/smb-shares",
        r#"{"server":"10.0.0.5","share":"isos/subdir","guest":true}"#,
    )
    .await;
    assert_eq!(s, StatusCode::BAD_REQUEST);
    let msg = String::from_utf8_lossy(&b);
    assert!(
        msg.to_lowercase().contains("share name"),
        "expected share name hint, got: {msg}"
    );
 }
 #[tokio::test]
 async fn smb_shares_list_starts_empty() {
    let (state, _dir) = build_state().await;
    let app = build_router(state);
    let (s, b) = get(&app, "/api/smb-shares").await;
    assert_eq!(s, StatusCode::OK);
    let v: serde_json::Value = serde_json::from_slice(&b).unwrap();
-    assert_eq!(v["mounts"].as_array().unwrap().len(), 0);
+    assert_eq!(v["shares"].as_array().unwrap().len(), 0);
 }
 // v0.4.67: NFSv3 share manager (parallel to SMB).
 #[tokio::test]
 async fn nfs_shares_list_starts_empty() {
    let (state, _dir) = build_state().await;
    let app = build_router(state);
    let (s, b) = get(&app, "/api/nfs-shares").await;
    assert_eq!(s, StatusCode::OK);
    let v: serde_json::Value = serde_json::from_slice(&b).unwrap();
    assert_eq!(v["shares"].as_array().unwrap().len(), 0);
 }
 #[tokio::test]
 async fn nfs_shares_add_rejects_missing_server() {
    let (state, _dir) = build_state().await;
    let app = build_router(state);
    let (s, b) = post_json(
        &app,
        "/api/nfs-shares",
        r#"{"server":"","export":"/srv/isos"}"#,
    )
    .await;
    assert_eq!(s, StatusCode::BAD_REQUEST);
    let msg = String::from_utf8_lossy(&b);
    assert!(
        msg.to_lowercase().contains("server"),
        "expected server hint, got: {msg}"
    );
 }
 #[tokio::test]
 async fn nfs_shares_add_rejects_export_without_leading_slash() {
    let (state, _dir) = build_state().await;
    let app = build_router(state);
    let (s, b) = post_json(
        &app,
        "/api/nfs-shares",
        r#"{"server":"10.0.0.5","export":"srv/isos"}"#,
    )
    .await;
    assert_eq!(s, StatusCode::BAD_REQUEST);
    let msg = String::from_utf8_lossy(&b);
    assert!(
        msg.to_lowercase().contains("export"),
        "expected export-path hint, got: {msg}"
    );
 }
 #[tokio::test]
@@ -1742,3 +1828,159 @@ async fn docs_lists_new_v0_4_5_endpoints() {
        assert!(paths.iter().any(|p| p == needle), "{needle} missing");
    }
 }
 // ─── v0.4.6: PXE logo endpoint ────────────────────────────────────────────
 #[tokio::test]
 async fn pxe_background_serves_default_when_no_custom_logo() {
    // v0.4.69: the endpoint always returns a full-screen PNG background
    // now — when no custom logo is configured it composes the default
    // OpenPXE mark on a dark field rather than 404ing. This is what lets
    // the PXE menu's `console --picture` paint a real background instead
    // of falling back to the (now-removed) ASCII placeholder.
    let (state, _dir) = build_state().await;
    let app = build_router(state);
    let res = app
        .clone()
        .oneshot(
            Request::builder()
                .uri("/branding/pxe-logo")
                .body(Body::empty())
                .unwrap(),
        )
        .await
        .unwrap();
    assert_eq!(res.status(), StatusCode::OK);
    assert_eq!(
        res.headers()
            .get(axum::http::header::CONTENT_TYPE)
            .unwrap()
            .to_str()
            .unwrap(),
        "image/png"
    );
    let body = axum::body::to_bytes(res.into_body(), usize::MAX)
        .await
        .unwrap();
    assert!(body.starts_with(b"\x89PNG"), "default background not a PNG");
    let width = u32::from_be_bytes([body[16], body[17], body[18], body[19]]);
    assert_eq!(width, 1024, "default background should be 1024 wide");
 }
 /// Build a tiny valid PNG via the `image` crate. The v0.4.61 PXE-logo
 /// compositor decodes whatever the operator uploaded — hand-rolled
 /// PNGs with handwritten CRCs are too easy to break; let the encoder
 /// produce something it can later decode.
 fn tiny_png() -> Vec<u8> {
    use image::{DynamicImage, ImageBuffer, ImageFormat, Rgb};
    use std::io::Cursor;
    let buf: ImageBuffer<Rgb<u8>, Vec<u8>> = ImageBuffer::from_pixel(8, 8, Rgb([0, 180, 220]));
    let mut out = Vec::with_capacity(256);
    DynamicImage::ImageRgb8(buf)
        .write_to(&mut Cursor::new(&mut out), ImageFormat::Png)
        .unwrap();
    out
 }
 #[tokio::test]
 async fn pxe_background_falls_back_to_default_for_svg_upload() {
    // iPXE can't rasterize SVG, so an SVG upload doesn't paint as the
    // PXE background — but v0.4.69 still returns the *default* OpenPXE
    // background PNG (not a 404) so the boot screen stays graphical.
    // The WebUI top-left continues to render the SVG natively.
    let (state, _dir) = build_state().await;
    state
        .branding
        .set_logo(
            "image/svg+xml",
            "svg",
            br#"<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 8 8"/>"#,
        )
        .unwrap();
    let app = build_router(state);
    let res = app
        .clone()
        .oneshot(
            Request::builder()
                .uri("/branding/pxe-logo")
                .body(Body::empty())
                .unwrap(),
        )
        .await
        .unwrap();
    assert_eq!(res.status(), StatusCode::OK);
    let body = axum::body::to_bytes(res.into_body(), usize::MAX)
        .await
        .unwrap();
    assert!(body.starts_with(b"\x89PNG"), "should serve default PNG for SVG");
    let width = u32::from_be_bytes([body[16], body[17], body[18], body[19]]);
    assert_eq!(width, 1024);
 }
 #[tokio::test]
 async fn pxe_logo_composes_to_1024x768_png() {
    // v0.4.61: the endpoint no longer serves the raw upload — it
    // composes the operator's logo into a fixed 1024×768 canvas so
    // the iPXE menu always paints at consistent dimensions.
    let (state, _dir) = build_state().await;
    let png = tiny_png();
    state
        .branding
        .set_logo("image/png", "png", &png)
        .unwrap();
    let app = build_router(state);
    let res = app
        .clone()
        .oneshot(
            Request::builder()
                .uri("/branding/pxe-logo")
                .body(Body::empty())
                .unwrap(),
        )
        .await
        .unwrap();
    assert_eq!(res.status(), StatusCode::OK);
    let ct = res
        .headers()
        .get(axum::http::header::CONTENT_TYPE)
        .unwrap()
        .to_str()
        .unwrap();
    assert_eq!(ct, "image/png");
    let body = axum::body::to_bytes(res.into_body(), usize::MAX)
        .await
        .unwrap();
    // PNG signature.
    assert!(body.starts_with(b"\x89PNG"), "PNG header missing");
    // IHDR chunk lives at bytes 8..29; width is bytes 16..20, height
    // 20..24 in big-endian u32. The composed canvas should be 1024×768.
    let width = u32::from_be_bytes([body[16], body[17], body[18], body[19]]);
    let height = u32::from_be_bytes([body[20], body[21], body[22], body[23]]);
    assert_eq!(width, 1024, "compose should pin width to 1024");
    assert_eq!(height, 768, "compose should pin height to 768");
 }
 #[tokio::test]
 async fn pxe_logo_endpoint_is_public_after_admin_setup() {
    // iPXE clients can't send a session cookie, so /branding/pxe-logo
    // must stay reachable once the admin has been bootstrapped. The
    // auth allowlist gates `/api/*` only.
    let (state, _dir) = build_state().await;
    let png = tiny_png();
    state
        .branding
        .set_logo("image/png", "png", &png)
        .unwrap();
    let app = build_router(state);
    // Configure an admin so the middleware kicks in.
    let (s, _, _) = post_collect(
        &app,
        "/api/setup",
        r#"{"username":"admin","password":"hunter2hunter2"}"#,
    )
    .await;
    assert_eq!(s, StatusCode::CREATED);
    // Still public without a cookie.
    let (s, _) = get(&app, "/branding/pxe-logo").await;
    assert_eq!(s, StatusCode::OK);
 }
@@ -27,6 +27,21 @@ parking_lot.workspace = true
 bytes.workspace = true
 tempfile = "3.12"
 libc = "0.2"
 # v0.4.61: server-side compose of the operator's uploaded raster into a
 # fixed 1024x768 canvas so the PXE menu always gets a consistently-sized
 # PNG regardless of what the operator uploaded. We use the bare-bones
 # `image` crate (no default features) and explicitly enable only the
 # decoders we accept on upload (PNG/JPEG/WebP/GIF) plus the PNG
 # encoder. Keeps the build slim — no JPEG2000, TIFF, BMP, etc.
 image = { version = "0.25", default-features = false, features = ["png", "jpeg", "webp", "gif"] }
 # v0.4.67: pure-Rust NFSv3 client for reading remote ISOs without a
 # kernel mount. See crates/iso-store/src/nfs_share.rs for usage.
 nfs3_client = { workspace = true }
 nfs3_types = { workspace = true }
 # Needed for the Stream trait that wraps the mpsc receiver feeding
 # NFS read-loop bytes into axum's Body::from_stream.
 futures = { workspace = true }
 [dev-dependencies]
 tempfile = "3.12"
@@ -18,15 +18,27 @@
 pub mod entry;
 pub mod introspect;
-pub mod nfs;
+pub mod nfs_share;
 pub mod pxe_logo;
 pub mod smb;
 pub mod smb_share;
 pub mod store;
 pub mod windows;
 pub use entry::{BootEntry, BootKind, KernelArgs};
 pub use introspect::{DistroFamily, IntrospectionReport};
-pub use nfs::{NfsAddRequest, NfsManager, NfsMount, NfsVersion};
+// v0.4.65: kernel-mount NFS is gone. SMB shares via Samba's userspace
 // `smbclient` CLI replaced it — works in any container (no
 // CAP_SYS_ADMIN, no host kernel modules), matching how Bootimus and
 // every other PXE/imaging tool that supports network storage handles
 // it.
 pub use smb::{extract_windows_iso, SmbManager, SmbState};
 pub use smb_share::{SmbAddRequest, SmbShare, SmbShareError, SmbShareManager, SmbStream};
 // v0.4.67: NFS is back — this time as an in-process userspace NFSv3
 // client (the `nfs3_client` crate) rather than a kernel mount. Same
 // "works in any container" property as SMB, plus support for HTTP
 // Range requests because NFSv3 READ3 takes an explicit offset.
 pub use nfs_share::{NfsAddRequest, NfsShare, NfsShareError, NfsShareManager, NfsStream};
 pub use store::{
    generate_boot_entries_for, slugify_str, IsoCategory, IsoMeta, IsoSource, IsoStore,
    UploadHandle,
@@ -1,558 +0,0 @@
 //! NFS share manager.
 //!
 //! Lets an operator mount a remote NFS export as an ISO source instead of
 //! uploading every ISO into the container's PVC. Supports NFSv3 and
 //! NFSv4.1 — the two versions the user explicitly asked for.
 //!
 //! ## How it works
 //!
 //! 1. Operator submits a mount spec via the Storage tab:
 //!    `{ server: "10.0.0.20", export: "/srv/isos", version: "v41" }`.
 //! 2. We slugify a stable id, mkdir `<work_dir>/nfs/<id>/`, then shell out
 //!    to `/bin/mount -t nfs -o vers=...,ro,nolock server:export local`.
 //! 3. On success we walk the mount point looking for `*.iso` files and
 //!    register each one with the `IsoStore` as an external source — same
 //!    introspection pipeline as a web upload, but no sha256 (the bytes
 //!    live on a remote machine; hashing them would suck them through the
 //!    network on every restart).
 //! 4. On failure we record `last_error` on the spec and persist anyway
 //!    so the UI can show a row in red rather than silently dropping it.
 //!
 //! ## Operational notes
 //!
 //! - Mounting NFS inside a container needs `CAP_SYS_ADMIN` and the
 //!   `nfs-common` package. The default image ships these (see Dockerfile).
 //! - On OpenShift, the SCC must allow `CAP_SYS_ADMIN`. The bundled SCC
 //!   doesn't — operators have to opt in by switching to a more privileged
 //!   SCC or running NFS mounts as a CSI driver outside the pod.
 //! - Mount commands are issued sequentially under a single mutex to avoid
 //!   `mount` racing on the same target dir.
 //!
 //! ## Persistence
 //!
 //! Mount specs (without runtime state) live at `<work_dir>/nfs.json`,
 //! re-mounted on startup. Mounts that fail to come back online keep their
 //! spec and their `last_error` so the operator sees what happened.
 use crate::introspect::{introspect, IntrospectionReport};
 use crate::store::{generate_boot_entries_for, slugify_str, IsoSource, IsoStore};
 use openpxe_core::{Error, Result};
 use parking_lot::Mutex;
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
 use time::OffsetDateTime;
 use tokio::process::Command;
 /// Wire-protocol versions we support. Keep this enum closed — silently
 /// accepting "auto" or letting the kernel negotiate would mean operators
 /// could never confirm which version is in use.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "lowercase")]
 pub enum NfsVersion {
    /// NFSv3 — UDP/TCP, separate `mountd` protocol. Required for many
    /// older NAS appliances.
    V3,
    /// NFSv4.1 — single TCP port (2049), session-based. Modern default.
    V41,
 }
 impl NfsVersion {
    fn vers_arg(self) -> &'static str {
        match self {
            Self::V3 => "vers=3",
            Self::V41 => "vers=4.1",
        }
    }
 }
 /// One configured mount. The id is generated from server+export so the
 /// operator can re-add the same export idempotently.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct NfsMount {
    pub id: String,
    pub server: String,
    pub export: String,
    pub version: NfsVersion,
    /// Read-only by default — most ISO libraries are. Operators that need
    /// write can flip this off but OpenPXE itself never writes.
    pub read_only: bool,
    /// Local mount point under `<work_dir>/nfs/`.
    pub local_path: PathBuf,
    /// Whether the mount is currently active.
    pub mounted: bool,
    /// Last error encountered on a `mount` or `umount` attempt; cleared on
    /// success.
    pub last_error: Option<String>,
    #[serde(with = "time::serde::rfc3339::option")]
    pub last_attempt: Option<OffsetDateTime>,
    /// Number of `.iso` files found on the share (re-counted on each scan).
    pub iso_count: u32,
 }
 /// Spec submitted by the UI. Server and export are normalized before use.
 #[derive(Debug, Clone, Deserialize)]
 pub struct NfsAddRequest {
    pub server: String,
    pub export: String,
    #[serde(default = "default_version")]
    pub version: NfsVersion,
    #[serde(default = "default_ro")]
    pub read_only: bool,
 }
 fn default_version() -> NfsVersion {
    NfsVersion::V41
 }
 fn default_ro() -> bool {
    true
 }
 #[derive(Debug, Default)]
 struct Inner {
    mounts: HashMap<String, NfsMount>,
 }
 /// Manages NFS mounts and surfaces them as ISO sources.
