v0.4.69: PNG boot-menu background (iPXE built from source), NFS AUTH_SYS, FleetDM logo

Three things, headlined by the long-blocked graphical PXE menu.

## 1. Graphical PXE boot background — the iVentoy feature, finally

iVentoy paints a PNG background on the PXE screen using stock iPXE
built with CONSOLE_FRAMEBUFFER + IMAGE_PNG + CONSOLE_CMD; the public
iPXE binaries omit those, so `console --picture` is a no-op on them.
We now build our own iPXE from upstream with that thin config delta
(deploy/ipxe/local/{general,console}.h).

The 8-release blocker was cc1 segfaulting when an amd64 gcc ran under
QEMU emulation on the arm64 build host. Fix: a new `ipxe-build`
Dockerfile stage pinned to $BUILDPLATFORM (native arch — no emulation)
that cross-compiles x86_64 iPXE with CROSS_COMPILE=x86_64-linux-gnu-.
The compiler runs native and emits x86_64. Validated end-to-end:
png.o + fbcon.o + pixbuf.o all compile and link (confirmed via the
linked-ELF symbol table, not just strings), ~112s, no segfault. Host
tools needed libc6-dev (dropped by --no-install-recommends; without
it the native host compile falls through to iPXE's freestanding
headers and dies on bits/stdint.h — fixed).

Server side:
- pxe_logo.rs is now a full-screen background compositor: a dark field
  (matching the WebUI theme) with the operator's uploaded logo across
  the top, or — with no upload — a default OpenPXE rainbow disc drawn
  with pure pixel math (no font/SVG deps). Always 1024x768 (iPXE
  doesn't scale; this is the universal mode). WebP/JPEG/GIF/PNG in,
  PNG out (iPXE only eats PNG).
- /branding/pxe-logo always returns a PNG now (default when no logo,
  default when SVG) so the menu always has a background.
- render_menu uses `console --picture … --top 290 || console`: paints
  the background and reserves the logo band on PNG-capable binaries
  (x86_64 UEFI), cleanly falls back to text on the others. The ASCII
  wordmark is GONE.

Only x86_64 UEFI is built from source (host-arch-agnostic cross build);
BIOS/i386/arm64 keep upstream-fetched no-PNG binaries + text fallback.
Modern clients are overwhelmingly x86_64 UEFI.

## 2. NFS AUTH_SYS credential — fixes NFS3ERR_ACCES

v0.4.68's privileged-port fix got past MNT3ERR_ACCES (mount); operators
then hit NFS3ERR_ACCES on READDIR because nfs3_client defaults to
AUTH_NONE and virtually every server exports sec=sys. We now present an
AUTH_UNIX credential (uid 0 / gid 0): no_root_squash servers treat us
as root, root_squash servers map us to anon which reads any
world-readable ISO share. Kept fixed (no UI knob) to stay dead-simple.
Hint updated: a remaining NFS3ERR_ACCES is now a server-side
permission/squash issue, not IP/auth-flavor.

## 3. FleetDM-style full-width logo (top-left)

When a custom logo is uploaded the sidebar header drops the bundled
mark + "OpenPXE" wordmark and lets the logo span the header
(left-aligned, capped 200x50, contain). Rendered server-side via a
brand-class in index_html (has_custom_logo) so there's no flash of the
default. The bundled-default case is unchanged.

Tests: 164 passing. clippy -D warnings clean. iPXE build stage
validated in isolation before the full image build.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Cargo.lock

@@ -1171,7 +1171,7 @@ checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
 
 [[package]]
 name = "openpxe"
-version = "0.4.67"
+version = "0.4.69"
 dependencies = [
  "anyhow",
  "axum",
@@ -1193,7 +1193,7 @@ dependencies = [
 
 [[package]]
 name = "openpxe-core"
-version = "0.4.67"
+version = "0.4.69"
 dependencies = [
  "anyhow",
  "bcrypt",
@@ -1212,7 +1212,7 @@ dependencies = [
 
 [[package]]
 name = "openpxe-dhcp-proxy"
-version = "0.4.67"
+version = "0.4.69"
 dependencies = [
  "anyhow",
  "bytes",
@@ -1226,7 +1226,7 @@ dependencies = [
 
 [[package]]
 name = "openpxe-http-api"
-version = "0.4.67"
+version = "0.4.69"
 dependencies = [
  "anyhow",
  "axum",
@@ -1257,7 +1257,7 @@ dependencies = [
 
 [[package]]
 name = "openpxe-ipxe-assets"
-version = "0.4.67"
+version = "0.4.69"
 dependencies = [
  "openpxe-core",
  "rust-embed",
@@ -1267,7 +1267,7 @@ dependencies = [
 
 [[package]]
 name = "openpxe-iso-store"
-version = "0.4.67"
+version = "0.4.69"
 dependencies = [
  "anyhow",
  "bcrypt",
@@ -1294,7 +1294,7 @@ dependencies = [
 
 [[package]]
 name = "openpxe-tftp"
-version = "0.4.67"
+version = "0.4.69"
 dependencies = [
  "anyhow",
  "bytes",
@@ -1308,7 +1308,7 @@ dependencies = [
 
