v0.4.69: PNG boot-menu background (iPXE built from source), NFS AUTH_SYS, FleetDM logo

Three things, headlined by the long-blocked graphical PXE menu. ## 1. Graphical PXE boot background — the iVentoy feature, finally iVentoy paints a PNG background on the PXE screen using stock iPXE built with CONSOLE_FRAMEBUFFER + IMAGE_PNG + CONSOLE_CMD; the public iPXE binaries omit those, so `console --picture` is a no-op on them. We now build our own iPXE from upstream with that thin config delta (deploy/ipxe/local/{general,console}.h). The 8-release blocker was cc1 segfaulting when an amd64 gcc ran under QEMU emulation on the arm64 build host. Fix: a new `ipxe-build` Dockerfile stage pinned to $BUILDPLATFORM (native arch — no emulation) that cross-compiles x86_64 iPXE with CROSS_COMPILE=x86_64-linux-gnu-. The compiler runs native and emits x86_64. Validated end-to-end: png.o + fbcon.o + pixbuf.o all compile and link (confirmed via the linked-ELF symbol table, not just strings), ~112s, no segfault. Host tools needed libc6-dev (dropped by --no-install-recommends; without it the native host compile falls through to iPXE's freestanding headers and dies on bits/stdint.h — fixed). Server side: - pxe_logo.rs is now a full-screen background compositor: a dark field (matching the WebUI theme) with the operator's uploaded logo across the top, or — with no upload — a default OpenPXE rainbow disc drawn with pure pixel math (no font/SVG deps). Always 1024x768 (iPXE doesn't scale; this is the universal mode). WebP/JPEG/GIF/PNG in, PNG out (iPXE only eats PNG). - /branding/pxe-logo always returns a PNG now (default when no logo, default when SVG) so the menu always has a background. - render_menu uses `console --picture … --top 290 || console`: paints the background and reserves the logo band on PNG-capable binaries (x86_64 UEFI), cleanly falls back to text on the others. The ASCII wordmark is GONE. Only x86_64 UEFI is built from source (host-arch-agnostic cross build); BIOS/i386/arm64 keep upstream-fetched no-PNG binaries + text fallback. Modern clients are overwhelmingly x86_64 UEFI. ## 2. NFS AUTH_SYS credential — fixes NFS3ERR_ACCES v0.4.68's privileged-port fix got past MNT3ERR_ACCES (mount); operators then hit NFS3ERR_ACCES on READDIR because nfs3_client defaults to AUTH_NONE and virtually every server exports sec=sys. We now present an AUTH_UNIX credential (uid 0 / gid 0): no_root_squash servers treat us as root, root_squash servers map us to anon which reads any world-readable ISO share. Kept fixed (no UI knob) to stay dead-simple. Hint updated: a remaining NFS3ERR_ACCES is now a server-side permission/squash issue, not IP/auth-flavor. ## 3. FleetDM-style full-width logo (top-left) When a custom logo is uploaded the sidebar header drops the bundled mark + "OpenPXE" wordmark and lets the logo span the header (left-aligned, capped 200x50, contain). Rendered server-side via a brand-class in index_html (has_custom_logo) so there's no flash of the default. The bundled-default case is unchanged. Tests: 164 passing. clippy -D warnings clean. iPXE build stage validated in isolation before the full image build. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
v0.4.68: fix NFS secure-export mount, logo cache-bust, dashboard disk card, NFS form spacing
2026-05-29 03:11:35 -04:00 · 2026-05-28 21:34:41 -04:00 · 2026-05-28 12:56:46 -04:00
22 changed files with 2200 additions and 313 deletions
@@ -1102,6 +1102,37 @@ dependencies = [
 "version_check",
 ]
 [[package]]
 name = "nfs3_client"
 version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0ac227029a6127f3474b4fb61cbf2d3dddbe9424ad50c24fada68b633687a532"
 dependencies = [
 "fastrand",
 "nfs3_types",
 "tokio",
 ]
 [[package]]
 name = "nfs3_macros"
 version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "06d8fb377e6efeb91911a8ed962a69615535e167e675025a2be8fa109751426a"
 dependencies = [
 "proc-macro2",
 "quote",
 "syn 2.0.117",
 ]
 [[package]]
 name = "nfs3_types"
 version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b5d5ab1a9fdfeab2f03b36b6300dea4ea3806e6a057cb479628b41d65e356b94"
 dependencies = [
 "nfs3_macros",
 ]
 [[package]]
 name = "nu-ansi-term"
 version = "0.50.3"
@@ -1140,7 +1171,7 @@ checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
 [[package]]
 name = "openpxe"
-version = "0.4.66"
+version = "0.4.69"
 dependencies = [
 "anyhow",
 "axum",
@@ -1162,7 +1193,7 @@ dependencies = [
 [[package]]
 name = "openpxe-core"
-version = "0.4.66"
+version = "0.4.69"
 dependencies = [
 "anyhow",
 "bcrypt",
@@ -1181,7 +1212,7 @@ dependencies = [
 [[package]]
 name = "openpxe-dhcp-proxy"
-version = "0.4.66"
+version = "0.4.69"
 dependencies = [
 "anyhow",
 "bytes",
@@ -1195,7 +1226,7 @@ dependencies = [
 [[package]]
 name = "openpxe-http-api"
-version = "0.4.66"
+version = "0.4.69"
 dependencies = [
 "anyhow",
 "axum",
@@ -1226,7 +1257,7 @@ dependencies = [
 [[package]]
 name = "openpxe-ipxe-assets"
-version = "0.4.66"
+version = "0.4.69"
 dependencies = [
 "openpxe-core",
 "rust-embed",
@@ -1236,14 +1267,17 @@ dependencies = [
 [[package]]
 name = "openpxe-iso-store"
-version = "0.4.66"
+version = "0.4.69"
 dependencies = [
 "anyhow",
 "bcrypt",
 "bytes",
 "futures",
 "hex",
 "image",
 "libc",
 "nfs3_client",
 "nfs3_types",
 "openpxe-core",
 "parking_lot",
 "serde",
@@ -1260,7 +1294,7 @@ dependencies = [
 [[package]]
 name = "openpxe-tftp"
-version = "0.4.66"
+version = "0.4.69"
 dependencies = [
 "anyhow",
 "bytes",
@@ -1274,7 +1308,7 @@ dependencies = [
 [[package]]
 name = "openpxe-webui"
-version = "0.4.66"
+version = "0.4.69"
 [[package]]
 name = "parking_lot"
@@ -12,7 +12,7 @@ members = [
 ]
 [workspace.package]
-version = "0.4.66"
+version = "0.4.69"
 edition = "2021"
 rust-version = "1.95"
 license = "MIT OR Apache-2.0"
@@ -58,6 +58,14 @@ once_cell = "1.19"
 parking_lot = "0.12"
 rust-embed = { version = "8.5", features = ["include-exclude"] }
 # v0.4.67: pure-Rust NFSv3 client. Replaces the (deleted-in-v0.4.65)
 # kernel-mount NFS path with an in-process implementation that works
 # in any container — no kernel modules, no CAP_SYS_ADMIN, no
 # subprocess. Ships alongside the userspace SMB consumer; operators
 # pick whichever protocol their NAS prefers.
 nfs3_client = { version = "0.9", features = ["tokio"] }
 nfs3_types = "0.5"
 openpxe-core = { path = "crates/core" }
 openpxe-dhcp-proxy = { path = "crates/dhcp-proxy" }
 openpxe-tftp = { path = "crates/tftp" }
@@ -44,6 +44,14 @@ struct Inner {
    /// MIME of the active logo, mirroring `logo_filename`. Cached here
    /// so the HTTP layer can set Content-Type without re-sniffing.
    logo_mime: Option<String>,
    /// Monotonic counter bumped on every set/clear. Surfaces as a
    /// cache-bust token (`/assets/logo.svg?r=<rev>`) so the browser
    /// fetches the new bytes the moment the operator swaps the logo —
    /// the app version alone can't do this since it doesn't change on
    /// upload. Persisted so the token stays stable across restarts and
    /// keeps climbing across multiple swaps.
    #[serde(default)]
    rev: u64,
 }
 /// In-memory + on-disk override registry. Cheap to clone; locks are
@@ -150,6 +158,7 @@ impl BrandingStore {
            let mut g = self.inner.write();
            g.logo_filename = Some(filename.clone());
            g.logo_mime = Some(mime.to_string());
            g.rev = g.rev.wrapping_add(1);
        }
        self.persist();
        tracing::info!(
@@ -166,6 +175,7 @@ impl BrandingStore {
            let mut g = self.inner.write();
            let removed = g.logo_filename.take();
            g.logo_mime = None;
            g.rev = g.rev.wrapping_add(1);
            removed
        };
        if let Some(name) = removed {
@@ -185,6 +195,14 @@ impl BrandingStore {
        self.inner.read().logo_filename.is_some()
    }
    /// Cache-bust token for the logo asset URL. Changes on every
    /// set/clear so `/assets/logo.svg?r=<rev>` resolves to a fresh URL
    /// whenever the operator swaps the brand mark. Stable otherwise.
    #[must_use]
    pub fn logo_rev(&self) -> u64 {
        self.inner.read().rev
    }
    fn persist(&self) {
        let snap = self.inner.read().clone();
        let body = match serde_json::to_vec_pretty(&snap) {
@@ -292,6 +310,23 @@ mod tests {
        assert!(!entries.iter().any(|n| n == "logo.png"), "stale PNG left over: {entries:?}");
    }
    #[test]
    fn logo_rev_bumps_on_each_set_and_clear() {
        let dir = tempdir().unwrap();
        let b = BrandingStore::load_or_default(dir.path());
        assert_eq!(b.logo_rev(), 0);
        b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake").unwrap();
        assert_eq!(b.logo_rev(), 1);
        b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake2").unwrap();
        assert_eq!(b.logo_rev(), 2);
        b.clear_logo().unwrap();
        assert_eq!(b.logo_rev(), 3);
        // Survives a restart.
        drop(b);
        let b2 = BrandingStore::load_or_default(dir.path());
        assert_eq!(b2.logo_rev(), 3);
    }
    #[test]
    fn sanitize_ext_strips_separators_and_path_chars() {
        assert_eq!(sanitize_ext("svg"), "svg");
@@ -319,6 +354,7 @@ mod tests {
        let inner = Inner {
            logo_filename: Some("logo.png".into()),
            logo_mime: Some("image/png".into()),
            rev: 0,
        };
        std::fs::write(
            brand_dir.join("branding.json"),
@@ -35,7 +35,7 @@ use openpxe_core::{
    MAX_LOGO_BYTES,
 };
 use openpxe_ipxe_assets::asset_bytes;
-use openpxe_iso_store::{IsoCategory, IsoMeta, IsoSource, SmbAddRequest};
+use openpxe_iso_store::{IsoCategory, IsoMeta, IsoSource, NfsAddRequest, SmbAddRequest};
 use serde::Deserialize;
 use serde_json::json;
 use std::net::SocketAddr;
@@ -141,6 +141,12 @@ pub fn build_router(state: AppState) -> Router {
        .route("/api/smb-shares", get(api_smb_shares_list).post(api_smb_shares_add))
        .route("/api/smb-shares/:id", delete(api_smb_shares_remove))
        .route("/api/smb-shares/:id/scan", post(api_smb_shares_scan))
        // v0.4.67: NFSv3 share manager (pure-Rust in-process client).
        // Ships alongside SMB. Routes are parallel so the UI can
        // reuse the same form/error/hint rendering for both.
        .route("/api/nfs-shares", get(api_nfs_shares_list).post(api_nfs_shares_add))
        .route("/api/nfs-shares/:id", delete(api_nfs_shares_remove))
        .route("/api/nfs-shares/:id/scan", post(api_nfs_shares_scan))
        // Phase 4: Network info (read-only) + DNS edit.
        .route("/api/network", get(api_network).put(api_network_put))
        // Phase 4: live-log stream + recent buffer for the Terminal tab.
@@ -202,7 +208,15 @@ async fn index(State(state): State<AppState>) -> Response {
    // browsers re-fetch JS/CSS after an upgrade. We use the OpenPXE
    // binary version — every release ships a new value, every release
    // forces a fresh URL on each asset.