 ///
 /// Cheap to clone — internal state is `Arc<Mutex<...>>`.
 #[derive(Debug, Clone)]
 pub struct NfsManager {
    work_root: Arc<PathBuf>,
    state_path: Arc<PathBuf>,
    inner: Arc<Mutex<Inner>>,
    iso_store: IsoStore,
    /// Single-writer lock around the actual `mount`/`umount` shell-outs;
    /// avoids racing on the same target directory.
    mount_lock: Arc<tokio::sync::Mutex<()>>,
 }
 impl NfsManager {
    /// Construct a manager rooted at `work_dir`. Mount points live under
    /// `<work_dir>/nfs/<id>/`. State persists to `<work_dir>/nfs.json`.
    #[must_use]
    pub fn new(work_dir: &Path, iso_store: IsoStore) -> Self {
        let work_root = work_dir.join("nfs");
        let state_path = work_dir.join("nfs.json");
        Self {
            work_root: Arc::new(work_root),
            state_path: Arc::new(state_path),
            inner: Arc::new(Mutex::new(Inner::default())),
            iso_store,
            mount_lock: Arc::new(tokio::sync::Mutex::new(())),
        }
    }
    /// Where this manager mounts shares. Used by `IsoStore` to resolve
    /// NFS-backed `IsoMeta`s to their on-disk path.
    #[must_use]
    pub fn mount_root(&self) -> PathBuf {
        self.work_root.as_ref().clone()
    }
    /// Load persisted state and re-attempt every mount. Errors are logged
    /// per-mount but never fail the call — startup must not block on a
    /// remote NFS server being slow.
    pub async fn load_and_remount(&self) -> Result<()> {
        tokio::fs::create_dir_all(self.work_root.as_path()).await?;
        let mounts = match tokio::fs::read_to_string(self.state_path.as_path()).await {
            Ok(text) => serde_json::from_str::<Vec<NfsMount>>(&text).unwrap_or_default(),
            Err(_) => Vec::new(),
        };
        for mut m in mounts {
            // Always start from "not mounted" — the kernel state was lost
            // when the process died. We'll try to remount each one.
            m.mounted = false;
            m.last_error = None;
            self.inner.lock().mounts.insert(m.id.clone(), m.clone());
            if let Err(e) = self.try_mount(&m.id).await {
                tracing::warn!(
                    target: "openpxe::nfs",
                    id = %m.id, error = %e,
                    "could not remount NFS share on startup"
                );
            }
        }
        Ok(())
    }
    /// Add a new mount. Returns the resulting `NfsMount` (with `mounted`
    /// reflecting reality) or an error if the spec was invalid.
    pub async fn add(&self, req: NfsAddRequest) -> Result<NfsMount> {
        let server = req.server.trim().to_string();
        let export = req.export.trim().to_string();
        if server.is_empty() {
            return Err(Error::Invalid("server is required".into()));
        }
        if !export.starts_with('/') {
            return Err(Error::Invalid("export path must start with '/'".into()));
        }
        let id = mount_id(&server, &export);
        let local_path = self.work_root.join(&id);
        tokio::fs::create_dir_all(&local_path).await?;
        let mount = NfsMount {
            id: id.clone(),
            server,
            export,
            version: req.version,
            read_only: req.read_only,
            local_path,
            mounted: false,
            last_error: None,
            last_attempt: None,
            iso_count: 0,
        };
        self.inner.lock().mounts.insert(id.clone(), mount);
        self.persist_locked();
        self.try_mount(&id).await?;
        Ok(self.get(&id).expect("mount just inserted"))
    }
    /// Unmount and forget a share. Removes any ISOs it contributed from
    /// the IsoStore and deletes the local mount point. Idempotent.
    pub async fn remove(&self, id: &str) -> Result<()> {
        // Best-effort umount; even if it fails (e.g. server unreachable)
        // we still want to drop the in-memory record.
        let _ = self.umount_one(id).await;
        let local_path = {
            let mut g = self.inner.lock();
            g.mounts.remove(id).map(|m| m.local_path)
        };
        self.persist_locked();
        self.iso_store.drop_external_source(id);
        if let Some(p) = local_path {
            // rmdir only — never recurse, the mount could still be live
            // on some kernel error path and we don't want to nuke a
            // remote filesystem.
            let _ = tokio::fs::remove_dir(&p).await;
        }
        Ok(())
    }
    /// Re-scan a mounted share for ISOs, refreshing the IsoStore.
    pub async fn rescan(&self, id: &str) -> Result<u32> {
        let mount = self
            .get(id)
            .ok_or_else(|| Error::Invalid(format!("no such mount '{id}'")))?;
        if !mount.mounted {
            return Err(Error::Invalid(format!("mount '{id}' is not active")));
        }
        let count = self.scan_and_register(&mount).await?;
        if let Some(m) = self.inner.lock().mounts.get_mut(id) {
            m.iso_count = count;
        }
        self.persist_locked();
        Ok(count)
    }
    /// Snapshot of every configured mount.
    #[must_use]
    pub fn list(&self) -> Vec<NfsMount> {
        let g = self.inner.lock();
        let mut v: Vec<_> = g.mounts.values().cloned().collect();
        v.sort_by(|a, b| a.id.cmp(&b.id));
        v
    }
    /// Look up a single mount by id.
    #[must_use]
    pub fn get(&self, id: &str) -> Option<NfsMount> {
        self.inner.lock().mounts.get(id).cloned()
    }
    // ── internals ─────────────────────────────────────────────────────
    async fn try_mount(&self, id: &str) -> Result<()> {
        let _g = self.mount_lock.lock().await;
        let m = self
            .get(id)
            .ok_or_else(|| Error::Invalid(format!("no such mount '{id}'")))?;
        let now = OffsetDateTime::now_utc();
        // Already mounted? Skip — `mount` would error on a busy target
        // and confuse the operator's UI status.
        if is_mountpoint(&m.local_path).await {
            self.update_status(id, true, None, now);
            // Even though already mounted, we still want a fresh ISO count.
            let count = self.scan_and_register(&m).await.unwrap_or(0);
            self.update_iso_count(id, count);
            return Ok(());
        }
        let opts = mount_options(&m);
        let target = format!("{}:{}", m.server, m.export);
        let output = Command::new("mount")
            .arg("-t")
            .arg("nfs")
            .arg("-o")
            .arg(&opts)
            .arg(&target)
            .arg(&m.local_path)
            .output()
            .await;
        match output {
            Ok(out) if out.status.success() => {
                tracing::info!(
                    target: "openpxe::nfs",
                    id = %id, server = %m.server, export = %m.export,
                    version = ?m.version,
                    "NFS mount succeeded"
                );
                self.update_status(id, true, None, now);
                let count = self.scan_and_register(&m).await.unwrap_or(0);
                self.update_iso_count(id, count);
                Ok(())
            }
            Ok(out) => {
                let err = format!(
                    "mount exit {}: {}",
                    out.status.code().unwrap_or(-1),
                    String::from_utf8_lossy(&out.stderr).trim()
                );
                tracing::warn!(target: "openpxe::nfs", id = %id, "{err}");
                self.update_status(id, false, Some(err.clone()), now);
                Err(Error::Invalid(err))
            }
            Err(e) => {
                let err = format!("could not exec /bin/mount: {e}");
                tracing::error!(target: "openpxe::nfs", id = %id, "{err}");
                self.update_status(id, false, Some(err.clone()), now);
                Err(Error::Invalid(err))
            }
        }
    }
    async fn umount_one(&self, id: &str) -> Result<()> {
        let _g = self.mount_lock.lock().await;
        let Some(m) = self.get(id) else { return Ok(()) };
        if !is_mountpoint(&m.local_path).await {
            self.update_status(id, false, None, OffsetDateTime::now_utc());
            return Ok(());
        }
        // -l = lazy: detach immediately, finish when no process has a
        // handle. Important if a stale ISO read is still in flight.
        let out = Command::new("umount")
            .arg("-l")
            .arg(&m.local_path)
            .output()
            .await;
        match out {
            Ok(o) if o.status.success() => {
                self.update_status(id, false, None, OffsetDateTime::now_utc());
                Ok(())
            }
            Ok(o) => {
                let e = format!(
                    "umount exit {}: {}",
                    o.status.code().unwrap_or(-1),
                    String::from_utf8_lossy(&o.stderr).trim()
                );
                self.update_status(id, false, Some(e.clone()), OffsetDateTime::now_utc());
                Err(Error::Invalid(e))
            }
            Err(e) => {
                let e = format!("could not exec /bin/umount: {e}");
                self.update_status(id, false, Some(e.clone()), OffsetDateTime::now_utc());
                Err(Error::Invalid(e))
            }
        }
    }
    /// Walk the mount point for `*.iso` files, introspect each one, and
    /// register it with the IsoStore as an NFS-sourced entry. Returns the
    /// count of ISOs registered.
    async fn scan_and_register(&self, m: &NfsMount) -> Result<u32> {
        // Drop any prior entries from this mount before re-registering, so
        // a removed file disappears from the store.
        self.iso_store.drop_external_source(&m.id);
        let mut walker = tokio::fs::read_dir(&m.local_path).await?;
        let mut count = 0u32;
        while let Some(entry) = walker.next_entry().await? {
            let p = entry.path();
            if p.extension()
                .and_then(|e| e.to_str())
                .map(str::to_ascii_lowercase)
                .as_deref()
                != Some("iso")
            {
                continue;
            }
            let filename = match p.file_name().and_then(|s| s.to_str()) {
                Some(f) => f.to_string(),
                None => continue,
            };
            let size = tokio::fs::metadata(&p).await?.len();
            // Introspection is sync + IO-bound (reads ISO9660 PVD). Push
            // it to a blocking thread so the runtime stays responsive on
            // a slow share.
            let p_owned = p.clone();
            let report: IntrospectionReport =
                tokio::task::spawn_blocking(move || introspect(&p_owned))
                    .await
                    .map_err(|e| Error::Other(e.into()))?;
            let id = format!("nfs-{}-{}", m.id, slugify_str(&filename));
            let boot_entries = generate_boot_entries_for(&id, &filename, &report);
            let source = IsoSource::Nfs {
                mount_id: m.id.clone(),
                relative_path: filename.clone(),
            };
            self.iso_store
                .register_external(id, filename, size, report, boot_entries, source);
            count += 1;
        }
        Ok(count)
    }
    fn update_status(&self, id: &str, mounted: bool, err: Option<String>, ts: OffsetDateTime) {
        if let Some(m) = self.inner.lock().mounts.get_mut(id) {
            m.mounted = mounted;
            m.last_error = err;
            m.last_attempt = Some(ts);
        }
        self.persist_locked();
    }
    fn update_iso_count(&self, id: &str, count: u32) {
        if let Some(m) = self.inner.lock().mounts.get_mut(id) {
            m.iso_count = count;
        }
        self.persist_locked();
    }
    /// Atomically replace the on-disk JSON with the current state.
    /// Persistence errors are logged, never propagated — settings live in
    /// memory authoritatively, matching the SettingsStore policy.
    fn persist_locked(&self) {
        let mounts: Vec<NfsMount> = self.inner.lock().mounts.values().cloned().collect();
        let path = self.state_path.as_path();
        let tmp = path.with_extension("json.tmp");
        let body = match serde_json::to_vec_pretty(&mounts) {
            Ok(b) => b,
            Err(e) => {
                tracing::warn!(target: "openpxe::nfs", "serialize NFS state: {e}");
                return;
            }
        };
        if let Some(parent) = path.parent() {
            let _ = std::fs::create_dir_all(parent);
        }
        if let Err(e) = std::fs::write(&tmp, body) {
            tracing::warn!(target: "openpxe::nfs", "write NFS state tmp: {e}");
            return;
        }
        if let Err(e) = std::fs::rename(&tmp, path) {
            tracing::warn!(target: "openpxe::nfs", "rename NFS state: {e}");
        }
    }
 }
 fn mount_options(m: &NfsMount) -> String {
    let mut opts = vec![m.version.vers_arg().to_string()];
    if m.read_only {
        opts.push("ro".into());
    } else {
        opts.push("rw".into());
    }
    // `nolock` for v3 — many storage appliances disable lockd; we don't
    // need locking for read-only ISO access anyway.
    if matches!(m.version, NfsVersion::V3) {
        opts.push("nolock".into());
    }
    // Soft mount with a generous timeout — better to surface a hung share
    // as a user-visible error than to wedge the iPXE client forever on a
    // dead NFS server.
    opts.push("soft".into());
    opts.push("timeo=100".into());
    opts.push("retrans=3".into());
    opts.join(",")
 }
 fn mount_id(server: &str, export: &str) -> String {
    let raw = format!("{server}{export}");
    slugify_str(&raw)
 }
 /// Detect whether `path` is currently a mount point. We don't have
 /// `is_mountpoint(2)`, so compare the parent's device id to the dir's;
 /// if they differ the dir is a mount.
 async fn is_mountpoint(path: &Path) -> bool {
    let Some(parent) = path.parent() else {
        return false;
    };
    let Ok(m1) = tokio::fs::metadata(path).await else {
        return false;
    };
    let Ok(m2) = tokio::fs::metadata(parent).await else {
        return false;
    };
    use std::os::unix::fs::MetadataExt;
    m1.dev() != m2.dev()
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    #[test]
    fn version_arg() {
        assert_eq!(NfsVersion::V3.vers_arg(), "vers=3");
        assert_eq!(NfsVersion::V41.vers_arg(), "vers=4.1");
    }
    #[test]
    fn mount_options_v3_includes_nolock() {
        let m = NfsMount {
            id: "x".into(),
            server: "s".into(),
            export: "/e".into(),
            version: NfsVersion::V3,
            read_only: true,
            local_path: PathBuf::from("/tmp/x"),
            mounted: false,
            last_error: None,
            last_attempt: None,
            iso_count: 0,
        };
        let opts = mount_options(&m);
        assert!(opts.contains("vers=3"));
        assert!(opts.contains("ro"));
        assert!(opts.contains("nolock"));
        assert!(opts.contains("soft"));
    }
    #[test]
    fn mount_options_v41_no_nolock() {
        let m = NfsMount {
            id: "x".into(),
            server: "s".into(),
            export: "/e".into(),
            version: NfsVersion::V41,
            read_only: false,
            local_path: PathBuf::from("/tmp/x"),
            mounted: false,
            last_error: None,
            last_attempt: None,
            iso_count: 0,
        };
        let opts = mount_options(&m);
        assert!(opts.contains("vers=4.1"));
        assert!(opts.contains("rw"));
        assert!(!opts.contains("nolock"));
    }
    #[test]
    fn mount_id_is_stable_and_safe() {
        let a = mount_id("10.0.0.5", "/srv/isos");
        let b = mount_id("10.0.0.5", "/srv/isos");
        assert_eq!(a, b);
        assert!(!a.contains('/'));
        assert!(!a.contains('.'));
    }
 }
@@ -0,0 +1,264 @@
 //! PXE boot-menu background compositor.
 //!
 //! The brief (v0.4.69): match iVentoy's polished graphical PXE screen.