 [[package]]
 name = "openpxe-webui"
-version = "0.4.67"
+version = "0.4.69"
 
 [[package]]
 name = "parking_lot"

Cargo.toml

@@ -12,7 +12,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.4.67"
+version = "0.4.69"
 edition = "2021"
 rust-version = "1.95"
 license = "MIT OR Apache-2.0"

crates/core/src/branding.rs

@@ -44,6 +44,14 @@ struct Inner {
     /// MIME of the active logo, mirroring `logo_filename`. Cached here
     /// so the HTTP layer can set Content-Type without re-sniffing.
     logo_mime: Option<String>,
+    /// Monotonic counter bumped on every set/clear. Surfaces as a
+    /// cache-bust token (`/assets/logo.svg?r=<rev>`) so the browser
+    /// fetches the new bytes the moment the operator swaps the logo —
+    /// the app version alone can't do this since it doesn't change on
+    /// upload. Persisted so the token stays stable across restarts and
+    /// keeps climbing across multiple swaps.
+    #[serde(default)]
+    rev: u64,
 }
 
 /// In-memory + on-disk override registry. Cheap to clone; locks are
@@ -150,6 +158,7 @@ impl BrandingStore {
             let mut g = self.inner.write();
             g.logo_filename = Some(filename.clone());
             g.logo_mime = Some(mime.to_string());
+            g.rev = g.rev.wrapping_add(1);
         }
         self.persist();
         tracing::info!(
@@ -166,6 +175,7 @@ impl BrandingStore {
             let mut g = self.inner.write();
             let removed = g.logo_filename.take();
             g.logo_mime = None;
+            g.rev = g.rev.wrapping_add(1);
             removed
         };
         if let Some(name) = removed {
@@ -185,6 +195,14 @@ impl BrandingStore {
         self.inner.read().logo_filename.is_some()
     }
 
+    /// Cache-bust token for the logo asset URL. Changes on every
+    /// set/clear so `/assets/logo.svg?r=<rev>` resolves to a fresh URL
+    /// whenever the operator swaps the brand mark. Stable otherwise.
+    #[must_use]
+    pub fn logo_rev(&self) -> u64 {
+        self.inner.read().rev
+    }
+
     fn persist(&self) {
         let snap = self.inner.read().clone();
         let body = match serde_json::to_vec_pretty(&snap) {
@@ -292,6 +310,23 @@ mod tests {
         assert!(!entries.iter().any(|n| n == "logo.png"), "stale PNG left over: {entries:?}");
     }
 
+    #[test]
+    fn logo_rev_bumps_on_each_set_and_clear() {
+        let dir = tempdir().unwrap();
+        let b = BrandingStore::load_or_default(dir.path());
+        assert_eq!(b.logo_rev(), 0);
+        b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake").unwrap();
+        assert_eq!(b.logo_rev(), 1);
+        b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake2").unwrap();
+        assert_eq!(b.logo_rev(), 2);
+        b.clear_logo().unwrap();
+        assert_eq!(b.logo_rev(), 3);
+        // Survives a restart.
+        drop(b);
+        let b2 = BrandingStore::load_or_default(dir.path());
+        assert_eq!(b2.logo_rev(), 3);
+    }
+
     #[test]
     fn sanitize_ext_strips_separators_and_path_chars() {
         assert_eq!(sanitize_ext("svg"), "svg");
@@ -319,6 +354,7 @@ mod tests {
         let inner = Inner {
             logo_filename: Some("logo.png".into()),
             logo_mime: Some("image/png".into()),
+            rev: 0,
         };
         std::fs::write(
             brand_dir.join("branding.json"),

crates/http-api/src/app.rs

@@ -208,7 +208,15 @@ async fn index(State(state): State<AppState>) -> Response {
     // browsers re-fetch JS/CSS after an upgrade. We use the OpenPXE
     // binary version — every release ships a new value, every release
     // forces a fresh URL on each asset.
-    let html = openpxe_webui::index_html(&state.public_base_url, env!("CARGO_PKG_VERSION"));
+    // logo_rev cache-busts the brand mark / favicon independently of
+    // the release version, so an operator who swaps the custom logo
+    // sees it update on the next reload without waiting for an upgrade.
+    let html = openpxe_webui::index_html(
+        &state.public_base_url,
+        env!("CARGO_PKG_VERSION"),
+        state.branding.logo_rev(),
+        state.branding.has_logo(),
+    );
     (
         [
             (
@@ -311,66 +319,62 @@ async fn ui_logo(State(state): State<AppState>) -> Response {
         .into_response()
 }
 