-    let html = openpxe_webui::index_html(&state.public_base_url, env!("CARGO_PKG_VERSION"));
+    // logo_rev cache-busts the brand mark / favicon independently of
    // the release version, so an operator who swaps the custom logo
    // sees it update on the next reload without waiting for an upgrade.
    let html = openpxe_webui::index_html(
        &state.public_base_url,
        env!("CARGO_PKG_VERSION"),
        state.branding.logo_rev(),
        state.branding.has_logo(),
    );
    (
        [
            (
@@ -305,66 +319,62 @@ async fn ui_logo(State(state): State<AppState>) -> Response {
        .into_response()
 }
-/// v0.4.61: PXE menu logo composed for the iPXE `console --picture`
+/// PXE boot-menu background, composed for the iPXE `console --picture`
-/// call. The operator can upload any raster image (PNG / JPEG / WebP /
+/// call. Returns a full-screen 1024×768 PNG: a dark field with the
-/// GIF) of any aspect ratio; this handler decodes it, draws it
+/// operator's uploaded logo across the top, or — when no logo is set —
-/// centered-top onto a fixed 1024×768 canvas, and returns PNG bytes.
+/// a default OpenPXE mark on the same dark field. Either way the
-/// That gives the same look as iVentoy regardless of what the operator
+/// endpoint *always* returns a valid PNG so the menu's `console
-/// uploaded — a portrait logo, a wide wordmark, a square monogram all
+/// --picture` paints a real background instead of falling through to
-/// land in the same place on the boot screen.
+/// bare text (v0.4.69 — replaces the old ASCII wordmark).
 ///
-/// SVG uploads still 404 here — iPXE can't rasterize SVG, and rather
+/// Any raster the operator uploads (PNG / JPEG / WebP / GIF) is decoded
-/// than haul in `resvg` we ask the operator to provide a raster when
+/// and transcoded to PNG here, since iPXE only consumes PNG. SVG
-/// they want a custom PXE-side logo. (The WebUI keeps using the SVG.)
+/// uploads can't be rasterized without hauling in `resvg`, so an SVG
 /// brand mark falls back to the *default* background for the PXE screen
 /// (the WebUI still renders the SVG natively in the top-left).
 async fn ui_pxe_logo(State(state): State<AppState>) -> Response {
-    let Some(path) = state.branding.logo_path() else {
+    // Resolve the operator's raster upload, if any and if it's a format
-        return (StatusCode::NOT_FOUND, "no custom logo configured").into_response();
+    // iPXE/our compositor can consume. SVG (or a missing/unreadable
-    };
+    // file) yields `None`, which composes the default background.
-    let Some(mime) = state.branding.logo_mime() else {
+    let raster: Option<Vec<u8>> = match (state.branding.logo_path(), state.branding.logo_mime()) {
-        return (StatusCode::NOT_FOUND, "no mime recorded").into_response();
+        (Some(path), Some(mime)) if mime != "image/svg+xml" => {
-    };
+            tokio::fs::read(&path).await.ok()
    if mime == "image/svg+xml" {
        return (
            StatusCode::NOT_FOUND,
            "operator-uploaded logo is SVG; PXE menu requires a raster (PNG / JPEG / WebP / GIF)",
        )
            .into_response();
    }
    let bytes = match tokio::fs::read(&path).await {
        Ok(b) => b,
        Err(e) => {
            return (
                StatusCode::NOT_FOUND,
                format!("custom logo unreadable: {e}"),
            )
                .into_response();
        }
        _ => None,
    };
-    // Compose to a fixed 1024×768 PNG so the PXE menu paints the logo
+
-    // centered-top regardless of the operator's source dimensions. The
+    let composed = match tokio::task::spawn_blocking(move || {
-    // `image` crate is pure-Rust + sync; offload to a blocking task
+        openpxe_iso_store::pxe_logo::compose_pxe_background(raster.as_deref())
-    // because Lanczos resampling on a 4K source can take tens of
+    })
    // milliseconds and we don't want to block the executor.
    let composed =
        match tokio::task::spawn_blocking(move || openpxe_iso_store::pxe_logo::compose_pxe_logo(&bytes))
    .await
    {
        Ok(Ok(png)) => png,
        Ok(Err(e)) => {
            // A decode failure on the operator's upload shouldn't blank
            // the boot screen — fall back to the default background.
            tracing::warn!(
                target: "openpxe::http::branding",
-                    error = %e, "failed to compose PXE logo PNG"
+                error = %e, "PXE background compose failed on upload; using default"
            );
            match tokio::task::spawn_blocking(|| {
                openpxe_iso_store::pxe_logo::compose_pxe_background(None)
            })
            .await
            {
                Ok(Ok(png)) => png,
                _ => {
                    return (
                        StatusCode::INTERNAL_SERVER_ERROR,
-                    format!("failed to compose PXE logo: {e}"),
+                        "failed to compose PXE background",
                    )
                        .into_response();
                }
            }
        }
        Err(e) => {
            return (
                StatusCode::INTERNAL_SERVER_ERROR,
-                    format!("pxe-logo task failed: {e}"),
+                format!("pxe-background task failed: {e}"),
            )
                .into_response();
        }
@@ -372,7 +382,12 @@ async fn ui_pxe_logo(State(state): State<AppState>) -> Response {
    (
        [
            (header::CONTENT_TYPE, HeaderValue::from_static("image/png")),
-            (header::CACHE_CONTROL, ASSET_CACHE_CONTROL),
+            // No-cache so a freshly uploaded logo paints on the next
            // boot without a stale composite lingering.
            (
                header::CACHE_CONTROL,
                HeaderValue::from_static("no-cache, max-age=0"),
            ),
        ],
        composed,
    )
@@ -696,6 +711,58 @@ async fn iso_raw(
                Err(e) => (StatusCode::BAD_GATEWAY, format!("smb stream: {e}")).into_response(),
            }
        }
        IsoSource::Nfs {
            share_id,
            relative_path,
        } => {
            // v0.4.67: NFS sources support Range requests because
            // NFSv3 READ3 takes an explicit offset. We resolve the
            // requested byte range here and pass start/len down to
            // the streamer which seeks into the file via READ3.
            let total = meta.size_bytes;
            let range = match parse_range(headers.get(header::RANGE), total) {
                Some(triple) => triple,
                None if headers.get(header::RANGE).is_some() => {
                    return Response::builder()
                        .status(StatusCode::RANGE_NOT_SATISFIABLE)
                        .header(header::CONTENT_RANGE, format!("bytes */{total}"))
                        .body(Body::empty())
                        .unwrap();
                }
                // No Range header — serve the whole file.
                None => (0, total.saturating_sub(1), false),
            };
            let (start, end, partial) = range;
            let len = if total == 0 { 0 } else { end - start + 1 };
            let max_len = if total == 0 { None } else { Some(len) };
            match state
                .nfs_shares
                .stream_iso(share_id, relative_path, start, max_len)
                .await
            {
                Ok(stream) => {
                    let body = Body::from_stream(stream);
                    let status = if partial {
                        StatusCode::PARTIAL_CONTENT
                    } else {
                        StatusCode::OK
                    };
                    let mut builder = Response::builder()
                        .status(status)
                        .header(header::CONTENT_TYPE, "application/octet-stream")
                        .header(header::ACCEPT_RANGES, "bytes")
                        .header(header::CONTENT_LENGTH, len);
                    if partial {
                        builder = builder.header(
                            header::CONTENT_RANGE,
                            format!("bytes {start}-{end}/{total}"),
                        );
                    }
                    builder.body(body).unwrap()
                }
                Err(e) => (StatusCode::BAD_GATEWAY, format!("nfs stream: {e}")).into_response(),
            }
        }
    }
 }
@@ -1095,6 +1162,19 @@ async fn api_docs() -> Json<serde_json::Value> {
                     "summary": "Re-list a share for new ISOs."},
                ],
            },
            {
                "name": "NFS shares",
                "endpoints": [
                    {"method": "GET", "path": "/api/nfs-shares",
                     "summary": "List configured NFSv3 shares with connection state and iso counts."},
                    {"method": "POST", "path": "/api/nfs-shares",
                     "summary": "Register an NFSv3 share. Body: { server, export, port? }. Auth is AUTH_SYS only; access control is by client IP on the server side."},
                    {"method": "DELETE", "path": "/api/nfs-shares/:id",
                     "summary": "Forget a share and drop its entries from the ISO store."},
                    {"method": "POST", "path": "/api/nfs-shares/:id/scan",
                     "summary": "Re-list a share for new ISOs."},
                ],
            },
            {
                "name": "Network",
                "endpoints": [
@@ -1509,11 +1589,13 @@ async fn api_list_clients(State(state): State<AppState>) -> Json<serde_json::Val
 async fn api_status(State(state): State<AppState>) -> Json<serde_json::Value> {
    let smb = state.smb.as_ref().map(|s| s.snapshot());
-    // v0.4.65: NFS replaced with SMB shares. The dashboard metric
+    // v0.4.65+v0.4.67: external storage shares — SMB (userspace
-    // shape stays similar (count + reachable) so the UI doesn't have
+    // smbclient) and NFS (in-process nfs3_client). Dashboard tile
-    // to change its top-line tiles.
+    // sums both so operators see a single "reachable shares" number.
    let smb_shares = state.smb_shares.list();
    let smb_reachable = smb_shares.iter().filter(|m| m.reachable).count();
    let nfs_shares = state.nfs_shares.list();
    let nfs_reachable = nfs_shares.iter().filter(|m| m.reachable).count();
    let isos = state.iso_store.list();
    let clients = state.clients.list();
    let queue_entries = state.queue.list();
@@ -1532,7 +1614,9 @@ async fn api_status(State(state): State<AppState>) -> Json<serde_json::Value> {
    state
        .metrics
        .set_queue_counts(queue_entries.len() as u64, imaging as u64);
-    state.metrics.set_nfs_active(smb_reachable as u64);
+    state
        .metrics
        .set_nfs_active((smb_reachable + nfs_reachable) as u64);
    state.metrics.record_http(openpxe_core::HttpRoute::Api);
    let now = time::OffsetDateTime::now_utc();
    let uptime_secs = (now - state.started_at).whole_seconds().max(0);
@@ -1547,12 +1631,13 @@ async fn api_status(State(state): State<AppState>) -> Json<serde_json::Value> {
        "ipxe_assets": openpxe_ipxe_assets::list_assets(),
        "settings": state.settings.snapshot(),
        "smb": smb,
        // Keep the field names for now so existing UI bindings on
        // `iso_count2` / `client_count2` / sidebar counters keep
        // working. They cover "external storage shares" generically;
        // v0.4.65 the source is SMB instead of NFS.
        "smb_share_count": smb_shares.len(),
        "smb_share_reachable": smb_reachable,
        // v0.4.67: NFSv3 share counts. The dashboard tile sums these
        // with the SMB counts above ("N shares reachable") so the
        // top-line metric works regardless of protocol mix.
        "nfs_share_count": nfs_shares.len(),
        "nfs_share_reachable": nfs_reachable,
        "host_bindings": state.hosts.len(),
        "custom_logo": state.branding.has_logo(),
        "uptime_secs": uptime_secs,
@@ -1808,6 +1893,47 @@ async fn api_smb_shares_scan(
    }
 }
 // ─── NFS share API (v0.4.67) ───────────────────────────────────────────────
 //
 // Parallel to the SMB shares API. The pure-Rust NFSv3 client
 // (`nfs3_client`) gives us in-process listing and streaming, no
 // subprocess. Unlike SMB, NFS-sourced ISOs support HTTP Range
 // requests — NFSv3 READ3 takes an explicit offset.
 async fn api_nfs_shares_list(State(state): State<AppState>) -> Json<serde_json::Value> {
    Json(json!({ "shares": state.nfs_shares.list() }))
 }
 async fn api_nfs_shares_add(
    State(state): State<AppState>,
    Json(req): Json<NfsAddRequest>,
 ) -> Response {
    match state.nfs_shares.add(req).await {
        Ok(s) => (StatusCode::CREATED, Json(s)).into_response(),
        Err(err) => (StatusCode::BAD_REQUEST, Json(err)).into_response(),
    }
 }
 async fn api_nfs_shares_remove(
    State(state): State<AppState>,
    AxumPath(id): AxumPath<String>,
 ) -> Response {
    match state.nfs_shares.remove(&id).await {
        Ok(()) => StatusCode::NO_CONTENT.into_response(),
        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
    }
 }
 async fn api_nfs_shares_scan(
    State(state): State<AppState>,
    AxumPath(id): AxumPath<String>,
 ) -> Response {
    match state.nfs_shares.rescan(&id).await {
        Ok(n) => Json(json!({ "ok": true, "iso_count": n })).into_response(),
        Err(e) => (StatusCode::BAD_REQUEST, format!("{e}")).into_response(),
    }
 }
 // ─── Network info API ──────────────────────────────────────────────────────
 async fn api_network(State(state): State<AppState>) -> Json<serde_json::Value> {
@@ -1922,11 +2048,21 @@ async fn api_metrics(State(state): State<AppState>) -> Response {
    state
        .metrics
        .set_queue_counts(queue_entries.len() as u64, imaging as u64);
-    // v0.4.65: gauge tracks reachable external-storage shares. With
+    // v0.4.67: gauge tracks reachable external-storage shares
-    // NFS removed it now reflects SMB share reachability instead.