 //! iPXE built with `CONSOLE_FRAMEBUFFER` + `IMAGE_PNG` paints a PNG to
 //! the framebuffer via `console --picture`, then draws the text menu on
 //! top (the console's default background colour is rendered transparent
 //! so the picture shows through the menu's blank cells). So what we
 //! produce here is a **full-screen 1024×768 background**, not just a
 //! floating logo:
 //!
 //!   - a solid dark field (matches the WebUI dark theme so the product
 //!     feels consistent from browser to bare metal), with
 //!   - the operator's uploaded logo composited across the top, leaving
 //!     the lower ~two-thirds clear for the iPXE menu text.
 //!
 //! When no custom logo is uploaded we still return a designed
 //! background — a dark field with a centered "rainbow-horizon" disc
 //! echoing the bundled OpenPXE mark — so the boot screen is graphical
 //! out of the box. This replaces the old ASCII wordmark entirely.
 //!
 //! iPXE does **not** scale pictures (confirmed against the decoder
 //! source): the image is painted at native pixel size and the firmware
 //! picks the smallest video mode that fits. 1024×768 is the universal
 //! safe mode, so we pin the canvas there. Operators uploading a 4K logo
 //! get it downscaled to fit the top band; tiny icons paint at native
 //! size, centered.
 //!
 //! Input formats: anything the `image` crate decodes with our enabled
 //! features — PNG, JPEG, WebP, GIF. iPXE itself only consumes PNG, so
 //! we always *emit* PNG regardless of what the operator uploaded; a
 //! WebP logo is transcoded here transparently.
 use image::imageops::FilterType;
 use image::{DynamicImage, ImageError, ImageFormat, Rgba, RgbaImage};
 use std::io::Cursor;
 /// Canvas dimensions. Pinned to 1024×768 — the universal framebuffer
 /// mode every BIOS/UEFI console supports, and iPXE doesn't scale.
 pub const CANVAS_W: u32 = 1024;
 pub const CANVAS_H: u32 = 768;
 /// Bounding box for the operator's logo across the top band. Wider than
 /// the old floating-logo box because the logo now anchors a full
 /// background rather than sitting alone on transparency.
 const LOGO_MAX_W: u32 = 760;
 const LOGO_MAX_H: u32 = 200;
 /// Top margin from the canvas top to the logo's top edge.
 const LOGO_TOP_MARGIN: u32 = 72;
 /// Background fill — a near-black with a faint blue cast, matching the
 /// WebUI's dark theme surface so the product reads as one piece from
 /// browser to PXE screen.
 const BG: Rgba<u8> = Rgba([11, 14, 22, 255]);
 /// Compose the operator's uploaded raster (`Some`) — or the default
 /// OpenPXE mark (`None`) — into a full-screen 1024×768 PNG background
 /// and return the encoded bytes.
 ///
 /// Errors only when a provided `src_bytes` can't be decoded; the
 /// `None` path and the PNG encode are infallible for our fixed canvas.
 pub fn compose_pxe_background(src_bytes: Option<&[u8]>) -> Result<Vec<u8>, ImageError> {
    let mut canvas: RgbaImage = RgbaImage::from_pixel(CANVAS_W, CANVAS_H, BG);
    match src_bytes {
        Some(bytes) => {
            let logo = image::load_from_memory(bytes)?;
            let logo = downscale_to_fit(logo, LOGO_MAX_W, LOGO_MAX_H);
            let logo_rgba = logo.to_rgba8();
            let off_x = CANVAS_W.saturating_sub(logo_rgba.width()) / 2;
            let off_y = LOGO_TOP_MARGIN.min(CANVAS_H.saturating_sub(logo_rgba.height()));
            // `overlay` alpha-composites, so a transparent-background
            // logo blends onto the dark field exactly as designed.
            image::imageops::overlay(&mut canvas, &logo_rgba, off_x.into(), off_y.into());
        }
        None => draw_default_mark(&mut canvas),
    }
    let mut out = Vec::with_capacity(128 * 1024);
    DynamicImage::ImageRgba8(canvas).write_to(&mut Cursor::new(&mut out), ImageFormat::Png)?;
    Ok(out)
 }
 /// Back-compat shim for the old name — callers that pass a raw logo and
 /// want it composited get the same result as `compose_pxe_background`
 /// with `Some`.
 pub fn compose_pxe_logo(src_bytes: &[u8]) -> Result<Vec<u8>, ImageError> {
    compose_pxe_background(Some(src_bytes))
 }
 /// Paint a centered "rainbow-horizon" disc onto the dark canvas as the
 /// default brand mark when no operator logo is set. Pure pixel math —
 /// no font, no SVG rasterizer, no extra deps. A filled circle with a
 /// left-to-right hue sweep echoes the bundled `logo.svg` motif.
 // Casts here are all bounded small-range geometry (radius ≤ 90, canvas
 // ≤ 1024) — precision loss / wrap is structurally impossible.
 #[allow(clippy::cast_precision_loss, clippy::cast_possible_wrap)]
 fn draw_default_mark(canvas: &mut RgbaImage) {
    let radius: i32 = 90;
    let cx = (CANVAS_W / 2) as i32;
    let cy = (LOGO_TOP_MARGIN + 100) as i32;
    // Four-stop horizontal sweep across the disc (teal → blue → violet
    // → magenta) — the OpenPXE palette.
    let stops = [
        [0x22u8, 0xd3, 0xaa],
        [0x3b, 0x82, 0xf6],
        [0x8b, 0x5c, 0xf6],
        [0xec, 0x48, 0x99],
    ];
    let r2 = radius * radius;
    for dy in -radius..=radius {
        for dx in -radius..=radius {
            if dx * dx + dy * dy > r2 {
                continue;
            }
            // Position across the disc in [0,1] left→right.
            let t = (f32::from(i16::try_from(dx + radius).unwrap_or(0)))
                / (f32::from(i16::try_from(2 * radius).unwrap_or(1)));
            let color = gradient_at(&stops, t);
            // Soft edge: fade alpha in the outer 3px ring.
            let dist = ((dx * dx + dy * dy) as f32).sqrt();
            let alpha = if dist > (radius as f32 - 3.0) {
                let edge = (radius as f32 - dist).clamp(0.0, 3.0) / 3.0;
                (edge * 255.0) as u8
            } else {
                255
            };
            let px = cx + dx;
            let py = cy + dy;
            if px >= 0 && py >= 0 && (px as u32) < CANVAS_W && (py as u32) < CANVAS_H {
                blend_pixel(canvas, px as u32, py as u32, color, alpha);
            }
        }
    }
 }
 /// Linear interpolate across an N-stop palette at position `t` in [0,1].
 // `segments`/`idx` are ≤ palette length (4) — f32 cast is exact.
 #[allow(clippy::cast_precision_loss)]
 fn gradient_at(stops: &[[u8; 3]], t: f32) -> [u8; 3] {
    let t = t.clamp(0.0, 1.0);
    let segments = stops.len() - 1;
    let scaled = t * segments as f32;
    let idx = (scaled.floor() as usize).min(segments - 1);
    let frac = scaled - idx as f32;
    let a = stops[idx];
    let b = stops[idx + 1];
    [
        lerp(a[0], b[0], frac),
        lerp(a[1], b[1], frac),
        lerp(a[2], b[2], frac),
    ]
 }
 fn lerp(a: u8, b: u8, t: f32) -> u8 {
    (f32::from(a) + (f32::from(b) - f32::from(a)) * t).round() as u8
 }
 /// Alpha-blend `color` at `alpha` over the existing canvas pixel.
 fn blend_pixel(canvas: &mut RgbaImage, x: u32, y: u32, color: [u8; 3], alpha: u8) {
    let bg = canvas.get_pixel(x, y).0;
    let a = f32::from(alpha) / 255.0;
    let out = Rgba([
        lerp(bg[0], color[0], a),
        lerp(bg[1], color[1], a),
        lerp(bg[2], color[2], a),
        255,
    ]);
    canvas.put_pixel(x, y, out);
 }
 fn downscale_to_fit(img: DynamicImage, max_w: u32, max_h: u32) -> DynamicImage {
    let (w, h) = (img.width(), img.height());
    if w <= max_w && h <= max_h {
        return img;
    }
    img.resize(max_w, max_h, FilterType::Lanczos3)
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    use image::{ImageBuffer, Rgb};
    fn solid_png(w: u32, h: u32, rgb: [u8; 3]) -> Vec<u8> {
        let img: ImageBuffer<Rgb<u8>, Vec<u8>> = ImageBuffer::from_pixel(w, h, Rgb(rgb));
        let mut out = Vec::with_capacity(4096);
        DynamicImage::ImageRgb8(img)
            .write_to(&mut Cursor::new(&mut out), ImageFormat::Png)
            .unwrap();
        out
    }
    #[test]
    fn custom_logo_emits_canvas_sized_png_with_dark_field() {
        let src = solid_png(120, 60, [200, 50, 50]);
        let out = compose_pxe_background(Some(&src)).unwrap();
        let img = image::load_from_memory(&out).unwrap().to_rgba8();
        assert_eq!(img.width(), CANVAS_W);
        assert_eq!(img.height(), CANVAS_H);
        // A far corner should be the opaque dark background fill, not
        // transparent — this is a full background now, not a floating
        // logo on transparency.
        let corner = img.get_pixel(CANVAS_W - 1, CANVAS_H - 1);
        assert_eq!(corner.0, BG.0, "corner should be the dark fill");
    }
    #[test]
    fn custom_logo_painted_in_top_band() {
        let src = solid_png(100, 40, [10, 200, 10]);
        let out = compose_pxe_background(Some(&src)).unwrap();
        let canvas = image::load_from_memory(&out).unwrap().to_rgba8();
        let cx = (CANVAS_W - 100) / 2;
        let cy = LOGO_TOP_MARGIN;
        let inside = canvas.get_pixel(cx + 10, cy + 10);
        assert!(
            inside.0[1] > 100 && inside.0[0] < 100,
            "logo pixel color mismatch: {inside:?}"
        );
    }
    #[test]
    fn default_background_is_dark_with_a_painted_mark() {
        let out = compose_pxe_background(None).unwrap();
        let canvas = image::load_from_memory(&out).unwrap().to_rgba8();
        assert_eq!(canvas.width(), CANVAS_W);
        assert_eq!(canvas.height(), CANVAS_H);
        // Corner is dark fill.
        assert_eq!(canvas.get_pixel(2, CANVAS_H - 2).0, BG.0);
        // Center of the disc is not the background fill (something was
        // painted there).
        let center = canvas.get_pixel(CANVAS_W / 2, LOGO_TOP_MARGIN + 100);
        assert_ne!(center.0, BG.0, "default mark should paint over the field");
    }
    #[test]
    fn webp_or_jpeg_input_is_accepted_and_transcoded_to_png() {
        // Encode a JPEG and confirm the compositor decodes it and emits
        // a valid PNG (iPXE only eats PNG, so transcoding is the point).
        let img: ImageBuffer<Rgb<u8>, Vec<u8>> = ImageBuffer::from_pixel(80, 80, Rgb([90, 90, 90]));
        let mut jpeg = Vec::new();
        DynamicImage::ImageRgb8(img)
            .write_to(&mut Cursor::new(&mut jpeg), ImageFormat::Jpeg)
            .unwrap();
        let out = compose_pxe_background(Some(&jpeg)).unwrap();
        // Output must be a PNG (magic bytes) of canvas size.
        assert_eq!(&out[..8], b"\x89PNG\r\n\x1a\n");
        let img = image::load_from_memory(&out).unwrap();
        assert_eq!(img.width(), CANVAS_W);
    }
    #[test]
    fn unsupported_bytes_returns_error_not_panic() {
        let r = compose_pxe_background(Some(b"\xde\xad\xbe\xef not an image"));
        assert!(r.is_err());
    }
    #[test]
    fn gradient_endpoints_match_stops() {
        let stops = [[0, 0, 0], [255, 255, 255]];
        assert_eq!(gradient_at(&stops, 0.0), [0, 0, 0]);
        assert_eq!(gradient_at(&stops, 1.0), [255, 255, 255]);
    }
 }
@@ -15,18 +15,31 @@ use tokio::io::AsyncWriteExt;
 /// Where the bytes for an ISO actually live.
 ///
-/// The default is `Local` — uploaded ISOs sit in `<iso_dir>/<id>.iso`.
+/// `Local` — uploaded ISO, sits at `<iso_dir>/<id>.iso`.
-/// `Nfs` entries point at a file inside a remote share that the
+/// `Smb` (v0.4.65) — remote SMB share, streamed via Samba's
-/// `NfsManager` is keeping mounted. We resolve the on-disk path lazily
+/// userspace `smbclient` CLI subprocess. No kernel mount, no local
-/// in [`IsoStore::iso_path_for`] using the `nfs_root` set at startup.
+/// cache. Sequential whole-file streaming; HTTP Range requests
 /// return 416.
 /// `Nfs` (v0.4.67) — remote NFSv3 share, streamed via the pure-Rust
 /// `nfs3_client` crate (in-process, no subprocess). Same "works in
 /// any container" property as SMB, plus Range requests work because
 /// NFSv3 READ3 takes an explicit offset.
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(tag = "kind", rename_all = "snake_case")]
 pub enum IsoSource {
    #[default]
    Local,
    /// v0.4.65: SMB via userspace `smbclient` works in any container.
    Smb {
        share_id: String,
        /// Filename at the share root. We don't support nested paths
        /// in v0.4.65; ISOs live at the top of the share.
        relative_path: String,
    },
    /// v0.4.67: NFSv3 via the in-process `nfs3_client` crate.
    Nfs {
-        mount_id: String,
+        share_id: String,
-        /// Path relative to the mount point — typically just the filename.
+        /// Filename at the export root.
        relative_path: String,
    },
 }
@@ -164,10 +177,6 @@ struct Inner {
 #[derive(Debug, Clone)]
 pub struct IsoStore {
    iso_dir: Arc<PathBuf>,
    /// Where NFS mounts land on disk. Set at startup via
    /// [`IsoStore::set_nfs_root`]; required for resolving any
    /// `IsoSource::Nfs` entry.
    nfs_root: Arc<RwLock<Option<PathBuf>>>,
    inner: Arc<RwLock<Inner>>,
 }
@@ -175,17 +184,10 @@ impl IsoStore {
    pub fn new(iso_dir: PathBuf) -> Self {
        Self {
            iso_dir: Arc::new(iso_dir),
            nfs_root: Arc::new(RwLock::new(None)),
            inner: Arc::new(RwLock::new(Inner::default())),
        }
    }
    /// Tell the store where NFS mounts live. Without this set,
    /// `IsoSource::Nfs` entries cannot be resolved to a file path.
    pub fn set_nfs_root(&self, root: PathBuf) {
        *self.nfs_root.write() = Some(root);
    }
    pub async fn ensure_dirs(&self) -> Result<()> {
        tokio::fs::create_dir_all(self.iso_dir.as_path()).await?;
        Ok(())
@@ -281,33 +283,33 @@ impl IsoStore {
        self.inner.read().isos.get(id).cloned()
    }
-    /// Resolve an ISO id to its on-disk path, if any. For local entries
+    /// Resolve an ISO id to its on-disk path, if any. For local
-    /// this is `<iso_dir>/<id>.iso`; for NFS entries it's
+    /// (uploaded) ISOs this is `<iso_dir>/<id>.iso`. For SMB-sourced
-    /// `<nfs_root>/<mount_id>/<relative_path>`. Returns None if the file
+    /// ISOs there is no on-disk path — the HTTP handler must stream
-    /// is missing or the source isn't resolvable (e.g. NFS share
+    /// via `SmbShareManager::stream_iso` instead. Returns `None` for
-    /// unmounted).
