feat(saml): wire SAML 2.0 SSO end-to-end (pure-Rust) + Settings/Storage UI consolidation (v0.5.1)

SAML SSO (the config was storage-only since v0.4.5; now it logs you in):
- New openpxe-core::saml — pure-Rust SP built on bergshamra (XML-DSig +
  exclusive c14n via RustCrypto, no OpenSSL/xmlsec/libxml2). The static
  musl binary stays C-free; samael was rejected for hard-requiring OpenSSL.
  * metadata.rs   — parse IdP EntityDescriptor (SSO URLs + signing certs),
                    build our SP metadata.
  * authn_request.rs — build + HTTP-Redirect-encode AuthnRequests.
  * response.rs   — verify the signature against the pinned IdP cert
                    (trusted_keys_only + strict_verification for XSW),
                    then enforce Status/Destination/Audience/time-bounds/
                    signature-scope. Stateless; returns the IDs the HTTP
                    layer needs.
- http-api saml_routes: GET /api/sso/login (302 to IdP), POST /api/sso/acs
  (verify -> InResponseTo correlation / IdP-initiated gating / assertion
  replay guard -> mint operator session -> 302), GET /api/sso/metadata.
  Added to the pre-auth allowlist; /api/sso config stays gated.
- SsoConfig gains entity_id (SP Entity ID, defaults to public base URL)
  and allow_idp_initiated (default off), mirroring FleetDM.
- Access model: any IdP-authenticated, cryptographically-verified user gets
  an operator session (single-tier; local admin remains the fallback owner).
- Login page: the "Sign in with <IdP>" button now drives the real flow and
  surfaces sso_error redirects.

UI consolidation:
- Removed the Advanced sidebar tab; folded its webhook-notifications +
  API-reference cards into a collapsible "Advanced" disclosure at the
  bottom of Settings.
- Merged the Storage tab's separate SMB and NFS cards into one "Remote
  shares" card with a protocol dropdown and a unified, protocol-badged
  table. No backend changes — same /api/smb-shares + /api/nfs-shares.

Tests: 17 SAML core tests (accept + reject tampered/unsigned/wrong-key/
wrong-audience/expired/future/wrong-issuer/non-success) and 6 ACS
integration tests (happy path, IdP-initiated gating, SP correlation,
replay, garbage). Full workspace: 206 tests green, clippy clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

.claude/settings.json

@@ -0,0 +1,16 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(cargo check *)",
+      "Bash(cargo build *)",
+      "Bash(cargo clippy *)",
+      "Bash(cargo fmt *)",
+      "Bash(cargo tree *)",
+      "Bash(cargo doc *)",
+      "Bash(cargo test --workspace --lib)",
+      "Bash(cargo test --workspace)",
+      "Bash(cargo --version)",
+      "Bash(rustc --version)"
+    ]
+  }
+}

Cargo.toml

@@ -12,7 +12,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.4.66"
+version = "0.5.1"
 edition = "2021"
 rust-version = "1.95"
 license = "MIT OR Apache-2.0"
@@ -35,7 +35,7 @@ axum = { version = "0.7", features = ["macros", "multipart", "http2"] }
 tower = "0.5"
 tower-http = { version = "0.6", features = ["fs", "trace", "cors", "limit"] }
 hyper = "1.4"
-reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "stream"] }
+reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "stream", "json"] }
 mime = "0.3"
 mime_guess = "2.0"
 
@@ -58,6 +58,33 @@ once_cell = "1.19"
 parking_lot = "0.12"
 rust-embed = { version = "8.5", features = ["include-exclude"] }
 
+# v0.4.67: pure-Rust NFSv3 client. Replaces the (deleted-in-v0.4.65)
+# kernel-mount NFS path with an in-process implementation that works
+# in any container — no kernel modules, no CAP_SYS_ADMIN, no
+# subprocess. Ships alongside the userspace SMB consumer; operators
+# pick whichever protocol their NAS prefers.
+nfs3_client = { version = "0.9", features = ["tokio"] }
+nfs3_types = "0.5"
+
+# v0.5.0: SMTP for webhook notifications (Slack/Teams/Discord go over
+# plain HTTP via reqwest; email needs a real SMTP client). rustls TLS
+# to match reqwest and stay musl-static-friendly — no OpenSSL.
+lettre = { version = "0.11", default-features = false, features = ["smtp-transport", "tokio1-rustls-tls", "builder", "hostname"] }
+
+# v0.5.1: pure-Rust SAML 2.0 Service Provider. bergshamra does XML-DSig
+# verification + exclusive c14n with RustCrypto (no OpenSSL/xmlsec/libxml2
+# C deps), so the static musl binary stays OpenSSL-free — samael was
+# rejected precisely because it hard-requires OpenSSL. We build the thin
+# SP layer (AuthnRequest, metadata parse, SAMLResponse semantics) on top.
+bergshamra = "0.4"
+roxmltree = "0.21"
+quick-xml = "0.40"
+x509-parser = "0.18"
+# flate2 default backend is miniz_oxide (pure Rust) — do NOT enable the
+# zlib/zlib-ng C backends, which would break the musl-static build.
+flate2 = "1.1"
+base64 = "0.22"
+
 openpxe-core = { path = "crates/core" }
 openpxe-dhcp-proxy = { path = "crates/dhcp-proxy" }
 openpxe-tftp = { path = "crates/tftp" }

crates/core/Cargo.toml

@@ -25,5 +25,19 @@ tokio = { workspace = true, features = ["sync", "rt", "macros", "time"] }
 # for per-ISO boot passwords; just re-exported here.
 bcrypt.workspace = true
 
+# v0.5.1: pure-Rust SAML 2.0 SP. bergshamra = XML-DSig verify + exclusive
+# c14n (no OpenSSL/C). roxmltree/quick-xml parse + build SAML XML;
+# x509-parser pulls the IdP signing cert out of metadata; flate2+base64
+# encode the HTTP-Redirect binding's SAMLRequest.
+bergshamra.workspace = true
+roxmltree.workspace = true
+quick-xml.workspace = true
+x509-parser.workspace = true
+flate2.workspace = true
+base64.workspace = true
+
 [dev-dependencies]
 tempfile = "3.12"
+# v0.5.1: generate a throwaway self-signed signing cert/key so SAML
+# verification tests can produce genuinely signed SAMLResponses.
+rcgen = "0.13"

crates/core/src/branding.rs

@@ -44,6 +44,14 @@ struct Inner {
     /// MIME of the active logo, mirroring `logo_filename`. Cached here
     /// so the HTTP layer can set Content-Type without re-sniffing.
     logo_mime: Option<String>,
+    /// Monotonic counter bumped on every set/clear. Surfaces as a
+    /// cache-bust token (`/assets/logo.svg?r=<rev>`) so the browser
+    /// fetches the new bytes the moment the operator swaps the logo —
+    /// the app version alone can't do this since it doesn't change on
+    /// upload. Persisted so the token stays stable across restarts and
+    /// keeps climbing across multiple swaps.
+    #[serde(default)]
+    rev: u64,
 }
 
 /// In-memory + on-disk override registry. Cheap to clone; locks are
@@ -150,6 +158,7 @@ impl BrandingStore {
             let mut g = self.inner.write();
             g.logo_filename = Some(filename.clone());
             g.logo_mime = Some(mime.to_string());
+            g.rev = g.rev.wrapping_add(1);
         }
         self.persist();
         tracing::info!(
@@ -166,6 +175,7 @@ impl BrandingStore {
             let mut g = self.inner.write();
             let removed = g.logo_filename.take();
             g.logo_mime = None;
+            g.rev = g.rev.wrapping_add(1);
             removed
         };
         if let Some(name) = removed {
@@ -185,6 +195,14 @@ impl BrandingStore {
         self.inner.read().logo_filename.is_some()
     }
 
+    /// Cache-bust token for the logo asset URL. Changes on every
+    /// set/clear so `/assets/logo.svg?r=<rev>` resolves to a fresh URL
+    /// whenever the operator swaps the brand mark. Stable otherwise.
+    #[must_use]
+    pub fn logo_rev(&self) -> u64 {
+        self.inner.read().rev
+    }
+
     fn persist(&self) {
         let snap = self.inner.read().clone();
         let body = match serde_json::to_vec_pretty(&snap) {
@@ -292,6 +310,23 @@ mod tests {
         assert!(!entries.iter().any(|n| n == "logo.png"), "stale PNG left over: {entries:?}");
     }
 
+    #[test]
+    fn logo_rev_bumps_on_each_set_and_clear() {
+        let dir = tempdir().unwrap();
+        let b = BrandingStore::load_or_default(dir.path());
+        assert_eq!(b.logo_rev(), 0);
+        b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake").unwrap();
+        assert_eq!(b.logo_rev(), 1);
+        b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake2").unwrap();
+        assert_eq!(b.logo_rev(), 2);
+        b.clear_logo().unwrap();
+        assert_eq!(b.logo_rev(), 3);
+        // Survives a restart.
+        drop(b);
+        let b2 = BrandingStore::load_or_default(dir.path());
+        assert_eq!(b2.logo_rev(), 3);
+    }
+
     #[test]
     fn sanitize_ext_strips_separators_and_path_chars() {
         assert_eq!(sanitize_ext("svg"), "svg");
@@ -319,6 +354,7 @@ mod tests {
         let inner = Inner {
             logo_filename: Some("logo.png".into()),
             logo_mime: Some("image/png".into()),
+            rev: 0,
         };
         std::fs::write(
             brand_dir.join("branding.json"),

crates/core/src/lib.rs

@@ -12,20 +12,25 @@ pub mod error;
 pub mod host_bindings;
 pub mod log_bus;
 pub mod metrics;
+pub mod notify;
 pub mod queue;
+pub mod saml;
 pub mod settings;
 pub mod sso;
+pub mod wol;
 
 pub use arch::{ClientArch, FirmwareClass};
 pub use auth::{AdminAccount, AdminPublic, AdminStore};
 pub use boot_log::{BootEvent, BootLog};
 pub use branding::{ext_for_mime, BrandingStore, ALLOWED_LOGO_MIMES, MAX_LOGO_BYTES};
 pub use client::{ClientEvent, ClientRegistry, ClientSnapshot};
-pub use sso::{SsoConfig, SsoStore};
 pub use config::{Config, DhcpMode, NetworkConfig, Paths, ServerConfig};
 pub use error::{Error, Result};
 pub use host_bindings::{normalize_mac, HostBinding, HostBindings};
 pub use log_bus::{LogBus, LogBusLayer, LogLine};
 pub use metrics::{HttpRoute, Metrics};
+pub use notify::{NotifyConfig, NotifyKind, NotifyStore};
 pub use queue::{DeploymentQueue, QueueEntry};
+pub use saml::{IdpMetadata, SamlError, SpParams, VerifiedPrincipal, VerifiedResponse};
 pub use settings::{Settings, SettingsStore, TimeoutAction};
+pub use sso::{SsoConfig, SsoStore};

crates/core/src/notify.rs

@@ -0,0 +1,362 @@
+//! Webhook / email notification configuration.
+//!
+//! v0.5.0: OpenPXE can ping a chat webhook or send an email when
+//! something noteworthy happens (a machine PXE-booted an image, a
+//! deployment was assigned, a WoL was sent). One active provider at a
+//! time, chosen by `kind` — dead-simple for an L1 tech: pick Slack,
+//! paste the incoming-webhook URL, done.
+//!
+//! This module owns only the *configuration* (validation + persistence
+//! to `<work_dir>/notify.json`). The actual sending — HTTP POST for the
+//! chat providers, SMTP for email — lives in the http-api crate, which
+//! already carries an HTTP client and the SMTP dependency. Keeping the
+//! network I/O out of `core` matches how `BrandingStore`/`SsoStore`
+//! stay pure config stores.
+//!
+//! Secrets note: the SMTP password is persisted in `notify.json`
+//! alongside the rest of the config (0644 like the other state files).
+//! It is never echoed back through the API — the snapshot used for the
+//! GET response blanks it (see `Self::redacted`).
+
+use parking_lot::RwLock;
+use serde::{Deserialize, Serialize};
+use std::path::PathBuf;
+use std::sync::Arc;
+
+use crate::{Error, Result};
+
+const MAX_URL_LEN: usize = 2048;
+const MAX_FIELD_LEN: usize = 512;
+
+/// Which notification transport is active.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum NotifyKind {
+    /// Slack incoming webhook (`{ "text": ... }`).
+    #[default]
+    Slack,
+    /// Discord webhook (`{ "content": ... }`).
+    Discord,
+    /// Microsoft Teams incoming webhook (legacy MessageCard JSON).
+    Teams,
+    /// Email via SMTP.
+    Smtp,
+}
+
+impl NotifyKind {
+    /// True when this kind drives a chat webhook (POST a JSON body to a
+    /// single URL) rather than SMTP.
+    #[must_use]
+    pub fn is_webhook(self) -> bool {
+        matches!(self, Self::Slack | Self::Discord | Self::Teams)
+    }
+}
+
+/// Operator-configurable notification settings. Single provider active
+/// at a time; the inactive fields are kept so switching providers
+/// doesn't wipe the other one's values.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+pub struct NotifyConfig {
+    #[serde(default)]
+    pub enabled: bool,
+    #[serde(default)]
+    pub kind: NotifyKind,
+    /// Incoming-webhook URL for Slack / Discord / Teams.
+    #[serde(default)]
+    pub webhook_url: String,
+
+    // ── SMTP fields (used when kind == Smtp) ──
+    #[serde(default)]
+    pub smtp_host: String,
+    #[serde(default = "default_smtp_port")]
+    pub smtp_port: u16,
+    #[serde(default)]
+    pub smtp_username: String,
+    #[serde(default)]
+    pub smtp_password: String,
+    /// `From:` address. Falls back to `smtp_username` when blank.
+    #[serde(default)]
+    pub smtp_from: String,
+    /// `To:` address (single recipient — keep it simple).
+    #[serde(default)]
+    pub smtp_to: String,
+    /// Use implicit TLS (port 465). When false we use STARTTLS on the
+    /// configured port (587 typical). Either way the connection is
+    /// encrypted — we never offer plaintext SMTP.
+    #[serde(default)]
+    pub smtp_implicit_tls: bool,
+}
+
+fn default_smtp_port() -> u16 {
+    587
+}
+
+impl NotifyConfig {
+    /// True when enabled and the active provider has the fields it
+    /// needs to actually send.
+    #[must_use]
+    pub fn is_usable(&self) -> bool {
+        if !self.enabled {
+            return false;
+        }
+        if self.kind.is_webhook() {
+            !self.webhook_url.trim().is_empty()
+        } else {
+            !self.smtp_host.trim().is_empty() && !self.smtp_to.trim().is_empty()
+        }
+    }
+
+    /// A copy safe to return over the API: the SMTP password is blanked
+    /// (replaced with a non-empty sentinel only when one is set, so the
+    /// UI can show "configured" without leaking it).
+    #[must_use]
+    pub fn redacted(&self) -> NotifyConfig {
+        let mut c = self.clone();
+        if !c.smtp_password.is_empty() {
+            c.smtp_password = SECRET_SENTINEL.to_string();
+        }
+        c
+    }
+}
+
+/// Returned by the API in place of a stored password. When the UI PUTs
+/// this value back unchanged we keep the existing password rather than
+/// overwriting it with the sentinel.
+pub const SECRET_SENTINEL: &str = "__keep__";
+
+/// In-memory + on-disk notification config registry.
+#[derive(Debug, Clone)]
+pub struct NotifyStore {
+    path: Arc<PathBuf>,
+    inner: Arc<RwLock<NotifyConfig>>,
+}
+
+impl NotifyStore {
+    #[must_use]
+    pub fn load_or_default(work_dir: &std::path::Path) -> Self {
+        let path = work_dir.join("notify.json");
+        let cfg = match std::fs::read_to_string(&path) {
+            Ok(text) => serde_json::from_str::<NotifyConfig>(&text).unwrap_or_else(|e| {
+                tracing::warn!(
+                    target: "openpxe::notify",
+                    "notify.json unreadable ({e}); starting with defaults"
+                );
+                NotifyConfig::default()
+            }),
+            Err(_) => NotifyConfig::default(),
+        };
+        Self {
+            path: Arc::new(path),
+            inner: Arc::new(RwLock::new(cfg)),
+        }
+    }
+
+    #[must_use]
+    pub fn snapshot(&self) -> NotifyConfig {
+        self.inner.read().clone()
+    }
+
+    /// Replace the whole config. `incoming.smtp_password == SECRET_SENTINEL`
+    /// is treated as "keep the existing password" so the UI never has to
+    /// round-trip the real secret.
+    pub fn replace(&self, mut incoming: NotifyConfig) -> Result<NotifyConfig> {
+        incoming.webhook_url = incoming.webhook_url.trim().to_string();
+        incoming.smtp_host = incoming.smtp_host.trim().to_string();
+        incoming.smtp_username = incoming.smtp_username.trim().to_string();
+        incoming.smtp_from = incoming.smtp_from.trim().to_string();
+        incoming.smtp_to = incoming.smtp_to.trim().to_string();
+
+        // Preserve the stored password when the UI sends the sentinel.
+        if incoming.smtp_password == SECRET_SENTINEL {
+            incoming
+                .smtp_password
+                .clone_from(&self.inner.read().smtp_password);
+        }
+
+        // Length caps.
+        if incoming.webhook_url.len() > MAX_URL_LEN {
+            return Err(Error::Invalid(format!(
+                "webhook URL exceeds {MAX_URL_LEN}-char cap"
+            )));
+        }
+        for (name, v) in [
+            ("smtp_host", &incoming.smtp_host),
+            ("smtp_username", &incoming.smtp_username),
+            ("smtp_from", &incoming.smtp_from),
+            ("smtp_to", &incoming.smtp_to),
+        ] {
+            if v.len() > MAX_FIELD_LEN {
+                return Err(Error::Invalid(format!(
+                    "{name} exceeds {MAX_FIELD_LEN}-char cap"
+                )));
+            }
+        }
+
+        // Validate the active provider only when enabling.
+        if incoming.enabled {
+            if incoming.kind.is_webhook() {
+                if incoming.webhook_url.is_empty() {
+                    return Err(Error::Invalid(
+                        "a webhook URL is required to enable chat notifications".into(),
+                    ));
+                }
+                if !incoming.webhook_url.starts_with("https://")
+                    && !incoming.webhook_url.starts_with("http://")
+                {
+                    return Err(Error::Invalid(
+                        "webhook URL must start with http:// or https://".into(),
+                    ));
+                }
+            } else {
+                if incoming.smtp_host.is_empty() {
+                    return Err(Error::Invalid(
+                        "SMTP host is required to enable email notifications".into(),
+                    ));
+                }
+                if incoming.smtp_to.is_empty() {
+                    return Err(Error::Invalid(
+                        "a recipient (To) is required to enable email notifications".into(),
+                    ));
+                }
+                if incoming.smtp_port == 0 {
+                    return Err(Error::Invalid("SMTP port must be non-zero".into()));
+                }
+            }
+        }
+
+        {
+            let mut g = self.inner.write();
+            *g = incoming.clone();
+        }
+        self.persist();
+        tracing::info!(
+            target: "openpxe::notify",
+            enabled = incoming.enabled, kind = ?incoming.kind,
+            "notification configuration updated"
+        );
+        Ok(incoming)
+    }
+
+    fn persist(&self) {
+        let snap = self.inner.read().clone();
+        let body = match serde_json::to_vec_pretty(&snap) {
+            Ok(b) => b,
+            Err(e) => {
+                tracing::warn!(target: "openpxe::notify", "serialize notify.json: {e}");
+                return;
+            }
+        };
+        if let Some(parent) = self.path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        let tmp = self.path.with_extension("json.tmp");
+        if let Err(e) = std::fs::write(&tmp, body) {
+            tracing::warn!(target: "openpxe::notify", "write notify.json tmp: {e}");
+            return;
+        }
+        if let Err(e) = std::fs::rename(&tmp, self.path.as_path()) {
+            tracing::warn!(target: "openpxe::notify", "rename notify.json: {e}");
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::tempdir;
+
+    #[test]
+    fn default_disabled_not_usable() {
+        let dir = tempdir().unwrap();
+        let s = NotifyStore::load_or_default(dir.path());
+        assert!(!s.snapshot().enabled);
+        assert!(!s.snapshot().is_usable());
+    }
+
+    #[test]
+    fn slack_requires_url_when_enabled() {
+        let dir = tempdir().unwrap();
+        let s = NotifyStore::load_or_default(dir.path());
+        let r = s.replace(NotifyConfig {
+            enabled: true,
+            kind: NotifyKind::Slack,
+            ..Default::default()
+        });
+        assert!(matches!(r, Err(Error::Invalid(_))));
+        s.replace(NotifyConfig {
+            enabled: true,
+            kind: NotifyKind::Slack,
+            webhook_url: "https://hooks.slack.com/services/XXX".into(),
+            ..Default::default()
+        })
+        .unwrap();
+        assert!(s.snapshot().is_usable());
+    }
+
+    #[test]
+    fn smtp_requires_host_and_recipient() {
+        let dir = tempdir().unwrap();
+        let s = NotifyStore::load_or_default(dir.path());
+        let r = s.replace(NotifyConfig {
+            enabled: true,
+            kind: NotifyKind::Smtp,
+            smtp_host: "smtp.example.com".into(),
+            ..Default::default()
+        });
+        assert!(matches!(r, Err(Error::Invalid(_))), "missing recipient should reject");
+        s.replace(NotifyConfig {
+            enabled: true,
+            kind: NotifyKind::Smtp,
+            smtp_host: "smtp.example.com".into(),
+            smtp_port: 587,
+            smtp_to: "[email protected]".into(),
+            smtp_from: "[email protected]".into(),
+            ..Default::default()
+        })
+        .unwrap();
+        assert!(s.snapshot().is_usable());
+    }
+
+    #[test]
+    fn password_sentinel_preserves_stored_secret() {
+        let dir = tempdir().unwrap();
+        let s = NotifyStore::load_or_default(dir.path());
+        s.replace(NotifyConfig {
+            enabled: true,
+            kind: NotifyKind::Smtp,
+            smtp_host: "smtp.example.com".into(),
+            smtp_port: 587,
+            smtp_to: "[email protected]".into(),
+            smtp_password: "s3cret".into(),
+            ..Default::default()
+        })
+        .unwrap();
+        // Redacted snapshot hides the password behind the sentinel.
+        assert_eq!(s.snapshot().redacted().smtp_password, SECRET_SENTINEL);
+        // PUTting the sentinel back keeps the real password.
+        s.replace(NotifyConfig {
+            enabled: true,
+            kind: NotifyKind::Smtp,
+            smtp_host: "smtp.example.com".into(),
+            smtp_port: 587,
+            smtp_to: "[email protected]".into(),
+            smtp_password: SECRET_SENTINEL.into(),
+            ..Default::default()
+        })
+        .unwrap();
+        assert_eq!(s.snapshot().smtp_password, "s3cret");
+    }
+
+    #[test]
+    fn webhook_url_scheme_enforced() {
+        let dir = tempdir().unwrap();
+        let s = NotifyStore::load_or_default(dir.path());
+        let r = s.replace(NotifyConfig {
+            enabled: true,
+            kind: NotifyKind::Discord,
+            webhook_url: "ftp://example.com/hook".into(),
+            ..Default::default()
+        });
+        assert!(matches!(r, Err(Error::Invalid(_))));
+    }
+}

crates/core/src/saml/authn_request.rs

@@ -0,0 +1,188 @@
+//! AuthnRequest construction + HTTP-Redirect binding encoding.
+//!
+//! For SP-initiated login we build an `<AuthnRequest>`, then encode it for the
+//! HTTP-Redirect binding: raw DEFLATE (RFC 1951) → base64 → percent-encode,
+//! appended as the `SAMLRequest` query parameter. AuthnRequests are sent
+//! unsigned in this release (the IdP must not require client signatures).
+
+use std::fmt::Write as _;
+use std::io::Write as _;
+
+use base64::Engine;
+use flate2::write::DeflateEncoder;
+use flate2::Compression;
+use time::format_description::well_known::Rfc3339;
+use time::OffsetDateTime;
+
+use super::{SamlError, SpParams};
+
+const NS_PROTOCOL: &str = "urn:oasis:names:tc:SAML:2.0:protocol";
+const NS_ASSERTION: &str = "urn:oasis:names:tc:SAML:2.0:assertion";
+const NAMEID_EMAIL: &str = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress";
+const BINDING_POST: &str = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST";
+
+/// A built AuthnRequest, ready to redirect the browser to the IdP.
+#[derive(Debug, Clone)]
+pub struct AuthnRequest {
+    /// The request `ID` — the caller records this so the matching response's
+    /// `InResponseTo` can be correlated (replay/CSRF protection).
+    pub id: String,
+    /// The full IdP URL to 302 the browser to (includes `SAMLRequest` and,
+    /// when supplied, `RelayState`).
+    pub location: String,
+}
+
+/// Build an AuthnRequest targeting `idp_sso_url` and encode it for the
+/// HTTP-Redirect binding. `relay_state`, if given, round-trips back to us via
+/// the response (we use it to send the operator to their intended page).
+pub fn build(
+    sp: &SpParams,
+    idp_sso_url: &str,
+    relay_state: Option<&str>,
+) -> Result<AuthnRequest, SamlError> {
+    let id = format!("_{}", uuid::Uuid::new_v4().simple());
+    let issue_instant = OffsetDateTime::now_utc()
+        .replace_nanosecond(0)
+        .unwrap_or_else(|_| OffsetDateTime::now_utc())
+        .format(&Rfc3339)
+        .map_err(|e| SamlError::Timestamp(e.to_string()))?;
+
+    let xml = format!(
+        r#"<samlp:AuthnRequest xmlns:samlp="{NS_PROTOCOL}" xmlns:saml="{NS_ASSERTION}" ID="{id}" Version="2.0" IssueInstant="{instant}" Destination="{dest}" ProtocolBinding="{BINDING_POST}" AssertionConsumerServiceURL="{acs}"><saml:Issuer>{issuer}</saml:Issuer><samlp:NameIDPolicy Format="{NAMEID_EMAIL}" AllowCreate="true"/></samlp:AuthnRequest>"#,
+        instant = issue_instant,
+        dest = xml_escape(idp_sso_url),
+        acs = xml_escape(&sp.acs_url),
+        issuer = xml_escape(&sp.entity_id),
+    );
+
+    let encoded = deflate_base64(&xml)?;
+
+    let sep = if idp_sso_url.contains('?') { '&' } else { '?' };
+    let mut location = format!("{idp_sso_url}{sep}SAMLRequest={}", pct_encode(&encoded));
+    if let Some(rs) = relay_state {
+        location.push_str("&RelayState=");
+        location.push_str(&pct_encode(rs));
+    }
+
+    Ok(AuthnRequest { id, location })
+}
+
+/// Raw-DEFLATE then base64 — the HTTP-Redirect binding's `SAMLRequest` payload.
+fn deflate_base64(xml: &str) -> Result<String, SamlError> {
+    let mut enc = DeflateEncoder::new(Vec::new(), Compression::default());
+    enc.write_all(xml.as_bytes())
+        .and_then(|()| enc.try_finish())
+        .map_err(|e| SamlError::Xml(format!("deflate: {e}")))?;
+    let compressed = enc
+        .finish()
+        .map_err(|e| SamlError::Xml(format!("deflate: {e}")))?;
+    Ok(base64::engine::general_purpose::STANDARD.encode(compressed))
+}
+
+/// Percent-encode a query-string component (RFC 3986 unreserved set passes
+/// through; everything else is `%XX`).
+fn pct_encode(s: &str) -> String {
+    let mut out = String::with_capacity(s.len() * 3);
+    for b in s.bytes() {
+        match b {
+            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => {
+                out.push(b as char);
+            }
+            _ => {
+                let _ = write!(out, "%{b:02X}");
+            }
+        }
+    }
+    out
+}
+
+fn xml_escape(s: &str) -> String {
+    let mut out = String::with_capacity(s.len());
+    for c in s.chars() {
+        match c {
+            '&' => out.push_str("&amp;"),
+            '<' => out.push_str("&lt;"),
+            '>' => out.push_str("&gt;"),
+            '"' => out.push_str("&quot;"),
+            '\'' => out.push_str("&apos;"),
+            _ => out.push(c),
+        }
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use flate2::read::DeflateDecoder;
+    use std::io::Read;
+
+    fn sp() -> SpParams {
+        SpParams {
+            entity_id: "https://pxe.example.com".into(),
+            acs_url: "https://pxe.example.com/api/sso/acs".into(),
+        }
+    }
+
+    fn pct_decode(s: &str) -> Vec<u8> {
+        let bytes = s.as_bytes();
+        let mut out = Vec::with_capacity(bytes.len());
+        let mut i = 0;
+        while i < bytes.len() {
+            if bytes[i] == b'%' && i + 2 < bytes.len() {
+                let hi = (bytes[i + 1] as char).to_digit(16).unwrap();
+                let lo = (bytes[i + 2] as char).to_digit(16).unwrap();
+                out.push((hi * 16 + lo) as u8);
+                i += 3;
+            } else {
+                out.push(bytes[i]);
+                i += 1;
+            }
+        }
+        out
+    }
+
+    #[test]
+    fn id_is_ncname_and_location_has_request() {
+        let req = build(&sp(), "https://idp.example.com/sso", Some("/dashboard")).unwrap();
+        assert!(req.id.starts_with('_'));
+        assert!(req
+            .location
+            .starts_with("https://idp.example.com/sso?SAMLRequest="));
+        assert!(req.location.contains("&RelayState=%2Fdashboard"));
+    }
+
+    #[test]
+    fn redirect_payload_round_trips_to_our_authn_request() {
+        let req = build(&sp(), "https://idp.example.com/sso", None).unwrap();
+        // Pull SAMLRequest value out of the query string.
+        let q = req.location.split("SAMLRequest=").nth(1).unwrap();
+        let val = q.split('&').next().unwrap();
+        let compressed = base64::engine::general_purpose::STANDARD
+            .decode(pct_decode(val))
+            .unwrap();
+        let mut inflate = DeflateDecoder::new(&compressed[..]);
+        let mut xml = String::new();
+        inflate.read_to_string(&mut xml).unwrap();
+
+        let doc = roxmltree::Document::parse(&xml).unwrap();
+        let root = doc.root_element();
+        assert_eq!(root.tag_name().name(), "AuthnRequest");
+        assert_eq!(root.attribute("ID").unwrap(), req.id);
+        assert_eq!(
+            root.attribute("AssertionConsumerServiceURL").unwrap(),
+            "https://pxe.example.com/api/sso/acs"
+        );
+        let issuer = root
+            .descendants()
+            .find(|n| n.tag_name().name() == "Issuer")
+            .unwrap();
+        assert_eq!(issuer.text().unwrap(), "https://pxe.example.com");
+    }
+
+    #[test]
+    fn existing_query_uses_ampersand_separator() {
+        let req = build(&sp(), "https://idp.example.com/sso?foo=bar", None).unwrap();
+        assert!(req.location.contains("?foo=bar&SAMLRequest="));
+    }
+}