+    // across both protocols (SMB userspace + NFSv3 in-process).
-    state
+    let smb_ok = state
-        .metrics
+        .smb_shares
-        .set_nfs_active(state.smb_shares.list().iter().filter(|m| m.reachable).count() as u64);
+        .list()
        .iter()
        .filter(|m| m.reachable)
        .count();
    let nfs_ok = state
        .nfs_shares
        .list()
        .iter()
        .filter(|m| m.reachable)
        .count();
    state.metrics.set_nfs_active((smb_ok + nfs_ok) as u64);
    let now = time::OffsetDateTime::now_utc();
    let uptime = (now - state.started_at).whole_seconds().max(0) as u64;
@@ -30,14 +30,15 @@ use std::fmt::Write as _;
 /// Top-level OpenPXE boot menu. Serialized identically for BIOS and UEFI
 /// clients because iPXE normalises the menu primitives across firmwares.
 ///
-/// v0.4.6: rendered with an iVentoy-style polished frame — centered
+/// v0.4.69: rendered with an iVentoy-style graphical frame — a
-/// OpenPXE wordmark banner at the top (ASCII so every iPXE build can
+/// `console --picture` directive paints a full-screen PNG background
-/// paint it), a footer carrying version + arch + firmware kind, and an
+/// (the operator's uploaded logo on a dark field, or the default
-/// optional `console --picture` directive that paints the operator's
+/// OpenPXE mark) with the menu text overlaid below a reserved top
-/// uploaded raster logo on top when the iPXE binary on the wire was
+/// margin, plus a footer carrying version + arch + firmware kind. On
-/// built with PNG support. The ASCII banner is always rendered so
+/// iPXE binaries built with `IMAGE_PNG` + `CONSOLE_FRAMEBUFFER` (our
-/// even when the picture call no-ops the screen still reads as
+/// x86_64 UEFI binaries, compiled from source) the background paints;
-/// "OpenPXE — here is the menu" rather than a featureless box.
+/// on binaries without PNG support the `|| console` fallback yields a
 /// clean text menu. The old ASCII wordmark has been removed.
 #[must_use]
 pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> String {
    let mut s = String::new();
@@ -56,14 +57,20 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
    let _ = writeln!(s, "set base-url {base}");
    let _ = writeln!(s, "set esc:hex 1b");
    let _ = writeln!(s, "set cls ${{esc:string}}[2J");
-    // v0.4.6: best-effort graphics console with the operator-uploaded
+    // v0.4.69: graphical background. `/branding/pxe-logo` always
-    // raster logo. Falls back to plain text console on iPXE builds
+    // returns a full-screen 1024×768 PNG now — the operator's logo on a
-    // without PNG support — the `||` chain keeps a parse-clean
+    // dark field, or a default OpenPXE mark when none is uploaded. The
-    // single-statement form so even the strictest iPXE parsers accept
+    // `--top 290` reserves the top band (where the logo paints) so the
-    // it. The `console` reset at the end re-syncs the menu output.
+    // menu text lands below it. On an iPXE build *with* `IMAGE_PNG` +
    // `CONSOLE_FRAMEBUFFER` (our x86_64 UEFI binaries, built from source
    // — see deploy/docker/Dockerfile) this paints the background and
    // overlays the menu. On a build *without* PNG support (the fetched
    // BIOS/i386/arm64 binaries) the whole `console --picture …` command
    // fails and the `|| console` resets to a clean full-screen text
    // menu. Either way there's no ASCII placeholder anymore.
    let _ = writeln!(
        s,
-        "console --picture {base}/branding/pxe-logo || console"
+        "console --picture {base}/branding/pxe-logo --top 290 || console"
    );
    // Map iPXE's ${{buildarch}} + ${{platform}} into the human form the
    // user asked for (e.g. "x86 BIOS", "x86_64 UEFI", "arm64 UEFI").
@@ -77,19 +84,8 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
    );
    let _ = writeln!(s, ":menu");
    let _ = writeln!(s, "menu OpenPXE - network boot menu");
-    // ASCII OpenPXE wordmark. Works on every iPXE build, including
+    // v0.4.69: the ASCII wordmark is gone — the graphical background
-    // the boot.ipxe.org pre-builds we ship (which omit `IMAGE_PNG`,
+    // (set via `console --picture` above) carries the branding now.
    // so `console --picture` paints nothing). When the queued iPXE
    // source-build lands and the operator's uploaded raster actually
    // paints via `console --picture`, this banner can be retired in
    // favour of the real image. The compositor at
    // /branding/pxe-logo is already wired and waiting.
    let _ = writeln!(s, "item --gap");
    let _ = writeln!(s, "item --gap --       ___                   ___  __  __ ___");
    let _ = writeln!(s, "item --gap --      / _ \\ _ __  ___ _ _   | _ \\ \\/  / | __|");
    let _ = writeln!(s, "item --gap --     | (_) | '_ \\/ -_) ' \\  |  _/  \\  /  | _|");
    let _ = writeln!(s, "item --gap --      \\___/| .__/\\___|_||_| |_|    /_/\\_\\ |___|");
    let _ = writeln!(s, "item --gap --           |_|");
    let _ = writeln!(s, "item --gap");
    let _ = writeln!(
        s,
@@ -631,27 +627,29 @@ mod password_tests {
    #[test]
    fn top_menu_has_polished_branding_and_arch_footer() {
-        // v0.4.6 polish + v0.4.62 stability fixes: the menu emits a
+        // v0.4.69: the menu emits a `console --picture` line that paints
-        // `console --picture` line that PNG-capable iPXE builds will
+        // a full-screen PNG background (the operator's logo, or the
-        // honour (queued for a follow-up release once we can rebuild
+        // default OpenPXE mark) reserving a top margin for it, then
-        // iPXE from source on native x86_64 hardware), an ASCII
+        // falls back to a clean text console on iPXE builds without PNG
-        // OpenPXE wordmark that works on every iPXE build (including
+        // support. The ASCII wordmark is gone — the graphical
-        // the boot.ipxe.org pre-builds we currently ship), and a
+        // background carries the branding now. A single-line footer
-        // single-line footer carrying the OpenPXE version + arch.
+        // still carries the OpenPXE version + arch.
        let settings = Settings::default();
        let s = render_menu(&[], &settings, "http://10.0.0.5");
        assert!(
            s.contains("console --picture http://10.0.0.5/branding/pxe-logo"),
            "missing console --picture line:\n{s}"
        );
        // The picture call reserves a top margin for the logo band.
        assert!(s.contains("--top 290"), "missing --top margin:\n{s}");
        // Picture-or-text-console must be a single statement so older
        // iPXE parsers don't choke on the chain.
        assert!(s.contains("|| console"), "missing graceful fallback:\n{s}");
-        // ASCII wordmark — paints on every iPXE build regardless of
+        // The ASCII wordmark must be GONE — its removal is the whole
-        // PNG support.
+        // point of v0.4.69's graphical background.
        assert!(
-            s.contains("___                   ___  __  __ ___"),
+            !s.contains("___                   ___  __  __ ___"),
-            "ASCII banner missing first row:\n{s}"
+            "ASCII banner should have been removed:\n{s}"
        );
        // Footer with version + arch interpolation. The version comes
        // from CARGO_PKG_VERSION at compile time.
@@ -4,7 +4,7 @@ use openpxe_core::{
    AdminStore, BootLog, BrandingStore, ClientRegistry, DeploymentQueue, HostBindings, LogBus,
    Metrics, SettingsStore, SsoStore,
 };
-use openpxe_iso_store::{IsoStore, SmbManager, SmbShareManager};
+use openpxe_iso_store::{IsoStore, NfsShareManager, SmbManager, SmbShareManager};
 use std::sync::Arc;
 use time::OffsetDateTime;
@@ -52,6 +52,12 @@ pub struct AppState {
    /// `smbclient` does the SMB protocol over a plain TCP socket in
    /// userspace — works in any container, no special caps required.
    pub smb_shares: SmbShareManager,
    /// v0.4.67: NFSv3 share manager — pure-Rust userspace consumer
    /// via the `nfs3_client` crate. Ships alongside the SMB manager
    /// so operators pick whichever protocol their NAS prefers.
    /// In-process (no subprocess); supports HTTP Range requests on
    /// NFS-sourced ISOs because NFSv3 READ3 takes an explicit offset.
    pub nfs_shares: NfsShareManager,
    /// Browser chunked upload state. Multipart uploads still go straight
    /// through `IsoStore`, but the UI uses sessions so large ISO transfers
    /// can show deterministic progress and leave visible partial files.
@@ -88,12 +88,14 @@ async fn dispatch(state: &AppState, argv: &[String]) -> Result<String, String> {
        "isos" | "images" => Ok(isos_text(state)),
        "clients" => Ok(clients_text(state)),
        "queue" => queue_command(state, tail).await,
-        // v0.4.65: `nfs` is gone — replaced with userspace SMB share
+        // `smb` controls the outbound Samba server for Windows
-        // consumer. `smb` still controls the outbound Samba server
+        // install media. `share` lists/manages remote SMB shares
-        // for Windows install media; `share` lists/manages remote SMB
+        // OpenPXE pulls ISOs from (v0.4.65). `nfs` is the parallel
-        // shares OpenPXE pulls ISOs from.
+        // command for remote NFSv3 shares (v0.4.67, in-process via
        // nfs3_client — not the v0.4.64 kernel-mount path).
        "share" | "smb-share" => smb_share_command(state, tail).await,
        "smb" => smb_command(state, tail).await,
        "nfs" => nfs_share_command(state, tail).await,
        "log" => log_command(state, tail),
        "whoami" => Ok("operator".to_string()),
        "echo" => Ok(tail.join(" ")),
@@ -113,16 +115,20 @@ fn status_text(s: &AppState) -> String {
    let smb = s.smb.as_ref().map(|m| m.snapshot());
    let smb_shares = s.smb_shares.list();
    let smb_reachable = smb_shares.iter().filter(|m| m.reachable).count();
    // v0.4.67: NFSv3 sources too.
    let nfs_shares = s.nfs_shares.list();
    let nfs_reachable = nfs_shares.iter().filter(|m| m.reachable).count();
    format!(
        "OpenPXE {ver}\n\
         base url:     {base}\n\
         interface:    {nic}\n\
         uptime:       {up}\n\
-         isos:         {n_isos}  (local: {n_local}, smb: {n_smb})\n\
+         isos:         {n_isos}  (local: {n_local}, smb: {n_smb}, nfs: {n_nfs})\n\
         clients:      {n_clients}\n\
         queue:        {n_entries}\n\
         smb server:   {smb}\n\
-         smb shares:   {n_total} configured ({n_active} reachable)\n",
+         smb shares:   {n_smb_total} configured ({n_smb_active} reachable)\n\
         nfs shares:   {n_nfs_total} configured ({n_nfs_active} reachable)\n",
        ver = env!("CARGO_PKG_VERSION"),
        base = s.public_base_url,
        nic = if s.nic_name.is_empty() {
@@ -140,11 +146,17 @@ fn status_text(s: &AppState) -> String {
            .iter()
            .filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Smb { .. }))
            .count(),
        n_nfs = isos
            .iter()
            .filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Nfs { .. }))
            .count(),
        n_clients = clients.len(),
        n_entries = queue_entries.len(),
        smb = smb.map_or_else(|| "(disabled)".into(), |s| format!("{s:?}")),
-        n_total = smb_shares.len(),
+        n_smb_total = smb_shares.len(),
-        n_active = smb_reachable,
+        n_smb_active = smb_reachable,
        n_nfs_total = nfs_shares.len(),
        n_nfs_active = nfs_reachable,
    )
 }
@@ -162,8 +174,9 @@ fn isos_text(s: &AppState) -> String {
    for i in isos {
        let src = match i.source {
            openpxe_iso_store::IsoSource::Local => "local".to_string(),
            // v0.4.65: SMB userspace consumer replaced kernel-mount NFS.
            openpxe_iso_store::IsoSource::Smb { share_id, .. } => format!("smb:{share_id}"),
            // v0.4.67: NFSv3 via in-process nfs3_client.