+    /// SMB sources or when the file is missing.
    pub fn iso_path_for(&self, id: &str) -> Option<PathBuf> {
        let meta = self.get(id)?;
-        let path = match &meta.source {
+        match &meta.source {
-            IsoSource::Local => self.iso_path(id),
+            IsoSource::Local => {
-            IsoSource::Nfs {
+                let path = self.iso_path(id);
-                mount_id,
+                if path.exists() {
-                relative_path,
+                    Some(path)
-            } => {
+                } else {
-                let root = self.nfs_root.read().clone()?;
+                    None
-                root.join(mount_id).join(relative_path)
+                }
            }
-        };
+            // SMB and NFS sources have no local path — they're
-        if path.exists() {
+            // streamed in-process. Callers must inspect the source
-            Some(path)
+            // kind first and dispatch to the appropriate share
-        } else {
+            // manager.
-            None
+            IsoSource::Smb { .. } | IsoSource::Nfs { .. } => None,
        }
    }
-    /// Delete an ISO and its sidecar metadata. Only acts on local ISOs;
+    /// Delete an ISO and its sidecar metadata. Only acts on local
-    /// for NFS-backed ISOs the operator must remove the file from the
+    /// (uploaded) ISOs; for SMB-backed ISOs the operator must remove
-    /// share or unmount the NFS share entirely.
+    /// the file from the share or unregister the share entirely.
    pub async fn delete(&self, id: &str) -> Result<()> {
        let meta = self.get(id);
        let is_local = matches!(
@@ -324,10 +326,10 @@ impl IsoStore {
        Ok(())
    }
-    /// Register an externally-sourced ISO (e.g. NFS-mounted). Used by
+    /// Register an externally-sourced ISO (SMB share, etc.). Used by
-    /// `NfsManager` after walking a freshly-mounted share. We do **not**
+    /// `SmbShareManager` after listing a share. We do **not** persist
-    /// persist a `meta.json` on disk for these — the source of truth is
+    /// a `meta.json` on disk for these — the source of truth is the
-    /// the share itself, and the NFS manager re-scans on startup.
+    /// share itself, and the manager re-scans on startup.
    pub fn register_external(
        &self,
        id: String,
@@ -352,14 +354,20 @@ impl IsoStore {
        self.inner.write().isos.insert(id, meta);
    }
-    /// Drop every entry that belongs to `mount_id`. Used by the NFS
+    /// Drop every entry that belongs to `share_id`. Used by the SMB
-    /// manager when an operator removes a share, or before re-scanning
+    /// and NFS share managers when an operator removes a share, or
-    /// to clean out stale entries.
+    /// before re-scanning to clean out stale entries. The same id
-    pub fn drop_external_source(&self, mount_id: &str) {
+    /// space serves both protocols — share ids are slugified from
    /// `server+share` (SMB) or `server+export` (NFS) and the
    /// protocol-specific prefix prevents collisions.
    pub fn drop_external_source(&self, share_id: &str) {
        let mut g = self.inner.write();
-        g.isos.retain(
+        g.isos.retain(|_, m| match &m.source {
-            |_, m| !matches!(&m.source, IsoSource::Nfs { mount_id: mid, .. } if mid == mount_id),
+            IsoSource::Smb { share_id: sid, .. } | IsoSource::Nfs { share_id: sid, .. } => {
-        );
+                sid != share_id
            }
            IsoSource::Local => true,
        });
    }
    /// Set or clear an ISO's boot password.
@@ -9,7 +9,7 @@ use openpxe_core::{
 };
 use openpxe_dhcp_proxy::DhcpProxyServer;
 use openpxe_http_api::{build_router, AppState};
-use openpxe_iso_store::{IsoStore, NfsManager, SmbManager};
+use openpxe_iso_store::{IsoStore, NfsShareManager, SmbManager, SmbShareManager};
 use openpxe_tftp::TftpServer;
 use std::net::{Ipv4Addr, SocketAddr};
 use std::path::PathBuf;
@@ -119,13 +119,30 @@ async fn main() -> anyhow::Result<()> {
        let _ = smb.start();
    }
-    // NFS manager. The mount root has to be set on the IsoStore *before*
+    // v0.4.65: SMB share manager — Samba `smbclient` userspace
-    // we replay any persisted mounts, otherwise an in-memory IsoMeta
+    // consumer. Replaces the kernel-mount NFS path that v0.4.64
-    // pointing at an NFS source can't resolve to a path.
+    // shipped; that didn't work on hosts whose kernel lacked the nfs
-    let nfs = NfsManager::new(&config.paths.work_dir, iso_store.clone());
+    // client modules (Unraid is the dominant case). `smbclient` does
-    iso_store.set_nfs_root(nfs.mount_root());
+    // the SMB protocol entirely in userspace over TCP and works in
-    if let Err(e) = nfs.load_and_remount().await {
+    // any container regardless of capabilities or kernel modules.
-        tracing::warn!(target: "openpxe::nfs", "could not reload NFS mounts: {e}");
+    let smb_shares = SmbShareManager::new(&config.paths.work_dir, iso_store.clone());
    if let Err(e) = smb_shares.load_and_rescan().await {
        tracing::warn!(
            target: "openpxe::smb",
            "could not reload SMB shares on startup: {e}"
        );
    }
    // v0.4.67: NFSv3 share manager — pure-Rust in-process consumer
    // via the `nfs3_client` crate. Sits alongside the SMB manager;
    // operators pick whichever protocol their NAS prefers, or use
    // both. No subprocess, no kernel mount, works in any container.
    let nfs_shares = NfsShareManager::new(&config.paths.work_dir, iso_store.clone());
    if let Err(e) = nfs_shares.load_and_rescan().await {
        tracing::warn!(
            target: "openpxe::nfs",
            "could not reload NFS shares on startup: {e}"
        );
    }
    // Sniff network details for the Network tab. None of these are
@@ -152,7 +169,8 @@ async fn main() -> anyhow::Result<()> {
        sso: sso.clone(),
        metrics: metrics.clone(),
        smb: Some(smb.clone()),
-        nfs: nfs.clone(),
+        smb_shares: smb_shares.clone(),
        nfs_shares: nfs_shares.clone(),
        uploads: openpxe_http_api::uploads::UploadSessions::default(),
        log_bus: log_bus.clone(),
        started_at: time::OffsetDateTime::now_utc(),
@@ -34,9 +34,18 @@
  --topbar-h:   56px;
  --mono: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
  --sans: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, system-ui, sans-serif;
  /* v0.4.63: tie native form-control rendering (checkboxes, scroll bars,
     date pickers) to the active OpenPXE theme. Without this, the inline
     `<meta name="color-scheme" content="dark light">` in index.html forces
     dark form chrome in *both* themes — so the SSO "Enable single sign-on"
     checkbox renders as an opaque black square against the light-mode
     panel, ignoring our accent-color hint. CSS `color-scheme` overrides
     the meta and tracks `data-theme` correctly. */
  color-scheme: dark;
 }
 :root[data-theme="light"] {
  color-scheme: light;
  /* Light palette — high-contrast neutral, accent unchanged for brand
     consistency. Designed against Netbox Labs's reference screenshot:
     near-white surfaces, soft grey dividers, dark text. */
@@ -108,6 +117,20 @@ code, kbd { font-family: var(--mono); font-size: 12.5px;
  letter-spacing: 0.2px;
  color: var(--fg);
 }
 /* v0.4.69: FleetDM-style full-width custom logo. When the operator has
   uploaded a custom brand mark, the sidebar header drops the bundled
   26px mark + "OpenPXE" wordmark and instead lets the uploaded image
   span the header — left-aligned, capped at 200x50, scaled to fit
   without distortion. The wordmark is hidden so the operator's logo is
   the sole brand element (their logo presumably already contains their
   name). The bundled-default case keeps the mark + wordmark. */
 .sidebar .brand.has-custom-logo { gap: 0; }
 .sidebar .brand.has-custom-logo img {
  width: auto; height: 50px; max-width: 200px;
  object-fit: contain; object-position: left center; flex: none;
 }
 .sidebar .brand.has-custom-logo strong { display: none; }
 .sidebar nav { padding: 10px 0; flex: 1; overflow-y: auto; }
 .sidebar nav a {
  display: flex; align-items: center; gap: 10px;
@@ -287,23 +310,83 @@ label.field {
 }
 label.field .name { color: var(--fg-dim); font-size: 12px; }
 label.field .hint { color: var(--fg-dimmer); font-size: 11px; }
-label.field input[type="text"],
+/* All single-line inputs share one chrome rule. Pre-v0.4.6 we only
-label.field input[type="number"],
+   styled type=text/number, which left type=password fields rendering
   with the default browser look — visibly off vs adjacent text fields
   in the Account card. The negation list keeps `type=checkbox`,
   `type=file`, and `type=range` (none of which we use inside
   `label.field`) from picking up the padded-box look. */
 label.field input:not([type="checkbox"]):not([type="file"]):not([type="range"]),
 label.field select,
 label.field textarea {
  width: 100%; background: var(--bg); color: var(--fg);
  border: 1px solid var(--border); border-radius: var(--radius);
  padding: 7px 10px; font: inherit;
  /* iOS/Safari shrinks password-field text by default; clamp it so
     the password input matches the username input's metrics. */
  font-size: 14px; line-height: 1.4;
  box-shadow: none; -webkit-appearance: none; appearance: none;
 }
 /* v0.4.63: with `appearance: none`, the native <select> dropdown arrow
   disappears, which makes the "Metadata source" pick-list look like a
   plain (and slightly squished) text input. Paint our own chevron via
   background-image so the control still reads as a dropdown, and reserve
   right-padding for it. The data-URI SVG inherits currentColor via the
   `stroke` attribute so the arrow follows light/dark theme without a
   second declaration. */
 label.field select {
  background-image: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 12 8' fill='none' stroke='%239aa0a6' stroke-width='1.6' stroke-linecap='round' stroke-linejoin='round'><polyline points='1.5,1.5 6,6 10.5,1.5'/></svg>");
  background-repeat: no-repeat;
  background-position: right 10px center;
  background-size: 11px 7px;
  padding-right: 30px;
 }
 :root[data-theme="light"] label.field select {
  background-image: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 12 8' fill='none' stroke='%235a6377' stroke-width='1.6' stroke-linecap='round' stroke-linejoin='round'><polyline points='1.5,1.5 6,6 10.5,1.5'/></svg>");
 }
 label.field input:focus, label.field select:focus, label.field textarea:focus {
  outline: none; border-color: var(--accent);
  box-shadow: 0 0 0 1px color-mix(in srgb, var(--accent) 35%, transparent);
 }
 label.check {
  display: flex; gap: 10px; align-items: center;
  padding: 8px 10px; margin-bottom: 6px;
  border: 1px solid var(--border-soft); border-radius: var(--radius);
 }
-label.check input { accent-color: var(--accent); }
+/* v0.4.63: native checkboxes used to render as opaque black squares in
   light mode because the page meta declares `color-scheme: dark light`
   and `accent-color` alone only repaints the *check mark* (not the
   container). Take full control of the chrome so the box reads cleanly
   on both palettes and the checked state lights up in our accent. */
 label.check input[type="checkbox"] {
  appearance: none; -webkit-appearance: none;
  width: 16px; height: 16px; flex: none;
  background: var(--bg);
  border: 1px solid var(--border);
  border-radius: 3px;
  display: inline-grid; place-content: center;
  cursor: pointer; margin: 0;
  transition: background 0.1s ease, border-color 0.1s ease;
 }
 label.check input[type="checkbox"]:hover { border-color: var(--accent); }
 label.check input[type="checkbox"]:checked {
  background: var(--accent);
  border-color: var(--accent);
 }
 label.check input[type="checkbox"]:checked::after {
  /* Classic ✓ glyph built from a rotated rectangle border. Colour is
     #002923 (the same near-black we use on solid-accent buttons) so the
     tick stays legible against the teal fill in both themes. */
  content: '';
  width: 4px; height: 8px;
  border: solid #002923;
  border-width: 0 2px 2px 0;
  transform: rotate(45deg) translate(-1px, -1px);
 }
 label.check input[type="checkbox"]:focus-visible {
  outline: none;
  box-shadow: 0 0 0 2px color-mix(in srgb, var(--accent) 35%, transparent);
 }
 /* ── Drop zone ────────────────────────────────────────────────────── */
@@ -421,9 +504,21 @@ tr.unbootable td:first-child { border-left: 3px solid var(--warn); }
 .dot.err  { background: var(--err); }
 .dot.warn { background: var(--warn); }
-/* Inline form rows. */
+/* Inline form rows. The default is a 4-column grid sized for the
-.form-row { display: grid; grid-template-columns: repeat(4, 1fr); gap: 10px 14px; }
+   Account card's "Current / New username / New password / Confirm"
-@media (max-width: 900px) { .form-row { grid-template-columns: 1fr; } }
+   quartet; the `.cols-3` modifier swaps to a 3-column layout for the
   SSO header strip (display name / logo URL / metadata source). All
   `.form-row > label.field` children share the same baseline because
   their inner inputs share metrics via the global rule above. */
 .form-row { display: grid; grid-template-columns: repeat(4, 1fr); gap: 10px 14px; align-items: end; }
 .form-row.cols-3 { grid-template-columns: repeat(3, 1fr); }
 .form-row.cols-2 { grid-template-columns: repeat(2, 1fr); }
 .form-row label.field { margin-bottom: 0; }
@media (max-width: 900px) {
  .form-row,
  .form-row.cols-3,
  .form-row.cols-2 { grid-template-columns: 1fr; }
 }
 /* ── Queued deployment visual ────────────────────────────────────── */
 .queue-track {
@@ -567,22 +662,56 @@ tr.unbootable td:first-child { border-left: 3px solid var(--warn); }
 }
 .auth-card .sso-btn .meta { color: var(--fg-dim); font-size: 11px; margin-top: 2px; }
-/* ── Logout chip (sidebar footer) ────────────────────────────── */
+/* ── Top-right user menu (v0.4.6) ────────────────────────────
-.sidebar .footer .logout-row {
+   The "signed in as X" identity + sign-out moved out of the sidebar
-  margin-top: 8px; display: flex; align-items: center; justify-content: space-between;
+   footer in v0.4.6 — the sidebar footer is now reserved for the
-  gap: 8px;
+   service-state trio (Service status / Advertised URL / Backend
   version). The button matches the theme toggle's size + chrome so
   the top-right reads as a tidy two-icon strip. */
 .user-menu { position: relative; }
 .user-btn {
  display: inline-flex; align-items: center; justify-content: center;
  width: 36px; height: 32px;
  background: transparent; color: var(--fg);
  border: 1px solid var(--border); border-radius: 8px;
  cursor: pointer; padding: 0;
  transition: background 0.15s ease, border-color 0.15s ease;
 }
-.sidebar .footer .logout-row .who {
+.user-btn:hover { background: var(--bg-panel-2); border-color: var(--accent); }
-  color: var(--fg); font-weight: 600; font-size: 11.5px;
+.user-pop {
  position: absolute; right: 0; top: 38px;
  min-width: 200px;
  background: var(--bg-panel);
  border: 1px solid var(--border);
  border-radius: var(--radius-lg);
  box-shadow: var(--shadow-card);
  padding: 6px;
  z-index: 60;
  display: flex; flex-direction: column; gap: 2px;
 }
 .user-pop[hidden] { display: none; }
 .user-pop .user-pop-name {
  padding: 8px 10px 6px;
  border-bottom: 1px solid var(--border-soft);
  margin-bottom: 4px;
  color: var(--fg); font-weight: 600; font-size: 13px;
  overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
 }
-.sidebar .footer .logout-btn {
+.user-pop .user-pop-item {
-  background: transparent; color: var(--fg-dim);
+  text-align: left; width: 100%;
-  border: 1px solid var(--border); border-radius: var(--radius);
+  background: transparent; color: var(--fg);
-  padding: 2px 8px; font: inherit; font-size: 11px; font-weight: 500;
+  border: 0; border-radius: var(--radius);
  padding: 7px 10px; font: inherit; font-size: 13px; font-weight: 500;
  cursor: pointer;
 }
-.sidebar .footer .logout-btn:hover { color: var(--fg); background: var(--bg-panel-2); border-color: var(--accent); }
+.user-pop .user-pop-item:hover {
  background: var(--bg-panel-2); color: var(--fg);
 }
 .user-pop .user-pop-danger { color: var(--err); }
 .user-pop .user-pop-danger:hover {
  background: color-mix(in srgb, var(--err) 12%, transparent);
  color: var(--err);
 }
 /* ── About card ─────────────────────────────────────────────────── */
 .about-hero { padding: 20px 24px; }
@@ -116,6 +116,46 @@
    return root;
  }
  // Disk-space card. Free + used + total for the volume hosting the ISO
  // directory, with a coloured bar. Warns at 80% and goes red at 95% so
  // the operator sees the runway shrinking before uploads start failing
  // with ENOSPC. Shared by the Storage tab and the Dashboard (v0.4.68).