-/// v0.4.61: PXE menu logo composed for the iPXE `console --picture`
+/// PXE boot-menu background, composed for the iPXE `console --picture`
-/// call. The operator can upload any raster image (PNG / JPEG / WebP /
+/// call. Returns a full-screen 1024×768 PNG: a dark field with the
-/// GIF) of any aspect ratio; this handler decodes it, draws it
+/// operator's uploaded logo across the top, or — when no logo is set —
-/// centered-top onto a fixed 1024×768 canvas, and returns PNG bytes.
+/// a default OpenPXE mark on the same dark field. Either way the
-/// That gives the same look as iVentoy regardless of what the operator
+/// endpoint *always* returns a valid PNG so the menu's `console
-/// uploaded — a portrait logo, a wide wordmark, a square monogram all
+/// --picture` paints a real background instead of falling through to
-/// land in the same place on the boot screen.
+/// bare text (v0.4.69 — replaces the old ASCII wordmark).
 ///
-/// SVG uploads still 404 here — iPXE can't rasterize SVG, and rather
+/// Any raster the operator uploads (PNG / JPEG / WebP / GIF) is decoded
-/// than haul in `resvg` we ask the operator to provide a raster when
+/// and transcoded to PNG here, since iPXE only consumes PNG. SVG
-/// they want a custom PXE-side logo. (The WebUI keeps using the SVG.)
+/// uploads can't be rasterized without hauling in `resvg`, so an SVG
+/// brand mark falls back to the *default* background for the PXE screen
+/// (the WebUI still renders the SVG natively in the top-left).
 async fn ui_pxe_logo(State(state): State<AppState>) -> Response {
-    let Some(path) = state.branding.logo_path() else {
+    // Resolve the operator's raster upload, if any and if it's a format
-        return (StatusCode::NOT_FOUND, "no custom logo configured").into_response();
+    // iPXE/our compositor can consume. SVG (or a missing/unreadable
-    };
+    // file) yields `None`, which composes the default background.
-    let Some(mime) = state.branding.logo_mime() else {
+    let raster: Option<Vec<u8>> = match (state.branding.logo_path(), state.branding.logo_mime()) {
-        return (StatusCode::NOT_FOUND, "no mime recorded").into_response();
+        (Some(path), Some(mime)) if mime != "image/svg+xml" => {
-    };
+            tokio::fs::read(&path).await.ok()
-    if mime == "image/svg+xml" {
-        return (
-            StatusCode::NOT_FOUND,
-            "operator-uploaded logo is SVG; PXE menu requires a raster (PNG / JPEG / WebP / GIF)",
-        )
-            .into_response();
-    }
-    let bytes = match tokio::fs::read(&path).await {
-        Ok(b) => b,
-        Err(e) => {
-            return (
-                StatusCode::NOT_FOUND,
-                format!("custom logo unreadable: {e}"),
-            )
-                .into_response();
         }
+        _ => None,
     };
-    // Compose to a fixed 1024×768 PNG so the PXE menu paints the logo
+
-    // centered-top regardless of the operator's source dimensions. The
+    let composed = match tokio::task::spawn_blocking(move || {
-    // `image` crate is pure-Rust + sync; offload to a blocking task
+        openpxe_iso_store::pxe_logo::compose_pxe_background(raster.as_deref())
-    // because Lanczos resampling on a 4K source can take tens of
+    })
-    // milliseconds and we don't want to block the executor.
-    let composed =
-        match tokio::task::spawn_blocking(move || openpxe_iso_store::pxe_logo::compose_pxe_logo(&bytes))
     .await
     {
         Ok(Ok(png)) => png,
         Ok(Err(e)) => {
+            // A decode failure on the operator's upload shouldn't blank
+            // the boot screen — fall back to the default background.
             tracing::warn!(
                 target: "openpxe::http::branding",
-                    error = %e, "failed to compose PXE logo PNG"
+                error = %e, "PXE background compose failed on upload; using default"
             );
+            match tokio::task::spawn_blocking(|| {
+                openpxe_iso_store::pxe_logo::compose_pxe_background(None)
+            })
+            .await
+            {
+                Ok(Ok(png)) => png,
+                _ => {
                     return (
                         StatusCode::INTERNAL_SERVER_ERROR,
-                    format!("failed to compose PXE logo: {e}"),
+                        "failed to compose PXE background",
                     )
                         .into_response();
                 }
+            }
+        }
         Err(e) => {
             return (
                 StatusCode::INTERNAL_SERVER_ERROR,
-                    format!("pxe-logo task failed: {e}"),
+                format!("pxe-background task failed: {e}"),
             )
                 .into_response();
         }
@@ -378,7 +382,12 @@ async fn ui_pxe_logo(State(state): State<AppState>) -> Response {
     (
         [
             (header::CONTENT_TYPE, HeaderValue::from_static("image/png")),
-            (header::CACHE_CONTROL, ASSET_CACHE_CONTROL),
+            // No-cache so a freshly uploaded logo paints on the next
+            // boot without a stale composite lingering.
+            (
+                header::CACHE_CONTROL,
+                HeaderValue::from_static("no-cache, max-age=0"),
+            ),
         ],
         composed,
     )