            openpxe_iso_store::IsoSource::Nfs { share_id, .. } => format!("nfs:{share_id}"),
        };
        let _ = writeln!(
            out,
@@ -378,6 +391,91 @@ async fn smb_share_command(s: &AppState, args: &[String]) -> Result<String, Stri
    }
 }
 // ── nfs (v0.4.67: in-process NFSv3 via nfs3_client) ────────────────────
 async fn nfs_share_command(s: &AppState, args: &[String]) -> Result<String, String> {
    match args.first().map(String::as_str) {
        None | Some("list") => {
            let shares = s.nfs_shares.list();
            if shares.is_empty() {
                return Ok("(no NFS shares configured)".into());
            }
            let mut out = String::new();
            let _ = writeln!(
                out,
                "{:<24} {:<7} {:<6} TARGET",
                "ID", "STATUS", "ISOS"
            );
            for m in shares {
                let status = if m.reachable { "ok" } else { "down" };
                let _ = writeln!(
                    out,
                    "{:<24} {:<7} {:<6} {}:{}",
                    truncate(&m.id, 24),
                    status,
                    m.iso_count,
                    m.server,
                    m.export,
                );
                if let Some(e) = m.last_error {
                    let _ = writeln!(out, "    error: {e}");
                }
                if let Some(h) = m.last_hint {
                    let _ = writeln!(out, "    hint:  {h}");
                }
            }
            Ok(out)
        }
        Some("add") => {
            // nfs add <server>:<export> [port]
            let target = args
                .get(1)
                .ok_or_else(|| "usage: nfs add <server>:<export> [port]".to_string())?;
            let (server, export) = target
                .split_once(':')
                .ok_or_else(|| "target must be 'server:/export'".to_string())?;
            let port = args.get(2).and_then(|s| s.parse::<u16>().ok());
            let req = openpxe_iso_store::NfsAddRequest {
                server: server.to_string(),
                export: export.to_string(),
                port,
            };
            match s.nfs_shares.add(req).await {
                Ok(m) => Ok(format!("added {} ({} isos)", m.id, m.iso_count)),
                Err(e) => {
                    let mut out = format!("add failed: {}", e.error);
                    if let Some(h) = e.hint {
                        out.push_str("\nhint: ");
                        out.push_str(&h);
                    }
                    Err(out)
                }
            }
        }
        Some("remove") => {
            let id = args
                .get(1)
                .ok_or_else(|| "usage: nfs remove <id>".to_string())?;
            match s.nfs_shares.remove(id).await {
                Ok(()) => Ok(format!("removed {id}")),
                Err(e) => Err(format!("remove failed: {e}")),
            }
        }
        Some("scan") => {
            let id = args
                .get(1)
                .ok_or_else(|| "usage: nfs scan <id>".to_string())?;
            match s.nfs_shares.rescan(id).await {
                Ok(n) => Ok(format!("re-scanned {id}: {n} isos")),
                Err(e) => Err(format!("scan failed: {e}")),
            }
        }
        Some(other) => Err(format!(
            "unknown nfs subcommand: {other}\ntry: nfs [list|add|remove|scan]"
        )),
    }
 }
 // ── smb ────────────────────────────────────────────────────────────────
 #[allow(clippy::unused_async)]
@@ -519,6 +617,11 @@ OpenPXE terminal — available commands:
  share remove <id>                 forget an SMB share
  share scan <id>                   re-list a share for new ISOs
  nfs list                          list configured NFSv3 shares
  nfs add <srv>:<export> [port]     add an NFSv3 share
  nfs remove <id>                   forget an NFS share
  nfs scan <id>                     re-list an NFS share for new ISOs
  smb status                        outbound Samba state (Windows install media)
  smb start | stop | reload         control the outbound smbd
@@ -14,7 +14,7 @@ use axum::body::Body;
 use axum::http::{header, Request, StatusCode};
 use openpxe_core::{ClientRegistry, DeploymentQueue, HostBindings, LogBus, Metrics, SettingsStore};
 use openpxe_http_api::{build_router, AppState};
-use openpxe_iso_store::{IsoStore, SmbShareManager};
+use openpxe_iso_store::{IsoStore, NfsShareManager, SmbShareManager};
 use tempfile::tempdir;
 use tower::ServiceExt;
@@ -95,6 +95,7 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
    let queue = DeploymentQueue::new();
    let settings = SettingsStore::load_or_default(dir.path());
    let smb_shares = SmbShareManager::new(dir.path(), iso_store.clone());
    let nfs_shares = NfsShareManager::new(dir.path(), iso_store.clone());
    let log_bus = LogBus::new(64);
    let hosts = HostBindings::load_or_default(dir.path());
    let boot_log = openpxe_core::BootLog::load_or_default(dir.path());
@@ -117,6 +118,7 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
        metrics,
        smb: None,
        smb_shares,
        nfs_shares,
        uploads: openpxe_http_api::uploads::UploadSessions::default(),
        log_bus,
        started_at: time::OffsetDateTime::now_utc(),
@@ -531,6 +533,54 @@ async fn smb_shares_list_starts_empty() {
    assert_eq!(v["shares"].as_array().unwrap().len(), 0);
 }
 // v0.4.67: NFSv3 share manager (parallel to SMB).
 #[tokio::test]
 async fn nfs_shares_list_starts_empty() {
    let (state, _dir) = build_state().await;
    let app = build_router(state);
    let (s, b) = get(&app, "/api/nfs-shares").await;
    assert_eq!(s, StatusCode::OK);
    let v: serde_json::Value = serde_json::from_slice(&b).unwrap();
    assert_eq!(v["shares"].as_array().unwrap().len(), 0);
 }
 #[tokio::test]
 async fn nfs_shares_add_rejects_missing_server() {
    let (state, _dir) = build_state().await;
    let app = build_router(state);
    let (s, b) = post_json(
        &app,
        "/api/nfs-shares",
        r#"{"server":"","export":"/srv/isos"}"#,
    )
    .await;
    assert_eq!(s, StatusCode::BAD_REQUEST);
    let msg = String::from_utf8_lossy(&b);
    assert!(
        msg.to_lowercase().contains("server"),
        "expected server hint, got: {msg}"
    );
 }
 #[tokio::test]
 async fn nfs_shares_add_rejects_export_without_leading_slash() {
    let (state, _dir) = build_state().await;
    let app = build_router(state);
    let (s, b) = post_json(
        &app,
        "/api/nfs-shares",
        r#"{"server":"10.0.0.5","export":"srv/isos"}"#,
    )
    .await;
    assert_eq!(s, StatusCode::BAD_REQUEST);
    let msg = String::from_utf8_lossy(&b);
    assert!(
        msg.to_lowercase().contains("export"),
        "expected export-path hint, got: {msg}"
    );
 }
 #[tokio::test]
 async fn terminal_help_and_status_round_trip() {
    let (state, _dir) = build_state().await;
@@ -1782,13 +1832,39 @@ async fn docs_lists_new_v0_4_5_endpoints() {
 // ─── v0.4.6: PXE logo endpoint ────────────────────────────────────────────
 #[tokio::test]
-async fn pxe_logo_404_when_no_custom_logo_configured() {
+async fn pxe_background_serves_default_when_no_custom_logo() {
    // v0.4.69: the endpoint always returns a full-screen PNG background
    // now — when no custom logo is configured it composes the default
    // OpenPXE mark on a dark field rather than 404ing. This is what lets
    // the PXE menu's `console --picture` paint a real background instead
    // of falling back to the (now-removed) ASCII placeholder.
    let (state, _dir) = build_state().await;
    let app = build_router(state);
-    let (s, body) = get(&app, "/branding/pxe-logo").await;
+    let res = app
-    assert_eq!(s, StatusCode::NOT_FOUND);
+        .clone()
-    let text = std::str::from_utf8(&body).unwrap();
+        .oneshot(
-    assert!(text.contains("no custom logo"), "got: {text}");
+            Request::builder()
                .uri("/branding/pxe-logo")
                .body(Body::empty())
                .unwrap(),
        )
        .await
        .unwrap();
    assert_eq!(res.status(), StatusCode::OK);
    assert_eq!(
        res.headers()
            .get(axum::http::header::CONTENT_TYPE)
            .unwrap()
            .to_str()
            .unwrap(),
        "image/png"
    );
    let body = axum::body::to_bytes(res.into_body(), usize::MAX)
        .await
        .unwrap();
    assert!(body.starts_with(b"\x89PNG"), "default background not a PNG");
    let width = u32::from_be_bytes([body[16], body[17], body[18], body[19]]);
    assert_eq!(width, 1024, "default background should be 1024 wide");
 }
 /// Build a tiny valid PNG via the `image` crate. The v0.4.61 PXE-logo
@@ -1807,10 +1883,11 @@ fn tiny_png() -> Vec<u8> {
 }
 #[tokio::test]
-async fn pxe_logo_404_when_uploaded_logo_is_svg() {
+async fn pxe_background_falls_back_to_default_for_svg_upload() {
-    // iPXE can't rasterize SVG, so an SVG upload deliberately doesn't
+    // iPXE can't rasterize SVG, so an SVG upload doesn't paint as the
-    // light up the PXE menu's `console --picture` overlay — the menu
+    // PXE background — but v0.4.69 still returns the *default* OpenPXE
-    // simply paints without a logo.
+    // background PNG (not a 404) so the boot screen stays graphical.
    // The WebUI top-left continues to render the SVG natively.
    let (state, _dir) = build_state().await;
    state
        .branding
@@ -1821,10 +1898,23 @@ async fn pxe_logo_404_when_uploaded_logo_is_svg() {
        )
        .unwrap();
    let app = build_router(state);
-    let (s, body) = get(&app, "/branding/pxe-logo").await;
+    let res = app
-    assert_eq!(s, StatusCode::NOT_FOUND);
+        .clone()
-    let text = std::str::from_utf8(&body).unwrap();
+        .oneshot(
-    assert!(text.contains("SVG"), "got: {text}");
+            Request::builder()
                .uri("/branding/pxe-logo")
                .body(Body::empty())
                .unwrap(),
        )
        .await
        .unwrap();
    assert_eq!(res.status(), StatusCode::OK);
    let body = axum::body::to_bytes(res.into_body(), usize::MAX)
        .await
        .unwrap();
    assert!(body.starts_with(b"\x89PNG"), "should serve default PNG for SVG");
    let width = u32::from_be_bytes([body[16], body[17], body[18], body[19]]);
    assert_eq!(width, 1024);
 }
 #[tokio::test]
@@ -35,5 +35,13 @@ libc = "0.2"
 # encoder. Keeps the build slim — no JPEG2000, TIFF, BMP, etc.
 image = { version = "0.25", default-features = false, features = ["png", "jpeg", "webp", "gif"] }
 # v0.4.67: pure-Rust NFSv3 client for reading remote ISOs without a
 # kernel mount. See crates/iso-store/src/nfs_share.rs for usage.
 nfs3_client = { workspace = true }
 nfs3_types = { workspace = true }
 # Needed for the Stream trait that wraps the mpsc receiver feeding
 # NFS read-loop bytes into axum's Body::from_stream.
 futures = { workspace = true }
 [dev-dependencies]
 tempfile = "3.12"
@@ -18,6 +18,7 @@
 pub mod entry;
 pub mod introspect;
 pub mod nfs_share;
 pub mod pxe_logo;
 pub mod smb;
 pub mod smb_share;
@@ -33,6 +34,11 @@ pub use introspect::{DistroFamily, IntrospectionReport};
 // it.
 pub use smb::{extract_windows_iso, SmbManager, SmbState};
 pub use smb_share::{SmbAddRequest, SmbShare, SmbShareError, SmbShareManager, SmbStream};
 // v0.4.67: NFS is back — this time as an in-process userspace NFSv3
 // client (the `nfs3_client` crate) rather than a kernel mount. Same
 // "works in any container" property as SMB, plus support for HTTP
 // Range requests because NFSv3 READ3 takes an explicit offset.
 pub use nfs_share::{NfsAddRequest, NfsShare, NfsShareError, NfsShareManager, NfsStream};
 pub use store::{
    generate_boot_entries_for, slugify_str, IsoCategory, IsoMeta, IsoSource, IsoStore,
    UploadHandle,
@@ -1,86 +1,179 @@
-//! Operator-logo compositor for the iPXE menu.
+//! PXE boot-menu background compositor.
 //!
-//! The brief: match iVentoy's polished centered-logo PXE chrome with
+//! The brief (v0.4.69): match iVentoy's polished graphical PXE screen.
-//! whatever raster the operator drops onto Settings → Branding. A wide
+//! iPXE built with `CONSOLE_FRAMEBUFFER` + `IMAGE_PNG` paints a PNG to
-//! wordmark, a portrait stack, a square monogram — all three should
+//! the framebuffer via `console --picture`, then draws the text menu on
-//! land in roughly the same place on the boot screen.
+//! top (the console's default background colour is rendered transparent
 //! so the picture shows through the menu's blank cells). So what we
 //! produce here is a **full-screen 1024×768 background**, not just a
 //! floating logo:
 //!