  function diskSpaceCard(disk) {
    const total = Number(disk.total_bytes || 0);
    const avail = Number(disk.available_bytes || 0);
    const used  = Number(disk.used_bytes  || 0);
    const pctUsed = total > 0 ? (used / total) * 100 : 0;
    let barClass = 'diskbar';
    if (pctUsed >= 95)      barClass += ' full';
    else if (pctUsed >= 80) barClass += ' warn';
    return el('div', {class:'card'}, [
      el('header', {}, [
        el('h2', {}, 'Disk space'),
        el('span', {class:'sub'},
          total > 0 ? (pctUsed.toFixed(1) + '% used') : 'unavailable'),
      ]),
      el('div', {class:'body'}, [
        el('div', {style:'color:var(--fg-dim);font-size:12px;word-break:break-all'},
          disk.path ? ('Volume: ' + disk.path) : 'Volume path unknown'),
        el('div', {class: barClass},
          el('div', {class:'fill',
            style:'width:' + Math.min(100, pctUsed).toFixed(1) + '%'})),
        el('div', {class:'disk-meta'}, [
          el('span', {}, ['Used ',  el('strong', {}, fmtBytes(used))]),
          el('span', {}, ['Free ',  el('strong', {}, fmtBytes(avail))]),
          el('span', {}, ['Total ', el('strong', {}, fmtBytes(total))]),
        ]),
        pctUsed >= 95
          ? el('p', {class:'msg err', style:'margin-top:10px'},
              '⚠ Less than 5% free. Remove old ISOs or grow the volume before uploading more.')
          : (pctUsed >= 80
              ? el('p', {class:'msg', style:'color:var(--warn);margin-top:10px'},
                  'Volume is getting full. Consider pruning old ISOs.')
              : null),
      ]),
    ]);
  }
  // Categorize an ISO row's "bootable now" status — drives the amber
  // tint borrowed from Bootimus v0.1.62. Returns {ok, reason}.
  function bootability(iso, settings) {
@@ -142,6 +182,13 @@
      const isos = await getJSON('/api/isos');
      const clients = (await getJSON('/api/clients')).clients || [];
      const entries = (await getJSON('/api/queue')).entries || [];
      // v0.4.68: surface the same disk-space card the Storage tab shows,
      // so operators see capacity at a glance from the landing page.
      // Tolerate the endpoint being unavailable (e.g. statvfs failure)
      // the same way the Storage tab does.
      const disk = await getJSON('/api/storage/disk').catch(() => ({
        total_bytes: 0, available_bytes: 0, used_bytes: 0, path: '?',
      }));
      const ipxeOk = (status.ipxe_assets || []).length > 0;
      const stats = el('div', {class: 'statstrip'}, [
@@ -167,7 +214,11 @@
          el('div', {class: 'trend'},
            isos.filter(i => i.introspection.family === 'windows_pe').length + ' Windows · ' +
            isos.filter(i => i.introspection.family !== 'windows_pe').length + ' Linux  ·  ' +
-            (status.nfs_active || 0) + ' NFS active'),
+            // v0.4.67: count both protocols. Label generically since
            // operators may be using one, the other, or both.
            ((status.smb_share_reachable || 0) + (status.nfs_share_reachable || 0)) +
            ' remote share' +
            (((status.smb_share_reachable || 0) + (status.nfs_share_reachable || 0)) === 1 ? '' : 's')),
        ])),
        el('div', {class: 'card'}, el('div', {class: 'stat'}, [
          el('div', {class: 'label'}, 'Uptime'),
@@ -218,7 +269,7 @@
            '⚠ ' + i.filename + ' — ' + b.reason)))
      ]) : null;
-      return el('div', {class:'grid'}, [stats, recentBlock, problemsBlock].filter(Boolean));
+      return el('div', {class:'grid'}, [stats, diskSpaceCard(disk), recentBlock, problemsBlock].filter(Boolean));
    },
    network: async () => {
@@ -342,13 +393,22 @@
    },
    storage: async () => {
-      const [isos, settings, nfsRes, disk] = await Promise.all([
+      // v0.4.65: kernel-mount NFS replaced with userspace SMB via
-        getJSON('/api/isos'), getJSON('/api/settings'), getJSON('/api/nfs'),
+      // smbclient — works in any container regardless of host kernel
      // modules or capabilities.
      // v0.4.67: NFSv3 added back as an in-process Rust client
      // (nfs3_client crate). Both protocols available side-by-side;
      // operators pick whichever their NAS prefers.
      const [isos, settings, smbRes, nfsRes, disk] = await Promise.all([
        getJSON('/api/isos'), getJSON('/api/settings'),
        getJSON('/api/smb-shares'),
        getJSON('/api/nfs-shares'),
        getJSON('/api/storage/disk').catch(() => ({
          total_bytes: 0, available_bytes: 0, used_bytes: 0, path: '?',
        })),
      ]);
-      const mounts = nfsRes.mounts || [];
+      const shares = smbRes.shares || [];
      const nfsShares = nfsRes.shares || [];
      // ── Upload card ──
      const drop = el('div', {class:'drop', id:'drop'}, [
@@ -450,7 +510,7 @@
        }
      }
-      // ── ISO table (mixed local + NFS) ──
+      // ── ISO table (mixed local + SMB) ──
      // Each row gets a "Password" cell that toggles a small inline
      // editor (a checkbox + a password field + Save button) inside the
      // *next* row of the table. Keeps the markup flat and avoids the
@@ -458,7 +518,14 @@
      const rowsAndEditors = [];
      isos.forEach(i => {
        const b = bootability(i, settings);
        // v0.4.65: SMB userspace consumer (smbclient).
        // v0.4.67: NFS back as in-process Rust client (nfs3_client).
        // Both render with the same "remote" badge colour — they
        // share the same "on a remote share, can't be deleted from
        // here" semantics in the UI.
        const isSmb = i.source && i.source.kind === 'smb';
        const isNfs = i.source && i.source.kind === 'nfs';
        const isRemote = isSmb || isNfs;
        const protectedNow = !!i.password_hash;
        // The inline editor row is hidden by default; the Password
@@ -578,8 +645,9 @@
          ]),
          el('td', {class:'num'}, fmtBytes(i.size_bytes)),
          el('td', {},
-            el('span', {class:'src-badge' + (isNfs ? ' nfs' : '')},
+            el('span', {class:'src-badge' + (isRemote ? ' nfs' : '')},
-              isNfs ? ('nfs:' + i.source.mount_id) : 'local')),
+              isSmb ? ('smb:' + i.source.share_id)
                : isNfs ? ('nfs:' + i.source.share_id) : 'local')),
          el('td', {},
            protectedNow
              ? el('span', {class:'tag accent'}, 'protected')
@@ -589,8 +657,12 @@
            el('button', {class:'ghost', style:'margin-right:6px', onclick: () => {
              editorRow.style.display = (editorRow.style.display === 'none') ? '' : 'none';
            }}, protectedNow ? 'Password ✎' : 'Set password'),
-            isNfs
+            isRemote
-              ? el('span', {class:'tag', style:'opacity:.6'}, 'on NFS')
+              // v0.4.65/v0.4.67: remote-sourced ISOs live on the
              // share — OpenPXE doesn't own those bytes. Surface a
              // tag instead of a destructive button.
              ? el('span', {class:'tag', style:'opacity:.6'},
                  isSmb ? 'on SMB' : 'on NFS')
              : el('button', {class:'danger', onclick: async () => {
                  if (!confirm('Remove this image?')) return;
                  await fetch('/api/isos/' + encodeURIComponent(i.id), {method:'DELETE'});
@@ -610,96 +682,166 @@
            ])),
            el('tbody', {}, rowsAndEditors),
          ])
-        : el('div', {class:'empty'}, 'No images yet. Upload an ISO or mount an NFS share.');
+        : el('div', {class:'empty'}, 'No images yet. Upload an ISO or add an SMB share.');
-      // ── NFS section ──
+      // ── SMB shares section (v0.4.65) ──
-      const nfsMsg = el('div', {class:'msg'});
+      // Replaces the kernel-mount NFS card. SMB shares are consumed
-      const nfsServer = el('input', {type:'text', placeholder:'10.0.0.20'});
+      // in userspace via Samba's `smbclient` CLI — no kernel modules,
-      const nfsExport = el('input', {type:'text', placeholder:'/srv/isos'});
+      // no CAP_SYS_ADMIN, works in any container. This is the same
-      const nfsVer = el('select', {}, [
+      // approach Bootimus uses.
-        el('option', {value:'v41'}, 'NFSv4.1 (default)'),
+      const smbMsg = el('div', {class:'msg'});
-        el('option', {value:'v3'}, 'NFSv3'),
+      const smbServer = el('input', {type:'text', placeholder:'192.168.1.51'});
-      ]);
+      const smbShare = el('input', {type:'text', placeholder:'isos'});
-      const nfsRo = el('input', {type:'checkbox'}); nfsRo.checked = true;
+      const smbGuest = el('input', {type:'checkbox'}); smbGuest.checked = true;
-      const addNfs = el('button', {onclick: async () => {
+      const smbUser = el('input', {type:'text', placeholder:'(disabled when Guest)'});
-        if (!nfsServer.value || !nfsExport.value) {
+      const smbPass = el('input', {type:'password', placeholder:'(disabled when Guest)'});
-          nfsMsg.textContent = 'Server and export are required.'; nfsMsg.className='msg err'; return;
+      // Toggle username/password fields based on the Guest checkbox so
      // operators don't get confused about which fields matter.
      const syncAuthDisabled = () => {
        smbUser.disabled = smbGuest.checked;
        smbPass.disabled = smbGuest.checked;
        smbUser.style.opacity = smbGuest.checked ? '0.55' : '1';
        smbPass.style.opacity = smbGuest.checked ? '0.55' : '1';
      };
      smbGuest.addEventListener('change', syncAuthDisabled);
      syncAuthDisabled();
      const addSmb = el('button', {onclick: async () => {
        if (!smbServer.value || !smbShare.value) {
          smbMsg.replaceChildren(document.createTextNode('Server and share name are required.'));
          smbMsg.className='msg err'; return;
        }
-        nfsMsg.textContent = 'Mounting…'; nfsMsg.className = 'msg';
+        if (!smbGuest.checked && !smbUser.value) {
-        const r = await postJSON('/api/nfs', {
+          smbMsg.replaceChildren(document.createTextNode('Username is required when Guest is unchecked.'));
-          server: nfsServer.value, export: nfsExport.value,
+          smbMsg.className='msg err'; return;
-          version: nfsVer.value, read_only: nfsRo.checked,
+        }
-        });
+        smbMsg.replaceChildren(document.createTextNode('Connecting…'));
        smbMsg.className = 'msg';
        const body = {
          server: smbServer.value,
          share: smbShare.value,
          guest: smbGuest.checked,
        };
        if (!smbGuest.checked) {
          body.username = smbUser.value;
          body.password = smbPass.value;
        }
        const r = await postJSON('/api/smb-shares', body);
        if (r.ok) {
-          nfsMsg.textContent = 'Mounted.'; nfsMsg.className = 'msg ok';
+          smbMsg.replaceChildren(document.createTextNode('Connected.'));
          smbMsg.className = 'msg ok';
          render('storage');
        } else {
-          const t = await r.text();
+          // The API returns a structured {error, stderr, hint} JSON
-          nfsMsg.textContent = 'Mount failed: ' + t; nfsMsg.className = 'msg err';
+          // body on failure so the raw smbclient error and the
          // actionable hint render as two distinct lines.
          let bodyJson = null;
          let raw = null;
          try { bodyJson = await r.clone().json(); }
          catch (_) { raw = await r.text().catch(()=> 'connect failed'); }
          const msg = bodyJson && bodyJson.error ? bodyJson.error : (raw || 'connect failed');
          const hint = bodyJson && bodyJson.hint;
          const parts = [el('div', {}, [
            el('strong', {}, 'Connect failed: '),
            document.createTextNode(msg),
          ])];
          if (hint) {
            parts.push(el('div', {style:'margin-top:6px;opacity:.78;font-size:12px'}, hint));
          }
          smbMsg.replaceChildren(...parts);
          smbMsg.className = 'msg err';
        }
-      }}, 'Mount share');
+      }}, 'Add share');
-      const nfsRows = mounts.length ? mounts.map(m => el('div', {class: 'nfs-row' + (m.mounted ? '' : ' down')}, [
+      const smbRows = shares.length ? shares.map(m => el('div', {class: 'nfs-row' + (m.reachable ? '' : ' down')}, [
-        el('span', {class: 'dot ' + (m.mounted ? 'ok' : 'err')}),
+        el('span', {class: 'dot ' + (m.reachable ? 'ok' : 'err')}),
        el('div', {}, [
-          el('div', {class:'id'}, m.server + ':' + m.export),
+          el('div', {class:'id'}, '//' + m.server + '/' + m.share),
          el('div', {class:'meta'},
-            (m.version === 'v3' ? 'NFSv3' : 'NFSv4.1') + ' · ' +
+            (m.guest ? 'guest' : ('user: ' + (m.username || '?'))) + ' · ' +
-            (m.read_only ? 'read-only' : 'read-write') + ' · ' +
+            (m.reachable ? m.iso_count + ' isos' : 'not reachable')),
            (m.mounted ? m.iso_count + ' isos' : 'not mounted')),
          m.last_error ? el('div', {class:'err'}, '⚠ ' + m.last_error) : null,
          m.last_hint ? el('div', {style:'margin-top:4px;opacity:.78;font-size:12px'}, m.last_hint) : null,
        ]),
        el('button', {class:'ghost', onclick: async () => {
-          const r = await postJSON('/api/nfs/' + encodeURIComponent(m.id) + '/scan', {});
+          const r = await postJSON('/api/smb-shares/' + encodeURIComponent(m.id) + '/scan', {});
          if (r.ok) render('storage');
        }}, 'Re-scan'),
        el('button', {class:'danger', onclick: async () => {
-          if (!confirm('Unmount ' + m.server + ':' + m.export + '?')) return;
+          if (!confirm('Forget //' + m.server + '/' + m.share + '?')) return;
-          await fetch('/api/nfs/' + encodeURIComponent(m.id), {method:'DELETE'});
+          await fetch('/api/smb-shares/' + encodeURIComponent(m.id), {method:'DELETE'});
          render('storage');
-        }}, 'Unmount'),
+        }}, 'Remove'),
        el('span'),
-      ])) : [el('div', {class:'empty'}, 'No NFS shares mounted.')];
+      ])) : [el('div', {class:'empty'}, 'No SMB shares configured.')];
-      // Disk-space card. Free + used + total for the volume hosting the
+      // ── NFS shares section (v0.4.67) ──
-      // ISO directory, with a coloured bar. Warns at 80% and goes red at
+      // Parallel to SMB shares above. The NFSv3 client is in-process
-      // 95% so the operator sees the runway shrinking before uploads
+      // (nfs3_client crate) so NFS-sourced ISOs support HTTP Range
-      // start failing with ENOSPC.