crates/http-api/src/ipxe_script.rs

@@ -30,14 +30,15 @@ use std::fmt::Write as _;
 /// Top-level OpenPXE boot menu. Serialized identically for BIOS and UEFI
 /// clients because iPXE normalises the menu primitives across firmwares.
 ///
-/// v0.4.6: rendered with an iVentoy-style polished frame — centered
+/// v0.4.69: rendered with an iVentoy-style graphical frame — a
-/// OpenPXE wordmark banner at the top (ASCII so every iPXE build can
+/// `console --picture` directive paints a full-screen PNG background
-/// paint it), a footer carrying version + arch + firmware kind, and an
+/// (the operator's uploaded logo on a dark field, or the default
-/// optional `console --picture` directive that paints the operator's
+/// OpenPXE mark) with the menu text overlaid below a reserved top
-/// uploaded raster logo on top when the iPXE binary on the wire was
+/// margin, plus a footer carrying version + arch + firmware kind. On
-/// built with PNG support. The ASCII banner is always rendered so
+/// iPXE binaries built with `IMAGE_PNG` + `CONSOLE_FRAMEBUFFER` (our
-/// even when the picture call no-ops the screen still reads as
+/// x86_64 UEFI binaries, compiled from source) the background paints;
-/// "OpenPXE — here is the menu" rather than a featureless box.
+/// on binaries without PNG support the `|| console` fallback yields a
+/// clean text menu. The old ASCII wordmark has been removed.
 #[must_use]
 pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> String {
     let mut s = String::new();
@@ -56,14 +57,20 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
     let _ = writeln!(s, "set base-url {base}");
     let _ = writeln!(s, "set esc:hex 1b");
     let _ = writeln!(s, "set cls ${{esc:string}}[2J");
-    // v0.4.6: best-effort graphics console with the operator-uploaded
+    // v0.4.69: graphical background. `/branding/pxe-logo` always
-    // raster logo. Falls back to plain text console on iPXE builds
+    // returns a full-screen 1024×768 PNG now — the operator's logo on a
-    // without PNG support — the `||` chain keeps a parse-clean
+    // dark field, or a default OpenPXE mark when none is uploaded. The
-    // single-statement form so even the strictest iPXE parsers accept
+    // `--top 290` reserves the top band (where the logo paints) so the
-    // it. The `console` reset at the end re-syncs the menu output.
+    // menu text lands below it. On an iPXE build *with* `IMAGE_PNG` +
+    // `CONSOLE_FRAMEBUFFER` (our x86_64 UEFI binaries, built from source
+    // — see deploy/docker/Dockerfile) this paints the background and
+    // overlays the menu. On a build *without* PNG support (the fetched
+    // BIOS/i386/arm64 binaries) the whole `console --picture …` command
+    // fails and the `|| console` resets to a clean full-screen text
+    // menu. Either way there's no ASCII placeholder anymore.
     let _ = writeln!(
         s,
-        "console --picture {base}/branding/pxe-logo || console"
+        "console --picture {base}/branding/pxe-logo --top 290 || console"
     );
     // Map iPXE's ${{buildarch}} + ${{platform}} into the human form the
     // user asked for (e.g. "x86 BIOS", "x86_64 UEFI", "arm64 UEFI").
@@ -77,19 +84,8 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
     );
     let _ = writeln!(s, ":menu");
     let _ = writeln!(s, "menu OpenPXE - network boot menu");
-    // ASCII OpenPXE wordmark. Works on every iPXE build, including
+    // v0.4.69: the ASCII wordmark is gone — the graphical background
-    // the boot.ipxe.org pre-builds we ship (which omit `IMAGE_PNG`,
+    // (set via `console --picture` above) carries the branding now.
-    // so `console --picture` paints nothing). When the queued iPXE
-    // source-build lands and the operator's uploaded raster actually
-    // paints via `console --picture`, this banner can be retired in
-    // favour of the real image. The compositor at
-    // /branding/pxe-logo is already wired and waiting.
-    let _ = writeln!(s, "item --gap");
-    let _ = writeln!(s, "item --gap --       ___                   ___  __  __ ___");
-    let _ = writeln!(s, "item --gap --      / _ \\ _ __  ___ _ _   | _ \\ \\/  / | __|");
-    let _ = writeln!(s, "item --gap --     | (_) | '_ \\/ -_) ' \\  |  _/  \\  /  | _|");
-    let _ = writeln!(s, "item --gap --      \\___/| .__/\\___|_||_| |_|    /_/\\_\\ |___|");
-    let _ = writeln!(s, "item --gap --           |_|");
     let _ = writeln!(s, "item --gap");
     let _ = writeln!(
         s,
@@ -631,27 +627,29 @@ mod password_tests {
 