-//! Approach: decode the operator's upload, fit it into a fixed
+//!   - a solid dark field (matches the WebUI dark theme so the product
-//! 1024×768 canvas with the logo horizontally centered and pinned a
+//!     feels consistent from browser to bare metal), with
-//! short margin from the top, re-encode as PNG, return the bytes. iPXE
+//!   - the operator's uploaded logo composited across the top, leaving
-//! built with `IMAGE_PNG` paints the result via `console --picture`.
+//!     the lower ~two-thirds clear for the iPXE menu text.
 //!
-//! The 1024×768 size matches the default VESA framebuffer iPXE picks
+//! When no custom logo is uploaded we still return a designed
-//! on most BIOS/UEFI consoles. Operators uploading 4K logos get
+//! background — a dark field with a centered "rainbow-horizon" disc
-//! correctly downscaled; tiny icons get drawn at their native size,
+//! echoing the bundled OpenPXE mark — so the boot screen is graphical
-//! centered, with transparent margins.
+//! out of the box. This replaces the old ASCII wordmark entirely.
 //!
-//! We deliberately don't ship `resvg` for SVG support — keeping the
+//! iPXE does **not** scale pictures (confirmed against the decoder
-//! dependency surface narrow matters more than supporting SVG-only
+//! source): the image is painted at native pixel size and the firmware
-//! brand assets. The WebUI's logo stays SVG-native (the browser
+//! picks the smallest video mode that fits. 1024×768 is the universal
-//! rasterizes it); the PXE menu wants a raster regardless.
+//! safe mode, so we pin the canvas there. Operators uploading a 4K logo
 //! get it downscaled to fit the top band; tiny icons paint at native
 //! size, centered.
 //!
 //! Input formats: anything the `image` crate decodes with our enabled
 //! features — PNG, JPEG, WebP, GIF. iPXE itself only consumes PNG, so
 //! we always *emit* PNG regardless of what the operator uploaded; a
 //! WebP logo is transcoded here transparently.
 use image::imageops::FilterType;
 use image::{DynamicImage, ImageError, ImageFormat, Rgba, RgbaImage};
 use std::io::Cursor;
-/// Canvas dimensions used for the composed PXE logo. Picked to match
+/// Canvas dimensions. Pinned to 1024×768 — the universal framebuffer
-/// the framebuffer dimensions iPXE picks on most BIOS/UEFI consoles —
+/// mode every BIOS/UEFI console supports, and iPXE doesn't scale.
 /// gives a 1:1 paint with no scaling at the firmware layer.
 pub const CANVAS_W: u32 = 1024;
 pub const CANVAS_H: u32 = 768;
-/// Maximum dimensions for the operator's logo inside the canvas. Any
+/// Bounding box for the operator's logo across the top band. Wider than
-/// upload larger than this in either axis is downscaled (preserving
+/// the old floating-logo box because the logo now anchors a full
-/// aspect ratio) to fit. Smaller uploads paint at native size.
+/// background rather than sitting alone on transparency.
-const LOGO_MAX_W: u32 = 600;
+const LOGO_MAX_W: u32 = 760;
 const LOGO_MAX_H: u32 = 200;
-/// Top margin in pixels from the canvas's top edge to the logo's top
+/// Top margin from the canvas top to the logo's top edge.
-/// edge. Matches the visual rhythm of iVentoy's screen (logo at top,
+const LOGO_TOP_MARGIN: u32 = 72;
 /// menu below).
 const LOGO_TOP_MARGIN: u32 = 64;
-/// Compose `src_bytes` (any PNG/JPEG/WebP/GIF) into a centered-top
+/// Background fill — a near-black with a faint blue cast, matching the
-/// 1024×768 PNG and return the encoded bytes.
+/// WebUI's dark theme surface so the product reads as one piece from
 /// browser to PXE screen.
 const BG: Rgba<u8> = Rgba([11, 14, 22, 255]);
 /// Compose the operator's uploaded raster (`Some`) — or the default
 /// OpenPXE mark (`None`) — into a full-screen 1024×768 PNG background
 /// and return the encoded bytes.
 ///
-/// Errors when the source can't be decoded or the encoded buffer can't
+/// Errors only when a provided `src_bytes` can't be decoded; the
-/// be written (only really fires on out-of-memory; the encoder itself
+/// `None` path and the PNG encode are infallible for our fixed canvas.
-/// is infallible for well-formed inputs).
+pub fn compose_pxe_background(src_bytes: Option<&[u8]>) -> Result<Vec<u8>, ImageError> {
-pub fn compose_pxe_logo(src_bytes: &[u8]) -> Result<Vec<u8>, ImageError> {
+    let mut canvas: RgbaImage = RgbaImage::from_pixel(CANVAS_W, CANVAS_H, BG);
-    let logo = image::load_from_memory(src_bytes)?;
+
-    // Resize-fit if the upload exceeds our bounding box. `Lanczos3`
+    match src_bytes {
-    // keeps the antialiasing crisp on the framebuffer console; it's a
+        Some(bytes) => {
-    // touch slower than `Triangle` but the operator hits this endpoint
+            let logo = image::load_from_memory(bytes)?;
    // once per boot at most.
            let logo = downscale_to_fit(logo, LOGO_MAX_W, LOGO_MAX_H);
            let logo_rgba = logo.to_rgba8();
-
+            let off_x = CANVAS_W.saturating_sub(logo_rgba.width()) / 2;
-    // Transparent canvas. iPXE 1.21+ honours alpha-channel transparency
+            let off_y = LOGO_TOP_MARGIN.min(CANVAS_H.saturating_sub(logo_rgba.height()));
-    // on framebuffer consoles; older builds simply draw the alpha as
+            // `overlay` alpha-composites, so a transparent-background
-    // black, which still gives a sensible look.
+            // logo blends onto the dark field exactly as designed.
    let mut canvas: RgbaImage = RgbaImage::from_pixel(CANVAS_W, CANVAS_H, Rgba([0, 0, 0, 0]));
    let logo_w = logo_rgba.width();
    let logo_h = logo_rgba.height();
    // Horizontal center, top-margin from the top. Saturating math
    // means a logo wider than CANVAS_W (shouldn't happen after the
    // downscale above, but defensive) just sits flush-left.
    let off_x = CANVAS_W.saturating_sub(logo_w) / 2;
    let off_y = LOGO_TOP_MARGIN.min(CANVAS_H.saturating_sub(logo_h));
            image::imageops::overlay(&mut canvas, &logo_rgba, off_x.into(), off_y.into());
        }
        None => draw_default_mark(&mut canvas),
    }
-    let mut out = Vec::with_capacity(64 * 1024);
+    let mut out = Vec::with_capacity(128 * 1024);
    DynamicImage::ImageRgba8(canvas).write_to(&mut Cursor::new(&mut out), ImageFormat::Png)?;
    Ok(out)
 }
 /// Back-compat shim for the old name — callers that pass a raw logo and
 /// want it composited get the same result as `compose_pxe_background`
 /// with `Some`.
 pub fn compose_pxe_logo(src_bytes: &[u8]) -> Result<Vec<u8>, ImageError> {
    compose_pxe_background(Some(src_bytes))
 }
 /// Paint a centered "rainbow-horizon" disc onto the dark canvas as the
 /// default brand mark when no operator logo is set. Pure pixel math —
 /// no font, no SVG rasterizer, no extra deps. A filled circle with a
 /// left-to-right hue sweep echoes the bundled `logo.svg` motif.
 // Casts here are all bounded small-range geometry (radius ≤ 90, canvas
 // ≤ 1024) — precision loss / wrap is structurally impossible.
 #[allow(clippy::cast_precision_loss, clippy::cast_possible_wrap)]
 fn draw_default_mark(canvas: &mut RgbaImage) {
    let radius: i32 = 90;
    let cx = (CANVAS_W / 2) as i32;
    let cy = (LOGO_TOP_MARGIN + 100) as i32;
    // Four-stop horizontal sweep across the disc (teal → blue → violet
    // → magenta) — the OpenPXE palette.
    let stops = [
        [0x22u8, 0xd3, 0xaa],
        [0x3b, 0x82, 0xf6],
        [0x8b, 0x5c, 0xf6],
        [0xec, 0x48, 0x99],
    ];
    let r2 = radius * radius;
    for dy in -radius..=radius {
        for dx in -radius..=radius {
            if dx * dx + dy * dy > r2 {
                continue;
            }
            // Position across the disc in [0,1] left→right.
            let t = (f32::from(i16::try_from(dx + radius).unwrap_or(0)))
                / (f32::from(i16::try_from(2 * radius).unwrap_or(1)));
            let color = gradient_at(&stops, t);
            // Soft edge: fade alpha in the outer 3px ring.
            let dist = ((dx * dx + dy * dy) as f32).sqrt();
            let alpha = if dist > (radius as f32 - 3.0) {
                let edge = (radius as f32 - dist).clamp(0.0, 3.0) / 3.0;
                (edge * 255.0) as u8
            } else {
                255
            };
            let px = cx + dx;
            let py = cy + dy;
            if px >= 0 && py >= 0 && (px as u32) < CANVAS_W && (py as u32) < CANVAS_H {
                blend_pixel(canvas, px as u32, py as u32, color, alpha);
            }
        }
    }
 }
 /// Linear interpolate across an N-stop palette at position `t` in [0,1].
 // `segments`/`idx` are ≤ palette length (4) — f32 cast is exact.
 #[allow(clippy::cast_precision_loss)]
 fn gradient_at(stops: &[[u8; 3]], t: f32) -> [u8; 3] {
    let t = t.clamp(0.0, 1.0);
    let segments = stops.len() - 1;
    let scaled = t * segments as f32;
    let idx = (scaled.floor() as usize).min(segments - 1);
    let frac = scaled - idx as f32;
    let a = stops[idx];
    let b = stops[idx + 1];
    [
        lerp(a[0], b[0], frac),
        lerp(a[1], b[1], frac),
        lerp(a[2], b[2], frac),
    ]
 }
 fn lerp(a: u8, b: u8, t: f32) -> u8 {
    (f32::from(a) + (f32::from(b) - f32::from(a)) * t).round() as u8
 }
 /// Alpha-blend `color` at `alpha` over the existing canvas pixel.
 fn blend_pixel(canvas: &mut RgbaImage, x: u32, y: u32, color: [u8; 3], alpha: u8) {
    let bg = canvas.get_pixel(x, y).0;
    let a = f32::from(alpha) / 255.0;
    let out = Rgba([
        lerp(bg[0], color[0], a),
        lerp(bg[1], color[1], a),
        lerp(bg[2], color[2], a),
        255,
    ]);
    canvas.put_pixel(x, y, out);
 }
 fn downscale_to_fit(img: DynamicImage, max_w: u32, max_h: u32) -> DynamicImage {
    let (w, h) = (img.width(), img.height());
    if w <= max_w && h <= max_h {
        return img;
    }
    // Preserve aspect ratio. `resize` clamps to the smaller of the
    // two scale factors so we never overshoot the bounding box.
    img.resize(max_w, max_h, FilterType::Lanczos3)
 }
@@ -99,54 +192,73 @@ mod tests {
    }
    #[test]
-    fn compose_emits_canvas_sized_png() {
+    fn custom_logo_emits_canvas_sized_png_with_dark_field() {
        let src = solid_png(120, 60, [200, 50, 50]);
-        let out = compose_pxe_logo(&src).unwrap();
+        let out = compose_pxe_background(Some(&src)).unwrap();
-        // Round-trip the output and confirm dimensions.
+        let img = image::load_from_memory(&out).unwrap().to_rgba8();
        let img = image::load_from_memory(&out).unwrap();
        assert_eq!(img.width(), CANVAS_W);
        assert_eq!(img.height(), CANVAS_H);
        // A far corner should be the opaque dark background fill, not
        // transparent — this is a full background now, not a floating
        // logo on transparency.
        let corner = img.get_pixel(CANVAS_W - 1, CANVAS_H - 1);
        assert_eq!(corner.0, BG.0, "corner should be the dark fill");
    }
    #[test]
-    fn small_logo_centered_at_top_margin() {
+    fn custom_logo_painted_in_top_band() {
        let src = solid_png(100, 40, [10, 200, 10]);
-        let out = compose_pxe_logo(&src).unwrap();
+        let out = compose_pxe_background(Some(&src)).unwrap();
        let canvas = image::load_from_memory(&out).unwrap().to_rgba8();
        // Pixel just inside the logo box should match the source color
        // (alpha=255). Pixel near a far corner of the canvas should be
        // the transparent background.
        let cx = (CANVAS_W - 100) / 2;
        let cy = LOGO_TOP_MARGIN;
        let inside = canvas.get_pixel(cx + 10, cy + 10);
-        assert_eq!(inside.0[3], 255, "logo pixel should be opaque");
+        assert!(
-        assert!(inside.0[0] < 100 && inside.0[1] > 100 && inside.0[2] < 100, "color mismatch: {inside:?}");
+            inside.0[1] > 100 && inside.0[0] < 100,
-        let corner = canvas.get_pixel(CANVAS_W - 1, CANVAS_H - 1);
+            "logo pixel color mismatch: {inside:?}"
-        assert_eq!(corner.0[3], 0, "canvas corner should be transparent");
+        );
    }
    #[test]
-    fn oversize_logo_is_downscaled_to_bounding_box() {
+    fn default_background_is_dark_with_a_painted_mark() {
-        // 4000×800 image — bigger than LOGO_MAX_W and LOGO_MAX_H in
+        let out = compose_pxe_background(None).unwrap();
        // both axes. After downscale the output must fit; we re-decode
        // the canvas, count non-transparent pixels, and confirm none
        // sit outside the expected band.
        let src = solid_png(4000, 800, [50, 50, 200]);
        let out = compose_pxe_logo(&src).unwrap();
        let canvas = image::load_from_memory(&out).unwrap().to_rgba8();
-        // Span row at the top margin should have non-transparent
+        assert_eq!(canvas.width(), CANVAS_W);
-        // pixels somewhere; rows past the LOGO_TOP_MARGIN + LOGO_MAX_H
+        assert_eq!(canvas.height(), CANVAS_H);
-        // should be entirely transparent.