+      // requests — SMB-sourced ones don't (smbclient CLI can't seek
-      const total = Number(disk.total_bytes || 0);
+      // mid-stream). Otherwise the UX is identical: server + export,
-      const avail = Number(disk.available_bytes || 0);
+      // submit, scan, remove.
-      const used  = Number(disk.used_bytes  || 0);
+      const nfsMsg = el('div', {class:'msg'});
-      const pctUsed = total > 0 ? (used / total) * 100 : 0;
+      const nfsServerIn = el('input', {type:'text', placeholder:'10.0.0.5'});
-      let barClass = 'diskbar';
+      const nfsExportIn = el('input', {type:'text', placeholder:'/srv/isos'});
-      if (pctUsed >= 95)      barClass += ' full';
+      const addNfs = el('button', {style:'margin-top:14px', onclick: async () => {
-      else if (pctUsed >= 80) barClass += ' warn';
+        if (!nfsServerIn.value || !nfsExportIn.value) {
-      const diskCard = el('div', {class:'card'}, [
+          nfsMsg.replaceChildren(document.createTextNode('Server and export are required.'));
-        el('header', {}, [
+          nfsMsg.className = 'msg err'; return;
-          el('h2', {}, 'Disk space'),
+        }
-          el('span', {class:'sub'},
+        nfsMsg.replaceChildren(document.createTextNode('Connecting…'));
-            total > 0
+        nfsMsg.className = 'msg';
-              ? (pctUsed.toFixed(1) + '% used')
+        const r = await postJSON('/api/nfs-shares', {
-              : 'unavailable'),
+          server: nfsServerIn.value,
          export: nfsExportIn.value,
        });
        if (r.ok) {
          nfsMsg.replaceChildren(document.createTextNode('Connected.'));
          nfsMsg.className = 'msg ok';
          render('storage');
        } else {
          // Structured {error, stderr, hint} same as SMB.
          let bodyJson = null;
          let raw = null;
          try { bodyJson = await r.clone().json(); }
          catch (_) { raw = await r.text().catch(()=> 'connect failed'); }
          const msg = bodyJson && bodyJson.error ? bodyJson.error : (raw || 'connect failed');
          const hint = bodyJson && bodyJson.hint;
          const parts = [el('div', {}, [
            el('strong', {}, 'Connect failed: '),
            document.createTextNode(msg),
          ])];
          if (hint) {
            parts.push(el('div', {style:'margin-top:6px;opacity:.78;font-size:12px'}, hint));
          }
          nfsMsg.replaceChildren(...parts);
          nfsMsg.className = 'msg err';
        }
      }}, 'Add share');
      const nfsRows = nfsShares.length ? nfsShares.map(m => el('div', {class: 'nfs-row' + (m.reachable ? '' : ' down')}, [
        el('span', {class: 'dot ' + (m.reachable ? 'ok' : 'err')}),
        el('div', {}, [
          el('div', {class:'id'}, m.server + ':' + m.export),
          el('div', {class:'meta'},
            'NFSv3 · ' +
            (m.reachable ? m.iso_count + ' isos' : 'not reachable')),
          m.last_error ? el('div', {class:'err'}, '⚠ ' + m.last_error) : null,
          m.last_hint ? el('div', {style:'margin-top:4px;opacity:.78;font-size:12px'}, m.last_hint) : null,
        ]),
-        el('div', {class:'body'}, [
+        el('button', {class:'ghost', onclick: async () => {
-          el('div', {style:'color:var(--fg-dim);font-size:12px;word-break:break-all'},
+          const r = await postJSON('/api/nfs-shares/' + encodeURIComponent(m.id) + '/scan', {});
-            disk.path ? ('Volume: ' + disk.path) : 'Volume path unknown'),
+          if (r.ok) render('storage');
-          el('div', {class: barClass},
+        }}, 'Re-scan'),
-            el('div', {class:'fill',
+        el('button', {class:'danger', onclick: async () => {
-              style:'width:' + Math.min(100, pctUsed).toFixed(1) + '%'})),
+          if (!confirm('Forget ' + m.server + ':' + m.export + '?')) return;
-          el('div', {class:'disk-meta'}, [
+          await fetch('/api/nfs-shares/' + encodeURIComponent(m.id), {method:'DELETE'});
-            el('span', {}, ['Used ',  el('strong', {}, fmtBytes(used))]),
+          render('storage');
-            el('span', {}, ['Free ',  el('strong', {}, fmtBytes(avail))]),
+        }}, 'Remove'),
-            el('span', {}, ['Total ', el('strong', {}, fmtBytes(total))]),
+        el('span'),
-          ]),
+      ])) : [el('div', {class:'empty'}, 'No NFS shares configured.')];
-          pctUsed >= 95
+
-            ? el('p', {class:'msg err', style:'margin-top:10px'},
+      const diskCard = diskSpaceCard(disk);
                '⚠ Less than 5% free. Remove old ISOs or grow the volume before uploading more.')
            : (pctUsed >= 80
                ? el('p', {class:'msg', style:'color:var(--warn);margin-top:10px'},
                    'Volume is getting full. Consider pruning old ISOs.')
                : null),
        ]),
      ]);
      return el('div', {class:'grid'}, [
        diskCard,
@@ -709,34 +851,75 @@
        ]),
        el('div', {class:'card'}, [
          el('header', {}, [
-            el('h2', {}, 'NFS shares'),
+            el('h2', {}, 'SMB shares'),
-            el('span', {class:'sub'}, mounts.length + ' configured'),
+            el('span', {class:'sub'}, shares.length + ' configured'),
          ]),
          el('div', {class:'body'}, [
-            el('div', {class:'form-row'}, [
+            el('div', {class:'form-row cols-2'}, [
              el('label', {class:'field'}, [
                el('span', {class:'name'}, 'SMB server'),
                smbServer,
              ]),
              el('label', {class:'field'}, [
                el('span', {class:'name'}, 'Share name'),
                smbShare,
              ]),
            ]),
            el('div', {class:'form-row cols-3', style:'margin-top:14px'}, [
              el('label', {class:'check'}, [
                smbGuest, el('span', {}, 'Guest (anonymous read)'),
              ]),
              el('label', {class:'field'}, [
                el('span', {class:'name'}, 'Username'),
                smbUser,
              ]),
              el('label', {class:'field'}, [
                el('span', {class:'name'}, 'Password'),
                smbPass,
              ]),
            ]),
            addSmb, smbMsg,
            el('div', {style:'margin-top:18px;display:grid;gap:8px'}, smbRows),
            el('p', {class:'msg', style:'margin-top:14px'},
              'SMB shares are read in userspace via Samba’s smbclient — ' +
              'no kernel modules, no CAP_SYS_ADMIN, works in any container ' +
              '(Unraid, OpenShift restricted SCC, plain Docker, etc.). Most NAS ' +
              'appliances expose ISO libraries as guest-readable; check the box ' +
              'above when that’s the case. ISOs are streamed on demand at PXE ' +
              'boot time — no local cache, no double disk usage.'),
          ]),
        ]),
        // v0.4.67: NFS shares card sits right below SMB so operators
        // can see both protocols at a glance. The form is simpler
        // (no auth) because NFSv3 access control is by client IP on
        // the server side, not by client-supplied credentials.
        el('div', {class:'card'}, [
          el('header', {}, [
            el('h2', {}, 'NFS shares'),
            el('span', {class:'sub'}, nfsShares.length + ' configured'),
          ]),
          el('div', {class:'body'}, [
            el('div', {class:'form-row cols-2'}, [
              el('label', {class:'field'}, [
                el('span', {class:'name'}, 'NFS server'),
-                nfsServer,
+                nfsServerIn,
              ]),
              el('label', {class:'field'}, [
                el('span', {class:'name'}, 'Export path'),
-                nfsExport,
+                nfsExportIn,
              ]),
              el('label', {class:'field'}, [
                el('span', {class:'name'}, 'Version'),
                nfsVer,
              ]),
              el('label', {class:'check', style:'margin-top:18px'}, [
                nfsRo, el('span', {}, 'Read-only'),
              ]),
            ]),
            addNfs, nfsMsg,
            el('div', {style:'margin-top:18px;display:grid;gap:8px'}, nfsRows),
            el('p', {class:'msg', style:'margin-top:14px'},
-              'Mounting NFS inside a container requires CAP_SYS_ADMIN and the ' +
+              'NFSv3 shares are read in-process via a pure-Rust client — ' +
-              'mount.nfs binary (bundled in the default Docker image). On ' +
+              'no kernel modules, no mount.nfs, no CAP_SYS_ADMIN. Works in ' +
-              'OpenShift, your SCC must allow CAP_SYS_ADMIN or you can run ' +
+              'every container the SMB path works in (Unraid included). ' +
-              'NFS mounts as a CSI driver outside the pod.'),
+              'NFSv3 auth is AUTH_SYS only; gate access on the server side ' +
              'by allowing this OpenPXE host’s IP in the export list. ' +
              'ISOs are streamed on demand and HTTP Range requests work — ' +
              'NFSv3 READ3 takes an explicit offset, so clients can seek ' +
              'into a 5 GB ISO without reading what comes before.'),
          ]),
        ]),
        el('div', {class:'card'}, [
@@ -1025,7 +1208,11 @@
      const newPwConfirm = el('input', {type:'password', autocomplete:'new-password',
        placeholder: 'confirm new password'});
      const accountMsg = el('div', {class:'msg', style:'margin-top:8px'});
-      const accountSave = el('button', {onclick: async () => {
+      // v0.4.63: explicit top margin so the action button sits clearly
      // beneath the input row instead of butting against the password
      // fields. Mirrors the `Save SSO settings` button below for visual
      // parity between the two settings cards.
      const accountSave = el('button', {style:'margin-top:6px', onclick: async () => {
        accountMsg.textContent = ''; accountMsg.className = 'msg';
        if (!currentPw.value) {
          accountMsg.textContent = 'Current password is required.';
@@ -1103,47 +1290,71 @@
      ssoEnabled.checked = !!sso.enabled;
      const ssoName = el('input', {type:'text', placeholder:'e.g. Okta, Azure AD',
        value: sso.idp_name || ''});
      // v0.4.6: optional FleetDM-style IdP logo URL. The login screen
      // will render this as the brand mark on the "Sign in with X"
      // button once the runtime SSO flow ships; for v0.4.6 we just
      // persist it.
      const ssoLogo = el('input', {type:'text',
        placeholder:'https://idp.example.com/logo.svg',
        value: sso.idp_logo_url || ''});
      const ssoUrl = el('input', {type:'text', placeholder:'https://idp.example.com/metadata',
        value: sso.metadata_url || ''});
-      const ssoXml = el('textarea', {rows:'6',
+      // The textarea inherits the same chrome via the global
-        placeholder:'<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"…',
+      // `label.field textarea` rule, plus the monospace family for
-        style:'width:100%;font-family:var(--mono);font-size:12px;background:var(--bg);' +
+      // pasting raw XML. Children come after the attrs object — the
-              'color:var(--fg);border:1px solid var(--border);border-radius:var(--radius);' +
+      // initial value is the only "child".