crates/core/src/saml/metadata.rs

@@ -0,0 +1,241 @@
+//! IdP metadata parsing + SP metadata generation.
+//!
+//! We parse only what the SP flow needs: the IdP Entity ID, its
+//! `SingleSignOnService` endpoints (HTTP-Redirect / HTTP-POST), and the
+//! X.509 signing certificate(s). Everything else in the document is ignored.
+
+use base64::Engine;
+
+use super::{SamlError, SpParams};
+
+/// SAML 2.0 binding URIs.
+pub const BINDING_REDIRECT: &str = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect";
+pub const BINDING_POST: &str = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST";
+
+/// The subset of an IdP's `EntityDescriptor` the SP flow consumes.
+#[derive(Debug, Clone)]
+pub struct IdpMetadata {
+    /// The IdP's Entity ID — we require incoming assertions to be issued by it.
+    pub entity_id: String,
+    /// SSO endpoint for the HTTP-Redirect binding (where we send AuthnRequests).
+    pub sso_redirect_url: Option<String>,
+    /// SSO endpoint for the HTTP-POST binding (fallback target).
+    pub sso_post_url: Option<String>,
+    /// DER-encoded X.509 signing certificate(s). More than one appears during
+    /// key rotation; verification tries each.
+    pub signing_certs_der: Vec<Vec<u8>>,
+}
+
+impl IdpMetadata {
+    /// Parse an IdP `EntityDescriptor` document.
+    ///
+    /// Robust to namespace-prefix variation (matches on local element names),
+    /// since IdPs disagree on prefixes (`md:`, `ns0:`, default, …).
+    pub fn parse(xml: &str) -> Result<Self, SamlError> {
+        let doc = roxmltree::Document::parse(xml).map_err(|e| SamlError::Xml(e.to_string()))?;
+        let root = doc.root_element();
+
+        // The signing IDP descriptor. Some metadata wraps multiple
+        // descriptors (AA, SP) in one document; we want IDPSSODescriptor.
+        let idp_desc = root
+            .descendants()
+            .find(|n| n.is_element() && n.tag_name().name() == "IDPSSODescriptor")
+            .ok_or_else(|| SamlError::Metadata("IDPSSODescriptor".into()))?;
+
+        // Entity ID lives on the EntityDescriptor (root, or an ancestor of the
+        // IDPSSODescriptor when several are nested).
+        let entity_id = idp_desc
+            .ancestors()
+            .find_map(|n| {
+                if n.tag_name().name() == "EntityDescriptor" {
+                    n.attribute("entityID")
+                } else {
+                    None
+                }
+            })
+            .or_else(|| root.attribute("entityID"))
+            .map(str::to_owned)
+            .ok_or_else(|| SamlError::Metadata("entityID".into()))?;
+
+        let mut sso_redirect_url = None;
+        let mut sso_post_url = None;
+        for sso in idp_desc
+            .children()
+            .filter(|n| n.is_element() && n.tag_name().name() == "SingleSignOnService")
+        {
+            let binding = sso.attribute("Binding").unwrap_or("");
+            let location = sso.attribute("Location").map(str::to_owned);
+            match binding {
+                BINDING_REDIRECT if sso_redirect_url.is_none() => sso_redirect_url = location,
+                BINDING_POST if sso_post_url.is_none() => sso_post_url = location,
+                _ => {}
+            }
+        }
+
+        // Signing certs: KeyDescriptor with use="signing" or no use attribute
+        // (a bare KeyDescriptor is valid for both signing and encryption).
+        let mut signing_certs_der = Vec::new();
+        for kd in idp_desc
+            .children()
+            .filter(|n| n.is_element() && n.tag_name().name() == "KeyDescriptor")
+        {
+            match kd.attribute("use") {
+                Some("signing") | None => {}
+                Some(_) => continue, // encryption-only key — skip
+            }
+            for cert_node in kd
+                .descendants()
+                .filter(|n| n.is_element() && n.tag_name().name() == "X509Certificate")
+            {
+                let b64: String = node_text(&cert_node)
+                    .chars()
+                    .filter(|c| !c.is_whitespace())
+                    .collect();
+                if b64.is_empty() {
+                    continue;
+                }
+                let der = base64::engine::general_purpose::STANDARD
+                    .decode(b64.as_bytes())
+                    .map_err(|e| SamlError::Base64(e.to_string()))?;
+                signing_certs_der.push(der);
+            }
+        }
+
+        if signing_certs_der.is_empty() {
+            return Err(SamlError::NoSigningCert);
+        }
+
+        Ok(Self {
+            entity_id,
+            sso_redirect_url,
+            sso_post_url,
+            signing_certs_der,
+        })
+    }
+
+    /// Preferred SSO destination for an outbound AuthnRequest: HTTP-Redirect
+    /// if advertised, otherwise HTTP-POST.
+    pub fn sso_destination(&self) -> Option<&str> {
+        self.sso_redirect_url
+            .as_deref()
+            .or(self.sso_post_url.as_deref())
+    }
+}
+
+/// Build our SP `EntityDescriptor` XML so an IdP admin can import OpenPXE as a
+/// relying party. Advertises the ACS URL (HTTP-POST binding) and an emailAddress
+/// NameID format — matching what the response path expects.
+pub fn build_sp_metadata(sp: &SpParams) -> String {
+    let entity = xml_escape(&sp.entity_id);
+    let acs = xml_escape(&sp.acs_url);
+    format!(
+        r#"<?xml version="1.0" encoding="UTF-8"?>
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="{entity}">
+  <SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
+    <AssertionConsumerService Binding="{BINDING_POST}" Location="{acs}" index="0" isDefault="true"/>
+  </SPSSODescriptor>
+</EntityDescriptor>
+"#
+    )
+}
+
+/// Collect the concatenated text of an element's direct text children.
+fn node_text(n: &roxmltree::Node<'_, '_>) -> String {
+    n.children()
+        .filter(roxmltree::Node::is_text)
+        .filter_map(|c| c.text())
+        .collect()
+}
+
+/// Minimal XML attribute/text escaping for the values we interpolate.
+fn xml_escape(s: &str) -> String {
+    let mut out = String::with_capacity(s.len());
+    for c in s.chars() {
+        match c {
+            '&' => out.push_str("&amp;"),
+            '<' => out.push_str("&lt;"),
+            '>' => out.push_str("&gt;"),
+            '"' => out.push_str("&quot;"),
+            '\'' => out.push_str("&apos;"),
+            _ => out.push(c),
+        }
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    // A trimmed-down Keycloak-style IdP descriptor (cert body is a stand-in;
+    // signing tests build real certs in the parent module's tests).
+    const SAMPLE: &str = r#"<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
+        xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
+        entityID="https://idp.example.com/realms/fleet">
+      <md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+        <md:KeyDescriptor use="signing">
+          <ds:KeyInfo><ds:X509Data><ds:X509Certificate>
+            QUJDREVG
+          </ds:X509Certificate></ds:X509Data></ds:KeyInfo>
+        </md:KeyDescriptor>
+        <md:KeyDescriptor use="encryption">
+          <ds:KeyInfo><ds:X509Data><ds:X509Certificate>WlpaWg==</ds:X509Certificate></ds:X509Data></ds:KeyInfo>
+        </md:KeyDescriptor>
+        <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
+            Location="https://idp.example.com/realms/fleet/protocol/saml"/>
+        <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
+            Location="https://idp.example.com/realms/fleet/protocol/saml"/>
+      </md:IDPSSODescriptor>
+    </md:EntityDescriptor>"#;
+
+    #[test]
+    fn parses_entity_sso_and_signing_cert() {
+        let m = IdpMetadata::parse(SAMPLE).unwrap();
+        assert_eq!(m.entity_id, "https://idp.example.com/realms/fleet");
+        assert_eq!(
+            m.sso_redirect_url.as_deref(),
+            Some("https://idp.example.com/realms/fleet/protocol/saml")
+        );
+        assert!(m.sso_post_url.is_some());
+        // Only the signing KeyDescriptor's cert is collected (ABCDEF), not the
+        // encryption one (ZZZZ).
+        assert_eq!(m.signing_certs_der.len(), 1);
+        assert_eq!(m.signing_certs_der[0], b"ABCDEF");
+    }
+
+    #[test]
+    fn missing_signing_cert_is_rejected() {
+        let xml = r#"<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="x">
+            <IDPSSODescriptor>
+              <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://x/sso"/>
+            </IDPSSODescriptor></EntityDescriptor>"#;
+        assert!(matches!(
+            IdpMetadata::parse(xml),
+            Err(SamlError::NoSigningCert)
+        ));
+    }
+
+    #[test]
+    fn missing_idp_descriptor_is_rejected() {
+        let xml = r#"<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="x"></EntityDescriptor>"#;
+        assert!(matches!(
+            IdpMetadata::parse(xml),
+            Err(SamlError::Metadata(_))
+        ));
+    }
+
+    #[test]
+    fn sp_metadata_contains_entity_and_acs() {
+        let sp = SpParams {
+            entity_id: "https://pxe.example.com".into(),
+            acs_url: "https://pxe.example.com/api/sso/acs".into(),
+        };
+        let xml = build_sp_metadata(&sp);
+        assert!(xml.contains(r#"entityID="https://pxe.example.com""#));
+        assert!(xml.contains("https://pxe.example.com/api/sso/acs"));
+        assert!(xml.contains(BINDING_POST));
+        // Must be well-formed.
+        roxmltree::Document::parse(&xml).unwrap();
+    }
+}

crates/core/src/saml/mod.rs

@@ -0,0 +1,92 @@
+//! Pure-Rust SAML 2.0 Service Provider (v0.5.1).
+//!
+//! This module implements the SP half of a SAML Web-Browser-SSO profile:
+//!
+//! * [`metadata`] — parse the IdP's `EntityDescriptor` (SSO URLs + signing
+//!   certificates) and build *our* SP metadata for the IdP admin to import.
+//! * [`authn_request`] — build an `AuthnRequest` and encode it for the
+//!   HTTP-Redirect binding.
+//! * [`response`] — decode a `SAMLResponse`, **verify its XML signature**
+//!   against the IdP's pinned certificate (via the pure-Rust `bergshamra`
+//!   crate — no OpenSSL/libxml2/xmlsec, so the static musl binary stays
+//!   C-free), then enforce the SP-side semantic checks (Status, Destination,
+//!   Audience, time bounds) that are where SAML SPs actually get attacked.
+//!
+//! Stateful checks (replay of assertion IDs, correlating `InResponseTo`
+//! against requests *we* issued, gating IdP-initiated login) live in the
+//! HTTP layer — [`response::consume`] is deliberately stateless and returns
+//! the IDs the caller needs to perform them.
+//!
+//! Access model: any assertion the IdP authenticates and we cryptographically
+//! verify yields an operator [`VerifiedPrincipal`]. OpenPXE is single-tier —
+//! there is no per-user role table — and the local admin account remains a
+//! guaranteed fallback owner regardless of SSO state.
+
+pub mod authn_request;
+pub mod metadata;
+pub mod response;
+
+pub use authn_request::AuthnRequest;
+pub use metadata::IdpMetadata;
+pub use response::{VerifiedPrincipal, VerifiedResponse};
+
+use thiserror::Error;
+
+/// Default clock-skew tolerance applied to assertion time bounds. SAML IdPs
+/// and SPs rarely have perfectly synced clocks; 60s matches common practice
+/// (Shibboleth/FleetDM defaults are in this ballpark).
+pub const DEFAULT_CLOCK_SKEW_SECS: i64 = 60;
+
+/// Runtime SP parameters, derived from [`crate::SsoConfig`] + the advertised
+/// public base URL by the HTTP layer.
+#[derive(Debug, Clone)]
+pub struct SpParams {
+    /// Our SP Entity ID (the `<Issuer>` we send and the `Audience` we require
+    /// in responses). Defaults to the public base URL when the operator left
+    /// the Entity ID field blank.
+    pub entity_id: String,
+    /// The Assertion Consumer Service URL the IdP POSTs the response to —
+    /// `<public_base_url>/api/sso/acs`.
+    pub acs_url: String,
+}
+
+/// Everything that can go wrong consuming a SAML response. Kept coarse on
+/// purpose: the HTTP layer logs the detail and shows the operator a generic
+/// "SSO sign-in failed" — we never leak which specific check tripped to the
+/// browser, since that aids an attacker probing the SP.
+#[derive(Debug, Error)]
+pub enum SamlError {
+    #[error("SAML XML parse error: {0}")]
+    Xml(String),
+    #[error("IdP metadata is missing a required element: {0}")]
+    Metadata(String),
+    #[error("no usable IdP signing certificate in metadata")]
+    NoSigningCert,
+    #[error("signature verification failed: {0}")]
+    Signature(String),
+    #[error("the signature does not cover the assertion we read")]
+    SignatureScope,
+    #[error("SAML response status was not Success: {0}")]
+    Status(String),
+    #[error("response is missing a required element: {0}")]
+    MissingElement(String),
+    #[error("encrypted assertions are not supported in this release")]
+    EncryptedAssertionUnsupported,
+    #[error("expected exactly one assertion, found {0}")]
+    AssertionCount(usize),
+    #[error("issuer mismatch: response was not issued by the configured IdP")]
+    IssuerMismatch,
+    #[error("audience mismatch: assertion is not addressed to this service provider")]
+    AudienceMismatch,
+    #[error("response destination does not match our ACS URL")]
+    DestinationMismatch,
+    #[error("assertion is expired or not yet valid")]
+    TimeBounds,
+    #[error("invalid SAML timestamp: {0}")]
+    Timestamp(String),
+    #[error("base64 decode failed: {0}")]
+    Base64(String),
+}
+
+#[cfg(test)]
+mod tests;

crates/core/src/saml/response.rs

@@ -0,0 +1,294 @@
+//! SAMLResponse consumption: signature verification + SP-side validation.
+//!
+//! [`consume`] is intentionally **stateless** — it verifies the XML signature
+//! against the IdP's pinned certificate(s) and enforces every check that can
+//! be made from the response alone (Status, Destination, Issuer, Audience,
+//! time bounds, signature scope). It then returns the `assertion_id` and
+//! `in_response_to` so the HTTP layer can perform the *stateful* checks it
+//! owns: replay rejection, correlating the request we issued, and gating
+//! IdP-initiated login.
+
+use roxmltree::{Document, Node};
+use time::format_description::well_known::Rfc3339;
+use time::{Duration, OffsetDateTime};
+
+use super::metadata::IdpMetadata;
+use super::{SamlError, SpParams};
+
+const STATUS_SUCCESS: &str = "urn:oasis:names:tc:SAML:2.0:status:Success";
+
+/// The verified subject of a SAML assertion. OpenPXE is single-tier, so this
+/// is all an operator session needs.
+#[derive(Debug, Clone)]
+pub struct VerifiedPrincipal {
+    /// The `<NameID>` value (an email, per our requested NameID format).
+    pub name_id: String,
+    /// Email used as the session identity. Equals `name_id` for the
+    /// emailAddress NameID format.
+    pub email: String,
+    /// Human-readable display name, if the IdP sent one as an attribute.
+    pub display_name: Option<String>,
+}
+
+/// Result of a successful [`consume`]. The IDs/expiry feed the HTTP layer's
+/// stateful checks.
+#[derive(Debug, Clone)]
+pub struct VerifiedResponse {
+    pub principal: VerifiedPrincipal,
+    /// `InResponseTo` from the response, if present. `None` = unsolicited
+    /// (IdP-initiated) — the HTTP layer only accepts that when the operator
+    /// enabled it.
+    pub in_response_to: Option<String>,
+    /// The assertion's `ID` — used by the caller as the replay-guard key.
+    pub assertion_id: String,
+    /// The assertion's expiry (`Conditions/@NotOnOrAfter`) — the replay
+    /// guard can drop the consumed ID after this instant.
+    pub assertion_expiry: OffsetDateTime,
+    /// `AuthnStatement/@SessionIndex`, if present (useful for future SLO).
+    pub session_index: Option<String>,
+}
+
+/// Verify and validate a decoded `SAMLResponse` XML document.
+pub fn consume(
+    xml: &str,
+    sp: &SpParams,
+    idp: &IdpMetadata,
+    now: OffsetDateTime,
+    clock_skew: Duration,
+) -> Result<VerifiedResponse, SamlError> {
+    // 1. Cryptographically verify the signature against the pinned IdP cert(s).
+    //    `trusted_keys_only` ignores any cert embedded in the document's
+    //    KeyInfo, so an attacker can't substitute their own key.
+    let verified_uris = verify_signature(xml, &idp.signing_certs_der)?;
+
+    // 2. Parse for semantic validation.
+    let doc = Document::parse(xml).map_err(|e| SamlError::Xml(e.to_string()))?;
+    let root = doc.root_element();
+    if root.tag_name().name() != "Response" {
+        return Err(SamlError::MissingElement("Response".into()));
+    }
+    let response_id = root.attribute("ID").map(str::to_owned);
+    let in_response_to = root.attribute("InResponseTo").map(str::to_owned);
+
+    // 3. Status must be Success.
+    let status_value = root
+        .descendants()
+        .find(|n| n.is_element() && n.tag_name().name() == "StatusCode")
+        .and_then(|sc| sc.attribute("Value"))
+        .unwrap_or("");
+    if status_value != STATUS_SUCCESS && !status_value.ends_with(":Success") {
+        return Err(SamlError::Status(status_value.to_owned()));
+    }
+
+    // 4. Destination (if the IdP set one) must be our ACS.
+    if let Some(dest) = root.attribute("Destination") {
+        if !urls_equal(dest, &sp.acs_url) {
+            return Err(SamlError::DestinationMismatch);
+        }
+    }
+
+    // 5. Exactly one (unencrypted) Assertion.
+    if root
+        .descendants()
+        .any(|n| n.is_element() && n.tag_name().name() == "EncryptedAssertion")
+    {
+        return Err(SamlError::EncryptedAssertionUnsupported);
+    }
+    let assertions: Vec<Node<'_, '_>> = root
+        .children()
+        .filter(|c| c.is_element() && c.tag_name().name() == "Assertion")
+        .collect();
+    if assertions.len() != 1 {
+        return Err(SamlError::AssertionCount(assertions.len()));
+    }
+    let assertion = assertions[0];
+    let assertion_id = assertion
+        .attribute("ID")
+        .map(str::to_owned)
+        .ok_or_else(|| SamlError::MissingElement("Assertion/@ID".into()))?;
+
+    // 6. The signature must actually cover the assertion we're about to trust:
+    //    either the assertion itself, the enclosing response, or the whole
+    //    document. (bergshamra's strict_verification already constrains where
+    //    the signed element may sit; this ties it to *our* assertion.)
+    let covers_assertion = verified_uris.iter().any(|u| {
+        u.is_empty()
+            || u == &format!("#{assertion_id}")
+            || response_id
+                .as_ref()
+                .is_some_and(|rid| u == &format!("#{rid}"))
+    });
+    if !covers_assertion {
+        return Err(SamlError::SignatureScope);
+    }
+
+    // 7. Issuer must be the configured IdP.
+    let issuer = first_child(assertion, "Issuer")
+        .map(text_of)
+        .unwrap_or_default();
+    if !idp.entity_id.is_empty() && issuer != idp.entity_id {
+        return Err(SamlError::IssuerMismatch);
+    }
+
+    // 8. Subject → NameID + SubjectConfirmationData time/recipient checks.
+    let subject = first_child(assertion, "Subject")
+        .ok_or_else(|| SamlError::MissingElement("Subject".into()))?;
+    let name_id = first_child(subject, "NameID")
+        .map(text_of)
+        .filter(|s| !s.is_empty())
+        .ok_or_else(|| SamlError::MissingElement("NameID".into()))?;
+    if let Some(scd) = subject
+        .descendants()
+        .find(|n| n.is_element() && n.tag_name().name() == "SubjectConfirmationData")
+    {
+        if let Some(recipient) = scd.attribute("Recipient") {
+            if !urls_equal(recipient, &sp.acs_url) {
+                return Err(SamlError::DestinationMismatch);
+            }
+        }
+        if let Some(noa) = scd.attribute("NotOnOrAfter") {
+            let noa = parse_instant(noa)?;
+            if now >= noa + clock_skew {
+                return Err(SamlError::TimeBounds);
+            }
+        }
+    }
+
+    // 9. Conditions: time window + audience.
+    let conditions = first_child(assertion, "Conditions");
+    if let Some(cond) = conditions {
+        if let Some(nb) = cond.attribute("NotBefore") {
+            let nb = parse_instant(nb)?;
+            if now < nb - clock_skew {
+                return Err(SamlError::TimeBounds);
+            }
+        }
+    }
+    let assertion_expiry = conditions
+        .and_then(|c| c.attribute("NotOnOrAfter"))
+        .map(parse_instant)
+        .transpose()?
+        .ok_or_else(|| SamlError::MissingElement("Conditions/@NotOnOrAfter".into()))?;
+    if now >= assertion_expiry + clock_skew {
+        return Err(SamlError::TimeBounds);
+    }
+
+    let audience_ok = conditions.is_some_and(|c| {
+        c.descendants()
+            .filter(|n| n.is_element() && n.tag_name().name() == "Audience")
+            .any(|a| text_of(a) == sp.entity_id)
+    });
+    if !audience_ok {
+        return Err(SamlError::AudienceMismatch);
+    }
+
+    // 10. Optional: SessionIndex + display-name attribute.
+    let session_index = assertion
+        .descendants()
+        .find(|n| n.is_element() && n.tag_name().name() == "AuthnStatement")
+        .and_then(|a| a.attribute("SessionIndex"))
+        .map(str::to_owned);
+
+    let display_name = extract_display_name(assertion);
+
+    Ok(VerifiedResponse {
+        principal: VerifiedPrincipal {
+            email: name_id.clone(),
+            name_id,
+            display_name,
+        },
+        in_response_to,
+        assertion_id,
+        assertion_expiry,
+        session_index,
+    })
+}
+
+/// Verify the document's XML-DSig against each pinned IdP cert in turn
+/// (handles key rotation), returning the verified `<Reference>` URIs.
+fn verify_signature(xml: &str, certs_der: &[Vec<u8>]) -> Result<Vec<String>, SamlError> {
+    let mut last_err = String::from("no signing certificate matched");
+    for der in certs_der {
+        let key = match bergshamra::keys::loader::load_x509_cert_der(der) {
+            Ok(k) => k,
+            Err(e) => {
+                last_err = e.to_string();
+                continue;
+            }
+        };
+        let mut km = bergshamra::keys::KeysManager::new();
+        km.add_key(key);
+        // trusted_keys_only: only ever trust the pinned IdP key, never an
+        // inline KeyInfo cert. strict_verification: XSW positional defense.
+        let ctx = bergshamra::DsigContext::new(km)
+            .with_trusted_keys_only(true)
+            .with_strict_verification(true);
+        match bergshamra::verify(&ctx, xml) {
+            Ok(bergshamra::VerifyResult::Valid { references, .. }) => {
+                return Ok(references.into_iter().map(|r| r.uri).collect());
+            }
+            Ok(bergshamra::VerifyResult::Invalid { reason }) => last_err = reason,
+            Err(e) => last_err = e.to_string(),
+        }
+    }
+    Err(SamlError::Signature(last_err))
+}
+
+/// Pull a display name from the assertion's attribute statement, trying the
+/// common attribute names IdPs use (FleetDM checks the same set).
+fn extract_display_name(assertion: Node<'_, '_>) -> Option<String> {
+    const WANTED: &[&str] = &[
+        "name",
+        "displayname",
+        "cn",
+        "urn:oid:2.5.4.3",
+        "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
+    ];
+    for attr in assertion
+        .descendants()
+        .filter(|n| n.is_element() && n.tag_name().name() == "Attribute")
+    {
+        let key = attr
+            .attribute("Name")
+            .or_else(|| attr.attribute("FriendlyName"))
+            .unwrap_or("")
+            .to_ascii_lowercase();
+        if WANTED.contains(&key.as_str()) {
+            if let Some(val) = attr
+                .descendants()
+                .find(|n| n.is_element() && n.tag_name().name() == "AttributeValue")
+            {
+                let v = text_of(val);
+                if !v.is_empty() {
+                    return Some(v);
+                }
+            }
+        }
+    }
+    None
+}
+
+fn first_child<'a, 'i>(n: Node<'a, 'i>, local: &str) -> Option<Node<'a, 'i>> {
+    n.children()
+        .find(|c| c.is_element() && c.tag_name().name() == local)
+}
+
+fn text_of(n: Node<'_, '_>) -> String {
+    n.children()
+        .filter(Node::is_text)
+        .filter_map(|c| c.text())
+        .collect::<String>()
+        .trim()
+        .to_owned()
+}
+
+/// Parse an `xs:dateTime` (e.g. `2026-05-31T12:00:00.000Z`).
+fn parse_instant(s: &str) -> Result<OffsetDateTime, SamlError> {
+    OffsetDateTime::parse(s.trim(), &Rfc3339).map_err(|e| SamlError::Timestamp(format!("{s}: {e}")))
+}
+
+/// Compare two URLs for SAML endpoint-matching purposes: exact, or differing
+/// only by a single trailing slash.
+fn urls_equal(a: &str, b: &str) -> bool {
+    a == b || a.trim_end_matches('/') == b.trim_end_matches('/')
+}

crates/core/src/saml/tests.rs

@@ -0,0 +1,287 @@
+//! End-to-end SAML SP tests.
+//!
+//! We mint a throwaway self-signed cert/key with `rcgen`, sign a SAML Response
+//! template with `bergshamra::sign` (the same engine that verifies it), and
+//! drive [`response::consume`] through the accept path and every reject path.
+//! This proves both the signature wiring and the SP-semantic checks.
+
+use time::format_description::well_known::Rfc3339;
+use time::{Duration, OffsetDateTime};
+
+use super::metadata::IdpMetadata;
+use super::{response, SamlError, SpParams};
+
+const SP_ENTITY: &str = "https://pxe.example.com";
+const ACS: &str = "https://pxe.example.com/api/sso/acs";
+const IDP_ENTITY: &str = "https://idp.example.com/realms/fleet";
+const EMAIL: &str = "[email protected]";
+
+struct TestIdp {
+    cert_der: Vec<u8>,
+    key_pem: String,
+}
+
+fn test_idp() -> TestIdp {
+    let ck = rcgen::generate_simple_self_signed(vec!["idp.example.com".to_string()]).unwrap();
+    TestIdp {
+        cert_der: ck.cert.der().as_ref().to_vec(),
+        key_pem: ck.key_pair.serialize_pem(),
+    }
+}
+
+fn fmt(t: OffsetDateTime) -> String {
+    t.replace_nanosecond(0).unwrap().format(&Rfc3339).unwrap()
+}
+
+/// Knobs for building a response template — defaults are a valid response.
+struct Resp {
+    issuer: String,
+    audience: String,
+    status: String,
+    not_before: OffsetDateTime,
+    not_on_or_after: OffsetDateTime,
+    in_response_to: Option<String>,
+    recipient: String,
+}
+
+impl Default for Resp {
+    fn default() -> Self {
+        let now = OffsetDateTime::now_utc();
+        Self {
+            issuer: IDP_ENTITY.into(),
+            audience: SP_ENTITY.into(),
+            status: "urn:oasis:names:tc:SAML:2.0:status:Success".into(),
+            not_before: now - Duration::minutes(5),
+            not_on_or_after: now + Duration::hours(1),
+            in_response_to: Some("_req-abc".into()),
+            recipient: ACS.into(),
+        }
+    }
+}
+
+impl Resp {
+    /// The unsigned template (a `<ds:Signature>` with empty values).
+    fn template(&self) -> String {
+        let now = fmt(OffsetDateTime::now_utc());
+        let irt = self
+            .in_response_to
+            .as_ref()
+            .map(|v| format!(r#" InResponseTo="{v}""#))
+            .unwrap_or_default();
+        format!(
+            r##"<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_resp1" Version="2.0" IssueInstant="{now}" Destination="{ACS}"{irt}>
+  <saml:Issuer>{issuer}</saml:Issuer>
+  <samlp:Status><samlp:StatusCode Value="{status}"/></samlp:Status>
+  <saml:Assertion ID="_assertion1" Version="2.0" IssueInstant="{now}">
+    <saml:Issuer>{issuer}</saml:Issuer>
+    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+      <ds:SignedInfo>
+        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+        <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256"/>
+        <ds:Reference URI="#_assertion1">
+          <ds:Transforms>
+            <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
+            <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+          </ds:Transforms>
+          <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
+          <ds:DigestValue></ds:DigestValue>
+        </ds:Reference>
+      </ds:SignedInfo>
+      <ds:SignatureValue></ds:SignatureValue>
+    </ds:Signature>
+    <saml:Subject>
+      <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">{EMAIL}</saml:NameID>
+      <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
+        <saml:SubjectConfirmationData Recipient="{recipient}" NotOnOrAfter="{noa}"{irt}/>
+      </saml:SubjectConfirmation>
+    </saml:Subject>
+    <saml:Conditions NotBefore="{nb}" NotOnOrAfter="{noa}">
+      <saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction>
+    </saml:Conditions>
+    <saml:AuthnStatement AuthnInstant="{now}" SessionIndex="sess-123">
+      <saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef></saml:AuthnContext>
+    </saml:AuthnStatement>
+    <saml:AttributeStatement>
+      <saml:Attribute Name="displayName"><saml:AttributeValue>Miles Ward</saml:AttributeValue></saml:Attribute>
+    </saml:AttributeStatement>
+  </saml:Assertion>
+</samlp:Response>"##,
+            issuer = self.issuer,
+            status = self.status,
+            audience = self.audience,
+            recipient = self.recipient,
+            nb = fmt(self.not_before),
+            noa = fmt(self.not_on_or_after),
+        )
+    }
+}
+
+fn sign(template: &str, key_pem: &str) -> String {
+    let key = bergshamra::keys::loader::load_pem_auto(key_pem.as_bytes(), None)
+        .expect("load test signing key");
+    let mut km = bergshamra::keys::KeysManager::new();
+    km.add_key(key);
+    let ctx = bergshamra::DsigContext::new(km);
+    bergshamra::sign(&ctx, template).expect("sign test response")
+}
+
+fn sp() -> SpParams {
+    SpParams {
+        entity_id: SP_ENTITY.into(),
+        acs_url: ACS.into(),
+    }
+}
+
+fn idp(cert_der: Vec<u8>) -> IdpMetadata {
+    IdpMetadata {
+        entity_id: IDP_ENTITY.into(),
+        sso_redirect_url: None,
+        sso_post_url: None,
+        signing_certs_der: vec![cert_der],
+    }
+}
+
+fn consume(xml: &str, cert_der: Vec<u8>) -> Result<response::VerifiedResponse, SamlError> {
+    response::consume(
+        xml,
+        &sp(),
+        &idp(cert_der),
+        OffsetDateTime::now_utc(),
+        Duration::seconds(60),
+    )
+}
+
+#[test]
+fn good_response_yields_principal() {
+    let t = test_idp();
+    let signed = sign(&Resp::default().template(), &t.key_pem);
+    let out = consume(&signed, t.cert_der).expect("valid response should verify");
+    assert_eq!(out.principal.email, EMAIL);
+    assert_eq!(out.principal.name_id, EMAIL);
+    assert_eq!(out.principal.display_name.as_deref(), Some("Miles Ward"));
+    assert_eq!(out.in_response_to.as_deref(), Some("_req-abc"));
+    assert_eq!(out.assertion_id, "_assertion1");
+    assert_eq!(out.session_index.as_deref(), Some("sess-123"));
+}
+
+#[test]
+fn tampered_assertion_is_rejected() {
+    let t = test_idp();
+    let signed = sign(&Resp::default().template(), &t.key_pem);
+    // Flip the subject email after signing — breaks the digest.
+    let tampered = signed.replace(EMAIL, "[email protected]");
+    assert_ne!(signed, tampered);
+    assert!(matches!(
+        consume(&tampered, t.cert_der),
+        Err(SamlError::Signature(_) | SamlError::SignatureScope)
+    ));
+}
+
+#[test]
+fn unsigned_response_is_rejected() {
+    let t = test_idp();
+    // Feed the *unsigned* template (empty SignatureValue) straight in.
+    let unsigned = Resp::default().template();
+    assert!(matches!(
+        consume(&unsigned, t.cert_der),
+        Err(SamlError::Signature(_))
+    ));
+}
+
+#[test]
+fn wrong_signing_key_is_rejected() {
+    let signer = test_idp();
+    let other = test_idp(); // different keypair pinned as the "IdP" cert
+    let signed = sign(&Resp::default().template(), &signer.key_pem);
+    assert!(matches!(
+        consume(&signed, other.cert_der),
+        Err(SamlError::Signature(_))
+    ));
+}
+
+#[test]
+fn wrong_audience_is_rejected() {
+    let t = test_idp();
+    let r = Resp {
+        audience: "https://someone-else.example".into(),
+        ..Resp::default()
+    };
+    let signed = sign(&r.template(), &t.key_pem);
+    assert!(matches!(
+        consume(&signed, t.cert_der),
+        Err(SamlError::AudienceMismatch)
+    ));
+}
+
+#[test]
+fn expired_assertion_is_rejected() {
+    let t = test_idp();
+    let now = OffsetDateTime::now_utc();
+    let r = Resp {
+        not_before: now - Duration::hours(2),
+        not_on_or_after: now - Duration::hours(1),
+        ..Resp::default()
+    };
+    let signed = sign(&r.template(), &t.key_pem);
+    assert!(matches!(
+        consume(&signed, t.cert_der),
+        Err(SamlError::TimeBounds)
+    ));
+}
+
+#[test]
+fn future_assertion_is_rejected() {
+    let t = test_idp();
+    let now = OffsetDateTime::now_utc();
+    let r = Resp {
+        not_before: now + Duration::hours(1),
+        not_on_or_after: now + Duration::hours(2),
+        ..Resp::default()
+    };
+    let signed = sign(&r.template(), &t.key_pem);
+    assert!(matches!(
+        consume(&signed, t.cert_der),
+        Err(SamlError::TimeBounds)
+    ));
+}
+
+#[test]
+fn wrong_issuer_is_rejected() {
+    let t = test_idp();
+    let r = Resp {
+        issuer: "https://evil-idp.example".into(),
+        ..Resp::default()
+    };
+    let signed = sign(&r.template(), &t.key_pem);
+    assert!(matches!(
+        consume(&signed, t.cert_der),
+        Err(SamlError::IssuerMismatch)
+    ));
+}
+
+#[test]
+fn non_success_status_is_rejected() {
+    let t = test_idp();
+    let r = Resp {
+        status: "urn:oasis:names:tc:SAML:2.0:status:Requester".into(),
+        ..Resp::default()
+    };
+    let signed = sign(&r.template(), &t.key_pem);
+    assert!(matches!(
+        consume(&signed, t.cert_der),
+        Err(SamlError::Status(_))
+    ));
+}
+
+#[test]
+fn idp_initiated_has_no_in_response_to() {
+    // No InResponseTo => the HTTP layer must gate it behind allow_idp_initiated.
+    let t = test_idp();
+    let r = Resp {
+        in_response_to: None,
+        ..Resp::default()
+    };
+    let signed = sign(&r.template(), &t.key_pem);
+    let out = consume(&signed, t.cert_der).expect("unsolicited but otherwise valid");
+    assert!(out.in_response_to.is_none());
+}

crates/core/src/sso.rs

@@ -1,16 +1,17 @@
-//! SAML SSO configuration — FleetDM-shaped, storage-only for v0.4.5.
+//! SAML SSO configuration — FleetDM-shaped.
 //!
 //! The operator pastes their IdP's metadata XML (or its URL) and a
-//! human-readable label; v0.4.5 just persists it. The actual SAML
+//! human-readable label. As of v0.5.1 the SAML login flow is wired
-//! response-validation / JIT-provisioning flow lands in a later release
+//! end-to-end (see [`crate::saml`]): SP-initiated AuthnRequest, the ACS
-//! — for now we cover the "configurable" half so an operator can teach
+//! endpoint, pure-Rust signature verification, and operator-session
-//! OpenPXE about their IdP today and flip the switch on next upgrade.
+//! minting. This module owns only the persisted *configuration*.
 //!
 //! Shape borrowed from <https://github.com/fleetdm/fleet>'s app-config
-//! SSO block, minus the user-RBAC fields (OpenPXE is single-tier: you
+//! SSO block, minus the user-RBAC fields (OpenPXE is single-tier: any
-//! have access or you don't). Entity ID is omitted from the operator
+//! IdP-authenticated user the SP cryptographically verifies gets an
-//! UI per the v0.4.5 brief — it defaults to the advertised public base
+//! operator session; there is no per-user role table). Entity ID is
-//! URL when SAML wiring lands, which is what most IdPs expect anyway.
+//! exposed (FleetDM-style) but defaults to the advertised public base
+//! URL when blank, which is what most IdPs expect anyway.
 
 use parking_lot::RwLock;
 use serde::{Deserialize, Serialize};
@@ -47,6 +48,18 @@ pub struct SsoConfig {
     /// future SAML flow; not validated here beyond a basic length cap.
     #[serde(default)]
     pub metadata_url: String,
+    /// SP Entity ID advertised to the IdP — mirrors FleetDM's "Entity ID".
+    /// Must exactly match the SP/Relying-Party entry configured on the IdP.
+    /// Empty falls back to the advertised public base URL at runtime, which
+    /// is what most IdPs expect. Length-capped at [`MAX_URL_LEN`].
+    #[serde(default)]
+    pub entity_id: String,
+    /// Allow IdP-initiated login — an unsolicited `<Response>` POSTed to the
+    /// ACS with no `InResponseTo`. Mirrors FleetDM's "Allow SSO login
+    /// initiated by identity provider". Default off; SP-initiated (the
+    /// "Sign in with X" button) is always allowed regardless.
+    #[serde(default)]
+    pub allow_idp_initiated: bool,
 }
 
 impl SsoConfig {
@@ -56,8 +69,7 @@ impl SsoConfig {
     /// surface a yellow "configured but not live yet" hint.
     #[must_use]
     pub fn is_usable(&self) -> bool {
-        self.enabled
+        self.enabled && (!self.metadata.trim().is_empty() || !self.metadata_url.trim().is_empty())
-            && (!self.metadata.trim().is_empty() || !self.metadata_url.trim().is_empty())
     }
 }
 