+        // Corner is dark fill.
-        let bottom_band_y = LOGO_TOP_MARGIN + LOGO_MAX_H + 10;
+        assert_eq!(canvas.get_pixel(2, CANVAS_H - 2).0, BG.0);
-        for x in 0..CANVAS_W {
+        // Center of the disc is not the background fill (something was
-            let p = canvas.get_pixel(x, bottom_band_y);
+        // painted there).
-            assert_eq!(p.0[3], 0, "row {bottom_band_y} should be transparent at x={x}");
+        let center = canvas.get_pixel(CANVAS_W / 2, LOGO_TOP_MARGIN + 100);
        assert_ne!(center.0, BG.0, "default mark should paint over the field");
    }
    #[test]
    fn webp_or_jpeg_input_is_accepted_and_transcoded_to_png() {
        // Encode a JPEG and confirm the compositor decodes it and emits
        // a valid PNG (iPXE only eats PNG, so transcoding is the point).
        let img: ImageBuffer<Rgb<u8>, Vec<u8>> = ImageBuffer::from_pixel(80, 80, Rgb([90, 90, 90]));
        let mut jpeg = Vec::new();
        DynamicImage::ImageRgb8(img)
            .write_to(&mut Cursor::new(&mut jpeg), ImageFormat::Jpeg)
            .unwrap();
        let out = compose_pxe_background(Some(&jpeg)).unwrap();
        // Output must be a PNG (magic bytes) of canvas size.
        assert_eq!(&out[..8], b"\x89PNG\r\n\x1a\n");
        let img = image::load_from_memory(&out).unwrap();
        assert_eq!(img.width(), CANVAS_W);
    }
    #[test]
    fn unsupported_bytes_returns_error_not_panic() {
-        let r = compose_pxe_logo(b"\xde\xad\xbe\xef not an image");
+        let r = compose_pxe_background(Some(b"\xde\xad\xbe\xef not an image"));
        assert!(r.is_err());
    }
    #[test]
    fn gradient_endpoints_match_stops() {
        let stops = [[0, 0, 0], [255, 255, 255]];
        assert_eq!(gradient_at(&stops, 0.0), [0, 0, 0]);
        assert_eq!(gradient_at(&stops, 1.0), [255, 255, 255]);
    }
 }
@@ -15,27 +15,33 @@ use tokio::io::AsyncWriteExt;
 /// Where the bytes for an ISO actually live.
 ///
-/// The default is `Local` — uploaded ISOs sit in `<iso_dir>/<id>.iso`.
+/// `Local` — uploaded ISO, sits at `<iso_dir>/<id>.iso`.
-/// `Smb` entries (v0.4.65) point at a file inside a remote SMB share
+/// `Smb` (v0.4.65) — remote SMB share, streamed via Samba's
-/// that the `SmbShareManager` knows how to stream via Samba's
+/// userspace `smbclient` CLI subprocess. No kernel mount, no local
-/// userspace `smbclient` CLI. The HTTP handler resolves the share by
+/// cache. Sequential whole-file streaming; HTTP Range requests
-/// id at request time and pipes `smbclient -c 'get file -'` straight
+/// return 416.
-/// into the response body — no kernel mount, no local cache.
+/// `Nfs` (v0.4.67) — remote NFSv3 share, streamed via the pure-Rust
 /// `nfs3_client` crate (in-process, no subprocess). Same "works in
 /// any container" property as SMB, plus Range requests work because
 /// NFSv3 READ3 takes an explicit offset.
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(tag = "kind", rename_all = "snake_case")]
 pub enum IsoSource {
    #[default]
    Local,
-    /// v0.4.65: kernel-mount NFS is gone (it didn't work on Unraid
+    /// v0.4.65: SMB via userspace `smbclient` works in any container.
    /// regardless of capabilities — the host kernel needs the nfs
    /// client modules loaded). SMB via userspace `smbclient` works in
    /// any container.
    Smb {
        share_id: String,
        /// Filename at the share root. We don't support nested paths
        /// in v0.4.65; ISOs live at the top of the share.
        relative_path: String,
    },
    /// v0.4.67: NFSv3 via the in-process `nfs3_client` crate.
    Nfs {
        share_id: String,
        /// Filename at the export root.
        relative_path: String,
    },
 }
 /// Where the ISO lands in the PXE menu hierarchy.
@@ -293,10 +299,11 @@ impl IsoStore {
                    None
                }
            }
-            // SMB sources have no local path — they're streamed via
+            // SMB and NFS sources have no local path — they're
-            // smbclient subprocess. Callers should check the source
+            // streamed in-process. Callers must inspect the source
-            // kind first and dispatch accordingly.
+            // kind first and dispatch to the appropriate share
-            IsoSource::Smb { .. } => None,
+            // manager.
            IsoSource::Smb { .. } | IsoSource::Nfs { .. } => None,
        }
    }
@@ -348,13 +355,19 @@ impl IsoStore {
    }
    /// Drop every entry that belongs to `share_id`. Used by the SMB
-    /// share manager when an operator removes a share, or before
+    /// and NFS share managers when an operator removes a share, or
-    /// re-scanning to clean out stale entries.
+    /// before re-scanning to clean out stale entries. The same id
    /// space serves both protocols — share ids are slugified from
    /// `server+share` (SMB) or `server+export` (NFS) and the
    /// protocol-specific prefix prevents collisions.
    pub fn drop_external_source(&self, share_id: &str) {
        let mut g = self.inner.write();
-        g.isos.retain(
+        g.isos.retain(|_, m| match &m.source {
-            |_, m| !matches!(&m.source, IsoSource::Smb { share_id: sid, .. } if sid == share_id),
+            IsoSource::Smb { share_id: sid, .. } | IsoSource::Nfs { share_id: sid, .. } => {
-        );
+                sid != share_id
            }
            IsoSource::Local => true,
        });
    }
    /// Set or clear an ISO's boot password.
@@ -9,7 +9,7 @@ use openpxe_core::{
 };
 use openpxe_dhcp_proxy::DhcpProxyServer;
 use openpxe_http_api::{build_router, AppState};
-use openpxe_iso_store::{IsoStore, SmbManager, SmbShareManager};
+use openpxe_iso_store::{IsoStore, NfsShareManager, SmbManager, SmbShareManager};
 use openpxe_tftp::TftpServer;
 use std::net::{Ipv4Addr, SocketAddr};
 use std::path::PathBuf;
@@ -133,6 +133,18 @@ async fn main() -> anyhow::Result<()> {
        );
    }
    // v0.4.67: NFSv3 share manager — pure-Rust in-process consumer
    // via the `nfs3_client` crate. Sits alongside the SMB manager;
    // operators pick whichever protocol their NAS prefers, or use
    // both. No subprocess, no kernel mount, works in any container.
    let nfs_shares = NfsShareManager::new(&config.paths.work_dir, iso_store.clone());
    if let Err(e) = nfs_shares.load_and_rescan().await {
        tracing::warn!(
            target: "openpxe::nfs",
            "could not reload NFS shares on startup: {e}"
        );
    }
    // Sniff network details for the Network tab. None of these are
    // required for PXE to work — they're informational, surfaced in the
    // UI so an operator doesn't have to drop to a shell to find their
@@ -158,6 +170,7 @@ async fn main() -> anyhow::Result<()> {
        metrics: metrics.clone(),
        smb: Some(smb.clone()),
        smb_shares: smb_shares.clone(),
        nfs_shares: nfs_shares.clone(),
        uploads: openpxe_http_api::uploads::UploadSessions::default(),
        log_bus: log_bus.clone(),
        started_at: time::OffsetDateTime::now_utc(),
@@ -117,6 +117,20 @@ code, kbd { font-family: var(--mono); font-size: 12.5px;
  letter-spacing: 0.2px;
  color: var(--fg);
 }
 /* v0.4.69: FleetDM-style full-width custom logo. When the operator has
   uploaded a custom brand mark, the sidebar header drops the bundled
   26px mark + "OpenPXE" wordmark and instead lets the uploaded image
   span the header — left-aligned, capped at 200x50, scaled to fit
   without distortion. The wordmark is hidden so the operator's logo is
   the sole brand element (their logo presumably already contains their
   name). The bundled-default case keeps the mark + wordmark. */
 .sidebar .brand.has-custom-logo { gap: 0; }
 .sidebar .brand.has-custom-logo img {
  width: auto; height: 50px; max-width: 200px;
  object-fit: contain; object-position: left center; flex: none;
 }
 .sidebar .brand.has-custom-logo strong { display: none; }
 .sidebar nav { padding: 10px 0; flex: 1; overflow-y: auto; }
 .sidebar nav a {
  display: flex; align-items: center; gap: 10px;
@@ -116,6 +116,46 @@
    return root;
  }
  // Disk-space card. Free + used + total for the volume hosting the ISO
  // directory, with a coloured bar. Warns at 80% and goes red at 95% so
  // the operator sees the runway shrinking before uploads start failing
  // with ENOSPC. Shared by the Storage tab and the Dashboard (v0.4.68).
  function diskSpaceCard(disk) {
    const total = Number(disk.total_bytes || 0);
    const avail = Number(disk.available_bytes || 0);
    const used  = Number(disk.used_bytes  || 0);
    const pctUsed = total > 0 ? (used / total) * 100 : 0;
    let barClass = 'diskbar';
    if (pctUsed >= 95)      barClass += ' full';
    else if (pctUsed >= 80) barClass += ' warn';
    return el('div', {class:'card'}, [
      el('header', {}, [
        el('h2', {}, 'Disk space'),
        el('span', {class:'sub'},
          total > 0 ? (pctUsed.toFixed(1) + '% used') : 'unavailable'),
      ]),
      el('div', {class:'body'}, [
        el('div', {style:'color:var(--fg-dim);font-size:12px;word-break:break-all'},
          disk.path ? ('Volume: ' + disk.path) : 'Volume path unknown'),
        el('div', {class: barClass},
          el('div', {class:'fill',
            style:'width:' + Math.min(100, pctUsed).toFixed(1) + '%'})),
        el('div', {class:'disk-meta'}, [
          el('span', {}, ['Used ',  el('strong', {}, fmtBytes(used))]),
          el('span', {}, ['Free ',  el('strong', {}, fmtBytes(avail))]),
          el('span', {}, ['Total ', el('strong', {}, fmtBytes(total))]),
        ]),
        pctUsed >= 95
          ? el('p', {class:'msg err', style:'margin-top:10px'},
              '⚠ Less than 5% free. Remove old ISOs or grow the volume before uploading more.')
          : (pctUsed >= 80
              ? el('p', {class:'msg', style:'color:var(--warn);margin-top:10px'},
                  'Volume is getting full. Consider pruning old ISOs.')
              : null),
      ]),
    ]);
  }
  // Categorize an ISO row's "bootable now" status — drives the amber
  // tint borrowed from Bootimus v0.1.62. Returns {ok, reason}.
  function bootability(iso, settings) {
@@ -142,6 +182,13 @@
      const isos = await getJSON('/api/isos');
      const clients = (await getJSON('/api/clients')).clients || [];
      const entries = (await getJSON('/api/queue')).entries || [];
      // v0.4.68: surface the same disk-space card the Storage tab shows,
      // so operators see capacity at a glance from the landing page.