     #[test]
     fn top_menu_has_polished_branding_and_arch_footer() {
-        // v0.4.6 polish + v0.4.62 stability fixes: the menu emits a
+        // v0.4.69: the menu emits a `console --picture` line that paints
-        // `console --picture` line that PNG-capable iPXE builds will
+        // a full-screen PNG background (the operator's logo, or the
-        // honour (queued for a follow-up release once we can rebuild
+        // default OpenPXE mark) reserving a top margin for it, then
-        // iPXE from source on native x86_64 hardware), an ASCII
+        // falls back to a clean text console on iPXE builds without PNG
-        // OpenPXE wordmark that works on every iPXE build (including
+        // support. The ASCII wordmark is gone — the graphical
-        // the boot.ipxe.org pre-builds we currently ship), and a
+        // background carries the branding now. A single-line footer
-        // single-line footer carrying the OpenPXE version + arch.
+        // still carries the OpenPXE version + arch.
         let settings = Settings::default();
         let s = render_menu(&[], &settings, "http://10.0.0.5");
         assert!(
             s.contains("console --picture http://10.0.0.5/branding/pxe-logo"),
             "missing console --picture line:\n{s}"
         );
+        // The picture call reserves a top margin for the logo band.
+        assert!(s.contains("--top 290"), "missing --top margin:\n{s}");
         // Picture-or-text-console must be a single statement so older
         // iPXE parsers don't choke on the chain.
         assert!(s.contains("|| console"), "missing graceful fallback:\n{s}");
-        // ASCII wordmark — paints on every iPXE build regardless of
+        // The ASCII wordmark must be GONE — its removal is the whole
-        // PNG support.
+        // point of v0.4.69's graphical background.
         assert!(
-            s.contains("___                   ___  __  __ ___"),
+            !s.contains("___                   ___  __  __ ___"),
-            "ASCII banner missing first row:\n{s}"
+            "ASCII banner should have been removed:\n{s}"
         );
         // Footer with version + arch interpolation. The version comes
         // from CARGO_PKG_VERSION at compile time.

crates/http-api/tests/full_flow.rs

@@ -1832,13 +1832,39 @@ async fn docs_lists_new_v0_4_5_endpoints() {
 // ─── v0.4.6: PXE logo endpoint ────────────────────────────────────────────
 
 #[tokio::test]
-async fn pxe_logo_404_when_no_custom_logo_configured() {
+async fn pxe_background_serves_default_when_no_custom_logo() {
+    // v0.4.69: the endpoint always returns a full-screen PNG background
+    // now — when no custom logo is configured it composes the default
+    // OpenPXE mark on a dark field rather than 404ing. This is what lets
+    // the PXE menu's `console --picture` paint a real background instead
+    // of falling back to the (now-removed) ASCII placeholder.
     let (state, _dir) = build_state().await;
     let app = build_router(state);
-    let (s, body) = get(&app, "/branding/pxe-logo").await;
+    let res = app
-    assert_eq!(s, StatusCode::NOT_FOUND);
+        .clone()
-    let text = std::str::from_utf8(&body).unwrap();
+        .oneshot(
-    assert!(text.contains("no custom logo"), "got: {text}");
+            Request::builder()
+                .uri("/branding/pxe-logo")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(res.status(), StatusCode::OK);
+    assert_eq!(
+        res.headers()
+            .get(axum::http::header::CONTENT_TYPE)
+            .unwrap()
+            .to_str()
+            .unwrap(),
+        "image/png"
+    );
+    let body = axum::body::to_bytes(res.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    assert!(body.starts_with(b"\x89PNG"), "default background not a PNG");
+    let width = u32::from_be_bytes([body[16], body[17], body[18], body[19]]);
+    assert_eq!(width, 1024, "default background should be 1024 wide");
 }
 
 /// Build a tiny valid PNG via the `image` crate. The v0.4.61 PXE-logo
@@ -1857,10 +1883,11 @@ fn tiny_png() -> Vec<u8> {
 }
 
 #[tokio::test]
-async fn pxe_logo_404_when_uploaded_logo_is_svg() {
+async fn pxe_background_falls_back_to_default_for_svg_upload() {
-    // iPXE can't rasterize SVG, so an SVG upload deliberately doesn't
+    // iPXE can't rasterize SVG, so an SVG upload doesn't paint as the
-    // light up the PXE menu's `console --picture` overlay — the menu
+    // PXE background — but v0.4.69 still returns the *default* OpenPXE
-    // simply paints without a logo.
+    // background PNG (not a 404) so the boot screen stays graphical.
+    // The WebUI top-left continues to render the SVG natively.
     let (state, _dir) = build_state().await;
     state
         .branding
@@ -1871,10 +1898,23 @@ async fn pxe_logo_404_when_uploaded_logo_is_svg() {
         )
         .unwrap();
     let app = build_router(state);
-    let (s, body) = get(&app, "/branding/pxe-logo").await;
+    let res = app
-    assert_eq!(s, StatusCode::NOT_FOUND);
+        .clone()
-    let text = std::str::from_utf8(&body).unwrap();
+        .oneshot(
-    assert!(text.contains("SVG"), "got: {text}");
+            Request::builder()
+                .uri("/branding/pxe-logo")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(res.status(), StatusCode::OK);
+    let body = axum::body::to_bytes(res.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    assert!(body.starts_with(b"\x89PNG"), "should serve default PNG for SVG");
+    let width = u32::from_be_bytes([body[16], body[17], body[18], body[19]]);
+    assert_eq!(width, 1024);
 }
 