-              'padding:8px 10px;resize:vertical'},
+      const ssoXml = el('textarea',
        {rows:'6',
         spellcheck:'false', autocapitalize:'off',
         placeholder:'<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"…',
         style:'font-family:var(--mono);font-size:12px;resize:vertical'},
        sso.metadata || '');
-      const ssoMode = el('select', {style:'min-width:160px;background:var(--bg);color:var(--fg);' +
+      // The mode picker is a styled <select> so it aligns with text
-        'border:1px solid var(--border);border-radius:var(--radius);padding:6px 8px;font:inherit'}, [
+      // inputs in the same `.form-row` — the global `label.field
      // select` rule takes care of the chrome.
      const ssoMode = el('select', {}, [
        el('option', {value:'url'}, 'Metadata URL'),
        el('option', {value:'xml'}, 'Metadata XML'),
      ]);
      ssoMode.value = sso.metadata && !sso.metadata_url ? 'xml' : 'url';
      // v0.4.63: the IdP metadata URL now sits inside the 4-col header
      // grid as column 4, so the SSO row is column-for-column aligned with
      // the Administrator account row above. When the operator switches
      // to XML mode, column 4 collapses (display:none) and the multi-line
      // XML textarea takes its own full-width row below — there's no way
      // to fit a 6-row textarea into a single grid cell without making
      // the rest of the row look stretched.
      const urlWrap = el('label', {class:'field'}, [
        el('span', {class:'name'}, 'IdP metadata URL'),
        ssoUrl,
        el('span', {class:'hint'},
          'OpenPXE will fetch this URL once SSO sign-in lands; v0.4.5 just stores it.'),
      ]);
-      const xmlWrap = el('label', {class:'field'}, [
+      const xmlWrap = el('label', {class:'field', style:'margin-top:14px'}, [
        el('span', {class:'name'}, 'IdP metadata XML'),
        ssoXml,
        el('span', {class:'hint'},
          'Paste the raw <EntityDescriptor>…</EntityDescriptor> document from your IdP.'),
      ]);
      // Hint that used to live under the URL field; surfaced once below
      // the whole row so it doesn't compete with the in-grid layout.
      const urlHint = el('p', {class:'msg', style:'margin-top:10px;margin-bottom:0'},
        'OpenPXE will fetch the metadata URL once SSO sign-in lands; v0.4.63 stores it.');
      const refreshSsoFields = () => {
        if (ssoMode.value === 'url') {
          urlWrap.style.display = ''; xmlWrap.style.display = 'none';
          urlHint.style.display = '';
        } else {
          urlWrap.style.display = 'none'; xmlWrap.style.display = '';
          urlHint.style.display = 'none';
        }
      };
      ssoMode.onchange = refreshSsoFields;
      refreshSsoFields();
      const ssoMsg = el('div', {class:'msg', style:'margin-top:8px'});
-      const ssoSave = el('button', {onclick: async () => {
+      const ssoSave = el('button', {style:'margin-top:16px', onclick: async () => {
        ssoMsg.textContent = ''; ssoMsg.className = 'msg';
        const payload = {
          enabled: ssoEnabled.checked,
          idp_name: ssoName.value,
          idp_logo_url: ssoLogo.value,
          metadata:     ssoMode.value === 'xml' ? ssoXml.value : '',
          metadata_url: ssoMode.value === 'url' ? ssoUrl.value : '',
        };
@@ -1179,22 +1390,35 @@
            ssoEnabled,
            el('span', {}, 'Enable single sign-on'),
          ]),
          // v0.4.63: 4-column form-row that matches the Administrator
          // account card above column-for-column — display name / logo
          // URL / metadata source / metadata URL. All four controls share
          // the same `label.field` chrome so they line up cleanly. When
          // the operator picks "Metadata XML" the URL column collapses
          // and the multi-line textarea drops below the row.
          el('div', {class:'form-row'}, [
            el('label', {class:'field'}, [
              el('span', {class:'name'}, 'IdP display name'),
              ssoName,
-              el('span', {class:'hint'}, '"Sign in with X" label on the login screen.'),
+            ]),
            el('label', {class:'field'}, [
              el('span', {class:'name'}, 'IdP logo URL'),
              ssoLogo,
            ]),
            el('label', {class:'field'}, [
              el('span', {class:'name'}, 'Metadata source'),
              ssoMode,
            ]),
            urlWrap,
          ]),
          urlWrap,
          xmlWrap,
          urlHint,
          ssoSave, ssoMsg,
        ]),
      ]);
      // Wire up + paint the initial visibility now that all elements
      // referenced by `refreshSsoFields` are attached.
      refreshSsoFields();
      // ── Custom logo upload.
      // Single-file drop-zone; PNG/SVG/JPEG/WebP/GIF up to 2 MB.
@@ -1610,25 +1834,67 @@
  }
  async function startDashboard() {
-    // Light up the sidebar's "signed in as X / Sign out" row. It was
+    // v0.4.6: light up the top-right user-menu chip. The button is
-    // hidden in index.html because we don't know the identity until
+    // hidden in index.html until /api/me confirms a signed-in session,
-    // /api/me resolves.
+    // so we don't show the icon (then hide it) when the user lands
    // on /login. Clicking the icon opens a small popover with
    // Name / Edit account / Sign out.
    try {
      const me = await fetch('/api/me').then(r => r.ok ? r.json() : null);
-      const row = $('[data-bind=logout_row]');
+      const wrap = $('[data-bind=user_menu_wrap]');
-      const who = $('[data-bind=signed_in_as]');
+      const pop  = $('[data-bind=user_menu_pop]');
-      const btn = $('[data-bind=logout_btn]');
+      const name = $('[data-bind=user_pop_name]');
-      if (row && me && me.authenticated && me.user) {
+      const edit = $('[data-bind=user_pop_edit]');
-        who.textContent = me.user.username;
+      const out  = $('[data-bind=user_pop_logout]');
-        who.title = 'Signed in as ' + me.user.username;
+      const btn  = $('#user-menu-btn');
-        row.style.display = '';
+      if (wrap && me && me.authenticated && me.user) {
        wrap.style.display = '';
        if (name) name.textContent = me.user.username;
        if (btn) btn.title = 'Signed in as ' + me.user.username;
        if (btn && !btn._wired) {
          btn._wired = true;
-          btn.addEventListener('click', async () => {
+          btn.addEventListener('click', (e) => {
            e.stopPropagation();
            const open = !pop.hidden;
            pop.hidden = open;
            btn.setAttribute('aria-expanded', String(!open));
          });
        }
        if (edit && !edit._wired) {
          edit._wired = true;
          edit.addEventListener('click', () => {
            pop.hidden = true;
            btn.setAttribute('aria-expanded', 'false');
            render('settings');
          });
        }
        if (out && !out._wired) {
          out._wired = true;
          out.addEventListener('click', async () => {
            pop.hidden = true;
            btn.setAttribute('aria-expanded', 'false');
            await fetch('/api/logout', {method:'POST'}).catch(() => {});
            wrap.style.display = 'none';
            showAuthScreen('login');
          });
        }
        // Click-outside-to-close, wired once. Stored on document so we
        // don't re-attach every render.
        if (!document._userPopWired) {
          document._userPopWired = true;
          document.addEventListener('click', (e) => {
            if (pop.hidden) return;
            if (e.target.closest('.user-menu')) return;
            pop.hidden = true;
            btn.setAttribute('aria-expanded', 'false');
          });
          document.addEventListener('keydown', (e) => {
            if (e.key === 'Escape' && !pop.hidden) {
              pop.hidden = true;
              btn.setAttribute('aria-expanded', 'false');
            }
          });
        }
      }
    } catch (e) { /* surfaces elsewhere */ }
    render('dashboard');
@@ -5,8 +5,15 @@
  <meta name="viewport" content="width=device-width, initial-scale=1" />
  <meta name="color-scheme" content="dark light" />
  <title>OpenPXE</title>
-  <link rel="stylesheet" href="/assets/app.css" />
+  <!-- v0.4.61: the `?v=…` query string is replaced by the server at
-  <link rel="icon" type="image/svg+xml" href="/assets/logo.svg" />
+       request time with the running OpenPXE version. That guarantees a
       fresh URL on every upgrade so browsers (and intermediary proxies)
       can't keep serving stale JS / CSS / branding from before the
       deploy. Combined with `Cache-Control: no-cache, must-revalidate`
       on the asset handlers, the practical caching window is one
       version. -->
  <link rel="stylesheet" href="/assets/app.css?v={{ASSET_VERSION}}" />
  <link rel="icon" type="image/svg+xml" href="/assets/logo.svg?v={{ASSET_VERSION}}&r={{LOGO_REV}}" />
  <!-- Theme is read from localStorage *before* paint to avoid the
       dark→light flash on every navigation. Falls back to the OS
       preference and finally to dark. -->
@@ -25,8 +32,8 @@
 <body>
 <div class="shell">
  <aside class="sidebar">
-    <div class="brand">
+    <div class="{{BRAND_CLASS}}">
-      <img src="/assets/logo.svg" alt="OpenPXE" />
+      <img src="/assets/logo.svg?v={{ASSET_VERSION}}&r={{LOGO_REV}}" alt="OpenPXE" />
      <strong>OpenPXE</strong>
    </div>
    <nav>
@@ -59,15 +66,7 @@
      <!-- The brand badge at the top can be overridden by operator-uploaded
           logos; keep "OpenPXE v…" pinned in the footer so the backend
           identity is always visible regardless of branding. -->
-      <div class="footer-version">OpenPXE&nbsp;v<span data-bind="version">0.4.5</span></div>
+      <div class="footer-version">OpenPXE&nbsp;v<span data-bind="version">0.4.63</span></div>
      <!-- v0.4.5: signed-in identity + one-click sign-out. The button
           is populated by app.js after /api/me reports an authenticated
           session — pre-auth states swap the whole shell for the
           login/setup card so this row never gets shown there. -->
      <div class="logout-row" data-bind="logout_row" style="display:none">
        <span class="who" data-bind="signed_in_as" title=""></span>
        <button type="button" class="logout-btn" data-bind="logout_btn">Sign out</button>
      </div>
    </div>
  </aside>
@@ -97,11 +96,32 @@
        <path d="M20.5 14A8 8 0 0 1 10 3.5 a8 8 0 1 0 10.5 10.5z"/>
      </svg>
    </button>
    <!-- v0.4.6: signed-in operator menu. Sits next to the theme toggle
         in the top-right corner so the sidebar footer stays clean for
         the "Service status / Advertised URL / Backend version" trio.
         The whole block is hidden until /api/me confirms a session. -->
    <div class="user-menu" data-bind="user_menu_wrap" style="display:none">
      <button id="user-menu-btn" class="user-btn" type="button"
              aria-label="Account menu" aria-haspopup="true" aria-expanded="false"
              title="Account">
        <svg viewBox="0 0 24 24" width="18" height="18" fill="none"
             stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
          <circle cx="12" cy="8" r="3.6"/>
          <path d="M4.5 20a7.5 7.5 0 0 1 15 0"/>
        </svg>
      </button>
      <div id="user-menu-pop" class="user-pop" data-bind="user_menu_pop" hidden>
        <div class="user-pop-name" data-bind="user_pop_name">—</div>
        <button type="button" class="user-pop-item" data-bind="user_pop_edit">Edit account</button>
        <button type="button" class="user-pop-item user-pop-danger" data-bind="user_pop_logout">Sign out</button>
      </div>
    </div>
  </header>
  <main class="main" id="view-root"></main>
 </div>
-<script src="/assets/app.js"></script>
+<script src="/assets/app.js?v={{ASSET_VERSION}}"></script>
 </body>
 </html>
@@ -7,11 +7,44 @@
 //! nav, top bar with secondary tabs, card-dense content panels.
 #![forbid(unsafe_code)]
-/// Render the top-level page. `base_url` is interpolated into the footer
+/// Render the top-level page.
-/// so operators can see at a glance what URL clients are PXE-booting from.
+///
 /// * `base_url` is interpolated into the footer so operators can see at
 ///   a glance what URL clients are PXE-booting from.
 /// * `asset_version` is appended as `?v=…` to every asset URL so each
 ///   release ships with brand-new asset URLs — browsers (and any
 ///   intermediary proxy) can't keep serving last release's `app.js`
 ///   when we know the new one is incompatible. Combined with
 ///   `Cache-Control: no-cache, must-revalidate` on the asset handlers,
 ///   the worst-case caching window is one version.
 /// * `logo_rev` is appended to the brand-mark and favicon URLs as an
 ///   extra `&r=…` token. Unlike `asset_version` it changes every time
 ///   the operator swaps the custom logo, so the top-left mark updates
 ///   immediately on the next page load instead of being pinned to the
 ///   release version (which only changes on upgrade). `index.html`
 ///   itself is served `no-cache`, so the fresh token lands as soon as
 ///   the operator reloads after an upload.
 /// * `has_custom_logo` switches the sidebar brand block between the
 ///   bundled mark + "OpenPXE" wordmark (false) and a FleetDM-style
 ///   full-width custom logo with the wordmark hidden (true). Rendered
 ///   server-side so there's no flash of the default mark before JS runs.
 #[must_use]
-pub fn index_html(base_url: &str) -> String {
+pub fn index_html(
-    INDEX_HTML.replace("{{BASE_URL}}", base_url)
+    base_url: &str,
    asset_version: &str,
    logo_rev: u64,
    has_custom_logo: bool,
 ) -> String {
    let brand_class = if has_custom_logo {
        "brand has-custom-logo"
    } else {
        "brand"
    };
    INDEX_HTML
        .replace("{{BASE_URL}}", base_url)
        .replace("{{ASSET_VERSION}}", asset_version)
        .replace("{{LOGO_REV}}", &logo_rev.to_string())
        .replace("{{BRAND_CLASS}}", brand_class)
 }
 #[must_use]
@@ -16,7 +16,12 @@
 ARG RUST_VERSION=1.95
-########## fetch iPXE binaries ##########
+########## fetch iPXE binaries + wimboot ##########
 # Pulls the upstream boot.ipxe.org pre-builds (no PNG support) plus
 # wimboot. These cover the arches we don't build from source here:
 # BIOS undionly.kpxe and i386-efi (which need a 32-bit x86 toolchain),
 # and serve as the baseline that the PNG-enabled x86_64/arm64 UEFI
 # binaries from the `ipxe-build` stage overlay on top of.
 FROM debian:12-slim AS fetch
 RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates \
 && rm -rf /var/lib/apt/lists/*
@@ -24,6 +29,36 @@ WORKDIR /src
 COPY scripts/fetch-ipxe.sh scripts/fetch-ipxe.sh
 RUN mkdir -p assets/ipxe && bash scripts/fetch-ipxe.sh
 ########## build PNG-enabled iPXE from source ##########
 # v0.4.69: THE graphical-boot-menu unlock. iVentoy paints a PNG
 # background on the PXE screen using stock iPXE built with
 # CONSOLE_FRAMEBUFFER + IMAGE_PNG + CONSOLE_CMD; the public iPXE
 # binaries omit those, so `console --picture` is a no-op on them.
 # We build our own from upstream with that thin config delta.
 #
 # The historical blocker was cc1 segfaulting when an amd64 gcc ran
 # under QEMU emulation on an arm64 host. The fix: pin this stage to
 # $BUILDPLATFORM (the NATIVE builder arch — arm64 on an Apple-Silicon
 # Mac, amd64 in x86 CI) and cross-compile with a real cross toolchain
 # (CROSS_COMPILE=x86_64-linux-gnu-). The compiler runs native and
 # emits x86_64 — no emulation, no segfault. arm64-efi builds natively.
 FROM --platform=$BUILDPLATFORM debian:12-slim AS ipxe-build
 # libc6-dev is REQUIRED and easy to miss under --no-install-recommends:
 # iPXE's host utilities (elf2efi, zbin) compile with the native gcc and
 # pull <stdint.h>; without the native libc headers gcc's #include_next
 # falls through to iPXE's freestanding headers and dies on bits/stdint.h.
 # The target (iPXE firmware) code is -ffreestanding/-nostdinc, so the
 # x86_64 cross toolchain needs NO cross libc headers.
 RUN apt-get update && apt-get install -y --no-install-recommends \
        git make perl gcc binutils libc6-dev \
        gcc-x86-64-linux-gnu binutils-x86-64-linux-gnu \
        ca-certificates \
 && rm -rf /var/lib/apt/lists/*
 WORKDIR /src
 COPY scripts/build-ipxe.sh scripts/build-ipxe.sh
 COPY deploy/ipxe/local/ deploy/ipxe/local/
 RUN mkdir -p assets/ipxe && bash scripts/build-ipxe.sh /src/assets/ipxe
 ########## build openpxe ##########
 FROM rust:${RUST_VERSION}-bookworm AS build
 WORKDIR /src
@@ -56,7 +91,14 @@ RUN apt-get update \
 # `cargo build`, which is slow and can exhaust small Colima/CI disks.
 COPY Cargo.toml Cargo.lock ./
 COPY crates/ crates/
 # Baseline binaries (BIOS / i386 / wimboot), then overlay the
 # PNG-enabled x86_64 + arm64 UEFI binaries built from source. The
 # overlay wins for snponly.efi / ipxe.efi / snponly-arm64.efi so the
 # common modern clients get the graphical background; the rest keep the
 # upstream no-PNG binaries and the menu's `|| console` text fallback.
 COPY --from=fetch /src/assets/ipxe /src/assets/ipxe
 COPY --from=ipxe-build /src/assets/ipxe/snponly.efi /src/assets/ipxe/snponly.efi
 COPY --from=ipxe-build /src/assets/ipxe/ipxe.efi /src/assets/ipxe/ipxe.efi
 # Cache cargo registry + target across builds. The mtime touch is
 # belt-and-suspenders: cargo occasionally misses mtime-only changes on
@@ -73,23 +115,30 @@ FROM debian:12-slim AS runtime
 RUN apt-get update \
 && apt-get install -y --no-install-recommends \
        ca-certificates libcap2-bin tini gosu iproute2 \
-        wimtools samba nfs-common \
+        wimtools samba smbclient \
 && rm -rf /var/lib/apt/lists/* \
 && useradd --system --uid 10001 --home-dir /var/lib/openpxe --shell /usr/sbin/nologin openpxe \
 && mkdir -p /var/lib/openpxe/isos /var/lib/openpxe/work /var/lib/openpxe/smb \
 && chown -R openpxe:openpxe /var/lib/openpxe
 # v0.4.5: the openpxe binary itself is now built against musl and is
 # fully static — no glibc dependency. The runtime stage still ships
-# Debian slim because OpenPXE shells out to the four packages below for
+# Debian slim because OpenPXE shells out to the packages below for
 # functionality we deliberately don't reimplement in-process:
 #
 #   wimtools   - `wimlib-imagex`, used to inject startnet.cmd into boot.wim.
 #   samba      - `smbd` serves extracted Windows install media on :445 so
 #                WinPE can `net use`. Guest read-only, scoped to
-#                /var/lib/openpxe/smb.