      // Tolerate the endpoint being unavailable (e.g. statvfs failure)
      // the same way the Storage tab does.
      const disk = await getJSON('/api/storage/disk').catch(() => ({
        total_bytes: 0, available_bytes: 0, used_bytes: 0, path: '?',
      }));
      const ipxeOk = (status.ipxe_assets || []).length > 0;
      const stats = el('div', {class: 'statstrip'}, [
@@ -167,8 +214,11 @@
          el('div', {class: 'trend'},
            isos.filter(i => i.introspection.family === 'windows_pe').length + ' Windows · ' +
            isos.filter(i => i.introspection.family !== 'windows_pe').length + ' Linux  ·  ' +
-            (status.smb_share_reachable || 0) + ' SMB share' +
+            // v0.4.67: count both protocols. Label generically since
-            ((status.smb_share_reachable || 0) === 1 ? '' : 's')),
+            // operators may be using one, the other, or both.
            ((status.smb_share_reachable || 0) + (status.nfs_share_reachable || 0)) +
            ' remote share' +
            (((status.smb_share_reachable || 0) + (status.nfs_share_reachable || 0)) === 1 ? '' : 's')),
        ])),
        el('div', {class: 'card'}, el('div', {class: 'stat'}, [
          el('div', {class: 'label'}, 'Uptime'),
@@ -219,7 +269,7 @@
            '⚠ ' + i.filename + ' — ' + b.reason)))
      ]) : null;
-      return el('div', {class:'grid'}, [stats, recentBlock, problemsBlock].filter(Boolean));
+      return el('div', {class:'grid'}, [stats, diskSpaceCard(disk), recentBlock, problemsBlock].filter(Boolean));
    },
    network: async () => {
@@ -345,16 +395,20 @@
    storage: async () => {
      // v0.4.65: kernel-mount NFS replaced with userspace SMB via
      // smbclient — works in any container regardless of host kernel
-      // modules or capabilities. The /api/nfs endpoint is gone;
+      // modules or capabilities.
-      // /api/smb-shares is the replacement.
+      // v0.4.67: NFSv3 added back as an in-process Rust client
-      const [isos, settings, smbRes, disk] = await Promise.all([
+      // (nfs3_client crate). Both protocols available side-by-side;
      // operators pick whichever their NAS prefers.
      const [isos, settings, smbRes, nfsRes, disk] = await Promise.all([
        getJSON('/api/isos'), getJSON('/api/settings'),
        getJSON('/api/smb-shares'),
        getJSON('/api/nfs-shares'),
        getJSON('/api/storage/disk').catch(() => ({
          total_bytes: 0, available_bytes: 0, used_bytes: 0, path: '?',
        })),
      ]);
      const shares = smbRes.shares || [];
      const nfsShares = nfsRes.shares || [];
      // ── Upload card ──
      const drop = el('div', {class:'drop', id:'drop'}, [
@@ -464,10 +518,14 @@
      const rowsAndEditors = [];
      isos.forEach(i => {
        const b = bootability(i, settings);
-        // v0.4.65: SMB userspace consumer replaced NFS. The badge
+        // v0.4.65: SMB userspace consumer (smbclient).
-        // colours stay the same so the table looks unchanged for
+        // v0.4.67: NFS back as in-process Rust client (nfs3_client).
-        // existing operators.
+        // Both render with the same "remote" badge colour — they
        // share the same "on a remote share, can't be deleted from
        // here" semantics in the UI.
        const isSmb = i.source && i.source.kind === 'smb';
        const isNfs = i.source && i.source.kind === 'nfs';
        const isRemote = isSmb || isNfs;
        const protectedNow = !!i.password_hash;
        // The inline editor row is hidden by default; the Password
@@ -587,8 +645,9 @@
          ]),
          el('td', {class:'num'}, fmtBytes(i.size_bytes)),
          el('td', {},
-            el('span', {class:'src-badge' + (isSmb ? ' nfs' : '')},
+            el('span', {class:'src-badge' + (isRemote ? ' nfs' : '')},
-              isSmb ? ('smb:' + i.source.share_id) : 'local')),
+              isSmb ? ('smb:' + i.source.share_id)
                : isNfs ? ('nfs:' + i.source.share_id) : 'local')),
          el('td', {},
            protectedNow
              ? el('span', {class:'tag accent'}, 'protected')
@@ -598,11 +657,12 @@
            el('button', {class:'ghost', style:'margin-right:6px', onclick: () => {
              editorRow.style.display = (editorRow.style.display === 'none') ? '' : 'none';
            }}, protectedNow ? 'Password ✎' : 'Set password'),
-            isSmb
+            isRemote
-              // v0.4.65: SMB-sourced ISOs live on the remote share —
+              // v0.4.65/v0.4.67: remote-sourced ISOs live on the
-              // OpenPXE doesn't own those bytes. Same pattern as NFS
+              // share — OpenPXE doesn't own those bytes. Surface a
-              // had: surface a tag instead of a destructive button.
+              // tag instead of a destructive button.
-              ? el('span', {class:'tag', style:'opacity:.6'}, 'on SMB')
+              ? el('span', {class:'tag', style:'opacity:.6'},
                  isSmb ? 'on SMB' : 'on NFS')
              : el('button', {class:'danger', onclick: async () => {
                  if (!confirm('Remove this image?')) return;
                  await fetch('/api/isos/' + encodeURIComponent(i.id), {method:'DELETE'});
@@ -715,45 +775,73 @@
        el('span'),
      ])) : [el('div', {class:'empty'}, 'No SMB shares configured.')];
-      // Disk-space card. Free + used + total for the volume hosting the
+      // ── NFS shares section (v0.4.67) ──
-      // ISO directory, with a coloured bar. Warns at 80% and goes red at
+      // Parallel to SMB shares above. The NFSv3 client is in-process
-      // 95% so the operator sees the runway shrinking before uploads
+      // (nfs3_client crate) so NFS-sourced ISOs support HTTP Range
-      // start failing with ENOSPC.
+      // requests — SMB-sourced ones don't (smbclient CLI can't seek
-      const total = Number(disk.total_bytes || 0);
+      // mid-stream). Otherwise the UX is identical: server + export,
-      const avail = Number(disk.available_bytes || 0);
+      // submit, scan, remove.
-      const used  = Number(disk.used_bytes  || 0);
+      const nfsMsg = el('div', {class:'msg'});
-      const pctUsed = total > 0 ? (used / total) * 100 : 0;
+      const nfsServerIn = el('input', {type:'text', placeholder:'10.0.0.5'});
-      let barClass = 'diskbar';
+      const nfsExportIn = el('input', {type:'text', placeholder:'/srv/isos'});
-      if (pctUsed >= 95)      barClass += ' full';
+      const addNfs = el('button', {style:'margin-top:14px', onclick: async () => {
-      else if (pctUsed >= 80) barClass += ' warn';
+        if (!nfsServerIn.value || !nfsExportIn.value) {
-      const diskCard = el('div', {class:'card'}, [
+          nfsMsg.replaceChildren(document.createTextNode('Server and export are required.'));
-        el('header', {}, [
+          nfsMsg.className = 'msg err'; return;
-          el('h2', {}, 'Disk space'),
+        }
-          el('span', {class:'sub'},
+        nfsMsg.replaceChildren(document.createTextNode('Connecting…'));
-            total > 0
+        nfsMsg.className = 'msg';
-              ? (pctUsed.toFixed(1) + '% used')
+        const r = await postJSON('/api/nfs-shares', {
-              : 'unavailable'),
+          server: nfsServerIn.value,
          export: nfsExportIn.value,
        });
        if (r.ok) {
          nfsMsg.replaceChildren(document.createTextNode('Connected.'));
          nfsMsg.className = 'msg ok';
          render('storage');
        } else {
          // Structured {error, stderr, hint} same as SMB.
          let bodyJson = null;
          let raw = null;
          try { bodyJson = await r.clone().json(); }
          catch (_) { raw = await r.text().catch(()=> 'connect failed'); }
          const msg = bodyJson && bodyJson.error ? bodyJson.error : (raw || 'connect failed');
          const hint = bodyJson && bodyJson.hint;
          const parts = [el('div', {}, [
            el('strong', {}, 'Connect failed: '),
            document.createTextNode(msg),
          ])];
          if (hint) {
            parts.push(el('div', {style:'margin-top:6px;opacity:.78;font-size:12px'}, hint));
          }
          nfsMsg.replaceChildren(...parts);
          nfsMsg.className = 'msg err';
        }
      }}, 'Add share');
      const nfsRows = nfsShares.length ? nfsShares.map(m => el('div', {class: 'nfs-row' + (m.reachable ? '' : ' down')}, [
        el('span', {class: 'dot ' + (m.reachable ? 'ok' : 'err')}),
        el('div', {}, [
          el('div', {class:'id'}, m.server + ':' + m.export),
          el('div', {class:'meta'},
            'NFSv3 · ' +
            (m.reachable ? m.iso_count + ' isos' : 'not reachable')),
          m.last_error ? el('div', {class:'err'}, '⚠ ' + m.last_error) : null,
          m.last_hint ? el('div', {style:'margin-top:4px;opacity:.78;font-size:12px'}, m.last_hint) : null,
        ]),
-        el('div', {class:'body'}, [
+        el('button', {class:'ghost', onclick: async () => {
-          el('div', {style:'color:var(--fg-dim);font-size:12px;word-break:break-all'},
+          const r = await postJSON('/api/nfs-shares/' + encodeURIComponent(m.id) + '/scan', {});
-            disk.path ? ('Volume: ' + disk.path) : 'Volume path unknown'),
+          if (r.ok) render('storage');
-          el('div', {class: barClass},
+        }}, 'Re-scan'),
-            el('div', {class:'fill',
+        el('button', {class:'danger', onclick: async () => {
-              style:'width:' + Math.min(100, pctUsed).toFixed(1) + '%'})),
+          if (!confirm('Forget ' + m.server + ':' + m.export + '?')) return;
-          el('div', {class:'disk-meta'}, [
+          await fetch('/api/nfs-shares/' + encodeURIComponent(m.id), {method:'DELETE'});
-            el('span', {}, ['Used ',  el('strong', {}, fmtBytes(used))]),
+          render('storage');
-            el('span', {}, ['Free ',  el('strong', {}, fmtBytes(avail))]),
+        }}, 'Remove'),
-            el('span', {}, ['Total ', el('strong', {}, fmtBytes(total))]),
+        el('span'),
-          ]),
+      ])) : [el('div', {class:'empty'}, 'No NFS shares configured.')];
-          pctUsed >= 95
+
-            ? el('p', {class:'msg err', style:'margin-top:10px'},
+      const diskCard = diskSpaceCard(disk);
                '⚠ Less than 5% free. Remove old ISOs or grow the volume before uploading more.')
            : (pctUsed >= 80
                ? el('p', {class:'msg', style:'color:var(--warn);margin-top:10px'},
                    'Volume is getting full. Consider pruning old ISOs.')
                : null),
        ]),
      ]);
      return el('div', {class:'grid'}, [
        diskCard,
@@ -801,6 +889,39 @@
              'boot time — no local cache, no double disk usage.'),
          ]),
        ]),
        // v0.4.67: NFS shares card sits right below SMB so operators
        // can see both protocols at a glance. The form is simpler
        // (no auth) because NFSv3 access control is by client IP on
        // the server side, not by client-supplied credentials.
        el('div', {class:'card'}, [
          el('header', {}, [
            el('h2', {}, 'NFS shares'),
            el('span', {class:'sub'}, nfsShares.length + ' configured'),
          ]),
          el('div', {class:'body'}, [
            el('div', {class:'form-row cols-2'}, [
              el('label', {class:'field'}, [
                el('span', {class:'name'}, 'NFS server'),
                nfsServerIn,
              ]),
              el('label', {class:'field'}, [
                el('span', {class:'name'}, 'Export path'),
                nfsExportIn,
              ]),
            ]),
            addNfs, nfsMsg,
            el('div', {style:'margin-top:18px;display:grid;gap:8px'}, nfsRows),
            el('p', {class:'msg', style:'margin-top:14px'},
              'NFSv3 shares are read in-process via a pure-Rust client — ' +
              'no kernel modules, no mount.nfs, no CAP_SYS_ADMIN. Works in ' +
              'every container the SMB path works in (Unraid included). ' +
              'NFSv3 auth is AUTH_SYS only; gate access on the server side ' +
              'by allowing this OpenPXE host’s IP in the export list. ' +
              'ISOs are streamed on demand and HTTP Range requests work — ' +
              'NFSv3 READ3 takes an explicit offset, so clients can seek ' +
              'into a 5 GB ISO without reading what comes before.'),
          ]),
        ]),
        el('div', {class:'card'}, [
          el('header', {}, [
            el('h2', {}, 'Available images'),
@@ -13,7 +13,7 @@
       on the asset handlers, the practical caching window is one
       version. -->
  <link rel="stylesheet" href="/assets/app.css?v={{ASSET_VERSION}}" />
-  <link rel="icon" type="image/svg+xml" href="/assets/logo.svg?v={{ASSET_VERSION}}" />
+  <link rel="icon" type="image/svg+xml" href="/assets/logo.svg?v={{ASSET_VERSION}}&r={{LOGO_REV}}" />
  <!-- Theme is read from localStorage *before* paint to avoid the
       dark→light flash on every navigation. Falls back to the OS
       preference and finally to dark. -->
@@ -32,8 +32,8 @@
 <body>
 <div class="shell">
  <aside class="sidebar">
-    <div class="brand">
+    <div class="{{BRAND_CLASS}}">
-      <img src="/assets/logo.svg?v={{ASSET_VERSION}}" alt="OpenPXE" />
+      <img src="/assets/logo.svg?v={{ASSET_VERSION}}&r={{LOGO_REV}}" alt="OpenPXE" />
      <strong>OpenPXE</strong>
    </div>
    <nav>
@@ -17,11 +17,34 @@
 ///   when we know the new one is incompatible. Combined with
 ///   `Cache-Control: no-cache, must-revalidate` on the asset handlers,
 ///   the worst-case caching window is one version.