@@ -108,6 +120,12 @@ impl SsoStore {
         cfg.idp_logo_url = cfg.idp_logo_url.trim().to_string();
         cfg.metadata = cfg.metadata.trim().to_string();
         cfg.metadata_url = cfg.metadata_url.trim().to_string();
+        cfg.entity_id = cfg.entity_id.trim().to_string();
+        if cfg.entity_id.len() > MAX_URL_LEN {
+            return Err(Error::Invalid(format!(
+                "entity_id exceeds {MAX_URL_LEN}-char cap"
+            )));
+        }
         if cfg.metadata.len() > MAX_METADATA_BYTES {
             return Err(Error::Invalid(format!(
                 "metadata XML exceeds {MAX_METADATA_BYTES}-byte cap"
@@ -217,6 +235,8 @@ mod tests {
             metadata: String::new(),
             metadata_url: "https://idp.example.com/metadata".into(),
             idp_logo_url: String::new(),
+            entity_id: String::new(),
+            allow_idp_initiated: false,
         })
         .unwrap();
         drop(s);
@@ -239,6 +259,8 @@ mod tests {
             metadata: xml.into(),
             metadata_url: String::new(),
             idp_logo_url: String::new(),
+            entity_id: String::new(),
+            allow_idp_initiated: false,
         })
         .unwrap();
         assert!(s.snapshot().is_usable());
@@ -254,6 +276,8 @@ mod tests {
             metadata: String::new(),
             metadata_url: String::new(),
             idp_logo_url: String::new(),
+            entity_id: String::new(),
+            allow_idp_initiated: false,
         });
         assert!(matches!(r, Err(Error::Invalid(_))));
         // …and a disabled blank config is fine.
@@ -270,6 +294,8 @@ mod tests {
             metadata: String::new(),
             metadata_url: "ftp://idp.example.com/metadata".into(),
             idp_logo_url: String::new(),
+            entity_id: String::new(),
+            allow_idp_initiated: false,
         });
         assert!(matches!(r, Err(Error::Invalid(_))));
     }
@@ -287,6 +313,8 @@ mod tests {
             metadata: String::new(),
             metadata_url: String::new(),
             idp_logo_url: "data:image/png;base64,...".into(),
+            entity_id: String::new(),
+            allow_idp_initiated: false,
         });
         assert!(matches!(r, Err(Error::Invalid(_))));
         // Real HTTPS URL is fine.
@@ -296,9 +324,51 @@ mod tests {
             metadata: String::new(),
             metadata_url: String::new(),
             idp_logo_url: "https://idp.example.com/logo.png".into(),
+            entity_id: String::new(),
+            allow_idp_initiated: false,
         })
         .unwrap();
-        assert_eq!(s.snapshot().idp_logo_url, "https://idp.example.com/logo.png");
+        assert_eq!(
+            s.snapshot().idp_logo_url,
+            "https://idp.example.com/logo.png"
+        );
+    }
+
+    #[test]
+    fn entity_id_and_idp_initiated_round_trip() {
+        // v0.5.1: SP Entity ID + IdP-initiated toggle persist across reload.
+        let dir = tempdir().unwrap();
+        let s = SsoStore::load_or_default(dir.path());
+        s.replace(SsoConfig {
+            enabled: true,
+            idp_name: "Keycloak".into(),
+            metadata: String::new(),
+            metadata_url: "https://idp.example.com/metadata".into(),
+            idp_logo_url: String::new(),
+            entity_id: "https://pxe.example.com".into(),
+            allow_idp_initiated: true,
+        })
+        .unwrap();
+        drop(s);
+        let cfg = SsoStore::load_or_default(dir.path()).snapshot();
+        assert_eq!(cfg.entity_id, "https://pxe.example.com");
+        assert!(cfg.allow_idp_initiated);
+    }
+
+    #[test]
+    fn entity_id_cap_enforced() {
+        let dir = tempdir().unwrap();
+        let s = SsoStore::load_or_default(dir.path());
+        let r = s.replace(SsoConfig {
+            enabled: false,
+            idp_name: String::new(),
+            metadata: String::new(),
+            metadata_url: String::new(),
+            idp_logo_url: String::new(),
+            entity_id: "x".repeat(MAX_URL_LEN + 1),
+            allow_idp_initiated: false,
+        });
+        assert!(matches!(r, Err(Error::Invalid(_))));
     }
 
     #[test]
@@ -312,6 +382,8 @@ mod tests {
             metadata: oversize,
             metadata_url: String::new(),
             idp_logo_url: String::new(),
+            entity_id: String::new(),
+            allow_idp_initiated: false,
         });
         assert!(matches!(r, Err(Error::Invalid(_))));
     }

crates/core/src/wol.rs

@@ -0,0 +1,210 @@
+//! Wake-on-LAN.
+//!
+//! v0.5.0: from the Hosts tab, an operator can wake a bound machine.
+//! WoL is a "magic packet" — six `0xFF` bytes followed by the target
+//! MAC repeated sixteen times (102 bytes total) — broadcast on the
+//! local segment. The NIC's WoL logic matches the repeated MAC and
+//! powers the board on.
+//!
+//! ## Why this is trivial and safe in our container
+//!
+//! - It's a single UDP datagram to a broadcast address. No privileged
+//!   *local* port is needed (we bind an ephemeral source port); the
+//!   destination port is conventionally 9 (discard) or 7 (echo), and
+//!   nothing actually listens there — the magic is in the payload, not
+//!   the port. So WoL works without any extra capability.
+//! - We send to the limited broadcast `255.255.255.255` (stays on the
+//!   local link) and, when the caller knows the server's own subnet
+//!   broadcast, to that too — directed broadcast reaches the right VLAN
+//!   even when the host bridges multiple segments.
+//!
+//! ## Limits
+//!
+//! WoL only crosses L2. If the target is on a different subnet than the
+//! OpenPXE host, the intervening router must be configured to forward
+//! directed broadcasts (most aren't, by design). For the common case —
+//! OpenPXE and its PXE clients on the same VLAN — the limited broadcast
+//! is enough.
+
+use crate::{Error, Result};
+use std::net::{Ipv4Addr, SocketAddrV4, UdpSocket};
+
+/// Conventional WoL destination port. 9 (discard) is the de-facto
+/// default; the port is immaterial since the match is on the payload.
+const WOL_PORT: u16 = 9;
+
+/// Parse a MAC string in any common form (`aa:bb:cc:dd:ee:ff`,
+/// `aa-bb-...`, `aabb.ccdd.eeff`, or bare hex) into six octets.
+///
+/// Returns `Error::Invalid` if it doesn't resolve to exactly six bytes.
+pub fn parse_mac(mac: &str) -> Result<[u8; 6]> {
+    // Strip every non-hex-digit, then expect exactly 12 hex chars.
+    let hex: String = mac.chars().filter(char::is_ascii_hexdigit).collect();
+    if hex.len() != 12 {
+        return Err(Error::Invalid(format!(
+            "invalid MAC '{mac}': expected 6 octets (12 hex digits), got {}",
+            hex.len()
+        )));
+    }
+    let mut out = [0u8; 6];
+    for (i, byte) in out.iter_mut().enumerate() {
+        // Each octet is two hex chars; unwrap is safe — we validated
+        // the length and that every char is a hex digit above.
+        *byte = u8::from_str_radix(&hex[i * 2..i * 2 + 2], 16)
+            .map_err(|e| Error::Invalid(format!("invalid MAC '{mac}': {e}")))?;
+    }
+    Ok(out)
+}
+
+/// Build the 102-byte magic packet for `mac`.
+#[must_use]
+pub fn magic_packet(mac: [u8; 6]) -> [u8; 102] {
+    let mut pkt = [0u8; 102];
+    // 6 bytes of 0xFF.
+    for b in &mut pkt[..6] {
+        *b = 0xFF;
+    }
+    // MAC repeated 16 times.
+    for rep in 0..16 {
+        let start = 6 + rep * 6;
+        pkt[start..start + 6].copy_from_slice(&mac);
+    }
+    pkt
+}
+
+/// Send a Wake-on-LAN magic packet for `mac` to every address in
+/// `broadcasts` (e.g. `255.255.255.255` plus the server's subnet
+/// broadcast). Returns the number of broadcast addresses the packet was
+/// successfully sent to; errors only if the MAC is malformed or the
+/// socket can't be opened at all.
+pub fn wake(mac: &str, broadcasts: &[Ipv4Addr]) -> Result<usize> {
+    let parsed = parse_mac(mac)?;
+    let packet = magic_packet(parsed);
+
+    // Always include the limited broadcast even if the caller didn't —
+    // it's the one that works with zero network configuration.
+    let mut targets: Vec<Ipv4Addr> = vec![Ipv4Addr::BROADCAST];
+    for b in broadcasts {
+        if !targets.contains(b) {
+            targets.push(*b);
+        }
+    }
+
+    let sent = send_magic(&packet, &targets, WOL_PORT)?;
+    tracing::info!(
+        target: "openpxe::wol",
+        mac = %mac, broadcasts = sent,
+        "Wake-on-LAN magic packet sent"
+    );
+    Ok(sent)
+}
+
+/// Open a broadcast-enabled UDP socket and send `packet` to every
+/// `target:port`. Returns how many sends succeeded. Errors if the
+/// socket can't be opened or if *no* target accepted the packet.
+fn send_magic(packet: &[u8], targets: &[Ipv4Addr], port: u16) -> Result<usize> {
+    // Bind an ephemeral local UDP port on all interfaces. SO_BROADCAST
+    // must be enabled to send to a broadcast address.
+    let sock = UdpSocket::bind(SocketAddrV4::new(Ipv4Addr::UNSPECIFIED, 0))
+        .map_err(|e| Error::Invalid(format!("could not open WoL socket: {e}")))?;
+    sock.set_broadcast(true)
+        .map_err(|e| Error::Invalid(format!("could not enable broadcast: {e}")))?;
+
+    let mut sent = 0usize;
+    for &addr in targets {
+        match sock.send_to(packet, SocketAddrV4::new(addr, port)) {
+            Ok(_) => sent += 1,
+            Err(e) => {
+                tracing::warn!(
+                    target: "openpxe::wol",
+                    broadcast = %addr,
+                    "WoL send failed: {e}"
+                );
+            }
+        }
+    }
+    if sent == 0 {
+        return Err(Error::Invalid(
+            "Wake-on-LAN: no broadcast address accepted the packet".into(),
+        ));
+    }
+    Ok(sent)
+}
+
+/// Compute the IPv4 broadcast address for `ip`/`mask`, if both parse.
+/// Used so the caller can include the server's own subnet broadcast
+/// alongside the limited broadcast.
+#[must_use]
+pub fn subnet_broadcast(ip: Ipv4Addr, mask: Ipv4Addr) -> Ipv4Addr {
+    let ip = u32::from(ip);
+    let mask = u32::from(mask);
+    Ipv4Addr::from(ip | !mask)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn parse_mac_accepts_common_forms() {
+        let want = [0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff];
+        assert_eq!(parse_mac("aa:bb:cc:dd:ee:ff").unwrap(), want);
+        assert_eq!(parse_mac("AA-BB-CC-DD-EE-FF").unwrap(), want);
+        assert_eq!(parse_mac("aabb.ccdd.eeff").unwrap(), want);
+        assert_eq!(parse_mac("aabbccddeeff").unwrap(), want);
+    }
+
+    #[test]
+    fn parse_mac_rejects_bad_length() {
+        assert!(parse_mac("aa:bb:cc").is_err());
+        assert!(parse_mac("").is_err());
+        assert!(parse_mac("zz:bb:cc:dd:ee:ff").is_err()); // non-hex stripped → too short
+    }
+
+    #[test]
+    fn magic_packet_shape() {
+        let pkt = magic_packet([0x01, 0x02, 0x03, 0x04, 0x05, 0x06]);
+        assert_eq!(&pkt[..6], &[0xFF; 6]);
+        // First MAC repetition.
+        assert_eq!(&pkt[6..12], &[0x01, 0x02, 0x03, 0x04, 0x05, 0x06]);
+        // Last (16th) repetition ends the packet.
+        assert_eq!(&pkt[96..102], &[0x01, 0x02, 0x03, 0x04, 0x05, 0x06]);
+    }
+
+    #[test]
+    fn subnet_broadcast_computes() {
+        assert_eq!(
+            subnet_broadcast(
+                Ipv4Addr::new(192, 168, 1, 49),
+                Ipv4Addr::new(255, 255, 255, 0)
+            ),
+            Ipv4Addr::new(192, 168, 1, 255)
+        );
+        assert_eq!(
+            subnet_broadcast(
+                Ipv4Addr::new(10, 5, 3, 7),
+                Ipv4Addr::new(255, 255, 0, 0)
+            ),
+            Ipv4Addr::new(10, 5, 255, 255)
+        );
+    }
+
+    #[test]
+    fn send_magic_delivers_intact_packet_over_loopback() {
+        // Deterministic round-trip that doesn't depend on the sandbox
+        // permitting a real L2 broadcast: bind a receiver on loopback
+        // and confirm send_magic transmits the exact 102-byte packet.
+        let rx = UdpSocket::bind(SocketAddrV4::new(Ipv4Addr::LOCALHOST, 0)).unwrap();
+        let port = rx.local_addr().unwrap().port();
+        rx.set_read_timeout(Some(std::time::Duration::from_secs(2))).unwrap();
+
+        let packet = magic_packet([0x0a, 0x1b, 0x2c, 0x3d, 0x4e, 0x5f]);
+        let sent = send_magic(&packet, &[Ipv4Addr::LOCALHOST], port).unwrap();
+        assert_eq!(sent, 1);
+
+        let mut buf = [0u8; 128];
+        let n = rx.recv(&mut buf).unwrap();
+        assert_eq!(n, 102, "magic packet should be 102 bytes");
+        assert_eq!(&buf[..102], &packet[..]);
+    }
+}

crates/http-api/Cargo.toml

@@ -4,6 +4,10 @@ version.workspace = true
 edition.workspace = true
 license.workspace = true
 authors.workspace = true
+# v0.5.0: inherit the workspace repository so CARGO_PKG_REPOSITORY is
+# populated at build time — the About-tab update check derives the
+# Gitea releases API URL from it.
+repository.workspace = true
 description = "HTTP server: ISO uploads, iPXE script generation, ISO streaming"
 
 [lints]
@@ -34,6 +38,14 @@ mime_guess.workspace = true
 uuid.workspace = true
 # v0.4.5 Forms auth: lock-free session store and cookie helpers.
 parking_lot.workspace = true
+# v0.5.0: outbound HTTP for chat webhooks (Slack/Teams/Discord) and the
+# About-tab "check for updates" call to the Gitea releases API; SMTP for
+# email notifications. Both use rustls so the static musl binary stays
+# OpenSSL-free.
+reqwest.workspace = true
+lettre.workspace = true
+# v0.5.1: decode the base64 SAMLResponse at the ACS endpoint.
+base64.workspace = true
 
 [dev-dependencies]
 tokio = { workspace = true, features = ["macros", "rt", "rt-multi-thread", "time"] }
@@ -44,3 +56,8 @@ time = { workspace = true }
 # v0.4.61: integration tests need to generate real PNG bytes for the
 # `/branding/pxe-logo` compositor; hand-rolled CRCs are too fragile.
 image = { version = "0.25", default-features = false, features = ["png"] }
+# v0.5.1: the SAML ACS integration tests mint a throwaway IdP keypair
+# (rcgen) and sign a SAMLResponse with bergshamra so the happy-path,
+# replay, and IdP-initiated-gating flows exercise real signatures.
+rcgen = "0.13"
+bergshamra = { workspace = true }

crates/http-api/src/app.rs

@@ -31,11 +31,11 @@ use axum::{
     Json, Router,
 };
 use openpxe_core::{
-    ext_for_mime, BootEvent, ClientEvent, Error, Settings, SsoConfig, ALLOWED_LOGO_MIMES,
+    ext_for_mime, wol, BootEvent, ClientEvent, Error, NotifyConfig, Settings, SsoConfig,
-    MAX_LOGO_BYTES,
+    ALLOWED_LOGO_MIMES, MAX_LOGO_BYTES,
 };
 use openpxe_ipxe_assets::asset_bytes;
-use openpxe_iso_store::{IsoCategory, IsoMeta, IsoSource, SmbAddRequest};
+use openpxe_iso_store::{IsoCategory, IsoMeta, IsoSource, NfsAddRequest, SmbAddRequest};
 use serde::Deserialize;
 use serde_json::json;
 use std::net::SocketAddr;
@@ -116,14 +116,16 @@ pub fn build_router(state: AppState) -> Router {
         .route("/api/login", post(auth_api::api_login))
         .route("/api/logout", post(auth_api::api_logout))
         .route("/api/me", get(auth_api::api_me))
-        .route(
+        .route("/api/me/credentials", put(auth_api::api_update_credentials))
-            "/api/me/credentials",
+        // SAML SSO configuration (FleetDM-shaped). Gated behind auth — the
-            put(auth_api::api_update_credentials),
+        // operator pastes their IdP metadata, Entity ID, and toggles here.
-        )
-        // v0.4.5: SAML SSO configuration (FleetDM-shaped, storage-only).
-        // The actual sign-in flow lands in a later release; this just
-        // gives operators a place to paste their IdP metadata today.
         .route("/api/sso", get(api_sso_get).put(api_sso_put))
+        // v0.5.1: SAML SP login flow (pre-auth — see the require_auth
+        // allowlist). /login redirects to the IdP, /acs consumes the signed
+        // response + mints a session, /metadata serves our SP descriptor.
+        .route("/api/sso/login", get(crate::saml_routes::sso_login))
+        .route("/api/sso/acs", post(crate::saml_routes::sso_acs))
+        .route("/api/sso/metadata", get(crate::saml_routes::sso_metadata))
         .route("/api/clients", get(api_list_clients))
         .route("/api/status", get(api_status))
         .route("/api/settings", get(api_get_settings).put(api_put_settings))
@@ -138,9 +140,21 @@ pub fn build_router(state: AppState) -> Router {
         // modules (Unraid), and no container-side configuration could
         // load a host kernel module. `smbclient` speaks SMB over a
         // plain TCP socket in userspace, works in every container.
-        .route("/api/smb-shares", get(api_smb_shares_list).post(api_smb_shares_add))
+        .route(
+            "/api/smb-shares",
+            get(api_smb_shares_list).post(api_smb_shares_add),
+        )
         .route("/api/smb-shares/:id", delete(api_smb_shares_remove))
         .route("/api/smb-shares/:id/scan", post(api_smb_shares_scan))
+        // v0.4.67: NFSv3 share manager (pure-Rust in-process client).
+        // Ships alongside SMB. Routes are parallel so the UI can
+        // reuse the same form/error/hint rendering for both.
+        .route(
+            "/api/nfs-shares",
+            get(api_nfs_shares_list).post(api_nfs_shares_add),
+        )
+        .route("/api/nfs-shares/:id", delete(api_nfs_shares_remove))
+        .route("/api/nfs-shares/:id/scan", post(api_nfs_shares_scan))
         // Phase 4: Network info (read-only) + DNS edit.
         .route("/api/network", get(api_network).put(api_network_put))
         // Phase 4: live-log stream + recent buffer for the Terminal tab.
@@ -153,9 +167,19 @@ pub fn build_router(state: AppState) -> Router {
         // pins a MAC to a boot entry; /boot.ipxe?mac=... chains directly.
         .route("/api/hosts", get(api_hosts_list).post(api_hosts_upsert))
         .route("/api/hosts/:mac", delete(api_hosts_remove))
+        // v0.5.0: Wake-on-LAN a bound host. Sends a magic packet to the
+        // limited broadcast + the server's own subnet broadcast.
+        .route("/api/hosts/:mac/wol", post(api_hosts_wol))
         // Rolling "host log" of boot events: what image actually
         // started installing on what MAC/IP, and when. Persisted to disk.
         .route("/api/boot-log", get(api_boot_log))
+        // v0.5.0: notification config (Advanced tab) + a "send test"
+        // probe. GET redacts the SMTP password.
+        .route("/api/notify", get(api_notify_get).put(api_notify_put))
+        .route("/api/notify/test", post(api_notify_test))
+        // v0.5.0: About-tab update check — queries the Gitea releases
+        // API and compares against the running version.
+        .route("/api/updates/check", get(api_updates_check))
         // Phase 5: Prometheus scrape endpoint. Plain text exposition
         // format. No auth — the metrics surface is intentionally
         // boring (counts, no payloads).
@@ -188,9 +212,7 @@ async fn api_sso_get(State(state): State<AppState>) -> Json<SsoConfig> {
 async fn api_sso_put(State(state): State<AppState>, Json(body): Json<SsoConfig>) -> Response {
     match state.sso.replace(body) {
         Ok(cfg) => (StatusCode::OK, Json(cfg)).into_response(),
-        Err(Error::Invalid(msg)) => {
+        Err(Error::Invalid(msg)) => (StatusCode::BAD_REQUEST, msg).into_response(),
-            (StatusCode::BAD_REQUEST, msg).into_response()
-        }
         Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
     }
 }
@@ -202,7 +224,15 @@ async fn index(State(state): State<AppState>) -> Response {
     // browsers re-fetch JS/CSS after an upgrade. We use the OpenPXE
     // binary version — every release ships a new value, every release
     // forces a fresh URL on each asset.
-    let html = openpxe_webui::index_html(&state.public_base_url, env!("CARGO_PKG_VERSION"));
+    // logo_rev cache-busts the brand mark / favicon independently of
+    // the release version, so an operator who swaps the custom logo
+    // sees it update on the next reload without waiting for an upgrade.
+    let html = openpxe_webui::index_html(
+        &state.public_base_url,
+        env!("CARGO_PKG_VERSION"),
+        state.branding.logo_rev(),
+        state.branding.has_logo(),
+    );
     (
         [
             (
@@ -227,8 +257,7 @@ async fn index(State(state): State<AppState>) -> Response {
 /// with the `?v=<version>` query string in index.html, the practical
 /// upper bound on caching across an upgrade is "until the operator
 /// reloads".
-const ASSET_CACHE_CONTROL: HeaderValue =
+const ASSET_CACHE_CONTROL: HeaderValue = HeaderValue::from_static("no-cache, must-revalidate");
-    HeaderValue::from_static("no-cache, must-revalidate");
 
 async fn ui_js() -> Response {
     (
@@ -305,74 +334,73 @@ async fn ui_logo(State(state): State<AppState>) -> Response {
         .into_response()
 }
 
-/// v0.4.61: PXE menu logo composed for the iPXE `console --picture`
+/// PXE boot-menu background, composed for the iPXE `console --picture`
-/// call. The operator can upload any raster image (PNG / JPEG / WebP /
+/// call. Returns a full-screen 1024×768 PNG: a dark field with the
-/// GIF) of any aspect ratio; this handler decodes it, draws it
+/// operator's uploaded logo across the top, or — when no logo is set —
-/// centered-top onto a fixed 1024×768 canvas, and returns PNG bytes.
+/// a default OpenPXE mark on the same dark field. Either way the
-/// That gives the same look as iVentoy regardless of what the operator
+/// endpoint *always* returns a valid PNG so the menu's `console
-/// uploaded — a portrait logo, a wide wordmark, a square monogram all
+/// --picture` paints a real background instead of falling through to
-/// land in the same place on the boot screen.
+/// bare text (v0.4.69 — replaces the old ASCII wordmark).
 ///
-/// SVG uploads still 404 here — iPXE can't rasterize SVG, and rather
+/// Any raster the operator uploads (PNG / JPEG / WebP / GIF) is decoded
-/// than haul in `resvg` we ask the operator to provide a raster when
+/// and transcoded to PNG here, since iPXE only consumes PNG. SVG
-/// they want a custom PXE-side logo. (The WebUI keeps using the SVG.)
+/// uploads can't be rasterized without hauling in `resvg`, so an SVG
+/// brand mark falls back to the *default* background for the PXE screen
+/// (the WebUI still renders the SVG natively in the top-left).
 async fn ui_pxe_logo(State(state): State<AppState>) -> Response {
-    let Some(path) = state.branding.logo_path() else {
+    // Resolve the operator's raster upload, if any and if it's a format
-        return (StatusCode::NOT_FOUND, "no custom logo configured").into_response();
+    // iPXE/our compositor can consume. SVG (or a missing/unreadable
+    // file) yields `None`, which composes the default background.
+    let raster: Option<Vec<u8>> = match (state.branding.logo_path(), state.branding.logo_mime()) {
+        (Some(path), Some(mime)) if mime != "image/svg+xml" => tokio::fs::read(&path).await.ok(),
+        _ => None,
     };
-    let Some(mime) = state.branding.logo_mime() else {
+
-        return (StatusCode::NOT_FOUND, "no mime recorded").into_response();
+    let composed = match tokio::task::spawn_blocking(move || {
-    };
+        openpxe_iso_store::pxe_logo::compose_pxe_background(raster.as_deref())
-    if mime == "image/svg+xml" {
+    })
-        return (
+    .await
-            StatusCode::NOT_FOUND,
+    {
-            "operator-uploaded logo is SVG; PXE menu requires a raster (PNG / JPEG / WebP / GIF)",
+        Ok(Ok(png)) => png,
-        )
+        Ok(Err(e)) => {
-            .into_response();
+            // A decode failure on the operator's upload shouldn't blank
-    }
+            // the boot screen — fall back to the default background.
-    let bytes = match tokio::fs::read(&path).await {
+            tracing::warn!(
-        Ok(b) => b,
+                target: "openpxe::http::branding",
+                error = %e, "PXE background compose failed on upload; using default"
+            );
+            match tokio::task::spawn_blocking(|| {
+                openpxe_iso_store::pxe_logo::compose_pxe_background(None)
+            })
+            .await
+            {
+                Ok(Ok(png)) => png,
+                _ => {
+                    return (
+                        StatusCode::INTERNAL_SERVER_ERROR,
+                        "failed to compose PXE background",
+                    )
+                        .into_response();
+                }
+            }
+        }
         Err(e) => {
             return (
-                StatusCode::NOT_FOUND,
+                StatusCode::INTERNAL_SERVER_ERROR,
-                format!("custom logo unreadable: {e}"),
+                format!("pxe-background task failed: {e}"),
             )
                 .into_response();
         }
     };
-    // Compose to a fixed 1024×768 PNG so the PXE menu paints the logo
-    // centered-top regardless of the operator's source dimensions. The
-    // `image` crate is pure-Rust + sync; offload to a blocking task
-    // because Lanczos resampling on a 4K source can take tens of
-    // milliseconds and we don't want to block the executor.
-    let composed =
-        match tokio::task::spawn_blocking(move || openpxe_iso_store::pxe_logo::compose_pxe_logo(&bytes))
-            .await
-        {
-            Ok(Ok(png)) => png,
-            Ok(Err(e)) => {
-                tracing::warn!(
-                    target: "openpxe::http::branding",
-                    error = %e, "failed to compose PXE logo PNG"
-                );
-                return (
-                    StatusCode::INTERNAL_SERVER_ERROR,
-                    format!("failed to compose PXE logo: {e}"),
-                )
-                    .into_response();
-            }
-            Err(e) => {
-                return (
-                    StatusCode::INTERNAL_SERVER_ERROR,
-                    format!("pxe-logo task failed: {e}"),
-                )
-                    .into_response();
-            }
-        };
     (
         [
             (header::CONTENT_TYPE, HeaderValue::from_static("image/png")),
-            (header::CACHE_CONTROL, ASSET_CACHE_CONTROL),
+            // No-cache so a freshly uploaded logo paints on the next
+            // boot without a stale composite lingering.
+            (
+                header::CACHE_CONTROL,
+                HeaderValue::from_static("no-cache, max-age=0"),
+            ),
         ],
         composed,
     )
@@ -598,11 +626,22 @@ async fn boot_sub(
                             .filter(|m| !m.is_empty());
                         state.boot_log.record(&BootEvent {
                             timestamp: time::OffsetDateTime::now_utc(),
-                            mac: mac_normalized,
+                            mac: mac_normalized.clone(),
                             ip: peer_ip,
                             target_id: entry.id.clone(),
                             target_title: format!("{} — {}", iso.filename, entry.title),
                         });
+                        // v0.5.0: fire-and-forget notification on the
+                        // canonical "a machine is imaging" moment.
+                        let who = mac_normalized
+                            .clone()
+                            .or_else(|| peer_ip.map(|ip| ip.to_string()))
+                            .unwrap_or_else(|| "an unknown client".into());
+                        spawn_notify(
+                            &state,
+                            "PXE boot started",
+                            &format!("{who} started booting {} ({}).", iso.filename, entry.title),
+                        );
                         return text_plain(render_entry(entry, &settings, base));
                     }
                 }
@@ -657,9 +696,7 @@ async fn iso_raw(
             };
             match stream_file_range(&path, headers.get(header::RANGE)).await {
                 Ok(r) => r,
-                Err(e) => {
+                Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
-                    (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response()
-                }
             }
         }
         IsoSource::Smb {
@@ -674,7 +711,10 @@ async fn iso_raw(
             if headers.get(header::RANGE).is_some() {
                 return Response::builder()
                     .status(StatusCode::RANGE_NOT_SATISFIABLE)
-                    .header(header::CONTENT_RANGE, format!("bytes */{}", meta.size_bytes))
+                    .header(
+                        header::CONTENT_RANGE,
+                        format!("bytes */{}", meta.size_bytes),
+                    )
                     .body(Body::empty())
                     .unwrap();
             }
@@ -696,6 +736,58 @@ async fn iso_raw(
                 Err(e) => (StatusCode::BAD_GATEWAY, format!("smb stream: {e}")).into_response(),
             }
         }
+        IsoSource::Nfs {
+            share_id,
+            relative_path,
+        } => {
+            // v0.4.67: NFS sources support Range requests because
+            // NFSv3 READ3 takes an explicit offset. We resolve the
+            // requested byte range here and pass start/len down to
+            // the streamer which seeks into the file via READ3.
+            let total = meta.size_bytes;
+            let range = match parse_range(headers.get(header::RANGE), total) {
+                Some(triple) => triple,
+                None if headers.get(header::RANGE).is_some() => {
+                    return Response::builder()
+                        .status(StatusCode::RANGE_NOT_SATISFIABLE)
+                        .header(header::CONTENT_RANGE, format!("bytes */{total}"))
+                        .body(Body::empty())
+                        .unwrap();
+                }
+                // No Range header — serve the whole file.
+                None => (0, total.saturating_sub(1), false),
+            };
+            let (start, end, partial) = range;
+            let len = if total == 0 { 0 } else { end - start + 1 };
+            let max_len = if total == 0 { None } else { Some(len) };
+            match state
+                .nfs_shares
+                .stream_iso(share_id, relative_path, start, max_len)
+                .await
+            {
+                Ok(stream) => {
+                    let body = Body::from_stream(stream);
+                    let status = if partial {
+                        StatusCode::PARTIAL_CONTENT
+                    } else {
+                        StatusCode::OK
+                    };
+                    let mut builder = Response::builder()
+                        .status(status)
+                        .header(header::CONTENT_TYPE, "application/octet-stream")
+                        .header(header::ACCEPT_RANGES, "bytes")
+                        .header(header::CONTENT_LENGTH, len);
+                    if partial {
+                        builder = builder.header(
+                            header::CONTENT_RANGE,
+                            format!("bytes {start}-{end}/{total}"),
+                        );
+                    }
+                    builder.body(body).unwrap()
+                }
+                Err(e) => (StatusCode::BAD_GATEWAY, format!("nfs stream: {e}")).into_response(),
+            }
+        }
     }
 }
 
@@ -960,10 +1052,7 @@ async fn api_storage_disk(State(state): State<AppState>) -> Json<serde_json::Val
 
 // ─── Branding (custom logo) ───────────────────────────────────────────────
 
-async fn api_branding_upload(
+async fn api_branding_upload(State(state): State<AppState>, mut multipart: Multipart) -> Response {
-    State(state): State<AppState>,
-    mut multipart: Multipart,
-) -> Response {
     while let Ok(Some(field)) = multipart.next_field().await {
         let name = field.name().unwrap_or("").to_string();
         if name != "file" && name != "logo" {
@@ -984,9 +1073,7 @@ async fn api_branding_upload(
         // hitting disk. Logos are tiny by definition.
         let bytes = match field.bytes().await {
             Ok(b) => b,
-            Err(e) => {
+            Err(e) => return (StatusCode::BAD_REQUEST, format!("read body: {e}")).into_response(),
-                return (StatusCode::BAD_REQUEST, format!("read body: {e}")).into_response()
-            }
         };
         if bytes.len() > MAX_LOGO_BYTES {
             return (
@@ -1014,9 +1101,7 @@ async fn api_branding_upload(
                 )
                     .into_response()
             }
-            Err(e) => {
+            Err(e) => return (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
-                return (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response()
-            }
         }
     }
     (StatusCode::BAD_REQUEST, "no 'file' part").into_response()
@@ -1095,6 +1180,19 @@ async fn api_docs() -> Json<serde_json::Value> {
                      "summary": "Re-list a share for new ISOs."},
                 ],
             },
+            {
+                "name": "NFS shares",
+                "endpoints": [
+                    {"method": "GET", "path": "/api/nfs-shares",
+                     "summary": "List configured NFSv3 shares with connection state and iso counts."},
+                    {"method": "POST", "path": "/api/nfs-shares",
+                     "summary": "Register an NFSv3 share. Body: { server, export, port? }. Auth is AUTH_SYS only; access control is by client IP on the server side."},
+                    {"method": "DELETE", "path": "/api/nfs-shares/:id",
+                     "summary": "Forget a share and drop its entries from the ISO store."},
+                    {"method": "POST", "path": "/api/nfs-shares/:id/scan",
+                     "summary": "Re-list a share for new ISOs."},
+                ],
+            },
             {
                 "name": "Network",
                 "endpoints": [
@@ -1167,10 +1265,25 @@ async fn api_docs() -> Json<serde_json::Value> {
                      "summary": "Pin a MAC to a boot target. Body: { mac, target, label }."},
                     {"method": "DELETE", "path": "/api/hosts/:mac",
                      "summary": "Remove a binding."},
+                    {"method": "POST", "path": "/api/hosts/:mac/wol",
+                     "summary": "Send a Wake-on-LAN magic packet to a bound MAC (limited + subnet broadcast)."},
                     {"method": "GET", "path": "/api/boot-log",
                      "summary": "Ring of recent boot events (timestamp, mac, ip, target)."},
                 ],
             },
+            {
+                "name": "Notifications & updates",
+                "endpoints": [
+                    {"method": "GET", "path": "/api/notify",
+                     "summary": "Current notification config (SMTP password redacted)."},
+                    {"method": "PUT", "path": "/api/notify",
+                     "summary": "Replace notification config. Body: { enabled, kind, webhook_url, smtp_* }."},
+                    {"method": "POST", "path": "/api/notify/test",
+                     "summary": "Send a test notification using the saved config."},
+                    {"method": "GET", "path": "/api/updates/check",
+                     "summary": "Compare the running version against the latest Gitea release."},
+                ],
+            },
             {
                 "name": "Operator console",
                 "endpoints": [
@@ -1509,11 +1622,13 @@ async fn api_list_clients(State(state): State<AppState>) -> Json<serde_json::Val
 
 async fn api_status(State(state): State<AppState>) -> Json<serde_json::Value> {
     let smb = state.smb.as_ref().map(|s| s.snapshot());
-    // v0.4.65: NFS replaced with SMB shares. The dashboard metric
+    // v0.4.65+v0.4.67: external storage shares — SMB (userspace
-    // shape stays similar (count + reachable) so the UI doesn't have
+    // smbclient) and NFS (in-process nfs3_client). Dashboard tile
-    // to change its top-line tiles.
+    // sums both so operators see a single "reachable shares" number.
     let smb_shares = state.smb_shares.list();
     let smb_reachable = smb_shares.iter().filter(|m| m.reachable).count();
+    let nfs_shares = state.nfs_shares.list();
+    let nfs_reachable = nfs_shares.iter().filter(|m| m.reachable).count();
     let isos = state.iso_store.list();
     let clients = state.clients.list();
     let queue_entries = state.queue.list();
@@ -1532,7 +1647,9 @@ async fn api_status(State(state): State<AppState>) -> Json<serde_json::Value> {
     state
         .metrics
         .set_queue_counts(queue_entries.len() as u64, imaging as u64);
-    state.metrics.set_nfs_active(smb_reachable as u64);
+    state
+        .metrics
+        .set_nfs_active((smb_reachable + nfs_reachable) as u64);
     state.metrics.record_http(openpxe_core::HttpRoute::Api);
     let now = time::OffsetDateTime::now_utc();
     let uptime_secs = (now - state.started_at).whole_seconds().max(0);
@@ -1547,12 +1664,13 @@ async fn api_status(State(state): State<AppState>) -> Json<serde_json::Value> {
         "ipxe_assets": openpxe_ipxe_assets::list_assets(),
         "settings": state.settings.snapshot(),
         "smb": smb,
-        // Keep the field names for now so existing UI bindings on
-        // `iso_count2` / `client_count2` / sidebar counters keep
-        // working. They cover "external storage shares" generically;
-        // v0.4.65 the source is SMB instead of NFS.
         "smb_share_count": smb_shares.len(),
         "smb_share_reachable": smb_reachable,
+        // v0.4.67: NFSv3 share counts. The dashboard tile sums these
+        // with the SMB counts above ("N shares reachable") so the
+        // top-line metric works regardless of protocol mix.
+        "nfs_share_count": nfs_shares.len(),
+        "nfs_share_reachable": nfs_reachable,
         "host_bindings": state.hosts.len(),
         "custom_logo": state.branding.has_logo(),
         "uptime_secs": uptime_secs,
@@ -1808,6 +1926,47 @@ async fn api_smb_shares_scan(
     }
 }
 