 #[tokio::test]

crates/iso-store/src/nfs_share.rs

@@ -66,6 +66,7 @@ use nfs3_types::nfs3::{
     self as nfs3, diropargs3, entry3, filename3, nfs_fh3, GETATTR3args, LOOKUP3args,
     Nfs3Result, READ3args, READDIR3args,
 };
+use nfs3_types::rpc::{auth_unix, opaque_auth};
 use nfs3_types::xdr_codec::Opaque;
 use openpxe_core::{Error, Result};
 use parking_lot::Mutex;
@@ -510,10 +511,9 @@ async fn list_isos(
     export: &str,
     port: u16,
 ) -> std::result::Result<Vec<NfsListEntry>, NfsClientError> {
-    let mut conn =
+    // build_connection applies its own per-attempt timeout (privileged
-        tokio::time::timeout(CONNECT_TIMEOUT, build_connection(server, export, port))
+    // source port first, then a non-privileged fallback).
-            .await
+    let mut conn = build_connection(server, export, port).await?;
-            .map_err(|_| NfsClientError::Timeout(server.to_string(), port))??;
 
     let root = conn.root_nfs_fh3();
     let mut entries = Vec::new();
@@ -610,10 +610,7 @@ async fn stream_loop(
     max_len: Option<u64>,
     tx: tokio::sync::mpsc::Sender<std::io::Result<Bytes>>,
 ) -> std::result::Result<(), NfsClientError> {
-    let mut conn =
+    let mut conn = build_connection(server, export, port).await?;
-        tokio::time::timeout(CONNECT_TIMEOUT, build_connection(server, export, port))
-            .await
-            .map_err(|_| NfsClientError::Timeout(server.to_string(), port))??;
 
     let root = conn.root_nfs_fh3();
     // Look up the file to get its handle.
@@ -686,13 +683,30 @@ async fn stream_loop(
     Ok(())
 }
 
-/// Hand the connection builder the user's settings. `mount_path` is
+/// Mount the export and return a live connection.
-/// the server-side export (e.g. "/srv/isos"). We disable
+///
-/// `connect_from_privileged_port` because the openpxe process runs
+/// ## Privileged source port (the v0.4.68 fix)
-/// as uid 10001 and can't bind sub-1024 source ports — and most
+///
-/// modern NFS servers no longer require them anyway. If a server
+/// Linux kernel `nfsd` — which is what UniFi UNAS, Synology, TrueNAS,
-/// does demand it the operator's hint will guide them to the
+/// and essentially every appliance NAS runs underneath — exports with
-/// `insecure` export option.
+/// the `secure` option **by default**. `secure` means the server only
+/// accepts MOUNT3 / NFS3 requests whose TCP **source** port is in the
+/// privileged range (< 1024). A client connecting from an ephemeral
+/// high port gets `MNT3ERR_ACCES` at mount time — which is exactly the
+/// error operators hit in v0.4.67 even with their host IP correctly in
+/// the export's allow-list.
+///
+/// v0.4.67 disabled privileged source ports because the openpxe
+/// process runs as uid 10001 and "can't bind sub-1024 ports". That
+/// reasoning was wrong: the binary carries `CAP_NET_BIND_SERVICE`
+/// (granted via `setcap` in the Dockerfile so it can bind the DHCP /
+/// TFTP / HTTP low ports as non-root), and that capability also lets
+/// it bind a privileged *source* port for an outbound connection.
+///
+/// So we now try a privileged source port first — the common case for
+/// real NAS appliances — and fall back to a non-privileged port for
+/// servers exported `insecure` (or environments where we genuinely
+/// can't grab a low port). Each attempt gets its own connect timeout.
 async fn build_connection(
     server: &str,
     export: &str,
@@ -701,12 +715,61 @@ async fn build_connection(
     nfs3_client::Nfs3Connection<nfs3_client::tokio::TokioIo<tokio::net::TcpStream>>,
     NfsClientError,
 > {
-    Nfs3ConnectionBuilder::new(TokioConnector, server, export)
+    match connect_once(server, export, port, true).await {
-        .connect_from_privileged_port(false)
+        Ok(conn) => Ok(conn),
+        // A timeout means the server didn't answer at all — a
+        // non-privileged retry would just time out again and double
+        // the operator's wait. Surface the timeout immediately.
+        Err(primary @ NfsClientError::Timeout(..)) => Err(primary),
+        Err(primary) => match connect_once(server, export, port, false).await {
+            Ok(conn) => Ok(conn),
+            // Surface the privileged-attempt error: for the dominant
+            // `secure`-export case it's the one whose hint points at
+            // the real fix.
+            Err(_) => Err(primary),
+        },
+    }
+}
+
+/// One mount attempt with a specific source-port policy, bounded by
+/// [`CONNECT_TIMEOUT`].
+async fn connect_once(
+    server: &str,
+    export: &str,
+    port: u16,
+    privileged: bool,
+) -> std::result::Result<
+    nfs3_client::Nfs3Connection<nfs3_client::tokio::TokioIo<tokio::net::TcpStream>>,
+    NfsClientError,
+> {
+    // v0.4.69: present an AUTH_SYS (AUTH_UNIX) credential instead of
+    // the crate default (AUTH_NONE). This is the fix for the
+    // `NFS3ERR_ACCES` operators hit *after* the v0.4.68 privileged-port
+    // fix got them past the mount: nearly every NFS server exports
+    // `sec=sys` and rejects AUTH_NONE callers on the actual file ops
+    // (READDIR/LOOKUP/READ) even when MOUNT succeeded. We send uid 0 /
+    // gid 0 — a server with `no_root_squash` treats us as root (full
+    // read), and the far more common `root_squash` maps us to the
+    // anonymous user, which can still read any world-readable ISO
+    // share (the normal case). We deliberately keep this fixed rather
+    // than a UI knob: ISO libraries are read-only shared data, and a
+    // uid field is exactly the kind of thing that makes a "dead simple"
+    // tool confusing for an L1 tech.
+    let cred = opaque_auth::auth_unix(&auth_unix {
+        uid: 0,
+        gid: 0,
+        ..Default::default()
+    });
+    let fut = Nfs3ConnectionBuilder::new(TokioConnector, server, export)
+        .connect_from_privileged_port(privileged)
         .nfs3_port(port)
-        .mount()
+        .credential(cred)
-        .await
+        .mount();
-        .map_err(|e| NfsClientError::Connect(e.to_string()))
+    match tokio::time::timeout(CONNECT_TIMEOUT, fut).await {
+        Ok(Ok(conn)) => Ok(conn),
+        Ok(Err(e)) => Err(NfsClientError::Connect(e.to_string())),
+        Err(_) => Err(NfsClientError::Timeout(server.to_string(), port)),
+    }
 }
 