+#                /var/lib/openpxe/smb. This package provides the SERVER
-#   nfs-common - `mount.nfs` / `mount.nfs4` for the Storage tab's NFS
+#                side only; the client CLI is a separate package below.
-#                share manager. Mount requires CAP_SYS_ADMIN; without it
+#   smbclient  - v0.4.66: Samba's `smbclient` userspace CLI, used by
-#                mount(2) returns EPERM and the manager surfaces a clear
+#                the Storage tab's SMB shares manager to list and stream
-#                error in the UI.
+#                ISOs from remote SMB servers without ever mounting them
 #                in the kernel. In Debian 12 `smbclient` is NOT pulled
 #                in by the `samba` package — they're siblings, not
 #                parent/child. v0.4.65 shipped without this line and
 #                every "Add share" attempt surfaced
 #                `could not exec smbclient: No such file or directory`
 #                until this landed.
 #   iproute2   - `ip addr` / `ip route` for the auto-detected Network
 #                tab fields (NIC name, subnet mask, default gateway).
 #                Tiny, always available; we don't pull in netlink crates
@@ -97,8 +146,13 @@ RUN apt-get update \
 #   gosu       - drops privileges cleanly from root after the entrypoint
 #                fixes bind-mount ownership (common OpenShift/Docker UX
 #                issue).
 #
 # v0.4.65 dropped `nfs-common` — kernel-mount NFS is gone. The SMB
 # shares replacement uses userspace `smbclient` and needs no kernel
 # helpers.
 #
 # A future "openpxe-static" variant could drop everything except the
-# binary onto distroless once we move the Windows + NFS legs to
+# binary onto distroless once we move the Windows + SMB legs to
 # in-process Rust crates.
 COPY --from=build /openpxe /usr/local/bin/openpxe
@@ -0,0 +1,14 @@
 /*
 * OpenPXE iPXE build override — console options.
 *
 * Included at the end of config/console.h. CONSOLE_FRAMEBUFFER is the
 * unified graphical framebuffer console (EFI GOP on UEFI, VESA on
 * BIOS); it's what `console --picture` paints into. This is the same
 * single flag iVentoy enables for its graphical PXE screen.
 *
 * We *add* the framebuffer console rather than replacing the default
 * EFI/BIOS text consoles, so text output still works before/after the
 * picture is set.
 */
 #define CONSOLE_FRAMEBUFFER
@@ -0,0 +1,23 @@
 /*
 * OpenPXE iPXE build override — general options.
 *
 * iPXE includes <config/local/general.h> at the end of config/general.h,
 * so anything defined here is layered on top of the stock defaults
 * without editing upstream files. We enable exactly the features the
 * graphical PXE boot menu needs:
 *
 *   IMAGE_PNG    - PNG decoder, so `console --picture <png>` can paint
 *                  the operator's logo / OpenPXE background.
 *   IMAGE_PNM    - Netpbm decoder (cheap; harmless belt-and-suspenders).
 *   CONSOLE_CMD  - the `console` command itself. Without it you get
 *                  "console: command not found" even with a framebuffer.
 *
 * (CONSOLE_FRAMEBUFFER lives in config/local/console.h.)
 *
 * Everything else stays at upstream defaults — we are intentionally a
 * thin, auditable delta over stock iPXE so the UBDL/GPL story is simple.
 */
 #define IMAGE_PNG
 #define IMAGE_PNM
 #define CONSOLE_CMD
@@ -0,0 +1,106 @@
 # PXE menu theme — research for next-release follow-up
 Status: queued. v0.4.63 keeps the ASCII-banner fallback + `console --picture`
 compositor wired; this note captures the design for the menu-theming work
 that lands once iPXE rebuilt with `IMAGE_PNG` is published.
 ## How iVentoy actually does it
 iVentoy is closed-source for its menu, but the supporting bits are
 public at https://github.com/ventoy/PXE — a vanilla iPXE snapshot
 (`iPXE/ipxe-bd13697`) used to produce the loader binaries iVentoy
 serves over TFTP (`pxeboot.efi`, `iventoy_loader_16000`,
 `iventoy_loader_16000_uefi`).
 The graphical menu itself is rendered by iPXE's framebuffer console
 with a baked-in PNG background via `console --picture` — same
 primitive OpenPXE already uses in `crates/http-api/src/ipxe_script.rs`.
 Evidence:
 - The iPXE build in `ventoy/PXE` is configured with `CONSOLE_FRAMEBUFFER`
  + `IMAGE_PNG` + `CONSOLE_CMD` (the three flags `console --picture`
  needs).
 - iVentoy issue #11 confirms "iventoy using default 1024x768"; users
  report 800x600 / 1024x768 / 1280x720 / 1280x1024 / 1920x1080 as
  selectable resolutions from the iVentoy web UI **Configuration tab**,
  not via EDID auto-detect. iPXE has no EDID parsing; the daemon writes
  a resolution-tagged script per boot and serves the matching PNG.
 - iVentoy docs explicitly state both Free and Pro editions **do not
  support** modifying the boot background/title — it's baked into the
  shipped PNG assets.
 - Chrome is iPXE's native `menu` / `item` / `choose` widgets (single
  highlight bar, no borders) painted on top of the PNG, with margins
  set via `console --left/--right/--top/--bottom` to keep the text off
  the logo. Not GRUB, not syslinux — UEFI iVentoy uses iPXE's
  `snponly.efi` / `pxeboot.efi`, and `--picture` does work under UEFI
  GOP despite older folklore.
 Do not conflate this with Ventoy-USB, which is a separate codebase and
 uses GRUB2 themes (`theme.txt`, `background_ventoy.png`, `select_c.png`).
 ## Rust ingredients to replicate / surpass
 Most of these already exist in the workspace.
 1. **Compositor (extend, don't replace)** — extend
   `crates/iso-store/src/pxe_logo.rs` to emit per-resolution PNGs
   (1024x768, 1280x1024, 1920x1080 as the v1 set). `image` +
   `imageproc` crates handle scaling; `ab_glyph` / `fontdue` for raster
   text (subtitle, hostname, version). One source SVG/logo, three to
   five rendered PNGs cached on disk.
 2. **Script generator** — `ipxe_script.rs` already emits
   `console --picture … || console`. Add a `?res=` query param (or
   per-MAC client hint persisted in `hosts.json`) and serve the matching
   PNG plus matching `console --x --y` line. Keep the text-console
   fallback already in place.
 3. **Resolution selection** — iPXE exposes `${vesa-x}` / `${vesa-y}` on
   BIOS; UEFI side we can probe firmware vars at chain-time. The simpler
   v1 is a "low-res / hi-res" toggle in Settings plus a per-host
   override — mirrors iVentoy's UX, no kernel helper needed. True EDID
   parsing is overkill for the first cut.
 4. **Chrome upgrades over iVentoy** — iPXE menus are limited (single
   highlight, no borders). To look distinctly cooler without leaving
   iPXE: paint border / title / footer **into the PNG**, leave a window
   in the middle, then `console --left/--right/--top/--bottom` to inset
   the iPXE menu exactly into that window. ASCII box-drawing inside the
   menu remains fragile (iPXE mangles non-ASCII on some builds — already
   noted in `ipxe_script.rs`).
 ## Recommended architecture for the next OpenPXE release
 - Build a `pxe_theme` module beside `pxe_logo.rs`: takes operator logo
  + theme tokens (accent colour, title, footer) and renders a layered
  PNG (background gradient → framing chrome → logo → title bar → footer
  with `${hostname}` / `${version}` / `${ip}`) at the three target
  resolutions. Cache by hash of inputs.
 - Serve at `/branding/pxe-menu-{w}x{h}.png`. Default 1024x768; expose a
  Settings dropdown.
 - In `ipxe_script.rs`, emit
  `console --picture …/pxe-menu-1024x768.png --left 80 --right 80 --top 180 --bottom 60 || console`,
  then the existing `menu` / `item` / `choose` block — text now lands
  inside the framed window.
 - Compile iPXE with `CONSOLE_FRAMEBUFFER`, `IMAGE_PNG`, `CONSOLE_CMD`,
  `CONSOLE_VESAFB` (BIOS) and `CONSOLE_EFIFB` (UEFI). The v0.4.61 image
  attempted this in-Docker via QEMU emulation and hit `cc1` segfaults.
  The follow-up will use a Gitea Actions runner pinned to native
  `linux/amd64` (an Unraid host already exists for this).
 - Stretch goal: a second "theme pack" that ships a layered PNG with
  subtle scanlines / grid — iPXE can't animate, but a well-designed
  static composite beats iVentoy's plain centered logo handily.
 ## Source URLs
 - https://github.com/ventoy/PXE
 - https://github.com/ventoy/PXE/tree/master/iPXE
 - https://github.com/ventoy/PXE/issues/11 — 1024x768 default
 - https://github.com/ventoy/PXE/issues/59 — iVentoy iPXE EFI loader
 - https://ipxe.org/cmd/console — `--picture` and compile flags
 - https://github.com/ipxe/ipxe/discussions/945 — background image how-to
 - https://github.com/ipxe/ipxe/discussions/802 — `CONSOLE_FRAMEBUFFER`
  requirement
 - https://github.com/ipxe/ipxe/discussions/1006 — picture resolution
  behaviour
 - https://www.iventoy.com/en/doc_edition.html — background / title not
  user-customisable
 - https://kingtam.win/archives/iventoy.html — third-party iPXE-based
  iVentoy alternative
@@ -0,0 +1,74 @@
 #!/usr/bin/env bash
 # Build PNG-enabled iPXE binaries from source.
 #
 # Why from source: the official boot.ipxe.org binaries (and the
 # Debian-packaged ones) are NOT built with CONSOLE_FRAMEBUFFER +
 # IMAGE_PNG + CONSOLE_CMD, so `console --picture` is a no-op on them —
 # you can't paint a graphical boot-menu background. iVentoy solves this
 # by shipping its own iPXE build with exactly those three flags; we do
 # the same, from upstream iPXE, with a thin auditable config delta
 # (deploy/ipxe/local/{general,console}.h).
 #
 # Why a real cross-compiler instead of QEMU: building amd64 iPXE by
 # emulating an amd64 gcc under QEMU on an arm64 host intermittently
 # segfaults cc1 (the reason this was stuck for ~8 releases). Running a
 # NATIVE arm64 gcc that cross-targets x86_64 (CROSS_COMPILE=
 # x86_64-linux-gnu-) sidesteps emulation entirely — the compiler is a
 # native binary, it just emits x86_64 objects. This stage is meant to
 # run on $BUILDPLATFORM (the native builder arch), NOT the emulated
 # target platform.
 #
 # Outputs (into $DEST), using the filenames OpenPXE's arch mapping
 # expects:
 #   snponly.efi   x86_64 UEFI, PNG-enabled
 #   ipxe.efi      x86_64 UEFI, PNG-enabled (bundled drivers)
 #
 # We build ONLY x86_64 UEFI, always via the x86_64 cross toolchain
 # (`x86_64-linux-gnu-gcc`). That's deliberately host-arch-agnostic: it
 # works whether this stage runs on an arm64 Mac builder or an amd64 CI
 # runner, because the cross compiler runs native and emits x86_64
 # either way. Building arm64-efi or BIOS here would re-introduce a
 # dependency on the host arch (native arm64 build) or a 32-bit multilib
 # toolchain — so those arches keep their upstream-fetched (no-PNG)
 # binaries and fall back to the menu's clean `|| console` text screen.
 # Modern PXE clients are overwhelmingly x86_64 UEFI, which get the full
 # graphical background.
 set -euo pipefail
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 DEST="${1:-$ROOT/assets/ipxe}"
 WORK="$(mktemp -d)"
 trap 'rm -rf "$WORK"' EXIT
 # Pinned upstream iPXE. Rolling master is fine functionally, but a pin
 # keeps builds reproducible and protects against a transient master
 # breakage. Bump deliberately.
 IPXE_REPO="https://github.com/ipxe/ipxe.git"
 IPXE_REF="${IPXE_REF:-master}"
 echo ">> cloning iPXE ($IPXE_REF)"
 git clone --depth 1 --branch "$IPXE_REF" "$IPXE_REPO" "$WORK/ipxe" 2>/dev/null \
  || git clone "$IPXE_REPO" "$WORK/ipxe"
 SRC="$WORK/ipxe/src"
 echo ">> applying OpenPXE config overrides (PNG + framebuffer + console cmd)"
 mkdir -p "$SRC/config/local"
 cp "$ROOT/deploy/ipxe/local/general.h" "$SRC/config/local/general.h"
 cp "$ROOT/deploy/ipxe/local/console.h" "$SRC/config/local/console.h"
 mkdir -p "$DEST"
 # x86_64 UEFI — cross-compiled with the native arm64 gcc targeting
 # x86_64. HOST_CC stays the native cc for iPXE's build-time utilities
 # (elf2efi, zbin, …); only the target objects use the cross compiler.
 echo ">> building x86_64 UEFI (snponly.efi, ipxe.efi)"
 make -C "$SRC" -j"$(nproc)" \
  CROSS_COMPILE=x86_64-linux-gnu- \
  bin-x86_64-efi/snponly.efi \
  bin-x86_64-efi/ipxe.efi
 cp "$SRC/bin-x86_64-efi/snponly.efi" "$DEST/snponly.efi"
 cp "$SRC/bin-x86_64-efi/ipxe.efi"    "$DEST/ipxe.efi"
 echo ">> iPXE build complete:"
 ls -l "$DEST"/snponly.efi "$DEST"/ipxe.efi