+// ─── NFS share API (v0.4.67) ───────────────────────────────────────────────
+//
+// Parallel to the SMB shares API. The pure-Rust NFSv3 client
+// (`nfs3_client`) gives us in-process listing and streaming, no
+// subprocess. Unlike SMB, NFS-sourced ISOs support HTTP Range
+// requests — NFSv3 READ3 takes an explicit offset.
+
+async fn api_nfs_shares_list(State(state): State<AppState>) -> Json<serde_json::Value> {
+    Json(json!({ "shares": state.nfs_shares.list() }))
+}
+
+async fn api_nfs_shares_add(
+    State(state): State<AppState>,
+    Json(req): Json<NfsAddRequest>,
+) -> Response {
+    match state.nfs_shares.add(req).await {
+        Ok(s) => (StatusCode::CREATED, Json(s)).into_response(),
+        Err(err) => (StatusCode::BAD_REQUEST, Json(err)).into_response(),
+    }
+}
+
+async fn api_nfs_shares_remove(
+    State(state): State<AppState>,
+    AxumPath(id): AxumPath<String>,
+) -> Response {
+    match state.nfs_shares.remove(&id).await {
+        Ok(()) => StatusCode::NO_CONTENT.into_response(),
+        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
+    }
+}
+
+async fn api_nfs_shares_scan(
+    State(state): State<AppState>,
+    AxumPath(id): AxumPath<String>,
+) -> Response {
+    match state.nfs_shares.rescan(&id).await {
+        Ok(n) => Json(json!({ "ok": true, "iso_count": n })).into_response(),
+        Err(e) => (StatusCode::BAD_REQUEST, format!("{e}")).into_response(),
+    }
+}
+
 // ─── Network info API ──────────────────────────────────────────────────────
 
 async fn api_network(State(state): State<AppState>) -> Json<serde_json::Value> {
@@ -1896,6 +2055,218 @@ async fn api_hosts_remove(
     }
 }
 
+/// v0.5.0: Wake-on-LAN a bound host. Sends a magic packet to the limited
+/// broadcast (255.255.255.255) and the server's own subnet broadcast
+/// (computed from the advertised IP + detected mask), which covers the
+/// common "same VLAN as OpenPXE" case with zero network config. We only
+/// wake MACs that are actually bound — keeps this from being an open
+/// "spray packets at any MAC" endpoint.
+async fn api_hosts_wol(State(state): State<AppState>, AxumPath(mac): AxumPath<String>) -> Response {
+    if state.hosts.lookup(&mac).is_none() {
+        return (
+            StatusCode::NOT_FOUND,
+            "no host binding for that MAC — bind it first",
+        )
+            .into_response();
+    }
+
+    // Compute the server's subnet broadcast from the advertised IP +
+    // detected mask so the packet reaches the right VLAN even if the
+    // limited broadcast is filtered. Best-effort: skip if either won't
+    // parse.
+    let server_ip = state
+        .public_base_url
+        .strip_prefix("http://")
+        .unwrap_or(&state.public_base_url)
+        .split(':')
+        .next()
+        .unwrap_or("")
+        .parse::<std::net::Ipv4Addr>();
+    let mask = state.subnet_mask.parse::<std::net::Ipv4Addr>();
+    let mut broadcasts = Vec::new();
+    if let (Ok(ip), Ok(m)) = (server_ip, mask) {
+        broadcasts.push(wol::subnet_broadcast(ip, m));
+    }
+
+    // The send is a blocking std UDP call; push it off the async
+    // executor.
+    let mac_owned = mac.clone();
+    let result = tokio::task::spawn_blocking(move || wol::wake(&mac_owned, &broadcasts)).await;
+    match result {
+        Ok(Ok(n)) => {
+            // Fire-and-forget notification — nice "someone woke a box"
+            // signal, never blocks the response.
+            spawn_notify(
+                &state,
+                "Wake-on-LAN sent",
+                &format!("OpenPXE sent a Wake-on-LAN magic packet to {mac}."),
+            );
+            Json(json!({ "ok": true, "broadcasts": n })).into_response()
+        }
+        Ok(Err(e)) => (StatusCode::BAD_REQUEST, format!("{e}")).into_response(),
+        Err(e) => (
+            StatusCode::INTERNAL_SERVER_ERROR,
+            format!("wol task failed: {e}"),
+        )
+            .into_response(),
+    }
+}
+
+// ─── Notifications (v0.5.0) ───────────────────────────────────────────────
+
+async fn api_notify_get(State(state): State<AppState>) -> Json<NotifyConfig> {
+    // Redact the SMTP password before it leaves the process.
+    Json(state.notify.snapshot().redacted())
+}
+
+async fn api_notify_put(State(state): State<AppState>, Json(cfg): Json<NotifyConfig>) -> Response {
+    match state.notify.replace(cfg) {
+        Ok(saved) => (StatusCode::OK, Json(saved.redacted())).into_response(),
+        Err(e) => (StatusCode::BAD_REQUEST, format!("{e}")).into_response(),
+    }
+}
+
+/// Send a test notification using the *currently saved* config (not the
+/// request body) so the operator validates exactly what's persisted.
+async fn api_notify_test(State(state): State<AppState>) -> Response {
+    let cfg = state.notify.snapshot();
+    match crate::notify::send(
+        &cfg,
+        "OpenPXE test notification",
+        "If you're reading this, OpenPXE notifications are wired up correctly. \
+         This is a test from the Advanced settings tab.",
+    )
+    .await
+    {
+        Ok(()) => Json(json!({ "ok": true })).into_response(),
+        Err(e) => (StatusCode::BAD_GATEWAY, e).into_response(),
+    }
+}
+
+// ─── Update check (v0.5.0) ────────────────────────────────────────────────
+
+/// Query the project's Gitea releases API for the latest published tag
+/// and compare it to the running version. This is the only outbound
+/// call OpenPXE makes that isn't operator-initiated data movement, and
+/// it's strictly on-demand (the About tab's "Check for updates" button)
+/// — never a background poll, keeping the air-gapped promise intact.
+async fn api_updates_check() -> Response {
+    let current = env!("CARGO_PKG_VERSION");
+    let Some(api) = gitea_releases_api_url() else {
+        return Json(json!({
+            "current": current,
+            "error": "repository URL not configured at build time",
+        }))
+        .into_response();
+    };
+
+    let client = match reqwest::Client::builder()
+        .timeout(std::time::Duration::from_secs(8))
+        .user_agent(concat!("OpenPXE/", env!("CARGO_PKG_VERSION")))
+        .build()
+    {
+        Ok(c) => c,
+        Err(e) => {
+            return Json(json!({ "current": current, "error": format!("client: {e}") }))
+                .into_response();
+        }
+    };
+
+    match client.get(&api).send().await {
+        Ok(resp) if resp.status().is_success() => {
+            let body: serde_json::Value = resp.json().await.unwrap_or(json!({}));
+            let latest_tag = body
+                .get("tag_name")
+                .and_then(|v| v.as_str())
+                .unwrap_or("")
+                .to_string();
+            let html_url = body
+                .get("html_url")
+                .and_then(|v| v.as_str())
+                .unwrap_or("")
+                .to_string();
+            let update_available = version_is_newer(latest_tag.trim_start_matches('v'), current);
+            Json(json!({
+                "current": current,
+                "latest": latest_tag,
+                "update_available": update_available,
+                "html_url": html_url,
+            }))
+            .into_response()
+        }
+        Ok(resp) => Json(json!({
+            "current": current,
+            "error": format!("releases API returned HTTP {}", resp.status()),
+        }))
+        .into_response(),
+        Err(e) => Json(json!({
+            "current": current,
+            "error": format!("could not reach the releases API: {e}"),
+        }))
+        .into_response(),
+    }
+}
+
+/// Derive the Gitea `releases/latest` API URL from the compile-time
+/// repository URL (`https://host/owner/repo`).
+fn gitea_releases_api_url() -> Option<String> {
+    let repo = option_env!("CARGO_PKG_REPOSITORY").unwrap_or("");
+    let rest = repo
+        .strip_prefix("https://")
+        .or_else(|| repo.strip_prefix("http://"))?;
+    let mut parts = rest.trim_end_matches('/').splitn(3, '/');
+    let host = parts.next()?;
+    let owner = parts.next()?;
+    let name = parts.next()?;
+    if host.is_empty() || owner.is_empty() || name.is_empty() {
+        return None;
+    }
+    Some(format!(
+        "https://{host}/api/v1/repos/{owner}/{name}/releases/latest"
+    ))
+}
+
+/// Compare two dotted numeric versions; `true` when `latest` is strictly
+/// newer than `current`. Non-numeric / malformed parts compare as 0, so
+/// a garbage tag never falsely reports an update.
+fn version_is_newer(latest: &str, current: &str) -> bool {
+    fn parts(v: &str) -> Vec<u64> {
+        v.split('.')
+            .map(|p| {
+                p.chars()
+                    .take_while(char::is_ascii_digit)
+                    .collect::<String>()
+            })
+            .map(|s| s.parse::<u64>().unwrap_or(0))
+            .collect()
+    }
+    let (l, c) = (parts(latest), parts(current));
+    for i in 0..l.len().max(c.len()) {
+        let lv = l.get(i).copied().unwrap_or(0);
+        let cv = c.get(i).copied().unwrap_or(0);
+        if lv != cv {
+            return lv > cv;
+        }
+    }
+    false
+}
+
+/// Fire a notification on a detached task. Never blocks the caller and
+/// never surfaces an error — boot/WoL paths must not hinge on a webhook.
+fn spawn_notify(state: &AppState, subject: &str, body: &str) {
+    let cfg = state.notify.snapshot();
+    if !cfg.is_usable() {
+        return;
+    }
+    let subject = subject.to_string();
+    let body = body.to_string();
+    tokio::spawn(async move {
+        if let Err(e) = crate::notify::send(&cfg, &subject, &body).await {
+            tracing::warn!(target: "openpxe::notify", "notification send failed: {e}");
+        }
+    });
+}
+
 // ─── Boot event log ───────────────────────────────────────────────────────
 
 async fn api_boot_log(State(state): State<AppState>) -> Json<serde_json::Value> {
@@ -1922,11 +2293,21 @@ async fn api_metrics(State(state): State<AppState>) -> Response {
     state
         .metrics
         .set_queue_counts(queue_entries.len() as u64, imaging as u64);
-    // v0.4.65: gauge tracks reachable external-storage shares. With
+    // v0.4.67: gauge tracks reachable external-storage shares
-    // NFS removed it now reflects SMB share reachability instead.
+    // across both protocols (SMB userspace + NFSv3 in-process).
-    state
+    let smb_ok = state
-        .metrics
+        .smb_shares
-        .set_nfs_active(state.smb_shares.list().iter().filter(|m| m.reachable).count() as u64);
+        .list()
+        .iter()
+        .filter(|m| m.reachable)
+        .count();
+    let nfs_ok = state
+        .nfs_shares
+        .list()
+        .iter()
+        .filter(|m| m.reachable)
+        .count();
+    state.metrics.set_nfs_active((smb_ok + nfs_ok) as u64);
 
     let now = time::OffsetDateTime::now_utc();
     let uptime = (now - state.started_at).whole_seconds().max(0) as u64;
@@ -1945,6 +2326,28 @@ async fn api_metrics(State(state): State<AppState>) -> Response {
 mod tests {
     use super::*;
 
+    #[test]
+    fn version_newer_detects_updates() {
+        assert!(version_is_newer("0.5.1", "0.5.0"));
+        assert!(version_is_newer("0.6.0", "0.5.9"));
+        assert!(version_is_newer("1.0.0", "0.9.9"));
+        assert!(!version_is_newer("0.5.0", "0.5.0"));
+        assert!(!version_is_newer("0.4.69", "0.5.0"));
+        // A garbage / empty tag must never falsely report an update.
+        assert!(!version_is_newer("", "0.5.0"));
+        assert!(!version_is_newer("not-a-version", "0.5.0"));
+    }
+
+    #[test]
+    fn gitea_api_url_derives_from_repo() {
+        // The crate inherits the workspace `repository`, so
+        // CARGO_PKG_REPOSITORY is populated and the update check has a
+        // real URL to hit (regressed once when the inherit was missing).
+        let u = gitea_releases_api_url().expect("repository must be configured at build time");
+        assert!(u.contains("/api/v1/repos/"), "got: {u}");
+        assert!(u.ends_with("/releases/latest"), "got: {u}");
+    }
+
     #[test]
     fn range_full() {
         let (s, e, p) = parse_range(None, 1000).unwrap();

crates/http-api/src/auth.rs

@@ -140,9 +140,16 @@ fn cookie_attrs(value: &str, max_age: Option<i64>) -> String {
     // never overflow i64, but clippy's `cast_possible_wrap` lint wants
     // us to be explicit. `cast_signed` is the documented form.
     let lifetime = max_age.unwrap_or_else(|| SESSION_TTL.as_secs().cast_signed());
-    format!(
+    format!("{SESSION_COOKIE}={value}; Path=/; HttpOnly; SameSite=Lax; Max-Age={lifetime}")
-        "{SESSION_COOKIE}={value}; Path=/; HttpOnly; SameSite=Lax; Max-Age={lifetime}"
+}
-    )
+
+/// Build the `Set-Cookie` header value that establishes a fresh operator
+/// session with the default 24h TTL. Exposed so the SAML ACS handler can
+/// attach an operator session to its post-login redirect, exactly as the
+/// Forms-login path does via [`login_response`].
+#[must_use]
+pub fn session_cookie(session: &str) -> String {
+    cookie_attrs(session, None)
 }
 
 fn parse_cookie(headers: &axum::http::HeaderMap) -> Option<String> {
@@ -169,9 +176,18 @@ fn is_public_path(path: &str) -> bool {
         return true;
     }
     // Auth surface and iPXE long-poll endpoints (no cookie available).
+    // The SAML SP endpoints are pre-auth by nature — the operator hasn't a
+    // session yet when they start (or arrive from) the IdP. `/api/sso`
+    // (the config GET/PUT, no trailing slash) stays gated.
     matches!(
         path,
-        "/api/setup" | "/api/login" | "/api/logout" | "/api/me"
+        "/api/setup"
+            | "/api/login"
+            | "/api/logout"
+            | "/api/me"
+            | "/api/sso/login"
+            | "/api/sso/acs"
+            | "/api/sso/metadata"
     ) || path.starts_with("/api/queue/join")
         || path.starts_with("/api/queue/poll/")
 }
@@ -222,10 +238,7 @@ pub struct SetupBody {
 /// guards against a leaked WebUI being re-bootstrapped by an attacker
 /// who's seen the deployment URL. After bootstrap, the new session
 /// cookie is set so the operator goes straight to the dashboard.
-pub async fn api_setup(
+pub async fn api_setup(State(state): State<AppState>, Json(body): Json<SetupBody>) -> Response {
-    State(state): State<AppState>,
-    Json(body): Json<SetupBody>,
-) -> Response {
     if state.admin.is_configured() {
         return (
             StatusCode::CONFLICT,
@@ -280,10 +293,7 @@ pub async fn api_login(State(state): State<AppState>, Json(body): Json<LoginBody
     login_response(StatusCode::OK, &pub_, &session)
 }
 
-pub async fn api_logout(
+pub async fn api_logout(State(state): State<AppState>, headers: axum::http::HeaderMap) -> Response {
-    State(state): State<AppState>,
-    headers: axum::http::HeaderMap,
-) -> Response {
     if let Some(t) = parse_cookie(&headers) {
         state.sessions.revoke(&t);
     }
@@ -303,12 +313,20 @@ pub async fn api_logout(
 /// * `authenticated: false` — admin exists, no session; show login.
 /// * `authenticated: true` + `user` — let the dashboard load.
 pub async fn api_me(State(state): State<AppState>, headers: axum::http::HeaderMap) -> Response {
+    // v0.5.0: include branding bootstrap so the pre-auth login/setup
+    // screens can render the FleetDM-style full-width custom logo (and
+    // cache-bust it) without an extra round trip. `/api/me` is public,
+    // and the logo asset is public, so this leaks nothing sensitive.
+    let has_custom_logo = state.branding.has_logo();
+    let logo_rev = state.branding.logo_rev();
     if !state.admin.is_configured() {
         return (
             StatusCode::OK,
             Json(json!({
                 "setup_required": true,
                 "authenticated": false,
+                "has_custom_logo": has_custom_logo,
+                "logo_rev": logo_rev,
             })),
         )
             .into_response();
@@ -323,6 +341,8 @@ pub async fn api_me(State(state): State<AppState>, headers: axum::http::HeaderMa
                 "authenticated": true,
                 "user": state.admin.snapshot(),
                 "session_user": u,
+                "has_custom_logo": has_custom_logo,
+                "logo_rev": logo_rev,
             })),
         )
             .into_response(),
@@ -331,6 +351,8 @@ pub async fn api_me(State(state): State<AppState>, headers: axum::http::HeaderMa
             Json(json!({
                 "setup_required": false,
                 "authenticated": false,
+                "has_custom_logo": has_custom_logo,
+                "logo_rev": logo_rev,
             })),
         )
             .into_response(),
@@ -437,8 +459,14 @@ mod tests {
     fn public_path_allowlist() {
         // PXE + chrome paths bypass auth.
         for p in [
-            "/", "/assets/app.js", "/boot.ipxe", "/boot/fake.ipxe",
+            "/",
-            "/iso/fake.iso", "/ipxe/snponly.efi", "/healthz", "/readyz",
+            "/assets/app.js",
+            "/boot.ipxe",
+            "/boot/fake.ipxe",
+            "/iso/fake.iso",
+            "/ipxe/snponly.efi",
+            "/healthz",
+            "/readyz",
             "/metrics",
             // v0.4.6: iPXE fetches this for `console --picture` before
             // it can possibly have a session cookie.
@@ -450,6 +478,10 @@ mod tests {
         for p in ["/api/setup", "/api/login", "/api/logout", "/api/me"] {
             assert!(is_public_path(p), "expected {p} to be public");
         }
+        // v0.5.1: SAML SP endpoints are pre-auth (no session yet).
+        for p in ["/api/sso/login", "/api/sso/acs", "/api/sso/metadata"] {
+            assert!(is_public_path(p), "expected {p} to be public");
+        }
         // iPXE long-poll endpoints are public (no cookie available).
         assert!(is_public_path("/api/queue/join"));
         assert!(is_public_path("/api/queue/poll/abc"));
@@ -471,8 +503,7 @@ mod tests {
         let mut h = axum::http::HeaderMap::new();
         h.insert(
             header::COOKIE,
-            HeaderValue::from_str(&format!("foo=bar; {SESSION_COOKIE}=abc123; baz=qux"))
+            HeaderValue::from_str(&format!("foo=bar; {SESSION_COOKIE}=abc123; baz=qux")).unwrap(),
-                .unwrap(),
         );
         assert_eq!(parse_cookie(&h).as_deref(), Some("abc123"));
         // Different name → None.

crates/http-api/src/ipxe_script.rs

@@ -30,14 +30,15 @@ use std::fmt::Write as _;
 /// Top-level OpenPXE boot menu. Serialized identically for BIOS and UEFI
 /// clients because iPXE normalises the menu primitives across firmwares.
 ///
-/// v0.4.6: rendered with an iVentoy-style polished frame — centered
+/// v0.4.69: rendered with an iVentoy-style graphical frame — a
-/// OpenPXE wordmark banner at the top (ASCII so every iPXE build can
+/// `console --picture` directive paints a full-screen PNG background
-/// paint it), a footer carrying version + arch + firmware kind, and an
+/// (the operator's uploaded logo on a dark field, or the default
-/// optional `console --picture` directive that paints the operator's
+/// OpenPXE mark) with the menu text overlaid below a reserved top
-/// uploaded raster logo on top when the iPXE binary on the wire was
+/// margin, plus a footer carrying version + arch + firmware kind. On
-/// built with PNG support. The ASCII banner is always rendered so
+/// iPXE binaries built with `IMAGE_PNG` + `CONSOLE_FRAMEBUFFER` (our
-/// even when the picture call no-ops the screen still reads as
+/// x86_64 UEFI binaries, compiled from source) the background paints;
-/// "OpenPXE — here is the menu" rather than a featureless box.
+/// on binaries without PNG support the `|| console` fallback yields a
+/// clean text menu. The old ASCII wordmark has been removed.
 #[must_use]
 pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> String {
     let mut s = String::new();
@@ -56,14 +57,20 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
     let _ = writeln!(s, "set base-url {base}");
     let _ = writeln!(s, "set esc:hex 1b");
     let _ = writeln!(s, "set cls ${{esc:string}}[2J");
-    // v0.4.6: best-effort graphics console with the operator-uploaded
+    // v0.4.69: graphical background. `/branding/pxe-logo` always
-    // raster logo. Falls back to plain text console on iPXE builds
+    // returns a full-screen 1024×768 PNG now — the operator's logo on a
-    // without PNG support — the `||` chain keeps a parse-clean
+    // dark field, or a default OpenPXE mark when none is uploaded. The
-    // single-statement form so even the strictest iPXE parsers accept
+    // `--top 290` reserves the top band (where the logo paints) so the
-    // it. The `console` reset at the end re-syncs the menu output.
+    // menu text lands below it. On an iPXE build *with* `IMAGE_PNG` +
+    // `CONSOLE_FRAMEBUFFER` (our x86_64 UEFI binaries, built from source
+    // — see deploy/docker/Dockerfile) this paints the background and
+    // overlays the menu. On a build *without* PNG support (the fetched
+    // BIOS/i386/arm64 binaries) the whole `console --picture …` command
+    // fails and the `|| console` resets to a clean full-screen text
+    // menu. Either way there's no ASCII placeholder anymore.
     let _ = writeln!(
         s,
-        "console --picture {base}/branding/pxe-logo || console"
+        "console --picture {base}/branding/pxe-logo --top 290 || console"
     );
     // Map iPXE's ${{buildarch}} + ${{platform}} into the human form the
     // user asked for (e.g. "x86 BIOS", "x86_64 UEFI", "arm64 UEFI").
@@ -77,19 +84,8 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
     );
     let _ = writeln!(s, ":menu");
     let _ = writeln!(s, "menu OpenPXE - network boot menu");
-    // ASCII OpenPXE wordmark. Works on every iPXE build, including
+    // v0.4.69: the ASCII wordmark is gone — the graphical background
-    // the boot.ipxe.org pre-builds we ship (which omit `IMAGE_PNG`,
+    // (set via `console --picture` above) carries the branding now.
-    // so `console --picture` paints nothing). When the queued iPXE
-    // source-build lands and the operator's uploaded raster actually
-    // paints via `console --picture`, this banner can be retired in
-    // favour of the real image. The compositor at
-    // /branding/pxe-logo is already wired and waiting.
-    let _ = writeln!(s, "item --gap");
-    let _ = writeln!(s, "item --gap --       ___                   ___  __  __ ___");
-    let _ = writeln!(s, "item --gap --      / _ \\ _ __  ___ _ _   | _ \\ \\/  / | __|");
-    let _ = writeln!(s, "item --gap --     | (_) | '_ \\/ -_) ' \\  |  _/  \\  /  | _|");
-    let _ = writeln!(s, "item --gap --      \\___/| .__/\\___|_||_| |_|    /_/\\_\\ |___|");
-    let _ = writeln!(s, "item --gap --           |_|");
     let _ = writeln!(s, "item --gap");
     let _ = writeln!(
         s,
@@ -631,27 +627,29 @@ mod password_tests {
 
     #[test]
     fn top_menu_has_polished_branding_and_arch_footer() {
-        // v0.4.6 polish + v0.4.62 stability fixes: the menu emits a
+        // v0.4.69: the menu emits a `console --picture` line that paints
-        // `console --picture` line that PNG-capable iPXE builds will
+        // a full-screen PNG background (the operator's logo, or the
-        // honour (queued for a follow-up release once we can rebuild
+        // default OpenPXE mark) reserving a top margin for it, then
-        // iPXE from source on native x86_64 hardware), an ASCII
+        // falls back to a clean text console on iPXE builds without PNG
-        // OpenPXE wordmark that works on every iPXE build (including
+        // support. The ASCII wordmark is gone — the graphical
-        // the boot.ipxe.org pre-builds we currently ship), and a
+        // background carries the branding now. A single-line footer
-        // single-line footer carrying the OpenPXE version + arch.
+        // still carries the OpenPXE version + arch.
         let settings = Settings::default();
         let s = render_menu(&[], &settings, "http://10.0.0.5");
         assert!(
             s.contains("console --picture http://10.0.0.5/branding/pxe-logo"),
             "missing console --picture line:\n{s}"
         );
+        // The picture call reserves a top margin for the logo band.
+        assert!(s.contains("--top 290"), "missing --top margin:\n{s}");
         // Picture-or-text-console must be a single statement so older
         // iPXE parsers don't choke on the chain.
         assert!(s.contains("|| console"), "missing graceful fallback:\n{s}");
-        // ASCII wordmark — paints on every iPXE build regardless of
+        // The ASCII wordmark must be GONE — its removal is the whole
-        // PNG support.
+        // point of v0.4.69's graphical background.
         assert!(
-            s.contains("___                   ___  __  __ ___"),
+            !s.contains("___                   ___  __  __ ___"),
-            "ASCII banner missing first row:\n{s}"
+            "ASCII banner should have been removed:\n{s}"
         );
         // Footer with version + arch interpolation. The version comes
         // from CARGO_PKG_VERSION at compile time.

crates/http-api/src/lib.rs

@@ -18,6 +18,8 @@ pub mod auth;
 pub mod ipxe_script;
 pub mod iso_fs;
 pub mod log_stream;
+pub mod notify;
+pub mod saml_routes;
 pub mod state;
 pub mod terminal;
 pub mod uploads;

crates/http-api/src/notify.rs

@@ -0,0 +1,138 @@
+//! Notification *delivery* — the network half of the notify feature.
+//!
+//! `openpxe_core::notify` owns the config + persistence; this module
+//! turns a `NotifyConfig` + a message into an actual delivery:
+//!
+//!   - Slack / Discord / Teams → HTTP POST of a provider-shaped JSON
+//!     body to the operator's incoming-webhook URL (via `reqwest`).
+//!   - SMTP → a TLS email via `lettre`.
+//!
+//! Every send is best-effort and time-bounded: a flaky webhook must
+//! never wedge a PXE boot. Callers fire these from a detached task.
+
+use openpxe_core::{NotifyConfig, NotifyKind};
+use std::time::Duration;
+
+/// Hard ceiling on any single delivery so a hung endpoint can't pin a
+/// task forever.
+const SEND_TIMEOUT: Duration = Duration::from_secs(10);
+
+/// Deliver `body` (with an optional `subject`, used as the email
+/// subject / chat bold-line) using the active provider in `cfg`.
+/// Returns `Ok(())` on success, or a human-readable error suitable for
+/// surfacing in the "Send test" response.
+pub async fn send(cfg: &NotifyConfig, subject: &str, body: &str) -> Result<(), String> {
+    if !cfg.is_usable() {
+        return Err("notifications are not enabled / fully configured".into());
+    }
+    match cfg.kind {
+        NotifyKind::Slack | NotifyKind::Discord | NotifyKind::Teams => {
+            send_webhook(cfg, subject, body).await
+        }
+        NotifyKind::Smtp => send_email(cfg, subject, body).await,
+    }
+}
+
+async fn send_webhook(cfg: &NotifyConfig, subject: &str, body: &str) -> Result<(), String> {
+    // Each chat platform wants a different JSON shape for an incoming
+    // webhook. Keep the bodies minimal and plain-text-ish so they
+    // render cleanly everywhere.
+    let combined = if subject.is_empty() {
+        body.to_string()
+    } else {
+        format!("*{subject}*\n{body}")
+    };
+    let payload = match cfg.kind {
+        NotifyKind::Slack => serde_json::json!({ "text": combined }),
+        NotifyKind::Discord => serde_json::json!({ "content": combined }),
+        NotifyKind::Teams => serde_json::json!({
+            // Legacy MessageCard — the format every Teams "Incoming
+            // Webhook" connector still accepts.
+            "@type": "MessageCard",
+            "@context": "https://schema.org/extensions",
+            "summary": if subject.is_empty() { "OpenPXE" } else { subject },
+            "title": subject,
+            "text": body,
+        }),
+        NotifyKind::Smtp => unreachable!("smtp handled separately"),
+    };
+
+    let client = reqwest::Client::builder()
+        .timeout(SEND_TIMEOUT)
+        .build()
+        .map_err(|e| format!("could not build HTTP client: {e}"))?;
+    let resp = client
+        .post(&cfg.webhook_url)
+        .json(&payload)
+        .send()
+        .await
+        .map_err(|e| format!("webhook POST failed: {e}"))?;
+    let status = resp.status();
+    if status.is_success() {
+        Ok(())
+    } else {
+        let snippet = resp
+            .text()
+            .await
+            .unwrap_or_default()
+            .chars()
+            .take(200)
+            .collect::<String>();
+        Err(format!("webhook returned HTTP {status}: {snippet}"))
+    }
+}
+
+async fn send_email(cfg: &NotifyConfig, subject: &str, body: &str) -> Result<(), String> {
+    use lettre::transport::smtp::authentication::Credentials;
+    use lettre::{AsyncSmtpTransport, AsyncTransport, Message, Tokio1Executor};
+
+    let from = if cfg.smtp_from.trim().is_empty() {
+        cfg.smtp_username.trim()
+    } else {
+        cfg.smtp_from.trim()
+    };
+    if from.is_empty() {
+        return Err("SMTP requires a From address (or a username to fall back to)".into());
+    }
+
+    let email = Message::builder()
+        .from(
+            from.parse()
+                .map_err(|e| format!("invalid From address '{from}': {e}"))?,
+        )
+        .to(cfg
+            .smtp_to
+            .trim()
+            .parse()
+            .map_err(|e| format!("invalid To address '{}': {e}", cfg.smtp_to))?)
+        .subject(if subject.is_empty() { "OpenPXE" } else { subject })
+        .body(body.to_string())
+        .map_err(|e| format!("could not build email: {e}"))?;
+
+    // Implicit TLS (465) vs STARTTLS (587). We never send plaintext.
+    let mut builder = if cfg.smtp_implicit_tls {
+        AsyncSmtpTransport::<Tokio1Executor>::relay(&cfg.smtp_host)
+            .map_err(|e| format!("SMTP relay setup failed: {e}"))?
+    } else {
+        AsyncSmtpTransport::<Tokio1Executor>::starttls_relay(&cfg.smtp_host)
+            .map_err(|e| format!("SMTP STARTTLS setup failed: {e}"))?
+    }
+    .port(cfg.smtp_port)
+    .timeout(Some(SEND_TIMEOUT));
+
+    // Auth is optional — some internal relays accept unauthenticated
+    // mail from trusted hosts. Only attach credentials when a username
+    // is set.
+    if !cfg.smtp_username.trim().is_empty() {
+        builder = builder.credentials(Credentials::new(
+            cfg.smtp_username.trim().to_string(),
+            cfg.smtp_password.clone(),
+        ));
+    }
+    let mailer = builder.build();
+    mailer
+        .send(email)
+        .await
+        .map(|_| ())
+        .map_err(|e| format!("SMTP send failed: {e}"))
+}