 #[derive(Debug)]
@@ -778,14 +841,43 @@ fn status_label(status: nfs3::nfsstat3) -> String {
 /// transport-level messages from the Rust crate.
 fn hint_for(text: &str) -> Option<String> {
     let s = text.to_ascii_lowercase();
-    if s.contains("nfs3err_acces") || s.contains("permission denied") {
+    if s.contains("mnt3err_acces") || s.contains("mount") && s.contains("acces") {
+        // Mount-protocol access denial. Two common causes, in order of
+        // likelihood for an appliance NAS: (1) the export requires a
+        // privileged source port (`secure`, the Linux default) — we
+        // already retry with one, so reaching here means even that was
+        // refused; (2) the client IP isn't in the allow-list.
         Some(
-            "the NFS server rejected this client. Most likely your export \
+            "the NFS server denied the mount (MNT3ERR_ACCES). Two things to \
-             is restricted by client IP — add this OpenPXE host (or its \
+             check on the server: (1) this OpenPXE host's IP is in the \
-             subnet) to the export's allowed-clients list on the server."
+             export's allowed-clients list, and (2) if your export uses the \
+             default `secure` option, OpenPXE already connects from a \
+             privileged port — but if the server still refuses, add \
+             `insecure` to the export. On UniFi UNAS, confirm the host IP is \
+             listed under the share's NFS permissions and the export path is \
+             /var/nfs/shared/<share> (not just /<share>)."
                 .into(),
         )
-    } else if s.contains("nfs3err_noent") || s.contains("nfs3err_notdir") {
+    } else if s.contains("nfs3err_acces") || s.contains("permission denied") {
+        // The mount succeeded but a file op was denied. OpenPXE
+        // already presents an AUTH_SYS uid-0 credential, so this is a
+        // server-side permission/squash issue, not an IP or auth-flavor
+        // one. Point the operator at the share's filesystem permissions.
+        Some(
+            "the mount succeeded but the server denied reading the share \
+             (NFS3ERR_ACCES). OpenPXE connects as AUTH_SYS uid 0, so this is \
+             a server-side permission issue: make sure the export's \
+             directory is readable (most ISO shares are world-readable / \
+             0755), and that the export isn't restricted to a specific \
+             non-root user via all_squash/anonuid. On UniFi UNAS, confirm \
+             the share's NFS permission for this host is Read-Write (or \
+             Read-Only) and that the share itself grants read access."
+                .into(),
+        )
+    } else if s.contains("nfs3err_noent")
+        || s.contains("nfs3err_notdir")
+        || s.contains("mnt3err_noent")
+    {
         Some(
             "the export path doesn't exist on the server, or it isn't a \
              directory. Double-check the path (e.g. /srv/isos vs /isos — \
@@ -888,6 +980,18 @@ mod tests {
         );
     }
 