 /// * `logo_rev` is appended to the brand-mark and favicon URLs as an
 ///   extra `&r=…` token. Unlike `asset_version` it changes every time
 ///   the operator swaps the custom logo, so the top-left mark updates
 ///   immediately on the next page load instead of being pinned to the
 ///   release version (which only changes on upgrade). `index.html`
 ///   itself is served `no-cache`, so the fresh token lands as soon as
 ///   the operator reloads after an upload.
 /// * `has_custom_logo` switches the sidebar brand block between the
 ///   bundled mark + "OpenPXE" wordmark (false) and a FleetDM-style
 ///   full-width custom logo with the wordmark hidden (true). Rendered
 ///   server-side so there's no flash of the default mark before JS runs.
 #[must_use]
-pub fn index_html(base_url: &str, asset_version: &str) -> String {
+pub fn index_html(
    base_url: &str,
    asset_version: &str,
    logo_rev: u64,
    has_custom_logo: bool,
 ) -> String {
    let brand_class = if has_custom_logo {
        "brand has-custom-logo"
    } else {
        "brand"
    };
    INDEX_HTML
        .replace("{{BASE_URL}}", base_url)
        .replace("{{ASSET_VERSION}}", asset_version)
        .replace("{{LOGO_REV}}", &logo_rev.to_string())
        .replace("{{BRAND_CLASS}}", brand_class)
 }
 #[must_use]
@@ -17,14 +17,11 @@
 ARG RUST_VERSION=1.95
 ########## fetch iPXE binaries + wimboot ##########
-# v0.4.62: kept on the boot.ipxe.org pre-builds for the moment. We
+# Pulls the upstream boot.ipxe.org pre-builds (no PNG support) plus
-# want PNG support (so `console --picture` paints the operator's logo
+# wimboot. These cover the arches we don't build from source here:
-# on the PXE menu) but the obvious path — adding a new `ipxe-build`
+# BIOS undionly.kpxe and i386-efi (which need a 32-bit x86 toolchain),
-# stage that compiles iPXE from source with `IMAGE_PNG` enabled —
+# and serve as the baseline that the PNG-enabled x86_64/arm64 UEFI
-# runs into a QEMU/gcc instability when cross-emulating x86_64 on
+# binaries from the `ipxe-build` stage overlay on top of.
 # arm64 build hosts (intermittent `cc1` segfaults). The compositor
 # at /branding/pxe-logo is already wired so when the iPXE rebuild
 # lands (on native x86_64 hardware), no other code change is needed.
 FROM debian:12-slim AS fetch
 RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates \
 && rm -rf /var/lib/apt/lists/*
@@ -32,6 +29,36 @@ WORKDIR /src
 COPY scripts/fetch-ipxe.sh scripts/fetch-ipxe.sh
 RUN mkdir -p assets/ipxe && bash scripts/fetch-ipxe.sh
 ########## build PNG-enabled iPXE from source ##########
 # v0.4.69: THE graphical-boot-menu unlock. iVentoy paints a PNG
 # background on the PXE screen using stock iPXE built with
 # CONSOLE_FRAMEBUFFER + IMAGE_PNG + CONSOLE_CMD; the public iPXE
 # binaries omit those, so `console --picture` is a no-op on them.
 # We build our own from upstream with that thin config delta.
 #
 # The historical blocker was cc1 segfaulting when an amd64 gcc ran
 # under QEMU emulation on an arm64 host. The fix: pin this stage to
 # $BUILDPLATFORM (the NATIVE builder arch — arm64 on an Apple-Silicon
 # Mac, amd64 in x86 CI) and cross-compile with a real cross toolchain
 # (CROSS_COMPILE=x86_64-linux-gnu-). The compiler runs native and
 # emits x86_64 — no emulation, no segfault. arm64-efi builds natively.
 FROM --platform=$BUILDPLATFORM debian:12-slim AS ipxe-build
 # libc6-dev is REQUIRED and easy to miss under --no-install-recommends:
 # iPXE's host utilities (elf2efi, zbin) compile with the native gcc and
 # pull <stdint.h>; without the native libc headers gcc's #include_next
 # falls through to iPXE's freestanding headers and dies on bits/stdint.h.
 # The target (iPXE firmware) code is -ffreestanding/-nostdinc, so the
 # x86_64 cross toolchain needs NO cross libc headers.
 RUN apt-get update && apt-get install -y --no-install-recommends \
        git make perl gcc binutils libc6-dev \
        gcc-x86-64-linux-gnu binutils-x86-64-linux-gnu \
        ca-certificates \
 && rm -rf /var/lib/apt/lists/*
 WORKDIR /src
 COPY scripts/build-ipxe.sh scripts/build-ipxe.sh
 COPY deploy/ipxe/local/ deploy/ipxe/local/
 RUN mkdir -p assets/ipxe && bash scripts/build-ipxe.sh /src/assets/ipxe
 ########## build openpxe ##########
 FROM rust:${RUST_VERSION}-bookworm AS build
 WORKDIR /src
@@ -64,7 +91,14 @@ RUN apt-get update \
 # `cargo build`, which is slow and can exhaust small Colima/CI disks.
 COPY Cargo.toml Cargo.lock ./
 COPY crates/ crates/
 # Baseline binaries (BIOS / i386 / wimboot), then overlay the
 # PNG-enabled x86_64 + arm64 UEFI binaries built from source. The
 # overlay wins for snponly.efi / ipxe.efi / snponly-arm64.efi so the
 # common modern clients get the graphical background; the rest keep the
 # upstream no-PNG binaries and the menu's `|| console` text fallback.
 COPY --from=fetch /src/assets/ipxe /src/assets/ipxe
 COPY --from=ipxe-build /src/assets/ipxe/snponly.efi /src/assets/ipxe/snponly.efi
 COPY --from=ipxe-build /src/assets/ipxe/ipxe.efi /src/assets/ipxe/ipxe.efi
 # Cache cargo registry + target across builds. The mtime touch is
 # belt-and-suspenders: cargo occasionally misses mtime-only changes on
@@ -0,0 +1,14 @@
 /*
 * OpenPXE iPXE build override — console options.
 *
 * Included at the end of config/console.h. CONSOLE_FRAMEBUFFER is the
 * unified graphical framebuffer console (EFI GOP on UEFI, VESA on
 * BIOS); it's what `console --picture` paints into. This is the same
 * single flag iVentoy enables for its graphical PXE screen.
 *
 * We *add* the framebuffer console rather than replacing the default
 * EFI/BIOS text consoles, so text output still works before/after the
 * picture is set.
 */
 #define CONSOLE_FRAMEBUFFER
@@ -0,0 +1,23 @@
 /*
 * OpenPXE iPXE build override — general options.
 *
 * iPXE includes <config/local/general.h> at the end of config/general.h,
 * so anything defined here is layered on top of the stock defaults
 * without editing upstream files. We enable exactly the features the
 * graphical PXE boot menu needs:
 *
 *   IMAGE_PNG    - PNG decoder, so `console --picture <png>` can paint
 *                  the operator's logo / OpenPXE background.
 *   IMAGE_PNM    - Netpbm decoder (cheap; harmless belt-and-suspenders).
 *   CONSOLE_CMD  - the `console` command itself. Without it you get
 *                  "console: command not found" even with a framebuffer.
 *
 * (CONSOLE_FRAMEBUFFER lives in config/local/console.h.)
 *
 * Everything else stays at upstream defaults — we are intentionally a
 * thin, auditable delta over stock iPXE so the UBDL/GPL story is simple.
 */
 #define IMAGE_PNG
 #define IMAGE_PNM
 #define CONSOLE_CMD
@@ -0,0 +1,74 @@
 #!/usr/bin/env bash
 # Build PNG-enabled iPXE binaries from source.
 #
 # Why from source: the official boot.ipxe.org binaries (and the
 # Debian-packaged ones) are NOT built with CONSOLE_FRAMEBUFFER +
 # IMAGE_PNG + CONSOLE_CMD, so `console --picture` is a no-op on them —
 # you can't paint a graphical boot-menu background. iVentoy solves this
 # by shipping its own iPXE build with exactly those three flags; we do
 # the same, from upstream iPXE, with a thin auditable config delta
 # (deploy/ipxe/local/{general,console}.h).
 #
 # Why a real cross-compiler instead of QEMU: building amd64 iPXE by
 # emulating an amd64 gcc under QEMU on an arm64 host intermittently
 # segfaults cc1 (the reason this was stuck for ~8 releases). Running a
 # NATIVE arm64 gcc that cross-targets x86_64 (CROSS_COMPILE=
 # x86_64-linux-gnu-) sidesteps emulation entirely — the compiler is a
 # native binary, it just emits x86_64 objects. This stage is meant to
 # run on $BUILDPLATFORM (the native builder arch), NOT the emulated
 # target platform.
 #
 # Outputs (into $DEST), using the filenames OpenPXE's arch mapping
 # expects:
 #   snponly.efi   x86_64 UEFI, PNG-enabled
 #   ipxe.efi      x86_64 UEFI, PNG-enabled (bundled drivers)
 #
 # We build ONLY x86_64 UEFI, always via the x86_64 cross toolchain
 # (`x86_64-linux-gnu-gcc`). That's deliberately host-arch-agnostic: it
 # works whether this stage runs on an arm64 Mac builder or an amd64 CI
 # runner, because the cross compiler runs native and emits x86_64
 # either way. Building arm64-efi or BIOS here would re-introduce a
 # dependency on the host arch (native arm64 build) or a 32-bit multilib
 # toolchain — so those arches keep their upstream-fetched (no-PNG)
 # binaries and fall back to the menu's clean `|| console` text screen.
 # Modern PXE clients are overwhelmingly x86_64 UEFI, which get the full
 # graphical background.
 set -euo pipefail
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 DEST="${1:-$ROOT/assets/ipxe}"
 WORK="$(mktemp -d)"
 trap 'rm -rf "$WORK"' EXIT
 # Pinned upstream iPXE. Rolling master is fine functionally, but a pin
 # keeps builds reproducible and protects against a transient master
 # breakage. Bump deliberately.
 IPXE_REPO="https://github.com/ipxe/ipxe.git"
 IPXE_REF="${IPXE_REF:-master}"
 echo ">> cloning iPXE ($IPXE_REF)"
 git clone --depth 1 --branch "$IPXE_REF" "$IPXE_REPO" "$WORK/ipxe" 2>/dev/null \
  || git clone "$IPXE_REPO" "$WORK/ipxe"
 SRC="$WORK/ipxe/src"
 echo ">> applying OpenPXE config overrides (PNG + framebuffer + console cmd)"
 mkdir -p "$SRC/config/local"
 cp "$ROOT/deploy/ipxe/local/general.h" "$SRC/config/local/general.h"
 cp "$ROOT/deploy/ipxe/local/console.h" "$SRC/config/local/console.h"
 mkdir -p "$DEST"
 # x86_64 UEFI — cross-compiled with the native arm64 gcc targeting
 # x86_64. HOST_CC stays the native cc for iPXE's build-time utilities
 # (elf2efi, zbin, …); only the target objects use the cross compiler.
 echo ">> building x86_64 UEFI (snponly.efi, ipxe.efi)"
 make -C "$SRC" -j"$(nproc)" \
  CROSS_COMPILE=x86_64-linux-gnu- \
  bin-x86_64-efi/snponly.efi \
  bin-x86_64-efi/ipxe.efi
 cp "$SRC/bin-x86_64-efi/snponly.efi" "$DEST/snponly.efi"
 cp "$SRC/bin-x86_64-efi/ipxe.efi"    "$DEST/ipxe.efi"
 echo ">> iPXE build complete:"
 ls -l "$DEST"/snponly.efi "$DEST"/ipxe.efi