crates/http-api/src/saml_routes.rs

@@ -0,0 +1,338 @@
+//! SAML 2.0 Service Provider HTTP endpoints (v0.5.1).
+//!
+//! * `GET  /api/sso/login`    — SP-initiated: build an AuthnRequest, record its
+//!   ID, and 302 the browser to the IdP.
+//! * `POST /api/sso/acs`      — Assertion Consumer Service: verify + validate
+//!   the IdP's `SAMLResponse`, perform the stateful checks (InResponseTo
+//!   correlation, IdP-initiated gating, assertion replay), mint an operator
+//!   session, and 302 to the dashboard. (Mirrors FleetDM's `/sso/callback`.)
+//! * `GET  /api/sso/metadata` — serve our SP metadata XML for IdP import.
+//!
+//! Stateless crypto + semantic validation live in `openpxe_core::saml`; this
+//! module owns only the HTTP glue and the in-memory state the SP needs.
+
+use std::collections::HashMap;
+use std::sync::Arc;
+use std::time::{Duration as StdDuration, Instant};
+
+use axum::{
+    body::Body,
+    extract::{Form, Query, State},
+    http::{header, StatusCode},
+    response::{IntoResponse, Response},
+};
+use base64::Engine;
+use parking_lot::Mutex;
+use serde::Deserialize;
+use time::{Duration, OffsetDateTime};
+
+use openpxe_core::saml::{self, metadata::IdpMetadata, SamlError, SpParams};
+use openpxe_core::SsoConfig;
+
+use crate::auth;
+use crate::state::AppState;
+
+/// Outstanding AuthnRequest IDs live at most this long before a matching
+/// response is considered stale (covers a slow human at the IdP login form).
+const REQUEST_TTL: StdDuration = StdDuration::from_mins(10);
+/// How long we fetch-cache IdP metadata loaded from a URL.
+const METADATA_FETCH_TIMEOUT: StdDuration = StdDuration::from_secs(10);
+
+/// In-memory SAML runtime state. Cheap to clone (Arc-shared).
+#[derive(Clone, Default)]
+pub struct SamlRuntime {
+    /// request_id → issued_at. Correlates a response's `InResponseTo` to a
+    /// request *we* actually sent (replay / CSRF defense for SP-initiated).
+    outstanding: Arc<Mutex<HashMap<String, Instant>>>,
+    /// assertion_id → expiry. A consumed assertion may not be replayed.
+    consumed: Arc<Mutex<HashMap<String, Instant>>>,
+    /// Cache of IdP metadata fetched from a URL: (url, parsed).
+    metadata_cache: Arc<Mutex<Option<(String, IdpMetadata)>>>,
+}
+
+impl SamlRuntime {
+    /// Record an AuthnRequest we just sent.
+    pub fn register_request(&self, id: &str) {
+        let mut g = self.outstanding.lock();
+        prune(&mut g);
+        g.insert(id.to_owned(), Instant::now());
+    }
+
+    /// Consume an outstanding request ID, returning `true` if it was present
+    /// and still fresh. A miss means the response doesn't correlate to any
+    /// live request we issued.
+    pub fn take_request(&self, id: &str) -> bool {
+        let mut g = self.outstanding.lock();
+        prune(&mut g);
+        g.remove(id).is_some()
+    }
+
+    /// Record a consumed assertion. Returns `false` if it was already
+    /// consumed (a replay) — in which case the caller must reject.
+    pub fn record_assertion(&self, id: &str, expiry: OffsetDateTime) -> bool {
+        let mut g = self.consumed.lock();
+        prune(&mut g);
+        if g.contains_key(id) {
+            return false;
+        }
+        let ttl = (expiry - OffsetDateTime::now_utc())
+            .max(Duration::ZERO)
+            .unsigned_abs();
+        g.insert(id.to_owned(), Instant::now() + ttl);
+        true
+    }
+
+    fn cached_metadata(&self, url: &str) -> Option<IdpMetadata> {
+        let g = self.metadata_cache.lock();
+        match &*g {
+            Some((cached_url, md)) if cached_url == url => Some(md.clone()),
+            _ => None,
+        }
+    }
+
+    fn cache_metadata(&self, url: String, md: IdpMetadata) {
+        *self.metadata_cache.lock() = Some((url, md));
+    }
+}
+
+/// Drop expired entries so neither map grows unbounded.
+fn prune(map: &mut HashMap<String, Instant>) {
+    let now = Instant::now();
+    // For the request map this over-prunes (entries store issued_at, not
+    // expiry), so cap by REQUEST_TTL; the consumed map stores absolute
+    // expiry instants. Using saturating logic keeps both correct: request
+    // entries older than REQUEST_TTL go, consumed entries past expiry go.
+    map.retain(|_, &mut t| now.saturating_duration_since(t) < REQUEST_TTL || t > now);
+}
+
+// ─── GET /api/sso/login ───────────────────────────────────────────────────
+
+#[derive(Debug, Deserialize)]
+pub struct LoginQuery {
+    /// Optional local path to return to after login (becomes RelayState).
+    #[serde(default)]
+    pub next: Option<String>,
+}
+
+pub async fn sso_login(State(state): State<AppState>, Query(q): Query<LoginQuery>) -> Response {
+    let cfg = state.sso.snapshot();
+    if !cfg.is_usable() {
+        return redirect("/?sso_error=unavailable");
+    }
+    let idp = match resolve_idp_metadata(&state, &cfg).await {
+        Ok(m) => m,
+        Err(e) => {
+            tracing::warn!(target: "openpxe::saml", "sso_login: metadata unavailable: {e}");
+            return redirect("/?sso_error=metadata");
+        }
+    };
+    let Some(dest) = idp.sso_destination().map(str::to_owned) else {
+        tracing::warn!(target: "openpxe::saml", "sso_login: IdP metadata has no SSO endpoint");
+        return redirect("/?sso_error=metadata");
+    };
+    let sp = sp_params(&state, &cfg);
+    let relay = safe_local_path(q.next.as_deref());
+    match saml::authn_request::build(&sp, &dest, Some(&relay)) {
+        Ok(req) => {
+            state.saml.register_request(&req.id);
+            redirect(&req.location)
+        }
+        Err(e) => {
+            tracing::warn!(target: "openpxe::saml", "sso_login: build AuthnRequest failed: {e}");
+            redirect("/?sso_error=request")
+        }
+    }
+}
+
+// ─── POST /api/sso/acs ──────────────────────────────────────────────────────
+
+#[derive(Debug, Deserialize)]
+pub struct AcsForm {
+    #[serde(rename = "SAMLResponse")]
+    pub saml_response: String,
+    #[serde(rename = "RelayState", default)]
+    pub relay_state: Option<String>,
+}
+
+pub async fn sso_acs(State(state): State<AppState>, Form(form): Form<AcsForm>) -> Response {
+    let cfg = state.sso.snapshot();
+    if !cfg.is_usable() {
+        return redirect("/?sso_error=unavailable");
+    }
+    let xml = match base64::engine::general_purpose::STANDARD.decode(form.saml_response.as_bytes())
+    {
+        Ok(bytes) => String::from_utf8_lossy(&bytes).into_owned(),
+        Err(e) => {
+            tracing::warn!(target: "openpxe::saml", "acs: base64 decode failed: {e}");
+            return redirect("/?sso_error=1");
+        }
+    };
+    let idp = match resolve_idp_metadata(&state, &cfg).await {
+        Ok(m) => m,
+        Err(e) => {
+            tracing::warn!(target: "openpxe::saml", "acs: metadata unavailable: {e}");
+            return redirect("/?sso_error=metadata");
+        }
+    };
+    let sp = sp_params(&state, &cfg);
+
+    // Signature verification + semantic checks are CPU-bound — keep them off
+    // the async executor.
+    let now = OffsetDateTime::now_utc();
+    let skew = Duration::seconds(saml::DEFAULT_CLOCK_SKEW_SECS);
+    let verify = {
+        let xml = xml.clone();
+        let sp = sp.clone();
+        tokio::task::spawn_blocking(move || saml::response::consume(&xml, &sp, &idp, now, skew))
+            .await
+    };
+    let verified = match verify {
+        Ok(Ok(v)) => v,
+        Ok(Err(e)) => {
+            // Never leak which specific check failed to the browser.
+            tracing::warn!(target: "openpxe::saml", "acs: response rejected: {e}");
+            return redirect("/?sso_error=1");
+        }
+        Err(join) => {
+            tracing::error!(target: "openpxe::saml", "acs: verify task panicked: {join}");
+            return redirect("/?sso_error=1");
+        }
+    };
+
+    // Stateful checks the core deliberately left to us.
+    match &verified.in_response_to {
+        Some(id) => {
+            if !state.saml.take_request(id) {
+                tracing::warn!(target: "openpxe::saml", "acs: InResponseTo matches no live request");
+                return redirect("/?sso_error=1");
+            }
+        }
+        None => {
+            if !cfg.allow_idp_initiated {
+                tracing::warn!(target: "openpxe::saml", "acs: IdP-initiated login is disabled");
+                return redirect("/?sso_error=idp_initiated");
+            }
+        }
+    }
+    if !state
+        .saml
+        .record_assertion(&verified.assertion_id, verified.assertion_expiry)
+    {
+        tracing::warn!(target: "openpxe::saml", "acs: assertion replay rejected");
+        return redirect("/?sso_error=1");
+    }
+
+    // Success → mint an operator session keyed to the verified email.
+    let session = state.sessions.create(&verified.principal.email);
+    tracing::info!(
+        target: "openpxe::saml",
+        email = %verified.principal.email,
+        idp_initiated = verified.in_response_to.is_none(),
+        "SAML SSO sign-in"
+    );
+    // safe_local_path already maps None / unsafe values to "/".
+    let relay = safe_local_path(form.relay_state.as_deref());
+    redirect_with_session(&relay, &session)
+}
+
+// ─── GET /api/sso/metadata ──────────────────────────────────────────────────
+
+pub async fn sso_metadata(State(state): State<AppState>) -> Response {
+    let cfg = state.sso.snapshot();
+    let sp = sp_params(&state, &cfg);
+    let xml = saml::metadata::build_sp_metadata(&sp);
+    (
+        StatusCode::OK,
+        [(header::CONTENT_TYPE, "application/samlmetadata+xml")],
+        xml,
+    )
+        .into_response()
+}
+
+// ─── helpers ────────────────────────────────────────────────────────────────
+
+/// Derive runtime SP parameters from config + the advertised public base URL.
+fn sp_params(state: &AppState, cfg: &SsoConfig) -> SpParams {
+    let base = state.public_base_url.trim_end_matches('/');
+    let entity_id = if cfg.entity_id.trim().is_empty() {
+        base.to_owned()
+    } else {
+        cfg.entity_id.trim().to_owned()
+    };
+    SpParams {
+        entity_id,
+        acs_url: format!("{base}/api/sso/acs"),
+    }
+}
+
+/// Resolve the IdP metadata: prefer the metadata URL (fetched + cached) per
+/// the "URL wins" rule, else parse the pasted XML.
+async fn resolve_idp_metadata(state: &AppState, cfg: &SsoConfig) -> Result<IdpMetadata, SamlError> {
+    let url = cfg.metadata_url.trim();
+    if !url.is_empty() {
+        if let Some(md) = state.saml.cached_metadata(url) {
+            return Ok(md);
+        }
+        let body = fetch_metadata(url).await?;
+        let md = IdpMetadata::parse(&body)?;
+        state.saml.cache_metadata(url.to_owned(), md.clone());
+        return Ok(md);
+    }
+    if !cfg.metadata.trim().is_empty() {
+        return IdpMetadata::parse(&cfg.metadata);
+    }
+    Err(SamlError::Metadata("no metadata source configured".into()))
+}
+
+async fn fetch_metadata(url: &str) -> Result<String, SamlError> {
+    let client = reqwest::Client::builder()
+        .timeout(METADATA_FETCH_TIMEOUT)
+        .build()
+        .map_err(|e| SamlError::Metadata(format!("http client: {e}")))?;
+    let resp = client
+        .get(url)
+        .send()
+        .await
+        .map_err(|e| SamlError::Metadata(format!("fetch {url}: {e}")))?;
+    if !resp.status().is_success() {
+        return Err(SamlError::Metadata(format!(
+            "fetch {url}: HTTP {}",
+            resp.status()
+        )));
+    }
+    resp.text()
+        .await
+        .map_err(|e| SamlError::Metadata(format!("read {url}: {e}")))
+}
+
+/// Only permit a same-site path (single leading slash) as a redirect target —
+/// blocks open-redirect / protocol-relative (`//evil.com`) abuse of RelayState.
+fn safe_local_path(p: Option<&str>) -> String {
+    match p {
+        Some(p) if p.starts_with('/') && !p.starts_with("//") => p.to_owned(),
+        _ => "/".to_owned(),
+    }
+}
+
+fn redirect(location: &str) -> Response {
+    Response::builder()
+        .status(StatusCode::FOUND)
+        .header(header::LOCATION, location)
+        .body(Body::empty())
+        .map_or_else(
+            |_| StatusCode::INTERNAL_SERVER_ERROR.into_response(),
+            IntoResponse::into_response,
+        )
+}
+
+fn redirect_with_session(location: &str, session: &str) -> Response {
+    Response::builder()
+        .status(StatusCode::FOUND)
+        .header(header::LOCATION, location)
+        .header(header::SET_COOKIE, auth::session_cookie(session))
+        .body(Body::empty())
+        .map_or_else(
+            |_| StatusCode::INTERNAL_SERVER_ERROR.into_response(),
+            IntoResponse::into_response,
+        )
+}

crates/http-api/src/state.rs

@@ -1,10 +1,11 @@
-use crate::uploads::UploadSessions;
 use crate::auth::SessionStore;
+use crate::saml_routes::SamlRuntime;
+use crate::uploads::UploadSessions;
 use openpxe_core::{
     AdminStore, BootLog, BrandingStore, ClientRegistry, DeploymentQueue, HostBindings, LogBus,
-    Metrics, SettingsStore, SsoStore,
+    Metrics, NotifyStore, SettingsStore, SsoStore,
 };
-use openpxe_iso_store::{IsoStore, SmbManager, SmbShareManager};
+use openpxe_iso_store::{IsoStore, NfsShareManager, SmbManager, SmbShareManager};
 use std::sync::Arc;
 use time::OffsetDateTime;
 
@@ -34,9 +35,17 @@ pub struct AppState {
     /// process restart (sessions are tied to UI state, not persisted —
     /// matches Sonarr/Radarr behaviour).
     pub sessions: SessionStore,
-    /// SAML SSO configuration. v0.4.5 stores it; the actual SSO login
+    /// SAML SSO configuration (persisted IdP metadata, Entity ID, toggles).
-    /// flow ships in a later release.
     pub sso: SsoStore,
+    /// v0.5.1: in-memory SAML runtime state — outstanding AuthnRequest IDs
+    /// (for InResponseTo correlation), consumed-assertion replay guard, and
+    /// a cache of fetched IdP metadata. Tied to process lifetime, like
+    /// `sessions`; a restart simply invalidates any in-flight SSO login.
+    pub saml: SamlRuntime,
+    /// v0.5.0: webhook / email notification config (Slack/Teams/Discord/
+    /// SMTP). Drives the fire-and-forget pings on boot events and powers
+    /// the Advanced tab's config + "Send test" button.
+    pub notify: NotifyStore,
     /// Lock-free metrics counters surfaced at `/metrics` in Prometheus
     /// text format. Cheap to clone (handles to atomics).
     pub metrics: Metrics,
@@ -52,6 +61,12 @@ pub struct AppState {
     /// `smbclient` does the SMB protocol over a plain TCP socket in
     /// userspace — works in any container, no special caps required.
     pub smb_shares: SmbShareManager,
+    /// v0.4.67: NFSv3 share manager — pure-Rust userspace consumer
+    /// via the `nfs3_client` crate. Ships alongside the SMB manager
+    /// so operators pick whichever protocol their NAS prefers.
+    /// In-process (no subprocess); supports HTTP Range requests on
+    /// NFS-sourced ISOs because NFSv3 READ3 takes an explicit offset.
+    pub nfs_shares: NfsShareManager,
     /// Browser chunked upload state. Multipart uploads still go straight
     /// through `IsoStore`, but the UI uses sessions so large ISO transfers
     /// can show deterministic progress and leave visible partial files.

crates/http-api/src/terminal.rs

@@ -88,12 +88,14 @@ async fn dispatch(state: &AppState, argv: &[String]) -> Result<String, String> {
         "isos" | "images" => Ok(isos_text(state)),
         "clients" => Ok(clients_text(state)),
         "queue" => queue_command(state, tail).await,
-        // v0.4.65: `nfs` is gone — replaced with userspace SMB share
+        // `smb` controls the outbound Samba server for Windows
-        // consumer. `smb` still controls the outbound Samba server
+        // install media. `share` lists/manages remote SMB shares
-        // for Windows install media; `share` lists/manages remote SMB
+        // OpenPXE pulls ISOs from (v0.4.65). `nfs` is the parallel
-        // shares OpenPXE pulls ISOs from.
+        // command for remote NFSv3 shares (v0.4.67, in-process via
+        // nfs3_client — not the v0.4.64 kernel-mount path).
         "share" | "smb-share" => smb_share_command(state, tail).await,
         "smb" => smb_command(state, tail).await,
+        "nfs" => nfs_share_command(state, tail).await,
         "log" => log_command(state, tail),
         "whoami" => Ok("operator".to_string()),
         "echo" => Ok(tail.join(" ")),
@@ -113,16 +115,20 @@ fn status_text(s: &AppState) -> String {
     let smb = s.smb.as_ref().map(|m| m.snapshot());
     let smb_shares = s.smb_shares.list();
     let smb_reachable = smb_shares.iter().filter(|m| m.reachable).count();
+    // v0.4.67: NFSv3 sources too.
+    let nfs_shares = s.nfs_shares.list();
+    let nfs_reachable = nfs_shares.iter().filter(|m| m.reachable).count();
     format!(
         "OpenPXE {ver}\n\
          base url:     {base}\n\
          interface:    {nic}\n\
          uptime:       {up}\n\
-         isos:         {n_isos}  (local: {n_local}, smb: {n_smb})\n\
+         isos:         {n_isos}  (local: {n_local}, smb: {n_smb}, nfs: {n_nfs})\n\
          clients:      {n_clients}\n\
          queue:        {n_entries}\n\
          smb server:   {smb}\n\
-         smb shares:   {n_total} configured ({n_active} reachable)\n",
+         smb shares:   {n_smb_total} configured ({n_smb_active} reachable)\n\
+         nfs shares:   {n_nfs_total} configured ({n_nfs_active} reachable)\n",
         ver = env!("CARGO_PKG_VERSION"),
         base = s.public_base_url,
         nic = if s.nic_name.is_empty() {
@@ -140,11 +146,17 @@ fn status_text(s: &AppState) -> String {
             .iter()
             .filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Smb { .. }))
             .count(),
+        n_nfs = isos
+            .iter()
+            .filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Nfs { .. }))
+            .count(),
         n_clients = clients.len(),
         n_entries = queue_entries.len(),
         smb = smb.map_or_else(|| "(disabled)".into(), |s| format!("{s:?}")),
-        n_total = smb_shares.len(),
+        n_smb_total = smb_shares.len(),
-        n_active = smb_reachable,
+        n_smb_active = smb_reachable,
+        n_nfs_total = nfs_shares.len(),
+        n_nfs_active = nfs_reachable,
     )
 }
 
@@ -162,8 +174,9 @@ fn isos_text(s: &AppState) -> String {
     for i in isos {
         let src = match i.source {
             openpxe_iso_store::IsoSource::Local => "local".to_string(),
-            // v0.4.65: SMB userspace consumer replaced kernel-mount NFS.
             openpxe_iso_store::IsoSource::Smb { share_id, .. } => format!("smb:{share_id}"),
+            // v0.4.67: NFSv3 via in-process nfs3_client.
+            openpxe_iso_store::IsoSource::Nfs { share_id, .. } => format!("nfs:{share_id}"),
         };
         let _ = writeln!(
             out,
@@ -378,6 +391,91 @@ async fn smb_share_command(s: &AppState, args: &[String]) -> Result<String, Stri
     }
 }
 
+// ── nfs (v0.4.67: in-process NFSv3 via nfs3_client) ────────────────────
+
+async fn nfs_share_command(s: &AppState, args: &[String]) -> Result<String, String> {
+    match args.first().map(String::as_str) {
+        None | Some("list") => {
+            let shares = s.nfs_shares.list();
+            if shares.is_empty() {
+                return Ok("(no NFS shares configured)".into());
+            }
+            let mut out = String::new();
+            let _ = writeln!(
+                out,
+                "{:<24} {:<7} {:<6} TARGET",
+                "ID", "STATUS", "ISOS"
+            );
+            for m in shares {
+                let status = if m.reachable { "ok" } else { "down" };
+                let _ = writeln!(
+                    out,
+                    "{:<24} {:<7} {:<6} {}:{}",
+                    truncate(&m.id, 24),
+                    status,
+                    m.iso_count,
+                    m.server,
+                    m.export,
+                );
+                if let Some(e) = m.last_error {
+                    let _ = writeln!(out, "    error: {e}");
+                }
+                if let Some(h) = m.last_hint {
+                    let _ = writeln!(out, "    hint:  {h}");
+                }
+            }
+            Ok(out)
+        }
+        Some("add") => {
+            // nfs add <server>:<export> [port]
+            let target = args
+                .get(1)
+                .ok_or_else(|| "usage: nfs add <server>:<export> [port]".to_string())?;
+            let (server, export) = target
+                .split_once(':')
+                .ok_or_else(|| "target must be 'server:/export'".to_string())?;
+            let port = args.get(2).and_then(|s| s.parse::<u16>().ok());
+            let req = openpxe_iso_store::NfsAddRequest {
+                server: server.to_string(),
+                export: export.to_string(),
+                port,
+            };
+            match s.nfs_shares.add(req).await {
+                Ok(m) => Ok(format!("added {} ({} isos)", m.id, m.iso_count)),
+                Err(e) => {
+                    let mut out = format!("add failed: {}", e.error);
+                    if let Some(h) = e.hint {
+                        out.push_str("\nhint: ");
+                        out.push_str(&h);
+                    }
+                    Err(out)
+                }
+            }
+        }
+        Some("remove") => {
+            let id = args
+                .get(1)
+                .ok_or_else(|| "usage: nfs remove <id>".to_string())?;
+            match s.nfs_shares.remove(id).await {
+                Ok(()) => Ok(format!("removed {id}")),
+                Err(e) => Err(format!("remove failed: {e}")),
+            }
+        }
+        Some("scan") => {
+            let id = args
+                .get(1)
+                .ok_or_else(|| "usage: nfs scan <id>".to_string())?;
+            match s.nfs_shares.rescan(id).await {
+                Ok(n) => Ok(format!("re-scanned {id}: {n} isos")),
+                Err(e) => Err(format!("scan failed: {e}")),
+            }
+        }
+        Some(other) => Err(format!(
+            "unknown nfs subcommand: {other}\ntry: nfs [list|add|remove|scan]"
+        )),
+    }
+}
+
 // ── smb ────────────────────────────────────────────────────────────────
 
 #[allow(clippy::unused_async)]
@@ -519,6 +617,11 @@ OpenPXE terminal — available commands:
   share remove <id>                 forget an SMB share
   share scan <id>                   re-list a share for new ISOs
 
+  nfs list                          list configured NFSv3 shares
+  nfs add <srv>:<export> [port]     add an NFSv3 share
+  nfs remove <id>                   forget an NFS share
+  nfs scan <id>                     re-list an NFS share for new ISOs
+
   smb status                        outbound Samba state (Windows install media)
   smb start | stop | reload         control the outbound smbd
 

crates/http-api/tests/full_flow.rs

@@ -14,7 +14,7 @@ use axum::body::Body;
 use axum::http::{header, Request, StatusCode};
 use openpxe_core::{ClientRegistry, DeploymentQueue, HostBindings, LogBus, Metrics, SettingsStore};
 use openpxe_http_api::{build_router, AppState};
-use openpxe_iso_store::{IsoStore, SmbShareManager};
+use openpxe_iso_store::{IsoStore, NfsShareManager, SmbShareManager};
 use tempfile::tempdir;
 use tower::ServiceExt;
 
@@ -95,12 +95,14 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
     let queue = DeploymentQueue::new();
     let settings = SettingsStore::load_or_default(dir.path());
     let smb_shares = SmbShareManager::new(dir.path(), iso_store.clone());
+    let nfs_shares = NfsShareManager::new(dir.path(), iso_store.clone());
     let log_bus = LogBus::new(64);
     let hosts = HostBindings::load_or_default(dir.path());
     let boot_log = openpxe_core::BootLog::load_or_default(dir.path());
     let branding = openpxe_core::BrandingStore::load_or_default(dir.path());
     let admin = openpxe_core::AdminStore::load_or_default(dir.path());
     let sso = openpxe_core::SsoStore::load_or_default(dir.path());
+    let notify = openpxe_core::NotifyStore::load_or_default(dir.path());
     let sessions = openpxe_http_api::auth::SessionStore::default();
     let metrics = Metrics::new();
     let state = AppState {
@@ -114,9 +116,12 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
         admin,
         sessions,
         sso,
+        saml: openpxe_http_api::saml_routes::SamlRuntime::default(),
+        notify,
         metrics,
         smb: None,
         smb_shares,
+        nfs_shares,
         uploads: openpxe_http_api::uploads::UploadSessions::default(),
         log_bus,
         started_at: time::OffsetDateTime::now_utc(),
@@ -531,6 +536,105 @@ async fn smb_shares_list_starts_empty() {
     assert_eq!(v["shares"].as_array().unwrap().len(), 0);
 }
 
+// v0.4.67: NFSv3 share manager (parallel to SMB).
+
+// ── v0.5.0: notifications + Wake-on-LAN ────────────────────────────────────
+
+#[tokio::test]
+async fn notify_config_round_trips_and_redacts_smtp_password() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    // Save an SMTP config with a password.
+    let (s, _b) = put_json(
+        &app,
+        "/api/notify",
+        r#"{"enabled":true,"kind":"smtp","smtp_host":"smtp.example.com","smtp_port":587,"smtp_to":"[email protected]","smtp_from":"[email protected]","smtp_password":"s3cret"}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::OK);
+    // GET must redact the password (never echo the real secret).
+    let (s, b) = get(&app, "/api/notify").await;
+    assert_eq!(s, StatusCode::OK);
+    let v: serde_json::Value = serde_json::from_slice(&b).unwrap();
+    assert_eq!(v["enabled"], true);
+    assert_eq!(v["kind"], "smtp");
+    let pw = v["smtp_password"].as_str().unwrap_or("");
+    assert_ne!(pw, "s3cret", "raw password must never be returned");
+    assert!(
+        !pw.is_empty(),
+        "a set password should surface as a sentinel"
+    );
+}
+
+#[tokio::test]
+async fn notify_enable_webhook_without_url_is_rejected() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (s, _b) = put_json(
+        &app,
+        "/api/notify",
+        r#"{"enabled":true,"kind":"slack","webhook_url":""}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::BAD_REQUEST);
+}
+
+#[tokio::test]
+async fn wol_on_unbound_mac_is_404() {
+    // WoL only fires for bound MACs — an arbitrary MAC must 404 so the
+    // endpoint isn't an open packet sprayer.
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (s, _b) = post_json(&app, "/api/hosts/aa:bb:cc:dd:ee:ff/wol", "{}").await;
+    assert_eq!(s, StatusCode::NOT_FOUND);
+}
+
+#[tokio::test]
+async fn nfs_shares_list_starts_empty() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (s, b) = get(&app, "/api/nfs-shares").await;
+    assert_eq!(s, StatusCode::OK);
+    let v: serde_json::Value = serde_json::from_slice(&b).unwrap();
+    assert_eq!(v["shares"].as_array().unwrap().len(), 0);
+}
+
+#[tokio::test]
+async fn nfs_shares_add_rejects_missing_server() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (s, b) = post_json(
+        &app,
+        "/api/nfs-shares",
+        r#"{"server":"","export":"/srv/isos"}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::BAD_REQUEST);
+    let msg = String::from_utf8_lossy(&b);
+    assert!(
+        msg.to_lowercase().contains("server"),
+        "expected server hint, got: {msg}"
+    );
+}
+
+#[tokio::test]
+async fn nfs_shares_add_rejects_export_without_leading_slash() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (s, b) = post_json(
+        &app,
+        "/api/nfs-shares",
+        r#"{"server":"10.0.0.5","export":"srv/isos"}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::BAD_REQUEST);
+    let msg = String::from_utf8_lossy(&b);
+    assert!(
+        msg.to_lowercase().contains("export"),
+        "expected export-path hint, got: {msg}"
+    );
+}
+
 #[tokio::test]
 async fn terminal_help_and_status_round_trip() {
     let (state, _dir) = build_state().await;
@@ -1359,7 +1463,7 @@ async fn storage_disk_endpoint_reports_volume_stats() {
     let avail = v["available_bytes"].as_u64().unwrap();
     let used = v["used_bytes"].as_u64().unwrap();
     assert!(total >= avail, "{v}");
-    assert!(total >= used,  "{v}");
+    assert!(total >= used, "{v}");
     assert!(v["path"].as_str().unwrap().contains("isos"), "got {v}");
 }
 
@@ -1451,7 +1555,11 @@ async fn put_json(router: &axum::Router, path: &str, body: &str) -> (StatusCode,
 
 // ─── v0.4.5: Forms auth + SSO ─────────────────────────────────────────────
 
-async fn post_collect(router: &axum::Router, path: &str, body: &str) -> (StatusCode, Vec<u8>, Vec<axum::http::HeaderValue>) {
+async fn post_collect(
+    router: &axum::Router,
+    path: &str,
+    body: &str,
+) -> (StatusCode, Vec<u8>, Vec<axum::http::HeaderValue>) {
     let res = router
         .clone()
         .oneshot(
@@ -1782,13 +1890,39 @@ async fn docs_lists_new_v0_4_5_endpoints() {
 // ─── v0.4.6: PXE logo endpoint ────────────────────────────────────────────
 
 #[tokio::test]
-async fn pxe_logo_404_when_no_custom_logo_configured() {
+async fn pxe_background_serves_default_when_no_custom_logo() {
+    // v0.4.69: the endpoint always returns a full-screen PNG background
+    // now — when no custom logo is configured it composes the default
+    // OpenPXE mark on a dark field rather than 404ing. This is what lets
+    // the PXE menu's `console --picture` paint a real background instead
+    // of falling back to the (now-removed) ASCII placeholder.
     let (state, _dir) = build_state().await;
     let app = build_router(state);
-    let (s, body) = get(&app, "/branding/pxe-logo").await;
+    let res = app
-    assert_eq!(s, StatusCode::NOT_FOUND);
+        .clone()
-    let text = std::str::from_utf8(&body).unwrap();
+        .oneshot(
-    assert!(text.contains("no custom logo"), "got: {text}");
+            Request::builder()
+                .uri("/branding/pxe-logo")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(res.status(), StatusCode::OK);
+    assert_eq!(
+        res.headers()
+            .get(axum::http::header::CONTENT_TYPE)
+            .unwrap()
+            .to_str()
+            .unwrap(),
+        "image/png"
+    );
+    let body = axum::body::to_bytes(res.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    assert!(body.starts_with(b"\x89PNG"), "default background not a PNG");
+    let width = u32::from_be_bytes([body[16], body[17], body[18], body[19]]);
+    assert_eq!(width, 1024, "default background should be 1024 wide");
 }
 
 /// Build a tiny valid PNG via the `image` crate. The v0.4.61 PXE-logo
@@ -1807,10 +1941,11 @@ fn tiny_png() -> Vec<u8> {
 }
 
 #[tokio::test]
-async fn pxe_logo_404_when_uploaded_logo_is_svg() {
+async fn pxe_background_falls_back_to_default_for_svg_upload() {
-    // iPXE can't rasterize SVG, so an SVG upload deliberately doesn't
+    // iPXE can't rasterize SVG, so an SVG upload doesn't paint as the
-    // light up the PXE menu's `console --picture` overlay — the menu
+    // PXE background — but v0.4.69 still returns the *default* OpenPXE
-    // simply paints without a logo.
+    // background PNG (not a 404) so the boot screen stays graphical.
+    // The WebUI top-left continues to render the SVG natively.
     let (state, _dir) = build_state().await;
     state
         .branding
@@ -1821,10 +1956,26 @@ async fn pxe_logo_404_when_uploaded_logo_is_svg() {
         )
         .unwrap();
     let app = build_router(state);
-    let (s, body) = get(&app, "/branding/pxe-logo").await;
+    let res = app
-    assert_eq!(s, StatusCode::NOT_FOUND);
+        .clone()
-    let text = std::str::from_utf8(&body).unwrap();
+        .oneshot(
-    assert!(text.contains("SVG"), "got: {text}");
+            Request::builder()
+                .uri("/branding/pxe-logo")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(res.status(), StatusCode::OK);
+    let body = axum::body::to_bytes(res.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    assert!(
+        body.starts_with(b"\x89PNG"),
+        "should serve default PNG for SVG"
+    );
+    let width = u32::from_be_bytes([body[16], body[17], body[18], body[19]]);
+    assert_eq!(width, 1024);
 }
 
 #[tokio::test]
@@ -1834,10 +1985,7 @@ async fn pxe_logo_composes_to_1024x768_png() {
     // the iPXE menu always paints at consistent dimensions.
     let (state, _dir) = build_state().await;
     let png = tiny_png();
-    state
+    state.branding.set_logo("image/png", "png", &png).unwrap();
-        .branding
-        .set_logo("image/png", "png", &png)
-        .unwrap();
     let app = build_router(state);
     let res = app
         .clone()
@@ -1877,10 +2025,7 @@ async fn pxe_logo_endpoint_is_public_after_admin_setup() {
     // auth allowlist gates `/api/*` only.
     let (state, _dir) = build_state().await;
     let png = tiny_png();
-    state
+    state.branding.set_logo("image/png", "png", &png).unwrap();
-        .branding
-        .set_logo("image/png", "png", &png)
-        .unwrap();
     let app = build_router(state);
     // Configure an admin so the middleware kicks in.
     let (s, _, _) = post_collect(
@@ -1894,3 +2039,305 @@ async fn pxe_logo_endpoint_is_public_after_admin_setup() {
     let (s, _) = get(&app, "/branding/pxe-logo").await;
     assert_eq!(s, StatusCode::OK);
 }
+
+// ─── v0.5.1: SAML SSO flow ──────────────────────────────────────────────────
+//
+// The core crate exhaustively tests signature verification + semantic
+// validation (crates/core/src/saml/tests.rs). These integration tests cover
+// the HTTP wiring the core can't: routing, base64 decode, session minting,
+// the InResponseTo / IdP-initiated gating, and assertion-replay rejection.
+
+use base64::Engine as _;
+use openpxe_core::SsoConfig;
+use time::format_description::well_known::Rfc3339;
+use time::{Duration as TimeDuration, OffsetDateTime};
+
+const SP_BASE: &str = "http://127.0.0.1"; // build_state's public_base_url
+const SP_ACS: &str = "http://127.0.0.1/api/sso/acs";
+const IDP_ENTITY: &str = "https://idp.test/realms/fleet";
+const IDP_SSO: &str = "https://idp.test/realms/fleet/protocol/saml";
+
+struct TestIdp {
+    cert_b64: String,
+    key_pem: String,
+}
+
+fn make_idp() -> TestIdp {
+    let ck = rcgen::generate_simple_self_signed(vec!["idp.test".to_string()]).unwrap();
+    let der = ck.cert.der().as_ref().to_vec();
+    TestIdp {
+        cert_b64: base64::engine::general_purpose::STANDARD.encode(der),
+        key_pem: ck.key_pair.serialize_pem(),
+    }
+}
+
+fn idp_metadata_xml(cert_b64: &str) -> String {
+    format!(
+        r#"<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" entityID="{IDP_ENTITY}">
+  <md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+    <md:KeyDescriptor use="signing"><ds:KeyInfo><ds:X509Data><ds:X509Certificate>{cert_b64}</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor>
+    <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="{IDP_SSO}"/>
+  </md:IDPSSODescriptor>
+</md:EntityDescriptor>"#
+    )
+}
+
+/// Build + sign a SAMLResponse with the test IdP key. `in_response_to: None`
+/// makes it an unsolicited (IdP-initiated) response.
+fn signed_response(idp: &TestIdp, in_response_to: Option<&str>) -> String {
+    let now = OffsetDateTime::now_utc().replace_nanosecond(0).unwrap();
+    let fmt = |t: OffsetDateTime| t.format(&Rfc3339).unwrap();
+    let irt = in_response_to
+        .map(|v| format!(r#" InResponseTo="{v}""#))
+        .unwrap_or_default();
+    let template = format!(
+        r##"<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_resp1" Version="2.0" IssueInstant="{now}" Destination="{SP_ACS}"{irt}>
+  <saml:Issuer>{IDP_ENTITY}</saml:Issuer>
+  <samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>
+  <saml:Assertion ID="_assertion1" Version="2.0" IssueInstant="{now}">
+    <saml:Issuer>{IDP_ENTITY}</saml:Issuer>
+    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+      <ds:SignedInfo>
+        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+        <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256"/>
+        <ds:Reference URI="#_assertion1">
+          <ds:Transforms>
+            <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
+            <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+          </ds:Transforms>
+          <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
+          <ds:DigestValue></ds:DigestValue>
+        </ds:Reference>
+      </ds:SignedInfo>
+      <ds:SignatureValue></ds:SignatureValue>
+    </ds:Signature>
+    <saml:Subject>
+      <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">[email protected]</saml:NameID>
+      <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
+        <saml:SubjectConfirmationData Recipient="{SP_ACS}" NotOnOrAfter="{noa}"{irt}/>
+      </saml:SubjectConfirmation>
+    </saml:Subject>
+    <saml:Conditions NotBefore="{nb}" NotOnOrAfter="{noa}">
+      <saml:AudienceRestriction><saml:Audience>{SP_BASE}</saml:Audience></saml:AudienceRestriction>
+    </saml:Conditions>
+    <saml:AuthnStatement AuthnInstant="{now}" SessionIndex="sess-1">
+      <saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef></saml:AuthnContext>
+    </saml:AuthnStatement>
+  </saml:Assertion>
+</samlp:Response>"##,
+        now = fmt(now),
+        nb = fmt(now - TimeDuration::minutes(5)),
+        noa = fmt(now + TimeDuration::hours(1)),
+    );
+    let key = bergshamra::keys::loader::load_pem_auto(idp.key_pem.as_bytes(), None).unwrap();
+    let mut km = bergshamra::keys::KeysManager::new();
+    km.add_key(key);
+    let ctx = bergshamra::DsigContext::new(km);
+    bergshamra::sign(&ctx, &template).unwrap()
+}
+
+fn urlencode(s: &str) -> String {
+    let mut out = String::with_capacity(s.len() * 3);
+    for b in s.bytes() {
+        match b {
+            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => {
+                out.push(b as char);
+            }
+            _ => {
+                out.push('%');
+                out.push(char::from_digit((b >> 4) as u32, 16).unwrap().to_ascii_uppercase());
+                out.push(char::from_digit((b & 0xf) as u32, 16).unwrap().to_ascii_uppercase());
+            }
+        }
+    }
+    out
+}
+
+fn configure_sso(state: &AppState, metadata: String, allow_idp_initiated: bool) {
+    state
+        .sso
+        .replace(SsoConfig {
+            enabled: true,
+            idp_name: "Test IdP".into(),
+            idp_logo_url: String::new(),
+            metadata,
+            metadata_url: String::new(),
+            entity_id: String::new(),
+            allow_idp_initiated,
+        })
+        .unwrap();
+}
+
+async fn post_acs(router: &axum::Router, signed_xml: &str) -> axum::response::Response {
+    let b64 = base64::engine::general_purpose::STANDARD.encode(signed_xml.as_bytes());
+    let body = format!("SAMLResponse={}", urlencode(&b64));
+    router
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri("/api/sso/acs")
+                .header("content-type", "application/x-www-form-urlencoded")
+                .body(Body::from(body))
+                .unwrap(),
+        )
+        .await
+        .unwrap()
+}
+
+fn has_session_cookie(resp: &axum::response::Response) -> bool {
+    resp.headers().get_all(header::SET_COOKIE).iter().any(|v| {
+        let s = v.to_str().unwrap_or("");
+        s.starts_with("openpxe_session=")
+            && !s.contains("openpxe_session=;")
+            && !s.contains("Max-Age=0")
+    })
+}
+
+fn location(resp: &axum::response::Response) -> String {
+    resp.headers()
+        .get(header::LOCATION)
+        .and_then(|v| v.to_str().ok())
+        .unwrap_or("")
+        .to_owned()
+}
+
+#[tokio::test]
+async fn sso_login_redirects_to_idp() {
+    let (state, _dir) = build_state().await;
+    let idp = make_idp();
+    configure_sso(&state, idp_metadata_xml(&idp.cert_b64), false);
+    let app = build_router(state);
+    let resp = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .uri("/api/sso/login")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), StatusCode::FOUND);
+    let loc = location(&resp);
+    assert!(loc.starts_with(IDP_SSO), "redirect to IdP, got {loc}");
+    assert!(
+        loc.contains("SAMLRequest="),
+        "carries SAMLRequest, got {loc}"
+    );
+}
+
+#[tokio::test]
+async fn sso_login_unavailable_when_disabled() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state); // SSO never configured
+    let resp = app
+        .oneshot(
+            Request::builder()
+                .uri("/api/sso/login")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), StatusCode::FOUND);
+    assert!(location(&resp).contains("sso_error"));
+}
+
+#[tokio::test]
+async fn sso_metadata_is_served() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (status, body) = get(&app, "/api/sso/metadata").await;
+    assert_eq!(status, StatusCode::OK);
+    let xml = String::from_utf8(body).unwrap();
+    assert!(xml.contains("SPSSODescriptor"));
+    assert!(xml.contains(SP_ACS));
+    assert!(xml.contains(SP_BASE));
+}
+
+#[tokio::test]
+async fn acs_idp_initiated_mints_session() {
+    let (state, _dir) = build_state().await;
+    let idp = make_idp();
+    configure_sso(&state, idp_metadata_xml(&idp.cert_b64), true);
+    let app = build_router(state);
+    let signed = signed_response(&idp, None);
+    let resp = post_acs(&app, &signed).await;
+    assert_eq!(resp.status(), StatusCode::FOUND);
+    assert_eq!(location(&resp), "/");
+    assert!(
+        has_session_cookie(&resp),
+        "ACS must set an operator session cookie"
+    );
+}
+
+#[tokio::test]
+async fn acs_idp_initiated_blocked_when_disabled() {
+    let (state, _dir) = build_state().await;
+    let idp = make_idp();
+    configure_sso(&state, idp_metadata_xml(&idp.cert_b64), false); // gate OFF
+    let app = build_router(state);
+    let signed = signed_response(&idp, None);
+    let resp = post_acs(&app, &signed).await;
+    assert_eq!(resp.status(), StatusCode::FOUND);
+    assert!(location(&resp).contains("sso_error"));
+    assert!(
+        !has_session_cookie(&resp),
+        "no session when IdP-initiated is disabled"
+    );
+}
+
+#[tokio::test]
+async fn acs_sp_initiated_without_known_request_is_rejected() {
+    let (state, _dir) = build_state().await;
+    let idp = make_idp();
+    configure_sso(&state, idp_metadata_xml(&idp.cert_b64), true);
+    let app = build_router(state);
+    // A valid signature but an InResponseTo we never issued => reject.
+    let signed = signed_response(&idp, Some("_never-issued"));
+    let resp = post_acs(&app, &signed).await;
+    assert_eq!(resp.status(), StatusCode::FOUND);
+    assert!(location(&resp).contains("sso_error"));
+    assert!(!has_session_cookie(&resp));
+}
+
+#[tokio::test]
+async fn acs_replayed_assertion_is_rejected() {
+    let (state, _dir) = build_state().await;
+    let idp = make_idp();
+    configure_sso(&state, idp_metadata_xml(&idp.cert_b64), true);
+    let app = build_router(state);
+    let signed = signed_response(&idp, None);
+    // First use succeeds…
+    let first = post_acs(&app, &signed).await;
+    assert!(has_session_cookie(&first));
+    // …replaying the identical assertion is rejected.
+    let second = post_acs(&app, &signed).await;
+    assert_eq!(second.status(), StatusCode::FOUND);
+    assert!(location(&second).contains("sso_error"));
+    assert!(!has_session_cookie(&second));
+}
+
+#[tokio::test]
+async fn acs_garbage_is_rejected_without_500() {
+    let (state, _dir) = build_state().await;
+    let idp = make_idp();
+    configure_sso(&state, idp_metadata_xml(&idp.cert_b64), true);
+    let app = build_router(state);
+    let body = "SAMLResponse=not%20valid%20base64%21%21";
+    let resp = app
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri("/api/sso/acs")
+                .header("content-type", "application/x-www-form-urlencoded")
+                .body(Body::from(body))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), StatusCode::FOUND);
+    assert!(location(&resp).contains("sso_error"));
+    assert!(!has_session_cookie(&resp));
+}

crates/iso-store/Cargo.toml

@@ -35,5 +35,13 @@ libc = "0.2"
 # encoder. Keeps the build slim — no JPEG2000, TIFF, BMP, etc.
 image = { version = "0.25", default-features = false, features = ["png", "jpeg", "webp", "gif"] }
 
+# v0.4.67: pure-Rust NFSv3 client for reading remote ISOs without a
+# kernel mount. See crates/iso-store/src/nfs_share.rs for usage.
+nfs3_client = { workspace = true }
+nfs3_types = { workspace = true }
+# Needed for the Stream trait that wraps the mpsc receiver feeding
+# NFS read-loop bytes into axum's Body::from_stream.
+futures = { workspace = true }
+
 [dev-dependencies]
 tempfile = "3.12"

crates/iso-store/src/lib.rs

@@ -18,6 +18,7 @@
 
 pub mod entry;
 pub mod introspect;
+pub mod nfs_share;
 pub mod pxe_logo;
 pub mod smb;
 pub mod smb_share;
@@ -33,6 +34,11 @@ pub use introspect::{DistroFamily, IntrospectionReport};
 // it.
 pub use smb::{extract_windows_iso, SmbManager, SmbState};
 pub use smb_share::{SmbAddRequest, SmbShare, SmbShareError, SmbShareManager, SmbStream};
+// v0.4.67: NFS is back — this time as an in-process userspace NFSv3
+// client (the `nfs3_client` crate) rather than a kernel mount. Same
+// "works in any container" property as SMB, plus support for HTTP
+// Range requests because NFSv3 READ3 takes an explicit offset.
+pub use nfs_share::{NfsAddRequest, NfsShare, NfsShareError, NfsShareManager, NfsStream};
 pub use store::{
     generate_boot_entries_for, slugify_str, IsoCategory, IsoMeta, IsoSource, IsoStore,
     UploadHandle,

crates/iso-store/src/pxe_logo.rs

@@ -1,86 +1,179 @@
-//! Operator-logo compositor for the iPXE menu.
+//! PXE boot-menu background compositor.
 //!
-//! The brief: match iVentoy's polished centered-logo PXE chrome with
+//! The brief (v0.4.69): match iVentoy's polished graphical PXE screen.
-//! whatever raster the operator drops onto Settings → Branding. A wide
+//! iPXE built with `CONSOLE_FRAMEBUFFER` + `IMAGE_PNG` paints a PNG to
-//! wordmark, a portrait stack, a square monogram — all three should
+//! the framebuffer via `console --picture`, then draws the text menu on
-//! land in roughly the same place on the boot screen.
+//! top (the console's default background colour is rendered transparent
+//! so the picture shows through the menu's blank cells). So what we
+//! produce here is a **full-screen 1024×768 background**, not just a
+//! floating logo:
 //!
-//! Approach: decode the operator's upload, fit it into a fixed
+//!   - a solid dark field (matches the WebUI dark theme so the product
-//! 1024×768 canvas with the logo horizontally centered and pinned a
+//!     feels consistent from browser to bare metal), with
-//! short margin from the top, re-encode as PNG, return the bytes. iPXE
+//!   - the operator's uploaded logo composited across the top, leaving
-//! built with `IMAGE_PNG` paints the result via `console --picture`.
+//!     the lower ~two-thirds clear for the iPXE menu text.
 //!
-//! The 1024×768 size matches the default VESA framebuffer iPXE picks
+//! When no custom logo is uploaded we still return a designed
-//! on most BIOS/UEFI consoles. Operators uploading 4K logos get
+//! background — a dark field with a centered "rainbow-horizon" disc
-//! correctly downscaled; tiny icons get drawn at their native size,
+//! echoing the bundled OpenPXE mark — so the boot screen is graphical
-//! centered, with transparent margins.
+//! out of the box. This replaces the old ASCII wordmark entirely.
 //!
-//! We deliberately don't ship `resvg` for SVG support — keeping the
+//! iPXE does **not** scale pictures (confirmed against the decoder
-//! dependency surface narrow matters more than supporting SVG-only
+//! source): the image is painted at native pixel size and the firmware
-//! brand assets. The WebUI's logo stays SVG-native (the browser
+//! picks the smallest video mode that fits. 1024×768 is the universal
-//! rasterizes it); the PXE menu wants a raster regardless.
+//! safe mode, so we pin the canvas there. Operators uploading a 4K logo
+//! get it downscaled to fit the top band; tiny icons paint at native
+//! size, centered.
+//!
+//! Input formats: anything the `image` crate decodes with our enabled
+//! features — PNG, JPEG, WebP, GIF. iPXE itself only consumes PNG, so
+//! we always *emit* PNG regardless of what the operator uploaded; a
+//! WebP logo is transcoded here transparently.
 
 use image::imageops::FilterType;
 use image::{DynamicImage, ImageError, ImageFormat, Rgba, RgbaImage};
 use std::io::Cursor;
 
-/// Canvas dimensions used for the composed PXE logo. Picked to match
+/// Canvas dimensions. Pinned to 1024×768 — the universal framebuffer
-/// the framebuffer dimensions iPXE picks on most BIOS/UEFI consoles —
+/// mode every BIOS/UEFI console supports, and iPXE doesn't scale.
-/// gives a 1:1 paint with no scaling at the firmware layer.
 pub const CANVAS_W: u32 = 1024;
 pub const CANVAS_H: u32 = 768;
 
-/// Maximum dimensions for the operator's logo inside the canvas. Any
+/// Bounding box for the operator's logo across the top band. Wider than
-/// upload larger than this in either axis is downscaled (preserving
+/// the old floating-logo box because the logo now anchors a full
-/// aspect ratio) to fit. Smaller uploads paint at native size.
+/// background rather than sitting alone on transparency.
-const LOGO_MAX_W: u32 = 600;
+const LOGO_MAX_W: u32 = 760;
 const LOGO_MAX_H: u32 = 200;
 
-/// Top margin in pixels from the canvas's top edge to the logo's top
+/// Top margin from the canvas top to the logo's top edge.
-/// edge. Matches the visual rhythm of iVentoy's screen (logo at top,
+const LOGO_TOP_MARGIN: u32 = 72;
-/// menu below).
-const LOGO_TOP_MARGIN: u32 = 64;
 
-/// Compose `src_bytes` (any PNG/JPEG/WebP/GIF) into a centered-top
+/// Background fill — a near-black with a faint blue cast, matching the
-/// 1024×768 PNG and return the encoded bytes.
+/// WebUI's dark theme surface so the product reads as one piece from
+/// browser to PXE screen.
+const BG: Rgba<u8> = Rgba([11, 14, 22, 255]);
+
+/// Compose the operator's uploaded raster (`Some`) — or the default
+/// OpenPXE mark (`None`) — into a full-screen 1024×768 PNG background
+/// and return the encoded bytes.
 ///
-/// Errors when the source can't be decoded or the encoded buffer can't
+/// Errors only when a provided `src_bytes` can't be decoded; the
-/// be written (only really fires on out-of-memory; the encoder itself
+/// `None` path and the PNG encode are infallible for our fixed canvas.
-/// is infallible for well-formed inputs).
+pub fn compose_pxe_background(src_bytes: Option<&[u8]>) -> Result<Vec<u8>, ImageError> {
-pub fn compose_pxe_logo(src_bytes: &[u8]) -> Result<Vec<u8>, ImageError> {
+    let mut canvas: RgbaImage = RgbaImage::from_pixel(CANVAS_W, CANVAS_H, BG);
-    let logo = image::load_from_memory(src_bytes)?;
-    // Resize-fit if the upload exceeds our bounding box. `Lanczos3`
-    // keeps the antialiasing crisp on the framebuffer console; it's a
-    // touch slower than `Triangle` but the operator hits this endpoint
-    // once per boot at most.
-    let logo = downscale_to_fit(logo, LOGO_MAX_W, LOGO_MAX_H);
-    let logo_rgba = logo.to_rgba8();
 
-    // Transparent canvas. iPXE 1.21+ honours alpha-channel transparency
+    match src_bytes {
-    // on framebuffer consoles; older builds simply draw the alpha as
+        Some(bytes) => {
-    // black, which still gives a sensible look.
+            let logo = image::load_from_memory(bytes)?;
-    let mut canvas: RgbaImage = RgbaImage::from_pixel(CANVAS_W, CANVAS_H, Rgba([0, 0, 0, 0]));
+            let logo = downscale_to_fit(logo, LOGO_MAX_W, LOGO_MAX_H);
-    let logo_w = logo_rgba.width();
+            let logo_rgba = logo.to_rgba8();
-    let logo_h = logo_rgba.height();
+            let off_x = CANVAS_W.saturating_sub(logo_rgba.width()) / 2;
-    // Horizontal center, top-margin from the top. Saturating math
+            let off_y = LOGO_TOP_MARGIN.min(CANVAS_H.saturating_sub(logo_rgba.height()));
-    // means a logo wider than CANVAS_W (shouldn't happen after the
+            // `overlay` alpha-composites, so a transparent-background
-    // downscale above, but defensive) just sits flush-left.
+            // logo blends onto the dark field exactly as designed.
-    let off_x = CANVAS_W.saturating_sub(logo_w) / 2;
+            image::imageops::overlay(&mut canvas, &logo_rgba, off_x.into(), off_y.into());
-    let off_y = LOGO_TOP_MARGIN.min(CANVAS_H.saturating_sub(logo_h));
+        }
-    image::imageops::overlay(&mut canvas, &logo_rgba, off_x.into(), off_y.into());
+        None => draw_default_mark(&mut canvas),
+    }
 
-    let mut out = Vec::with_capacity(64 * 1024);
+    let mut out = Vec::with_capacity(128 * 1024);
     DynamicImage::ImageRgba8(canvas).write_to(&mut Cursor::new(&mut out), ImageFormat::Png)?;
     Ok(out)
 }
 
+/// Back-compat shim for the old name — callers that pass a raw logo and
+/// want it composited get the same result as `compose_pxe_background`
+/// with `Some`.
+pub fn compose_pxe_logo(src_bytes: &[u8]) -> Result<Vec<u8>, ImageError> {
+    compose_pxe_background(Some(src_bytes))
+}
+
+/// Paint a centered "rainbow-horizon" disc onto the dark canvas as the
+/// default brand mark when no operator logo is set. Pure pixel math —
+/// no font, no SVG rasterizer, no extra deps. A filled circle with a
+/// left-to-right hue sweep echoes the bundled `logo.svg` motif.
+// Casts here are all bounded small-range geometry (radius ≤ 90, canvas
+// ≤ 1024) — precision loss / wrap is structurally impossible.
+#[allow(clippy::cast_precision_loss, clippy::cast_possible_wrap)]
+fn draw_default_mark(canvas: &mut RgbaImage) {
+    let radius: i32 = 90;
+    let cx = (CANVAS_W / 2) as i32;
+    let cy = (LOGO_TOP_MARGIN + 100) as i32;
+    // Four-stop horizontal sweep across the disc (teal → blue → violet
+    // → magenta) — the OpenPXE palette.
+    let stops = [
+        [0x22u8, 0xd3, 0xaa],
+        [0x3b, 0x82, 0xf6],
+        [0x8b, 0x5c, 0xf6],
+        [0xec, 0x48, 0x99],
+    ];
+    let r2 = radius * radius;
+    for dy in -radius..=radius {
+        for dx in -radius..=radius {
+            if dx * dx + dy * dy > r2 {
+                continue;
+            }
+            // Position across the disc in [0,1] left→right.
+            let t = (f32::from(i16::try_from(dx + radius).unwrap_or(0)))
+                / (f32::from(i16::try_from(2 * radius).unwrap_or(1)));
+            let color = gradient_at(&stops, t);
+            // Soft edge: fade alpha in the outer 3px ring.
+            let dist = ((dx * dx + dy * dy) as f32).sqrt();
+            let alpha = if dist > (radius as f32 - 3.0) {
+                let edge = (radius as f32 - dist).clamp(0.0, 3.0) / 3.0;
+                (edge * 255.0) as u8
+            } else {
+                255
+            };
+            let px = cx + dx;
+            let py = cy + dy;
+            if px >= 0 && py >= 0 && (px as u32) < CANVAS_W && (py as u32) < CANVAS_H {
+                blend_pixel(canvas, px as u32, py as u32, color, alpha);
+            }
+        }
+    }
+}
+
+/// Linear interpolate across an N-stop palette at position `t` in [0,1].
+// `segments`/`idx` are ≤ palette length (4) — f32 cast is exact.
+#[allow(clippy::cast_precision_loss)]
+fn gradient_at(stops: &[[u8; 3]], t: f32) -> [u8; 3] {
+    let t = t.clamp(0.0, 1.0);
+    let segments = stops.len() - 1;
+    let scaled = t * segments as f32;
+    let idx = (scaled.floor() as usize).min(segments - 1);
+    let frac = scaled - idx as f32;
+    let a = stops[idx];
+    let b = stops[idx + 1];
+    [
+        lerp(a[0], b[0], frac),
+        lerp(a[1], b[1], frac),
+        lerp(a[2], b[2], frac),
+    ]
+}
+
+fn lerp(a: u8, b: u8, t: f32) -> u8 {
+    (f32::from(a) + (f32::from(b) - f32::from(a)) * t).round() as u8
+}
+
+/// Alpha-blend `color` at `alpha` over the existing canvas pixel.
+fn blend_pixel(canvas: &mut RgbaImage, x: u32, y: u32, color: [u8; 3], alpha: u8) {
+    let bg = canvas.get_pixel(x, y).0;
+    let a = f32::from(alpha) / 255.0;
+    let out = Rgba([
+        lerp(bg[0], color[0], a),
+        lerp(bg[1], color[1], a),
+        lerp(bg[2], color[2], a),
+        255,
+    ]);
+    canvas.put_pixel(x, y, out);
+}
+
 fn downscale_to_fit(img: DynamicImage, max_w: u32, max_h: u32) -> DynamicImage {
     let (w, h) = (img.width(), img.height());
     if w <= max_w && h <= max_h {
         return img;
     }
-    // Preserve aspect ratio. `resize` clamps to the smaller of the
-    // two scale factors so we never overshoot the bounding box.
     img.resize(max_w, max_h, FilterType::Lanczos3)
 }
 
@@ -99,54 +192,73 @@ mod tests {
     }
 
     #[test]
-    fn compose_emits_canvas_sized_png() {
+    fn custom_logo_emits_canvas_sized_png_with_dark_field() {
         let src = solid_png(120, 60, [200, 50, 50]);
-        let out = compose_pxe_logo(&src).unwrap();
+        let out = compose_pxe_background(Some(&src)).unwrap();
-        // Round-trip the output and confirm dimensions.
+        let img = image::load_from_memory(&out).unwrap().to_rgba8();
-        let img = image::load_from_memory(&out).unwrap();
         assert_eq!(img.width(), CANVAS_W);
         assert_eq!(img.height(), CANVAS_H);
+        // A far corner should be the opaque dark background fill, not
+        // transparent — this is a full background now, not a floating
+        // logo on transparency.
+        let corner = img.get_pixel(CANVAS_W - 1, CANVAS_H - 1);
+        assert_eq!(corner.0, BG.0, "corner should be the dark fill");
     }
 
     #[test]
-    fn small_logo_centered_at_top_margin() {
+    fn custom_logo_painted_in_top_band() {
         let src = solid_png(100, 40, [10, 200, 10]);
-        let out = compose_pxe_logo(&src).unwrap();
+        let out = compose_pxe_background(Some(&src)).unwrap();
         let canvas = image::load_from_memory(&out).unwrap().to_rgba8();
-        // Pixel just inside the logo box should match the source color
-        // (alpha=255). Pixel near a far corner of the canvas should be
-        // the transparent background.
         let cx = (CANVAS_W - 100) / 2;
         let cy = LOGO_TOP_MARGIN;
         let inside = canvas.get_pixel(cx + 10, cy + 10);
-        assert_eq!(inside.0[3], 255, "logo pixel should be opaque");
+        assert!(
-        assert!(inside.0[0] < 100 && inside.0[1] > 100 && inside.0[2] < 100, "color mismatch: {inside:?}");
+            inside.0[1] > 100 && inside.0[0] < 100,
-        let corner = canvas.get_pixel(CANVAS_W - 1, CANVAS_H - 1);
+            "logo pixel color mismatch: {inside:?}"
-        assert_eq!(corner.0[3], 0, "canvas corner should be transparent");
+        );
     }
 
     #[test]
-    fn oversize_logo_is_downscaled_to_bounding_box() {
+    fn default_background_is_dark_with_a_painted_mark() {
-        // 4000×800 image — bigger than LOGO_MAX_W and LOGO_MAX_H in
+        let out = compose_pxe_background(None).unwrap();
-        // both axes. After downscale the output must fit; we re-decode
-        // the canvas, count non-transparent pixels, and confirm none
-        // sit outside the expected band.
-        let src = solid_png(4000, 800, [50, 50, 200]);
-        let out = compose_pxe_logo(&src).unwrap();
         let canvas = image::load_from_memory(&out).unwrap().to_rgba8();
-        // Span row at the top margin should have non-transparent
+        assert_eq!(canvas.width(), CANVAS_W);
-        // pixels somewhere; rows past the LOGO_TOP_MARGIN + LOGO_MAX_H
+        assert_eq!(canvas.height(), CANVAS_H);
-        // should be entirely transparent.
+        // Corner is dark fill.
-        let bottom_band_y = LOGO_TOP_MARGIN + LOGO_MAX_H + 10;
+        assert_eq!(canvas.get_pixel(2, CANVAS_H - 2).0, BG.0);
-        for x in 0..CANVAS_W {
+        // Center of the disc is not the background fill (something was
-            let p = canvas.get_pixel(x, bottom_band_y);
+        // painted there).
-            assert_eq!(p.0[3], 0, "row {bottom_band_y} should be transparent at x={x}");
+        let center = canvas.get_pixel(CANVAS_W / 2, LOGO_TOP_MARGIN + 100);
-        }
+        assert_ne!(center.0, BG.0, "default mark should paint over the field");
+    }
+
+    #[test]
+    fn webp_or_jpeg_input_is_accepted_and_transcoded_to_png() {
+        // Encode a JPEG and confirm the compositor decodes it and emits
+        // a valid PNG (iPXE only eats PNG, so transcoding is the point).
+        let img: ImageBuffer<Rgb<u8>, Vec<u8>> = ImageBuffer::from_pixel(80, 80, Rgb([90, 90, 90]));
+        let mut jpeg = Vec::new();
+        DynamicImage::ImageRgb8(img)
+            .write_to(&mut Cursor::new(&mut jpeg), ImageFormat::Jpeg)
+            .unwrap();
+        let out = compose_pxe_background(Some(&jpeg)).unwrap();
+        // Output must be a PNG (magic bytes) of canvas size.
+        assert_eq!(&out[..8], b"\x89PNG\r\n\x1a\n");
+        let img = image::load_from_memory(&out).unwrap();
+        assert_eq!(img.width(), CANVAS_W);
     }
 
     #[test]
     fn unsupported_bytes_returns_error_not_panic() {
-        let r = compose_pxe_logo(b"\xde\xad\xbe\xef not an image");
+        let r = compose_pxe_background(Some(b"\xde\xad\xbe\xef not an image"));
         assert!(r.is_err());
     }
+
+    #[test]
+    fn gradient_endpoints_match_stops() {
+        let stops = [[0, 0, 0], [255, 255, 255]];
+        assert_eq!(gradient_at(&stops, 0.0), [0, 0, 0]);
+        assert_eq!(gradient_at(&stops, 1.0), [255, 255, 255]);
+    }
 }

crates/iso-store/src/store.rs

@@ -15,27 +15,33 @@ use tokio::io::AsyncWriteExt;
 
 /// Where the bytes for an ISO actually live.
 ///
-/// The default is `Local` — uploaded ISOs sit in `<iso_dir>/<id>.iso`.
+/// `Local` — uploaded ISO, sits at `<iso_dir>/<id>.iso`.
-/// `Smb` entries (v0.4.65) point at a file inside a remote SMB share
+/// `Smb` (v0.4.65) — remote SMB share, streamed via Samba's
-/// that the `SmbShareManager` knows how to stream via Samba's
+/// userspace `smbclient` CLI subprocess. No kernel mount, no local
-/// userspace `smbclient` CLI. The HTTP handler resolves the share by
+/// cache. Sequential whole-file streaming; HTTP Range requests
-/// id at request time and pipes `smbclient -c 'get file -'` straight
+/// return 416.
-/// into the response body — no kernel mount, no local cache.
+/// `Nfs` (v0.4.67) — remote NFSv3 share, streamed via the pure-Rust
+/// `nfs3_client` crate (in-process, no subprocess). Same "works in
+/// any container" property as SMB, plus Range requests work because
+/// NFSv3 READ3 takes an explicit offset.
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(tag = "kind", rename_all = "snake_case")]
 pub enum IsoSource {
     #[default]
     Local,
-    /// v0.4.65: kernel-mount NFS is gone (it didn't work on Unraid
+    /// v0.4.65: SMB via userspace `smbclient` works in any container.
-    /// regardless of capabilities — the host kernel needs the nfs
-    /// client modules loaded). SMB via userspace `smbclient` works in
-    /// any container.
     Smb {
         share_id: String,
         /// Filename at the share root. We don't support nested paths
         /// in v0.4.65; ISOs live at the top of the share.
         relative_path: String,
     },
+    /// v0.4.67: NFSv3 via the in-process `nfs3_client` crate.
+    Nfs {
+        share_id: String,
+        /// Filename at the export root.
+        relative_path: String,
+    },
 }
 
 /// Where the ISO lands in the PXE menu hierarchy.
@@ -293,10 +299,11 @@ impl IsoStore {
                     None
                 }
             }
-            // SMB sources have no local path — they're streamed via
+            // SMB and NFS sources have no local path — they're
-            // smbclient subprocess. Callers should check the source
+            // streamed in-process. Callers must inspect the source
-            // kind first and dispatch accordingly.
+            // kind first and dispatch to the appropriate share
-            IsoSource::Smb { .. } => None,
+            // manager.
+            IsoSource::Smb { .. } | IsoSource::Nfs { .. } => None,
         }
     }
 
@@ -348,13 +355,19 @@ impl IsoStore {
     }
 
     /// Drop every entry that belongs to `share_id`. Used by the SMB
-    /// share manager when an operator removes a share, or before
+    /// and NFS share managers when an operator removes a share, or
-    /// re-scanning to clean out stale entries.
+    /// before re-scanning to clean out stale entries. The same id
+    /// space serves both protocols — share ids are slugified from
+    /// `server+share` (SMB) or `server+export` (NFS) and the
+    /// protocol-specific prefix prevents collisions.
     pub fn drop_external_source(&self, share_id: &str) {
         let mut g = self.inner.write();
-        g.isos.retain(
+        g.isos.retain(|_, m| match &m.source {
-            |_, m| !matches!(&m.source, IsoSource::Smb { share_id: sid, .. } if sid == share_id),
+            IsoSource::Smb { share_id: sid, .. } | IsoSource::Nfs { share_id: sid, .. } => {
-        );
+                sid != share_id
+            }
+            IsoSource::Local => true,
+        });
     }
 
     /// Set or clear an ISO's boot password.

crates/openpxe/src/main.rs

@@ -9,7 +9,7 @@ use openpxe_core::{
 };
 use openpxe_dhcp_proxy::DhcpProxyServer;
 use openpxe_http_api::{build_router, AppState};
-use openpxe_iso_store::{IsoStore, SmbManager, SmbShareManager};
+use openpxe_iso_store::{IsoStore, NfsShareManager, SmbManager, SmbShareManager};
 use openpxe_tftp::TftpServer;
 use std::net::{Ipv4Addr, SocketAddr};
 use std::path::PathBuf;
@@ -107,6 +107,7 @@ async fn main() -> anyhow::Result<()> {
     let branding = openpxe_core::BrandingStore::load_or_default(&config.paths.work_dir);
     let admin = openpxe_core::AdminStore::load_or_default(&config.paths.work_dir);
     let sso = openpxe_core::SsoStore::load_or_default(&config.paths.work_dir);
+    let notify = openpxe_core::NotifyStore::load_or_default(&config.paths.work_dir);
     let sessions = openpxe_http_api::auth::SessionStore::default();
     let metrics = Metrics::new();
 
@@ -133,6 +134,18 @@ async fn main() -> anyhow::Result<()> {
         );
     }
 
+    // v0.4.67: NFSv3 share manager — pure-Rust in-process consumer
+    // via the `nfs3_client` crate. Sits alongside the SMB manager;
+    // operators pick whichever protocol their NAS prefers, or use
+    // both. No subprocess, no kernel mount, works in any container.
+    let nfs_shares = NfsShareManager::new(&config.paths.work_dir, iso_store.clone());
+    if let Err(e) = nfs_shares.load_and_rescan().await {
+        tracing::warn!(
+            target: "openpxe::nfs",
+            "could not reload NFS shares on startup: {e}"
+        );
+    }
+
     // Sniff network details for the Network tab. None of these are
     // required for PXE to work — they're informational, surfaced in the
     // UI so an operator doesn't have to drop to a shell to find their
@@ -155,9 +168,12 @@ async fn main() -> anyhow::Result<()> {
         admin: admin.clone(),
         sessions: sessions.clone(),
         sso: sso.clone(),
+        saml: openpxe_http_api::saml_routes::SamlRuntime::default(),
+        notify: notify.clone(),
         metrics: metrics.clone(),
         smb: Some(smb.clone()),
         smb_shares: smb_shares.clone(),
+        nfs_shares: nfs_shares.clone(),
         uploads: openpxe_http_api::uploads::UploadSessions::default(),
         log_bus: log_bus.clone(),
         started_at: time::OffsetDateTime::now_utc(),

crates/webui/src/app.css

@@ -117,6 +117,20 @@ code, kbd { font-family: var(--mono); font-size: 12.5px;
   letter-spacing: 0.2px;
   color: var(--fg);
 }
+
+/* v0.4.69: FleetDM-style full-width custom logo. When the operator has
+   uploaded a custom brand mark, the sidebar header drops the bundled
+   26px mark + "OpenPXE" wordmark and instead lets the uploaded image
+   span the header — left-aligned, capped at 200x50, scaled to fit
+   without distortion. The wordmark is hidden so the operator's logo is
+   the sole brand element (their logo presumably already contains their
+   name). The bundled-default case keeps the mark + wordmark. */
+.sidebar .brand.has-custom-logo { gap: 0; }
+.sidebar .brand.has-custom-logo img {
+  width: auto; height: 50px; max-width: 200px;
+  object-fit: contain; object-position: left center; flex: none;
+}
+.sidebar .brand.has-custom-logo strong { display: none; }
 .sidebar nav { padding: 10px 0; flex: 1; overflow-y: auto; }
 .sidebar nav a {
   display: flex; align-items: center; gap: 10px;
@@ -613,6 +627,14 @@ tr.unbootable td:first-child { border-left: 3px solid var(--warn); }
 }
 .auth-card .brand-row img { width: 32px; height: 32px; flex: none; }
 .auth-card .brand-row .name { font-size: 17px; font-weight: 600; letter-spacing: 0.2px; color: var(--fg); }
+/* v0.5.0: FleetDM-style custom logo on the login/setup card — the
+   uploaded logo spans the card header and the "OpenPXE" wordmark is
+   dropped (the logo is the brand). Matches the sidebar treatment. */
+.auth-card .brand-row.has-custom-logo { justify-content: center; gap: 0; margin-bottom: 22px; }
+.auth-card .brand-row.has-custom-logo img {
+  width: auto; height: 52px; max-width: 240px;
+  object-fit: contain; object-position: center;
+}
 .auth-card h2 {
   margin: 0 0 6px; font-size: 16px; font-weight: 600; color: var(--fg);
 }
@@ -775,3 +797,46 @@ tr.unbootable td:first-child { border-left: 3px solid var(--warn); }
 .logo-preview .info { flex: 1; min-width: 0; }
 .logo-preview .info .name { color: var(--fg); font-weight: 600; }
 .logo-preview .info .meta { color: var(--fg-dim); font-size: 12px; margin-top: 2px; }
+
+/* v0.5.1: collapsible "Advanced" disclosure at the bottom of Settings
+   (the former Advanced sidebar tab). A quiet, full-width toggle that
+   expands to reveal the notification + API-reference cards. */
+.advanced-disclosure { width: 100%; }
+.advanced-summary {
+  list-style: none;
+  cursor: pointer;
+  user-select: none;
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  padding: 10px 14px;
+  color: var(--fg-dim);
+  font-size: 13px;
+  font-weight: 600;
+  background: var(--bg-panel-2);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+}
+.advanced-summary:hover { color: var(--fg); }
+.advanced-summary::-webkit-details-marker { display: none; }
+.advanced-summary::before {
+  content: "▸";
+  font-size: 11px;
+  transition: transform 0.15s ease;
+}
+.advanced-disclosure[open] .advanced-summary::before { transform: rotate(90deg); }
+
+/* v0.5.1: protocol tag on a unified Remote-shares row (SMB / NFS). */
+.proto-badge {
+  display: inline-block;
+  font-size: 10px;
+  font-weight: 700;
+  letter-spacing: 0.04em;
+  padding: 1px 6px;
+  margin-right: 8px;
+  border-radius: 4px;
+  vertical-align: middle;
+  background: var(--bg-panel-2);
+  border: 1px solid var(--border);
+  color: var(--fg-dim);
+}

crates/webui/src/app.js

@@ -116,6 +116,46 @@
     return root;
   }
 
+  // Disk-space card. Free + used + total for the volume hosting the ISO
+  // directory, with a coloured bar. Warns at 80% and goes red at 95% so
+  // the operator sees the runway shrinking before uploads start failing
+  // with ENOSPC. Shared by the Storage tab and the Dashboard (v0.4.68).
+  function diskSpaceCard(disk) {
+    const total = Number(disk.total_bytes || 0);
+    const avail = Number(disk.available_bytes || 0);
+    const used  = Number(disk.used_bytes  || 0);
+    const pctUsed = total > 0 ? (used / total) * 100 : 0;
+    let barClass = 'diskbar';
+    if (pctUsed >= 95)      barClass += ' full';
+    else if (pctUsed >= 80) barClass += ' warn';
+    return el('div', {class:'card'}, [
+      el('header', {}, [
+        el('h2', {}, 'Disk space'),
+        el('span', {class:'sub'},
+          total > 0 ? (pctUsed.toFixed(1) + '% used') : 'unavailable'),
+      ]),
+      el('div', {class:'body'}, [
+        el('div', {style:'color:var(--fg-dim);font-size:12px;word-break:break-all'},
+          disk.path ? ('Volume: ' + disk.path) : 'Volume path unknown'),
+        el('div', {class: barClass},
+          el('div', {class:'fill',
+            style:'width:' + Math.min(100, pctUsed).toFixed(1) + '%'})),
+        el('div', {class:'disk-meta'}, [
+          el('span', {}, ['Used ',  el('strong', {}, fmtBytes(used))]),
+          el('span', {}, ['Free ',  el('strong', {}, fmtBytes(avail))]),
+          el('span', {}, ['Total ', el('strong', {}, fmtBytes(total))]),
+        ]),
+        pctUsed >= 95
+          ? el('p', {class:'msg err', style:'margin-top:10px'},
+              '⚠ Less than 5% free. Remove old ISOs or grow the volume before uploading more.')
+          : (pctUsed >= 80
+              ? el('p', {class:'msg', style:'color:var(--warn);margin-top:10px'},
+                  'Volume is getting full. Consider pruning old ISOs.')
+              : null),
+      ]),
+    ]);
+  }
+
   // Categorize an ISO row's "bootable now" status — drives the amber
   // tint borrowed from Bootimus v0.1.62. Returns {ok, reason}.
   function bootability(iso, settings) {
@@ -142,6 +182,13 @@
       const isos = await getJSON('/api/isos');
       const clients = (await getJSON('/api/clients')).clients || [];
       const entries = (await getJSON('/api/queue')).entries || [];
+      // v0.4.68: surface the same disk-space card the Storage tab shows,
+      // so operators see capacity at a glance from the landing page.
+      // Tolerate the endpoint being unavailable (e.g. statvfs failure)
+      // the same way the Storage tab does.
+      const disk = await getJSON('/api/storage/disk').catch(() => ({
+        total_bytes: 0, available_bytes: 0, used_bytes: 0, path: '?',
+      }));
 
       const ipxeOk = (status.ipxe_assets || []).length > 0;
       const stats = el('div', {class: 'statstrip'}, [
@@ -167,8 +214,11 @@
           el('div', {class: 'trend'},
             isos.filter(i => i.introspection.family === 'windows_pe').length + ' Windows · ' +
             isos.filter(i => i.introspection.family !== 'windows_pe').length + ' Linux  ·  ' +
-            (status.smb_share_reachable || 0) + ' SMB share' +
+            // v0.4.67: count both protocols. Label generically since
-            ((status.smb_share_reachable || 0) === 1 ? '' : 's')),
+            // operators may be using one, the other, or both.
+            ((status.smb_share_reachable || 0) + (status.nfs_share_reachable || 0)) +
+            ' remote share' +
+            (((status.smb_share_reachable || 0) + (status.nfs_share_reachable || 0)) === 1 ? '' : 's')),
         ])),
         el('div', {class: 'card'}, el('div', {class: 'stat'}, [
           el('div', {class: 'label'}, 'Uptime'),
@@ -219,7 +269,7 @@
             '⚠ ' + i.filename + ' — ' + b.reason)))
       ]) : null;
 
-      return el('div', {class:'grid'}, [stats, recentBlock, problemsBlock].filter(Boolean));
+      return el('div', {class:'grid'}, [stats, diskSpaceCard(disk), recentBlock, problemsBlock].filter(Boolean));
     },
 
     network: async () => {
@@ -345,16 +395,20 @@
     storage: async () => {
       // v0.4.65: kernel-mount NFS replaced with userspace SMB via
       // smbclient — works in any container regardless of host kernel
-      // modules or capabilities. The /api/nfs endpoint is gone;
+      // modules or capabilities.
-      // /api/smb-shares is the replacement.
+      // v0.4.67: NFSv3 added back as an in-process Rust client
-      const [isos, settings, smbRes, disk] = await Promise.all([
+      // (nfs3_client crate). Both protocols available side-by-side;
+      // operators pick whichever their NAS prefers.
+      const [isos, settings, smbRes, nfsRes, disk] = await Promise.all([
         getJSON('/api/isos'), getJSON('/api/settings'),
         getJSON('/api/smb-shares'),
+        getJSON('/api/nfs-shares'),
         getJSON('/api/storage/disk').catch(() => ({
           total_bytes: 0, available_bytes: 0, used_bytes: 0, path: '?',
         })),
       ]);
       const shares = smbRes.shares || [];
+      const nfsShares = nfsRes.shares || [];
 
       // ── Upload card ──
       const drop = el('div', {class:'drop', id:'drop'}, [
@@ -464,10 +518,14 @@
       const rowsAndEditors = [];
       isos.forEach(i => {
         const b = bootability(i, settings);
-        // v0.4.65: SMB userspace consumer replaced NFS. The badge
+        // v0.4.65: SMB userspace consumer (smbclient).
-        // colours stay the same so the table looks unchanged for
+        // v0.4.67: NFS back as in-process Rust client (nfs3_client).
-        // existing operators.
+        // Both render with the same "remote" badge colour — they
+        // share the same "on a remote share, can't be deleted from
+        // here" semantics in the UI.
         const isSmb = i.source && i.source.kind === 'smb';
+        const isNfs = i.source && i.source.kind === 'nfs';
+        const isRemote = isSmb || isNfs;
         const protectedNow = !!i.password_hash;
 
         // The inline editor row is hidden by default; the Password
@@ -587,8 +645,9 @@
           ]),
           el('td', {class:'num'}, fmtBytes(i.size_bytes)),
           el('td', {},
-            el('span', {class:'src-badge' + (isSmb ? ' nfs' : '')},
+            el('span', {class:'src-badge' + (isRemote ? ' nfs' : '')},
-              isSmb ? ('smb:' + i.source.share_id) : 'local')),
+              isSmb ? ('smb:' + i.source.share_id)
+                : isNfs ? ('nfs:' + i.source.share_id) : 'local')),
           el('td', {},
             protectedNow
               ? el('span', {class:'tag accent'}, 'protected')
@@ -598,11 +657,12 @@
             el('button', {class:'ghost', style:'margin-right:6px', onclick: () => {
               editorRow.style.display = (editorRow.style.display === 'none') ? '' : 'none';
             }}, protectedNow ? 'Password ✎' : 'Set password'),
-            isSmb
+            isRemote
-              // v0.4.65: SMB-sourced ISOs live on the remote share —
+              // v0.4.65/v0.4.67: remote-sourced ISOs live on the
-              // OpenPXE doesn't own those bytes. Same pattern as NFS
+              // share — OpenPXE doesn't own those bytes. Surface a
-              // had: surface a tag instead of a destructive button.
+              // tag instead of a destructive button.
-              ? el('span', {class:'tag', style:'opacity:.6'}, 'on SMB')
+              ? el('span', {class:'tag', style:'opacity:.6'},
+                  isSmb ? 'on SMB' : 'on NFS')
               : el('button', {class:'danger', onclick: async () => {
                   if (!confirm('Remove this image?')) return;
                   await fetch('/api/isos/' + encodeURIComponent(i.id), {method:'DELETE'});
@@ -624,19 +684,46 @@
           ])
         : el('div', {class:'empty'}, 'No images yet. Upload an ISO or add an SMB share.');
 
-      // ── SMB shares section (v0.4.65) ──
+      // ── Remote shares section (v0.5.1) ──
-      // Replaces the kernel-mount NFS card. SMB shares are consumed
+      // SMB + NFS unified into one "Remote shares" card with a protocol
-      // in userspace via Samba's `smbclient` CLI — no kernel modules,
+      // dropdown. The two protocols keep their own backend endpoints
-      // no CAP_SYS_ADMIN, works in any container. This is the same
+      // (/api/smb-shares, /api/nfs-shares) and the same add/scan/remove
-      // approach Bootimus uses.
+      // UX; the form just swaps the relevant fields. This declutters the
-      const smbMsg = el('div', {class:'msg'});
+      // Storage tab and leaves room for a future "Config files" card.
+      const shareMsg = el('div', {class:'msg'});
+
+      // Shared structured-error renderer ({error, stderr, hint}) for both
+      // protocols' add calls.
+      const showShareError = async (r) => {
+        let bodyJson = null;
+        let raw = null;
+        try { bodyJson = await r.clone().json(); }
+        catch (_) { raw = await r.text().catch(() => 'connect failed'); }
+        const msg = bodyJson && bodyJson.error ? bodyJson.error : (raw || 'connect failed');
+        const hint = bodyJson && bodyJson.hint;
+        const parts = [el('div', {}, [
+          el('strong', {}, 'Connect failed: '),
+          document.createTextNode(msg),
+        ])];
+        if (hint) {
+          parts.push(el('div', {style:'margin-top:6px;opacity:.78;font-size:12px'}, hint));
+        }
+        shareMsg.replaceChildren(...parts);
+        shareMsg.className = 'msg err';
+      };
+
+      // Protocol picker — swaps which field block is visible.
+      const protoSelect = el('select', {}, [
+        el('option', {value:'smb'}, 'SMB / CIFS'),
+        el('option', {value:'nfs'}, 'NFS (NFSv3)'),
+      ]);
+
+      // SMB inputs.
       const smbServer = el('input', {type:'text', placeholder:'192.168.1.51'});
       const smbShare = el('input', {type:'text', placeholder:'isos'});
       const smbGuest = el('input', {type:'checkbox'}); smbGuest.checked = true;
       const smbUser = el('input', {type:'text', placeholder:'(disabled when Guest)'});
       const smbPass = el('input', {type:'password', placeholder:'(disabled when Guest)'});
-      // Toggle username/password fields based on the Guest checkbox so
-      // operators don't get confused about which fields matter.
       const syncAuthDisabled = () => {
         smbUser.disabled = smbGuest.checked;
         smbPass.disabled = smbGuest.checked;
@@ -645,58 +732,23 @@
       };
       smbGuest.addEventListener('change', syncAuthDisabled);
       syncAuthDisabled();
+      const smbFields = el('div', {}, [
+        el('div', {class:'form-row cols-2'}, [
+          el('label', {class:'field'}, [el('span', {class:'name'}, 'SMB server'), smbServer]),
+          el('label', {class:'field'}, [el('span', {class:'name'}, 'Share name'), smbShare]),
+        ]),
+        el('div', {class:'form-row cols-3', style:'margin-top:14px'}, [
+          el('label', {class:'check'}, [smbGuest, el('span', {}, 'Guest (anonymous read)')]),
+          el('label', {class:'field'}, [el('span', {class:'name'}, 'Username'), smbUser]),
+          el('label', {class:'field'}, [el('span', {class:'name'}, 'Password'), smbPass]),
+        ]),
+      ]);
 
-      const addSmb = el('button', {onclick: async () => {
+      const smbRowEls = shares.map(m => el('div', {class: 'nfs-row' + (m.reachable ? '' : ' down')}, [
-        if (!smbServer.value || !smbShare.value) {
-          smbMsg.replaceChildren(document.createTextNode('Server and share name are required.'));
-          smbMsg.className='msg err'; return;
-        }
-        if (!smbGuest.checked && !smbUser.value) {
-          smbMsg.replaceChildren(document.createTextNode('Username is required when Guest is unchecked.'));
-          smbMsg.className='msg err'; return;
-        }
-        smbMsg.replaceChildren(document.createTextNode('Connecting…'));
-        smbMsg.className = 'msg';
-        const body = {
-          server: smbServer.value,
-          share: smbShare.value,
-          guest: smbGuest.checked,
-        };
-        if (!smbGuest.checked) {
-          body.username = smbUser.value;
-          body.password = smbPass.value;
-        }
-        const r = await postJSON('/api/smb-shares', body);
-        if (r.ok) {
-          smbMsg.replaceChildren(document.createTextNode('Connected.'));
-          smbMsg.className = 'msg ok';
-          render('storage');
-        } else {
-          // The API returns a structured {error, stderr, hint} JSON
-          // body on failure so the raw smbclient error and the
-          // actionable hint render as two distinct lines.
-          let bodyJson = null;
-          let raw = null;
-          try { bodyJson = await r.clone().json(); }
-          catch (_) { raw = await r.text().catch(()=> 'connect failed'); }
-          const msg = bodyJson && bodyJson.error ? bodyJson.error : (raw || 'connect failed');
-          const hint = bodyJson && bodyJson.hint;
-          const parts = [el('div', {}, [
-            el('strong', {}, 'Connect failed: '),
-            document.createTextNode(msg),
-          ])];
-          if (hint) {
-            parts.push(el('div', {style:'margin-top:6px;opacity:.78;font-size:12px'}, hint));
-          }
-          smbMsg.replaceChildren(...parts);
-          smbMsg.className = 'msg err';
-        }
-      }}, 'Add share');
-
-      const smbRows = shares.length ? shares.map(m => el('div', {class: 'nfs-row' + (m.reachable ? '' : ' down')}, [
         el('span', {class: 'dot ' + (m.reachable ? 'ok' : 'err')}),
         el('div', {}, [
-          el('div', {class:'id'}, '//' + m.server + '/' + m.share),
+          el('div', {class:'id'}, [el('span', {class:'proto-badge'}, 'SMB'),
+            document.createTextNode('//' + m.server + '/' + m.share)]),
           el('div', {class:'meta'},
             (m.guest ? 'guest' : ('user: ' + (m.username || '?'))) + ' · ' +
             (m.reachable ? m.iso_count + ' isos' : 'not reachable')),
@@ -713,92 +765,134 @@
           render('storage');
         }}, 'Remove'),
         el('span'),
-      ])) : [el('div', {class:'empty'}, 'No SMB shares configured.')];
+      ]));
 
-      // Disk-space card. Free + used + total for the volume hosting the
+      // NFS inputs. The NFSv3 client is in-process (nfs3_client crate) so
-      // ISO directory, with a coloured bar. Warns at 80% and goes red at
+      // NFS-sourced ISOs support HTTP Range — SMB-sourced ones can't seek
-      // 95% so the operator sees the runway shrinking before uploads
+      // mid-stream. No auth fields: NFSv3 access is gated by client IP on
-      // start failing with ENOSPC.
+      // the server's export list, not client-supplied credentials.
-      const total = Number(disk.total_bytes || 0);
+      const nfsServerIn = el('input', {type:'text', placeholder:'10.0.0.5'});
-      const avail = Number(disk.available_bytes || 0);
+      const nfsExportIn = el('input', {type:'text', placeholder:'/srv/isos'});
-      const used  = Number(disk.used_bytes  || 0);
+      const nfsFields = el('div', {}, [
-      const pctUsed = total > 0 ? (used / total) * 100 : 0;
+        el('div', {class:'form-row cols-2'}, [
-      let barClass = 'diskbar';
+          el('label', {class:'field'}, [el('span', {class:'name'}, 'NFS server'), nfsServerIn]),
-      if (pctUsed >= 95)      barClass += ' full';
+          el('label', {class:'field'}, [el('span', {class:'name'}, 'Export path'), nfsExportIn]),
-      else if (pctUsed >= 80) barClass += ' warn';
-      const diskCard = el('div', {class:'card'}, [
-        el('header', {}, [
-          el('h2', {}, 'Disk space'),
-          el('span', {class:'sub'},
-            total > 0
-              ? (pctUsed.toFixed(1) + '% used')
-              : 'unavailable'),
-        ]),
-        el('div', {class:'body'}, [
-          el('div', {style:'color:var(--fg-dim);font-size:12px;word-break:break-all'},
-            disk.path ? ('Volume: ' + disk.path) : 'Volume path unknown'),
-          el('div', {class: barClass},
-            el('div', {class:'fill',
-              style:'width:' + Math.min(100, pctUsed).toFixed(1) + '%'})),
-          el('div', {class:'disk-meta'}, [
-            el('span', {}, ['Used ',  el('strong', {}, fmtBytes(used))]),
-            el('span', {}, ['Free ',  el('strong', {}, fmtBytes(avail))]),
-            el('span', {}, ['Total ', el('strong', {}, fmtBytes(total))]),
-          ]),
-          pctUsed >= 95
-            ? el('p', {class:'msg err', style:'margin-top:10px'},
-                '⚠ Less than 5% free. Remove old ISOs or grow the volume before uploading more.')
-            : (pctUsed >= 80
-                ? el('p', {class:'msg', style:'color:var(--warn);margin-top:10px'},
-                    'Volume is getting full. Consider pruning old ISOs.')
-                : null),
         ]),
       ]);
 
+      // Swap the visible field block + clear any stale message.
+      const syncProto = () => {
+        const nfs = protoSelect.value === 'nfs';
+        smbFields.style.display = nfs ? 'none' : '';
+        nfsFields.style.display = nfs ? '' : 'none';
+        shareMsg.replaceChildren();
+        shareMsg.className = 'msg';
+      };
+      protoSelect.addEventListener('change', syncProto);
+
+      // One add button; dispatches to the selected protocol's endpoint.
+      const addShare = el('button', {style:'margin-top:14px', onclick: async () => {
+        if (protoSelect.value === 'smb') {
+          if (!smbServer.value || !smbShare.value) {
+            shareMsg.replaceChildren(document.createTextNode('Server and share name are required.'));
+            shareMsg.className = 'msg err'; return;
+          }
+          if (!smbGuest.checked && !smbUser.value) {
+            shareMsg.replaceChildren(document.createTextNode('Username is required when Guest is unchecked.'));
+            shareMsg.className = 'msg err'; return;
+          }
+          shareMsg.replaceChildren(document.createTextNode('Connecting…'));
+          shareMsg.className = 'msg';
+          const body = { server: smbServer.value, share: smbShare.value, guest: smbGuest.checked };
+          if (!smbGuest.checked) { body.username = smbUser.value; body.password = smbPass.value; }
+          const r = await postJSON('/api/smb-shares', body);
+          if (r.ok) {
+            shareMsg.replaceChildren(document.createTextNode('Connected.'));
+            shareMsg.className = 'msg ok';
+            render('storage');
+          } else { await showShareError(r); }
+        } else {
+          if (!nfsServerIn.value || !nfsExportIn.value) {
+            shareMsg.replaceChildren(document.createTextNode('Server and export are required.'));
+            shareMsg.className = 'msg err'; return;
+          }
+          shareMsg.replaceChildren(document.createTextNode('Connecting…'));
+          shareMsg.className = 'msg';
+          const r = await postJSON('/api/nfs-shares', { server: nfsServerIn.value, export: nfsExportIn.value });
+          if (r.ok) {
+            shareMsg.replaceChildren(document.createTextNode('Connected.'));
+            shareMsg.className = 'msg ok';
+            render('storage');
+          } else { await showShareError(r); }
+        }
+      }}, 'Add share');
+
+      const nfsRowEls = nfsShares.map(m => el('div', {class: 'nfs-row' + (m.reachable ? '' : ' down')}, [
+        el('span', {class: 'dot ' + (m.reachable ? 'ok' : 'err')}),
+        el('div', {}, [
+          el('div', {class:'id'}, [el('span', {class:'proto-badge'}, 'NFS'),
+            document.createTextNode(m.server + ':' + m.export)]),
+          el('div', {class:'meta'},
+            'NFSv3 · ' + (m.reachable ? m.iso_count + ' isos' : 'not reachable')),
+          m.last_error ? el('div', {class:'err'}, '⚠ ' + m.last_error) : null,
+          m.last_hint ? el('div', {style:'margin-top:4px;opacity:.78;font-size:12px'}, m.last_hint) : null,
+        ]),
+        el('button', {class:'ghost', onclick: async () => {
+          const r = await postJSON('/api/nfs-shares/' + encodeURIComponent(m.id) + '/scan', {});
+          if (r.ok) render('storage');
+        }}, 'Re-scan'),
+        el('button', {class:'danger', onclick: async () => {
+          if (!confirm('Forget ' + m.server + ':' + m.export + '?')) return;
+          await fetch('/api/nfs-shares/' + encodeURIComponent(m.id), {method:'DELETE'});
+          render('storage');
+        }}, 'Remove'),
+        el('span'),
+      ]));
+
+      const totalShares = shares.length + nfsShares.length;
+      const remoteRows = totalShares
+        ? [...smbRowEls, ...nfsRowEls]
+        : [el('div', {class:'empty'}, 'No remote shares configured.')];
+      syncProto();
+
+      const diskCard = diskSpaceCard(disk);
+
       return el('div', {class:'grid'}, [
         diskCard,
         el('div', {class:'card'}, [
           el('header', {}, el('h2', {}, 'Upload ISO')),
           el('div', {class:'body'}, [drop, file, prog, upMsg]),
         ]),
+        // v0.5.1: SMB + NFS unified into one "Remote shares" card with a
+        // protocol dropdown. Backend endpoints are unchanged; this is a
+        // pure UI consolidation that declutters the Storage tab.
         el('div', {class:'card'}, [
           el('header', {}, [
-            el('h2', {}, 'SMB shares'),
+            el('h2', {}, 'Remote shares'),
-            el('span', {class:'sub'}, shares.length + ' configured'),
+            el('span', {class:'sub'}, totalShares + ' configured'),
           ]),
           el('div', {class:'body'}, [
             el('div', {class:'form-row cols-2'}, [
               el('label', {class:'field'}, [
-                el('span', {class:'name'}, 'SMB server'),
+                el('span', {class:'name'}, 'Protocol'),
-                smbServer,
+                protoSelect,
-              ]),
-              el('label', {class:'field'}, [
-                el('span', {class:'name'}, 'Share name'),
-                smbShare,
               ]),
+              el('span'),
             ]),
-            el('div', {class:'form-row cols-3', style:'margin-top:14px'}, [
+            el('div', {style:'margin-top:14px'}, [smbFields, nfsFields]),
-              el('label', {class:'check'}, [
+            addShare, shareMsg,
-                smbGuest, el('span', {}, 'Guest (anonymous read)'),
+            el('div', {style:'margin-top:18px;display:grid;gap:8px'}, remoteRows),
-              ]),
-              el('label', {class:'field'}, [
-                el('span', {class:'name'}, 'Username'),
-                smbUser,
-              ]),
-              el('label', {class:'field'}, [
-                el('span', {class:'name'}, 'Password'),
-                smbPass,
-              ]),
-            ]),
-            addSmb, smbMsg,
-            el('div', {style:'margin-top:18px;display:grid;gap:8px'}, smbRows),
             el('p', {class:'msg', style:'margin-top:14px'},
-              'SMB shares are read in userspace via Samba’s smbclient — ' +
+              'Remote ISO libraries are read on demand — no local cache, no ' +
-              'no kernel modules, no CAP_SYS_ADMIN, works in any container ' +
+              'double disk usage. SMB/CIFS is read in userspace via Samba’s ' +
-              '(Unraid, OpenShift restricted SCC, plain Docker, etc.). Most NAS ' +
+              'smbclient; NFSv3 via a pure-Rust in-process client. Both work in ' +
-              'appliances expose ISO libraries as guest-readable; check the box ' +
+              'any container (Unraid, OpenShift restricted SCC, plain Docker) with ' +
-              'above when that’s the case. ISOs are streamed on demand at PXE ' +
+              'no kernel modules and no CAP_SYS_ADMIN. SMB supports guest or ' +
-              'boot time — no local cache, no double disk usage.'),
+              'user/password; most NAS appliances expose ISO libraries as ' +
+              'guest-readable. NFSv3 auth is AUTH_SYS only — gate access by ' +
+              'allowing this OpenPXE host’s IP in the server’s export list. ' +
+              'NFS-sourced ISOs also support HTTP Range (seek into a 5 GB ISO ' +
+              'without reading what precedes the offset); SMB streams sequentially.'),
           ]),
         ]),
         el('div', {class:'card'}, [
@@ -852,18 +946,37 @@
         }
       }}, 'Bind MAC to target');
 
-      const rows = hosts.map(h => el('tr', {}, [
+      const rows = hosts.map(h => {
-        el('td', {class:'mono'}, h.mac),
+        // v0.5.0: Wake-on-LAN. Only shown for bound hosts (this whole
-        el('td', {}, h.label || el('span', {class:'tag'}, '(unlabeled)')),
+        // table is bound hosts). The button reports its own state inline
-        el('td', {class:'mono'}, h.target),
+        // so there's no shared toast to thread through.
-        el('td', {}, fmtAgo(h.updated_at)),
+        const wakeBtn = el('button', {class:'ghost', onclick: async () => {
-        el('td', {style:'text-align:right'},
+          wakeBtn.disabled = true;
-          el('button', {class:'danger', onclick: async () => {
+          const original = wakeBtn.textContent;
-            if (!confirm('Remove binding for ' + h.mac + '?')) return;
+          wakeBtn.textContent = 'Waking…';
-            await fetch('/api/hosts/' + encodeURIComponent(h.mac), {method:'DELETE'});
+          try {
-            render('hosts');
+            const r = await postJSON('/api/hosts/' + encodeURIComponent(h.mac) + '/wol', {});
-          }}, 'Remove')),
+            wakeBtn.textContent = r.ok ? 'Sent ✓' : 'Failed';
-      ]));
+          } catch (e) {
+            wakeBtn.textContent = 'Failed';
+          }
+          setTimeout(() => { wakeBtn.textContent = original; wakeBtn.disabled = false; }, 2500);
+        }}, 'Wake');
+        return el('tr', {}, [
+          el('td', {class:'mono'}, h.mac),
+          el('td', {}, h.label || el('span', {class:'tag'}, '(unlabeled)')),
+          el('td', {class:'mono'}, h.target),
+          el('td', {}, fmtAgo(h.updated_at)),
+          el('td', {style:'text-align:right;white-space:nowrap'}, [
+            wakeBtn,
+            el('button', {class:'danger', style:'margin-left:8px', onclick: async () => {
+              if (!confirm('Remove binding for ' + h.mac + '?')) return;
+              await fetch('/api/hosts/' + encodeURIComponent(h.mac), {method:'DELETE'});
+              render('hosts');
+            }}, 'Remove'),
+          ]),
+        ]);
+      });
 
       const table = hosts.length
         ? el('table', {}, [
@@ -1064,13 +1177,16 @@
     },
 
     settings: async () => {
-      const [status, docs, me, sso] = await Promise.all([
+      const [status, me, sso, notify, docs] = await Promise.all([
         getJSON('/api/status'),
-        getJSON('/api/docs').catch(() => ({ groups: [] })),
         getJSON('/api/me').catch(() => ({})),
         getJSON('/api/sso').catch(() => ({
           enabled:false, idp_name:'', metadata:'', metadata_url:'',
         })),
+        // v0.5.1: the former Advanced tab folds in here, so Settings
+        // fetches the notify config + API docs it needs too.
+        getJSON('/api/notify').catch(() => ({ enabled:false, kind:'slack' })),
+        getJSON('/api/docs').catch(() => ({ groups: [] })),
       ]);
       const hasLogo = !!status.custom_logo;
 
@@ -1368,10 +1484,141 @@
         ]),
       ]);
 
-      // ── API reference (always at the bottom of Settings).
+      // v0.5.1: the former "Advanced" sidebar tab now lives here, folded
-      // Sourced from /api/docs so the hand-curated list stays the
+      // into a collapsible disclosure beneath the core settings cards —
-      // single source of truth and the UI doesn't need its own copy
+      // webhook/email notifications + the API reference. Keeps Settings
-      // baked into the JS bundle.
+      // clean by default while leaving the knobs one click away.
+      const [notifyCard, apiCard] = views._advancedCards(notify, docs);
+      const advanced = el('details', {class:'advanced-disclosure', style:'margin-top:18px'}, [
+        el('summary', {class:'advanced-summary'}, 'Advanced'),
+        el('div', {class:'grid', style:'margin-top:14px'}, [notifyCard, apiCard]),
+      ]);
+      return el('div', {}, [
+        el('div', {class:'grid'}, [accountCard, ssoCard, logoCard]),
+        advanced,
+      ]);
+    },
+
+    // v0.5.1: builds the two "Advanced" cards — webhook/email notifications
+    // and the API reference. There is no longer an Advanced sidebar tab;
+    // the Settings view folds these into a collapsible disclosure and
+    // passes in the pre-fetched `notify` + `docs` payloads.
+    _advancedCards: (notify, docs) => {
+
+      // ── Notification config ──
+      const nMsg = el('div', {class:'msg', style:'margin-top:12px'});
+      const nEnabled = el('input', {type:'checkbox'}); nEnabled.checked = !!notify.enabled;
+      const nKind = el('select', {}, [
+        el('option', {value:'slack'}, 'Slack'),
+        el('option', {value:'discord'}, 'Discord'),
+        el('option', {value:'teams'}, 'Microsoft Teams'),
+        el('option', {value:'smtp'}, 'Email (SMTP)'),
+      ]);
+      nKind.value = notify.kind || 'slack';
+      const nWebhook = el('input', {type:'text', placeholder:'https://hooks.slack.com/services/…',
+        value: notify.webhook_url || ''});
+      // SMTP fields.
+      const sHost = el('input', {type:'text', placeholder:'smtp.example.com', value: notify.smtp_host || ''});
+      const sPort = el('input', {type:'number', value: String(notify.smtp_port || 587)});
+      const sUser = el('input', {type:'text', placeholder:'(optional)', value: notify.smtp_username || ''});
+      // GET returns the password as a redaction sentinel when one is
+      // set; show an empty field with an "(unchanged)" placeholder and
+      // let collectNotify() re-send the sentinel so the stored secret
+      // is preserved unless the operator types a new one.
+      const hasStoredPass = !!notify.smtp_password;
+      const sPass = el('input', {type:'password',
+        placeholder: hasStoredPass ? '•••••• (unchanged)' : '', value: ''});
+      const sFrom = el('input', {type:'text', placeholder:'[email protected]', value: notify.smtp_from || ''});
+      const sTo   = el('input', {type:'text', placeholder:'[email protected]', value: notify.smtp_to || ''});
+      const sTls  = el('input', {type:'checkbox'}); sTls.checked = !!notify.smtp_implicit_tls;
+
+      const webhookBlock = el('div', {class:'form-row'}, [
+        el('label', {class:'field', style:'grid-column:1 / -1'}, [
+          el('span', {class:'name'}, 'Incoming webhook URL'),
+          nWebhook,
+          el('span', {class:'hint'},
+            'Slack/Discord/Teams all use an "incoming webhook" URL you create in that app.'),
+        ]),
+      ]);
+      const smtpBlock = el('div', {}, [
+        el('div', {class:'form-row cols-2'}, [
+          el('label', {class:'field'}, [el('span', {class:'name'}, 'SMTP host'), sHost]),
+          el('label', {class:'field'}, [el('span', {class:'name'}, 'Port'), sPort]),
+        ]),
+        el('div', {class:'form-row cols-2', style:'margin-top:12px'}, [
+          el('label', {class:'field'}, [el('span', {class:'name'}, 'Username (optional)'), sUser]),
+          el('label', {class:'field'}, [el('span', {class:'name'}, 'Password'), sPass]),
+        ]),
+        el('div', {class:'form-row cols-2', style:'margin-top:12px'}, [
+          el('label', {class:'field'}, [el('span', {class:'name'}, 'From'), sFrom]),
+          el('label', {class:'field'}, [el('span', {class:'name'}, 'To'), sTo]),
+        ]),
+        el('label', {class:'check', style:'margin-top:12px'}, [
+          sTls, el('span', {}, 'Implicit TLS (port 465). Leave off for STARTTLS (587).'),
+        ]),
+      ]);
+      // Toggle which provider block shows.
+      const syncKind = () => {
+        const smtp = nKind.value === 'smtp';
+        webhookBlock.style.display = smtp ? 'none' : '';
+        smtpBlock.style.display = smtp ? '' : 'none';
+      };
+      nKind.addEventListener('change', syncKind);
+      syncKind();
+
+      const collectNotify = () => ({
+        enabled: nEnabled.checked,
+        kind: nKind.value,
+        webhook_url: nWebhook.value,
+        smtp_host: sHost.value,
+        smtp_port: Number(sPort.value) || 587,
+        smtp_username: sUser.value,
+        // Empty field + a stored password → send the sentinel so the
+        // server keeps it. Otherwise send whatever was typed (a new
+        // password, or empty to clear when none was stored).
+        smtp_password: (sPass.value === '' && hasStoredPass) ? '__keep__' : sPass.value,
+        smtp_from: sFrom.value,
+        smtp_to: sTo.value,
+        smtp_implicit_tls: sTls.checked,
+      });
+
+      const saveBtn = el('button', {style:'margin-top:16px', onclick: async () => {
+        nMsg.textContent = 'Saving…'; nMsg.className = 'msg';
+        const r = await putJSON('/api/notify', collectNotify());
+        if (r.ok) { nMsg.textContent = 'Saved.'; nMsg.className = 'msg ok'; render('settings'); }
+        else { nMsg.textContent = 'Save failed: ' + (await r.text()); nMsg.className = 'msg err'; }
+      }}, 'Save notification settings');
+      const testBtn = el('button', {class:'ghost', style:'margin-top:16px;margin-left:8px',
+        onclick: async () => {
+          nMsg.textContent = 'Sending test…'; nMsg.className = 'msg';
+          // Save first so the test uses exactly what's on screen.
+          const rs = await putJSON('/api/notify', collectNotify());
+          if (!rs.ok) { nMsg.textContent = 'Save failed: ' + (await rs.text()); nMsg.className = 'msg err'; return; }
+          const r = await postJSON('/api/notify/test', {});
+          if (r.ok) { nMsg.textContent = 'Test notification sent — check your channel/inbox.'; nMsg.className = 'msg ok'; }
+          else { nMsg.textContent = 'Test failed: ' + (await r.text()); nMsg.className = 'msg err'; }
+        }}, 'Send test');
+
+      const notifyCard = el('div', {class:'card'}, [
+        el('header', {}, [
+          el('h2', {}, 'Webhook notifications'),
+          el('span', {class:'sub'}, notify.enabled ? 'enabled' : 'disabled'),
+        ]),
+        el('div', {class:'body'}, [
+          el('p', {class:'msg', style:'margin-bottom:14px'},
+            'Get pinged when a machine PXE-boots an image, a deployment is assigned, ' +
+            'or a host is woken. One provider at a time — pick yours, paste the URL ' +
+            '(or SMTP details), and Send test.'),
+          el('div', {class:'form-row cols-2'}, [
+            el('label', {class:'check'}, [nEnabled, el('span', {}, 'Enable notifications')]),
+            el('label', {class:'field'}, [el('span', {class:'name'}, 'Provider'), nKind]),
+          ]),
+          el('div', {style:'margin-top:14px'}, [webhookBlock, smtpBlock]),
+          saveBtn, testBtn, nMsg,
+        ]),
+      ]);
+
+      // ── API reference (relocated from Settings) ──
       const groups = docs.groups || [];
       const apiCard = el('div', {class:'card'}, [
         el('header', {}, [
@@ -1394,12 +1641,41 @@
                 'No API documentation returned by /api/docs.')),
       ]);
 
-      return el('div', {class:'grid'}, [accountCard, ssoCard, logoCard, apiCard]);
+      return [notifyCard, apiCard];
     },
 
     about: async () => {
       const status = await getJSON('/api/status');
-      return el('div', {class:'card'}, [
+
+      // ── Check for updates ──
+      const updMsg = el('div', {class:'msg', style:'margin-top:10px'});
+      const updBtn = el('button', {onclick: async () => {
+        updMsg.textContent = 'Checking the OpenPXE release feed…'; updMsg.className = 'msg';
+        try {
+          const r = await getJSON('/api/updates/check');
+          if (r.error) {
+            updMsg.replaceChildren(document.createTextNode('Couldn’t check: ' + r.error));
+            updMsg.className = 'msg err';
+          } else if (r.update_available) {
+            const parts = [document.createTextNode('Update available: '),
+              el('strong', {}, r.latest), document.createTextNode(' (you’re on ' + r.current + '). ')];
+            if (r.html_url) {
+              parts.push(el('a', {href:r.html_url, target:'_blank', rel:'noopener noreferrer'},
+                'View release →'));
+            }
+            updMsg.replaceChildren(...parts);
+            updMsg.className = 'msg ok';
+          } else {
+            updMsg.replaceChildren(document.createTextNode(
+              'You’re up to date — running the latest release (' + r.current + ').'));
+            updMsg.className = 'msg ok';
+          }
+        } catch (e) {
+          updMsg.textContent = 'Couldn’t reach the release feed (offline?).'; updMsg.className = 'msg err';
+        }
+      }}, 'Check for updates');
+
+      const heroCard = el('div', {class:'card'}, [
         el('div', {class:'about-hero'}, [
           el('h2', {}, 'OpenPXE'),
           el('p', {class:'lead'},
@@ -1414,6 +1690,7 @@
             el('a', {href:'https://openpxe.com/', target:'_blank', rel:'noopener noreferrer'},
               'https://openpxe.com/'),
           ]),
+          el('div', {style:'margin-top:18px'}, [updBtn, updMsg]),
           el('p', {class:'msg', style:'margin-top:18px'},
             'iPXE is an internal implementation detail. Everything the firmware ' +
             'executes is generated from the settings on these tabs — there is no ' +
@@ -1426,6 +1703,46 @@
             'flip "testsigning" on a target machine.'),
         ]),
       ]);
+
+      // ── Licenses ──
+      const licenseCard = el('div', {class:'card'}, [
+        el('header', {}, el('h2', {}, 'License')),
+        el('div', {class:'body'}, [
+          el('p', {class:'msg', style:'margin-bottom:12px'}, [
+            'OpenPXE is dual-licensed under ',
+            el('strong', {}, 'MIT'), document.createTextNode(' OR '),
+            el('strong', {}, 'Apache License 2.0'),
+            document.createTextNode(
+              ' — use it under whichever fits your organization (SPDX: MIT OR Apache-2.0).'),
+          ]),
+          el('div', {class:'license-grid', style:'display:grid;grid-template-columns:1fr 1fr;gap:14px'}, [
+            el('div', {}, [
+              el('h3', {style:'margin:0 0 6px'}, 'MIT License'),
+              el('p', {class:'msg', style:'font-size:12px'},
+                'Permission is hereby granted, free of charge, to any person obtaining a copy ' +
+                'of this software and associated documentation files, to deal in the Software ' +
+                'without restriction… THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND.'),
+              el('a', {href:'https://opensource.org/license/mit', target:'_blank', rel:'noopener noreferrer'},
+                'Full MIT text →'),
+            ]),
+            el('div', {}, [
+              el('h3', {style:'margin:0 0 6px'}, 'Apache License 2.0'),
+              el('p', {class:'msg', style:'font-size:12px'},
+                'Licensed under the Apache License, Version 2.0. Includes an express grant of ' +
+                'patent rights from contributors. Distributed on an "AS IS" BASIS, WITHOUT ' +
+                'WARRANTIES OR CONDITIONS OF ANY KIND.'),
+              el('a', {href:'https://www.apache.org/licenses/LICENSE-2.0', target:'_blank', rel:'noopener noreferrer'},
+                'Full Apache 2.0 text →'),
+            ]),
+          ]),
+          el('p', {class:'msg', style:'margin-top:14px;font-size:12px;opacity:.8'},
+            'Bundled components keep their own licenses: iPXE (GPLv2 / UBDL), Samba smbclient, ' +
+            'wimtools, and the Rust crates in this build. See the source repository for the ' +
+            'complete NOTICE.'),
+        ]),
+      ]);
+
+      return el('div', {class:'grid'}, [heroCard, licenseCard]);
     },
   };
 
@@ -1542,6 +1859,26 @@
   let chipsInterval = null;
   let authScreenEl = null;
   let ssoConfig = null;
+  // v0.5.0: branding bootstrap for the pre-auth screens, populated from
+  // /api/me (public). Lets the login/setup cards render the same
+  // FleetDM-style full-width custom logo the dashboard sidebar uses.
+  let brandInfo = { has_custom_logo: false, logo_rev: 0 };
+
+  // Brand row for the auth screens. With a custom logo uploaded: the
+  // logo spans the card, no "OpenPXE" wordmark (the logo is the brand).
+  // Default: bundled mark + "OpenPXE".
+  function authBrandRow() {
+    const src = '/assets/logo.svg?r=' + (brandInfo.logo_rev || 0);
+    if (brandInfo.has_custom_logo) {
+      return el('div', {class:'brand-row has-custom-logo'}, [
+        el('img', {src, alt:'logo'}),
+      ]);
+    }
+    return el('div', {class:'brand-row'}, [
+      el('img', {src, alt:''}),
+      el('div', {class:'name'}, 'OpenPXE'),
+    ]);
+  }
 
   function teardownAuthScreen() {
     if (authScreenEl && authScreenEl.parentNode) {
@@ -1557,16 +1894,28 @@
     const err = el('div', {class:'auth-err', style:'display:none'});
     const submit = el('button', {class:'submit', type:'submit'}, 'Sign in');
 
+    // v0.5.1: surface a failed/blocked SSO round-trip. The ACS handler
+    // redirects back to "/?sso_error=..." on any failure; we show a
+    // generic, non-leaky message and scrub the query so a refresh is clean.
+    const ssoErr = new URLSearchParams(window.location.search).get('sso_error');
+    if (ssoErr) {
+      err.textContent = ssoErr === 'idp_initiated'
+        ? 'IdP-initiated SSO is disabled. Use the “Sign in with …” button, or enable it under Settings → SSO.'
+        : (ssoErr === 'unavailable' || ssoErr === 'metadata')
+          ? 'Single sign-on is unavailable right now. Sign in with the local admin, or check the SSO settings.'
+          : 'SSO sign-in failed. Please try again, or sign in with the local admin.';
+      err.style.display = '';
+      window.history.replaceState({}, '', window.location.pathname);
+    }
+
     const ssoButton = ssoConfig && ssoConfig.enabled && (ssoConfig.metadata_url || ssoConfig.metadata)
       ? el('button', {type:'button', class:'sso-btn', onclick: () => {
-          // SSO login flow lands in a later release — for now we
+          // SP-initiated SAML login (v0.5.1): hand off to the IdP. The
-          // surface a friendly note so the operator knows the config
+          // /api/sso/acs endpoint verifies the response, mints the
-          // landed but the runtime hookup is pending.
+          // operator session, and redirects back to the dashboard.
-          err.textContent = 'SSO sign-in is configured but the runtime flow ships in a future release. Sign in with the local admin for now.';
+          window.location.assign('/api/sso/login');
-          err.style.display = '';
         }}, [
           el('div', {}, 'Sign in with ' + (ssoConfig.idp_name || 'SSO')),
-          el('div', {class:'meta'}, 'configured · runtime flow pending'),
         ])
       : null;
 
@@ -1598,10 +1947,7 @@
         submit.textContent = 'Sign in';
       }
     }}, [
-      el('div', {class:'brand-row'}, [
+      authBrandRow(),
-        el('img', {src:'/assets/logo.svg', alt:''}),
-        el('div', {class:'name'}, 'OpenPXE'),
-      ]),
       el('h2', {}, 'Sign in'),
       el('p', {class:'lede'}, 'Enter your administrator credentials. Forgot them? SSH to the host and remove work_dir/auth.json — the next launch will re-prompt for setup.'),
       el('label', {class:'field'}, [
@@ -1666,10 +2012,7 @@
         submit.textContent = 'Create administrator';
       }
     }}, [
-      el('div', {class:'brand-row'}, [
+      authBrandRow(),
-        el('img', {src:'/assets/logo.svg', alt:''}),
-        el('div', {class:'name'}, 'OpenPXE'),
-      ]),
       el('h2', {}, 'First-run setup'),
       el('p', {class:'lede'}, 'Welcome. Create the administrator account that will own this OpenPXE deployment. Additional users come in through SSO later.'),
       el('label', {class:'field'}, [
@@ -1785,15 +2128,17 @@
     let me;
     try {
       me = await fetch('/api/me').then(r => r.json());
+      // Capture branding so the auth cards render the custom logo.
+      brandInfo = {
+        has_custom_logo: !!me.has_custom_logo,
+        logo_rev: me.logo_rev || 0,
+      };
     } catch (e) {
       // /api/me is unauthenticated in every state — if we can't reach
       // it the server is genuinely down, not an auth problem.
       document.body.appendChild(el('div', {class:'auth-screen'},
         el('div', {class:'auth-card'}, [
-          el('div', {class:'brand-row'}, [
+          authBrandRow(),
-            el('img', {src:'/assets/logo.svg', alt:''}),
-            el('div', {class:'name'}, 'OpenPXE'),
-          ]),
           el('h2', {}, 'Connection error'),
           el('p', {class:'lede'}, 'Could not reach the OpenPXE server. Refresh once it is back up.'),
         ])));

crates/webui/src/index.html

@@ -13,7 +13,7 @@
        on the asset handlers, the practical caching window is one
        version. -->
   <link rel="stylesheet" href="/assets/app.css?v={{ASSET_VERSION}}" />
-  <link rel="icon" type="image/svg+xml" href="/assets/logo.svg?v={{ASSET_VERSION}}" />
+  <link rel="icon" type="image/svg+xml" href="/assets/logo.svg?v={{ASSET_VERSION}}&r={{LOGO_REV}}" />
   <!-- Theme is read from localStorage *before* paint to avoid the
        dark→light flash on every navigation. Falls back to the OS
        preference and finally to dark. -->
@@ -32,8 +32,8 @@
 <body>
 <div class="shell">
   <aside class="sidebar">
-    <div class="brand">
+    <div class="{{BRAND_CLASS}}">
-      <img src="/assets/logo.svg?v={{ASSET_VERSION}}" alt="OpenPXE" />
+      <img src="/assets/logo.svg?v={{ASSET_VERSION}}&r={{LOGO_REV}}" alt="OpenPXE" />
       <strong>OpenPXE</strong>
     </div>
     <nav>

crates/webui/src/lib.rs

@@ -17,11 +17,34 @@
 ///   when we know the new one is incompatible. Combined with
 ///   `Cache-Control: no-cache, must-revalidate` on the asset handlers,
 ///   the worst-case caching window is one version.
+/// * `logo_rev` is appended to the brand-mark and favicon URLs as an
+///   extra `&r=…` token. Unlike `asset_version` it changes every time
+///   the operator swaps the custom logo, so the top-left mark updates
+///   immediately on the next page load instead of being pinned to the
+///   release version (which only changes on upgrade). `index.html`
+///   itself is served `no-cache`, so the fresh token lands as soon as
+///   the operator reloads after an upload.
+/// * `has_custom_logo` switches the sidebar brand block between the
+///   bundled mark + "OpenPXE" wordmark (false) and a FleetDM-style
+///   full-width custom logo with the wordmark hidden (true). Rendered
+///   server-side so there's no flash of the default mark before JS runs.
 #[must_use]
-pub fn index_html(base_url: &str, asset_version: &str) -> String {
+pub fn index_html(
+    base_url: &str,
+    asset_version: &str,
+    logo_rev: u64,
+    has_custom_logo: bool,
+) -> String {
+    let brand_class = if has_custom_logo {
+        "brand has-custom-logo"
+    } else {
+        "brand"
+    };
     INDEX_HTML
         .replace("{{BASE_URL}}", base_url)
         .replace("{{ASSET_VERSION}}", asset_version)
+        .replace("{{LOGO_REV}}", &logo_rev.to_string())
+        .replace("{{BRAND_CLASS}}", brand_class)
 }
 
 #[must_use]

deploy/docker/Dockerfile

@@ -17,14 +17,11 @@
 ARG RUST_VERSION=1.95
 
 ########## fetch iPXE binaries + wimboot ##########
-# v0.4.62: kept on the boot.ipxe.org pre-builds for the moment. We
+# Pulls the upstream boot.ipxe.org pre-builds (no PNG support) plus
-# want PNG support (so `console --picture` paints the operator's logo
+# wimboot. These cover the arches we don't build from source here:
-# on the PXE menu) but the obvious path — adding a new `ipxe-build`
+# BIOS undionly.kpxe and i386-efi (which need a 32-bit x86 toolchain),
-# stage that compiles iPXE from source with `IMAGE_PNG` enabled —
+# and serve as the baseline that the PNG-enabled x86_64/arm64 UEFI
-# runs into a QEMU/gcc instability when cross-emulating x86_64 on
+# binaries from the `ipxe-build` stage overlay on top of.
-# arm64 build hosts (intermittent `cc1` segfaults). The compositor
-# at /branding/pxe-logo is already wired so when the iPXE rebuild
-# lands (on native x86_64 hardware), no other code change is needed.
 FROM debian:12-slim AS fetch
 RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates \
  && rm -rf /var/lib/apt/lists/*
@@ -32,6 +29,36 @@ WORKDIR /src
 COPY scripts/fetch-ipxe.sh scripts/fetch-ipxe.sh
 RUN mkdir -p assets/ipxe && bash scripts/fetch-ipxe.sh
 
+########## build PNG-enabled iPXE from source ##########
+# v0.4.69: THE graphical-boot-menu unlock. iVentoy paints a PNG
+# background on the PXE screen using stock iPXE built with
+# CONSOLE_FRAMEBUFFER + IMAGE_PNG + CONSOLE_CMD; the public iPXE
+# binaries omit those, so `console --picture` is a no-op on them.
+# We build our own from upstream with that thin config delta.
+#
+# The historical blocker was cc1 segfaulting when an amd64 gcc ran
+# under QEMU emulation on an arm64 host. The fix: pin this stage to
+# $BUILDPLATFORM (the NATIVE builder arch — arm64 on an Apple-Silicon
+# Mac, amd64 in x86 CI) and cross-compile with a real cross toolchain
+# (CROSS_COMPILE=x86_64-linux-gnu-). The compiler runs native and
+# emits x86_64 — no emulation, no segfault. arm64-efi builds natively.
+FROM --platform=$BUILDPLATFORM debian:12-slim AS ipxe-build
+# libc6-dev is REQUIRED and easy to miss under --no-install-recommends:
+# iPXE's host utilities (elf2efi, zbin) compile with the native gcc and
+# pull <stdint.h>; without the native libc headers gcc's #include_next
+# falls through to iPXE's freestanding headers and dies on bits/stdint.h.
+# The target (iPXE firmware) code is -ffreestanding/-nostdinc, so the
+# x86_64 cross toolchain needs NO cross libc headers.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        git make perl gcc binutils libc6-dev \
+        gcc-x86-64-linux-gnu binutils-x86-64-linux-gnu \
+        ca-certificates \
+ && rm -rf /var/lib/apt/lists/*
+WORKDIR /src
+COPY scripts/build-ipxe.sh scripts/build-ipxe.sh
+COPY deploy/ipxe/local/ deploy/ipxe/local/
+RUN mkdir -p assets/ipxe && bash scripts/build-ipxe.sh /src/assets/ipxe
+
 ########## build openpxe ##########
 FROM rust:${RUST_VERSION}-bookworm AS build
 WORKDIR /src
@@ -64,7 +91,14 @@ RUN apt-get update \
 # `cargo build`, which is slow and can exhaust small Colima/CI disks.
 COPY Cargo.toml Cargo.lock ./
 COPY crates/ crates/
+# Baseline binaries (BIOS / i386 / wimboot), then overlay the
+# PNG-enabled x86_64 + arm64 UEFI binaries built from source. The
+# overlay wins for snponly.efi / ipxe.efi / snponly-arm64.efi so the
+# common modern clients get the graphical background; the rest keep the
+# upstream no-PNG binaries and the menu's `|| console` text fallback.
 COPY --from=fetch /src/assets/ipxe /src/assets/ipxe
+COPY --from=ipxe-build /src/assets/ipxe/snponly.efi /src/assets/ipxe/snponly.efi
+COPY --from=ipxe-build /src/assets/ipxe/ipxe.efi /src/assets/ipxe/ipxe.efi
 
 # Cache cargo registry + target across builds. The mtime touch is
 # belt-and-suspenders: cargo occasionally misses mtime-only changes on

deploy/ipxe/local/console.h

@@ -0,0 +1,14 @@
+/*
+ * OpenPXE iPXE build override — console options.
+ *
+ * Included at the end of config/console.h. CONSOLE_FRAMEBUFFER is the
+ * unified graphical framebuffer console (EFI GOP on UEFI, VESA on
+ * BIOS); it's what `console --picture` paints into. This is the same
+ * single flag iVentoy enables for its graphical PXE screen.
+ *
+ * We *add* the framebuffer console rather than replacing the default
+ * EFI/BIOS text consoles, so text output still works before/after the
+ * picture is set.
+ */
+
+#define CONSOLE_FRAMEBUFFER

deploy/ipxe/local/general.h

@@ -0,0 +1,23 @@
+/*
+ * OpenPXE iPXE build override — general options.
+ *
+ * iPXE includes <config/local/general.h> at the end of config/general.h,
+ * so anything defined here is layered on top of the stock defaults
+ * without editing upstream files. We enable exactly the features the
+ * graphical PXE boot menu needs:
+ *
+ *   IMAGE_PNG    - PNG decoder, so `console --picture <png>` can paint
+ *                  the operator's logo / OpenPXE background.
+ *   IMAGE_PNM    - Netpbm decoder (cheap; harmless belt-and-suspenders).
+ *   CONSOLE_CMD  - the `console` command itself. Without it you get
+ *                  "console: command not found" even with a framebuffer.
+ *
+ * (CONSOLE_FRAMEBUFFER lives in config/local/console.h.)
+ *
+ * Everything else stays at upstream defaults — we are intentionally a
+ * thin, auditable delta over stock iPXE so the UBDL/GPL story is simple.
+ */
+
+#define IMAGE_PNG
+#define IMAGE_PNM
+#define CONSOLE_CMD

docs/superpowers/specs/2026-05-31-saml-sso-and-ui-design.md

@@ -0,0 +1,199 @@
+# OpenPXE v0.5.1 — SAML SSO wiring + Settings/Storage UI consolidation
+
+**Date:** 2026-05-31
+**Author:** Miles Ward (with Claude)
+**Status:** Approved design → implementation
+
+## Summary
+
+Three workstreams for v0.5.1:
+
+1. **Wire SAML 2.0 SSO** end-to-end (currently config is persisted but no runtime
+   sign-in exists). Pure-Rust implementation that preserves the static-musl /
+   no-OpenSSL architecture, mirroring how FleetDM exposes and handles SAML.
+2. **Fold the Advanced sidebar tab into Settings** as a collapsible section.
+3. **Merge the Storage tab's SMB and NFS cards** into one "Remote shares" card
+   with a protocol dropdown.
+
+Then bump `0.5.0 → 0.5.1`, build the static musl image, push `:0.5.1` + `:latest`
+to Gitea, create the release, and scrub registry credentials.
+
+## Decisions (locked with the user)
+
+- **Crypto:** pure-Rust via `bergshamra` (XML-DSig + exclusive c14n, RustCrypto-based,
+  `#![forbid(unsafe_code)]`, ~99% xmlsec interop). `samael` is rejected — it
+  hard-requires OpenSSL/`xmlsec`/`libxml2` C deps, which would break the static
+  musl binary and the project's pure-Rust / no-OpenSSL architecture.
+- **Access model:** any SAML assertion the IdP successfully authenticates and that
+  we cryptographically verify mints a full operator session. No user table, no
+  roles, no domain allowlist. The local admin account remains a guaranteed
+  fallback owner regardless of SSO state.
+- **Flows:** SP-initiated (the "Sign in with <IdP>" button) is always on.
+  IdP-initiated is supported but gated behind an `allow_idp_initiated` toggle
+  (default off), mirroring FleetDM's "Allow SSO login initiated by identity
+  provider."
+
+## Scope boundaries (v0.5.1)
+
+In scope: SP-initiated + (gated) IdP-initiated login, signature verification on the
+SAML Response/Assertion, full SP-side semantic validation, SP metadata endpoint,
+login-page button wiring.
+
+Out of scope (note for later releases): EncryptedAssertion (assertions must be
+unencrypted), signed AuthnRequests (sent unsigned; Keycloak "client signature
+required" must be off), Single Logout (SLO), multi-user accounts / RBAC / JIT role
+mapping.
+
+---
+
+## Workstream 1 — SAML SP wiring (pure-Rust)
+
+### New dependencies (workspace)
+
+- `bergshamra` — XML-DSig verification + exclusive c14n (pure Rust).
+- `roxmltree` (read/navigate) and/or `quick-xml` (build/serialize) — parse IdP
+  metadata + SAMLResponse, build AuthnRequest and SP metadata.
+- `x509-parser` — extract the IdP signing certificate / public key from metadata.
+- `flate2` — raw DEFLATE for the HTTP-Redirect binding.
+- `base64` — encode/decode SAMLRequest/SAMLResponse.
+
+All pure-Rust → the `x86_64-unknown-linux-musl` static build stays OpenSSL-free.
+Exact `bergshamra` function signatures (`verify`, `DsigContext`, `KeysManager`,
+`Key`, `VerifiedReference`, `VerifyResult`) will be pinned against the installed
+crate source during implementation.
+
+### Module boundaries
+
+Pure protocol logic lives in `openpxe-core` (no axum dependency, unit-testable);
+HTTP wiring lives in `openpxe-http-api`.
+
+- `crates/core/src/saml/mod.rs` — public surface + shared types
+  (`VerifiedPrincipal { email, display_name, name_id, session_index }`, `SamlError`).
+- `crates/core/src/saml/metadata.rs` — parse IdP `EntityDescriptor`: IdP EntityID,
+  `SingleSignOnService` locations + bindings, and one or more X.509 signing
+  certificates. Also build **our** SP metadata XML.
+- `crates/core/src/saml/authn_request.rs` — build an AuthnRequest, return both the
+  request ID (to track) and the encoded HTTP-Redirect query value
+  (deflate → base64 → URL-encode).
+- `crates/core/src/saml/response.rs` — decode `SAMLResponse` (base64 → XML),
+  **verify the signature via bergshamra** against the IdP cert, then enforce SP
+  semantics, returning `VerifiedPrincipal` or a typed `SamlError`.
+
+### SP-side validation (response.rs)
+
+After a cryptographically valid signature over the Response and/or the Assertion:
+
+1. `Status` is `Success`.
+2. `Destination` (if present) equals our ACS URL.
+3. `Conditions/AudienceRestriction/Audience` equals our SP EntityID.
+4. `NotBefore` / `NotOnOrAfter` within bounds (allow small clock skew, e.g. ±60s).
+5. `InResponseTo` matches an outstanding request we issued (SP-initiated). Absent
+   for IdP-initiated, which is only accepted when `allow_idp_initiated` is true.
+6. Assertion-ID replay guard: reject a previously consumed assertion ID.
+7. NameID is the email (`nameid-format:emailAddress`). Display name read from
+   common attributes (`name`, `displayname`, `cn`, `urn:oid:2.5.4.3`).
+
+XML Signature Wrapping (XSW) defenses come from bergshamra (duplicate-ID rejection,
+strict positional verification); enable its strict verification options. We
+additionally confirm the verified `Reference` covers the element we read claims from.
+
+### State (in `openpxe-http-api`)
+
+Two small TTL-pruned in-memory stores (parking_lot `Mutex<HashMap<...>>`):
+
+- **Outstanding requests:** `request_id → issued_at`, TTL ≈ 5 min, for `InResponseTo`.
+- **Consumed assertions:** `assertion_id → expires_at`, TTL = assertion validity,
+  for replay protection.
+
+(In-memory is acceptable: a single-container app; a restart simply invalidates
+in-flight logins.)
+
+### Routes (all pre-auth; added to the public allowlist in the auth middleware)
+
+- `GET /api/sso/login` → build AuthnRequest, record its ID, 302 to the IdP SSO URL
+  (HTTP-Redirect binding) with `SAMLRequest` + `RelayState`.
+- `POST /api/sso/acs` → consume `SAMLResponse` (form-encoded). Verify + validate.
+  On success: `SessionStore::create(email)`, set the `openpxe_session` cookie
+  (same attributes as forms login), 302 to the dashboard. On failure: 302 back to
+  the login page with an error indicator. (Mirrors FleetDM's `/sso/callback`.)
+- `GET /api/sso/metadata` → serve our SP `EntityDescriptor` XML for IdP import.
+
+### Config changes (`crates/core/src/sso.rs`)
+
+Add to `SsoConfig` (preserve existing fields + validation):
+
+- `entity_id: String` — SP Entity ID (mirrors FleetDM's "Entity ID"); defaults to
+  the configured public base URL. The ACS URL is derived as
+  `<public_base_url>/api/sso/acs`.
+- `allow_idp_initiated: bool` — default `false`.
+
+`GET /api/sso` returns the new fields; `PUT /api/sso` validates and persists them.
+
+### Login page (`crates/webui/src/app.js`)
+
+Replace the "configured · runtime pending" message: the existing
+"Sign in with <IdP>" button navigates to `GET /api/sso/login`. Render the IdP logo
+(if `idp_logo_url` set) and use `idp_name` as the label. Keep the existing
+FleetDM-style login layout.
+
+### Testing
+
+- `core/saml` unit tests using a self-signed test keypair we control:
+  - Parse representative Keycloak IdP metadata → correct SSO URL + cert.
+  - Build an AuthnRequest → well-formed, deflate/base64 round-trips, ID recorded.
+  - A correctly signed Response → `VerifiedPrincipal { email, .. }`.
+  - Reject: tampered signature, expired (`NotOnOrAfter`), wrong audience,
+    replayed assertion ID, unsigned response, `Status != Success`.
+- `http-api` integration test: `GET /api/sso/login` returns a 302 with a
+  `SAMLRequest` query param; a crafted signed `SAMLResponse` POSTed to
+  `/api/sso/acs` (signed with the test key) sets an `openpxe_session` cookie.
+
+---
+
+## Workstream 2 — Advanced tab → Settings
+
+- Remove the `Advanced` sidebar entry (`crates/webui/src/index.html`) and its
+  `advanced` view route in `app.js`.
+- In the Settings view, append a **collapsible "Advanced" disclosure**
+  (default-collapsed) at the bottom containing the existing **Webhook
+  Notifications** card and the **API reference** block (moved out of the removed
+  Advanced view).
+- No backend changes; `/api/notify*` and `/api/docs` endpoints are unchanged.
+
+---
+
+## Workstream 3 — Storage: merge SMB + NFS → "Remote shares"
+
+- Replace the separate "SMB shares" and "NFS shares" cards with a single
+  **"Remote shares"** card:
+  - One add-form with a **protocol dropdown (SMB / NFS)**. Selecting the protocol
+    swaps the fields: SMB → server, share, guest checkbox, username, password;
+    NFS → server, export path.
+  - One unified table with a leading **Protocol** column (SMB/NFS badge), then
+    server/share-or-export, auth, ISO count, reachability, and Re-scan / Remove
+    actions.
+- **No backend changes.** The form dispatches to the existing
+  `POST /api/smb-shares` or `POST /api/nfs-shares`; the table merges
+  `GET /api/smb-shares` + `GET /api/nfs-shares`, tagging each row with its
+  protocol. Re-scan/Remove call the existing per-protocol endpoints.
+- Leaves the card pattern open for a future "Config files" card.
+
+---
+
+## Release
+
+1. Bump workspace version `0.5.0 → 0.5.1` (`Cargo.toml`).
+2. `cargo fmt`, `cargo clippy`, `cargo test` (all crates) green.
+3. Build the static musl binary + Docker image; verify SAML deps compile clean
+   under musl (no OpenSSL/C linkage).
+4. Push `openpxe:0.5.1` + `openpxe:latest` to Gitea via the established
+   temp-DOCKER_CONFIG pipeline; scrub credentials (logout + verify no token traces).
+5. Create the Gitea release `v0.5.1` with notes.
+
+## Risks
+
+- `bergshamra` is pre-1.0 and unaudited. Mitigation: pin the version, enable strict
+  verification, keep the local-admin fallback, and own the SP-semantic checks
+  carefully (audience/Conditions/replay/InResponseTo — where SP vulns usually live).
+- SAML is security-sensitive; negative tests (tamper/expiry/audience/replay/unsigned)
+  are part of the definition of done, not optional.

scripts/build-ipxe.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+# Build PNG-enabled iPXE binaries from source.
+#
+# Why from source: the official boot.ipxe.org binaries (and the
+# Debian-packaged ones) are NOT built with CONSOLE_FRAMEBUFFER +
+# IMAGE_PNG + CONSOLE_CMD, so `console --picture` is a no-op on them —
+# you can't paint a graphical boot-menu background. iVentoy solves this
+# by shipping its own iPXE build with exactly those three flags; we do
+# the same, from upstream iPXE, with a thin auditable config delta
+# (deploy/ipxe/local/{general,console}.h).
+#
+# Why a real cross-compiler instead of QEMU: building amd64 iPXE by
+# emulating an amd64 gcc under QEMU on an arm64 host intermittently
+# segfaults cc1 (the reason this was stuck for ~8 releases). Running a
+# NATIVE arm64 gcc that cross-targets x86_64 (CROSS_COMPILE=
+# x86_64-linux-gnu-) sidesteps emulation entirely — the compiler is a
+# native binary, it just emits x86_64 objects. This stage is meant to
+# run on $BUILDPLATFORM (the native builder arch), NOT the emulated
+# target platform.
+#
+# Outputs (into $DEST), using the filenames OpenPXE's arch mapping
+# expects:
+#   snponly.efi   x86_64 UEFI, PNG-enabled
+#   ipxe.efi      x86_64 UEFI, PNG-enabled (bundled drivers)
+#
+# We build ONLY x86_64 UEFI, always via the x86_64 cross toolchain
+# (`x86_64-linux-gnu-gcc`). That's deliberately host-arch-agnostic: it
+# works whether this stage runs on an arm64 Mac builder or an amd64 CI
+# runner, because the cross compiler runs native and emits x86_64
+# either way. Building arm64-efi or BIOS here would re-introduce a
+# dependency on the host arch (native arm64 build) or a 32-bit multilib
+# toolchain — so those arches keep their upstream-fetched (no-PNG)
+# binaries and fall back to the menu's clean `|| console` text screen.
+# Modern PXE clients are overwhelmingly x86_64 UEFI, which get the full
+# graphical background.
+
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+DEST="${1:-$ROOT/assets/ipxe}"
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+
+# Pinned upstream iPXE. Rolling master is fine functionally, but a pin
+# keeps builds reproducible and protects against a transient master
+# breakage. Bump deliberately.
+IPXE_REPO="https://github.com/ipxe/ipxe.git"
+IPXE_REF="${IPXE_REF:-master}"
+
+echo ">> cloning iPXE ($IPXE_REF)"
+git clone --depth 1 --branch "$IPXE_REF" "$IPXE_REPO" "$WORK/ipxe" 2>/dev/null \
+  || git clone "$IPXE_REPO" "$WORK/ipxe"
+SRC="$WORK/ipxe/src"
+
+echo ">> applying OpenPXE config overrides (PNG + framebuffer + console cmd)"
+mkdir -p "$SRC/config/local"
+cp "$ROOT/deploy/ipxe/local/general.h" "$SRC/config/local/general.h"
+cp "$ROOT/deploy/ipxe/local/console.h" "$SRC/config/local/console.h"
+
+mkdir -p "$DEST"
+
+# x86_64 UEFI — cross-compiled with the native arm64 gcc targeting
+# x86_64. HOST_CC stays the native cc for iPXE's build-time utilities
+# (elf2efi, zbin, …); only the target objects use the cross compiler.
+echo ">> building x86_64 UEFI (snponly.efi, ipxe.efi)"
+make -C "$SRC" -j"$(nproc)" \
+  CROSS_COMPILE=x86_64-linux-gnu- \
+  bin-x86_64-efi/snponly.efi \
+  bin-x86_64-efi/ipxe.efi
+cp "$SRC/bin-x86_64-efi/snponly.efi" "$DEST/snponly.efi"
+cp "$SRC/bin-x86_64-efi/ipxe.efi"    "$DEST/ipxe.efi"
+
+echo ">> iPXE build complete:"
+ls -l "$DEST"/snponly.efi "$DEST"/ipxe.efi