+    #[test]
+    fn hint_for_mount_acces_calls_out_privileged_port_and_allowlist() {
+        // The dominant v0.4.67 field failure: mount denied even with the
+        // host IP allow-listed, because the export is `secure` and the
+        // client used a high source port. The hint should mention both
+        // the allow-list and the secure/insecure angle.
+        let h = hint_for("connect failed: MNT3ERR_ACCES").unwrap();
+        let lc = h.to_lowercase();
+        assert!(lc.contains("insecure") || lc.contains("privileged"), "got: {h}");
+        assert!(lc.contains("allow") || lc.contains("permission"), "got: {h}");
+    }
+
     #[test]
     fn hint_for_noent_points_to_export_path() {
         let h = hint_for("NFS server returned NFS3ERR_NOENT").unwrap();

crates/iso-store/src/pxe_logo.rs

@@ -1,86 +1,179 @@
-//! Operator-logo compositor for the iPXE menu.
+//! PXE boot-menu background compositor.
 //!
-//! The brief: match iVentoy's polished centered-logo PXE chrome with
+//! The brief (v0.4.69): match iVentoy's polished graphical PXE screen.
-//! whatever raster the operator drops onto Settings → Branding. A wide
+//! iPXE built with `CONSOLE_FRAMEBUFFER` + `IMAGE_PNG` paints a PNG to
-//! wordmark, a portrait stack, a square monogram — all three should
+//! the framebuffer via `console --picture`, then draws the text menu on
-//! land in roughly the same place on the boot screen.
+//! top (the console's default background colour is rendered transparent
+//! so the picture shows through the menu's blank cells). So what we
+//! produce here is a **full-screen 1024×768 background**, not just a
+//! floating logo:
 //!
-//! Approach: decode the operator's upload, fit it into a fixed
+//!   - a solid dark field (matches the WebUI dark theme so the product
-//! 1024×768 canvas with the logo horizontally centered and pinned a
+//!     feels consistent from browser to bare metal), with
-//! short margin from the top, re-encode as PNG, return the bytes. iPXE
+//!   - the operator's uploaded logo composited across the top, leaving
-//! built with `IMAGE_PNG` paints the result via `console --picture`.
+//!     the lower ~two-thirds clear for the iPXE menu text.
 //!
-//! The 1024×768 size matches the default VESA framebuffer iPXE picks
+//! When no custom logo is uploaded we still return a designed
-//! on most BIOS/UEFI consoles. Operators uploading 4K logos get
+//! background — a dark field with a centered "rainbow-horizon" disc
-//! correctly downscaled; tiny icons get drawn at their native size,
+//! echoing the bundled OpenPXE mark — so the boot screen is graphical
-//! centered, with transparent margins.
+//! out of the box. This replaces the old ASCII wordmark entirely.
 //!
-//! We deliberately don't ship `resvg` for SVG support — keeping the
+//! iPXE does **not** scale pictures (confirmed against the decoder
-//! dependency surface narrow matters more than supporting SVG-only
+//! source): the image is painted at native pixel size and the firmware
-//! brand assets. The WebUI's logo stays SVG-native (the browser
+//! picks the smallest video mode that fits. 1024×768 is the universal
-//! rasterizes it); the PXE menu wants a raster regardless.
+//! safe mode, so we pin the canvas there. Operators uploading a 4K logo
+//! get it downscaled to fit the top band; tiny icons paint at native
+//! size, centered.
+//!
+//! Input formats: anything the `image` crate decodes with our enabled
+//! features — PNG, JPEG, WebP, GIF. iPXE itself only consumes PNG, so
+//! we always *emit* PNG regardless of what the operator uploaded; a
+//! WebP logo is transcoded here transparently.
 
 use image::imageops::FilterType;
 use image::{DynamicImage, ImageError, ImageFormat, Rgba, RgbaImage};
 use std::io::Cursor;
 
-/// Canvas dimensions used for the composed PXE logo. Picked to match
+/// Canvas dimensions. Pinned to 1024×768 — the universal framebuffer
-/// the framebuffer dimensions iPXE picks on most BIOS/UEFI consoles —
+/// mode every BIOS/UEFI console supports, and iPXE doesn't scale.
-/// gives a 1:1 paint with no scaling at the firmware layer.
 pub const CANVAS_W: u32 = 1024;
 pub const CANVAS_H: u32 = 768;
 
-/// Maximum dimensions for the operator's logo inside the canvas. Any
+/// Bounding box for the operator's logo across the top band. Wider than
-/// upload larger than this in either axis is downscaled (preserving
+/// the old floating-logo box because the logo now anchors a full
-/// aspect ratio) to fit. Smaller uploads paint at native size.
+/// background rather than sitting alone on transparency.
-const LOGO_MAX_W: u32 = 600;
+const LOGO_MAX_W: u32 = 760;
 const LOGO_MAX_H: u32 = 200;
 
-/// Top margin in pixels from the canvas's top edge to the logo's top
+/// Top margin from the canvas top to the logo's top edge.
-/// edge. Matches the visual rhythm of iVentoy's screen (logo at top,
+const LOGO_TOP_MARGIN: u32 = 72;
-/// menu below).
-const LOGO_TOP_MARGIN: u32 = 64;
 
-/// Compose `src_bytes` (any PNG/JPEG/WebP/GIF) into a centered-top
+/// Background fill — a near-black with a faint blue cast, matching the
-/// 1024×768 PNG and return the encoded bytes.
+/// WebUI's dark theme surface so the product reads as one piece from
+/// browser to PXE screen.
+const BG: Rgba<u8> = Rgba([11, 14, 22, 255]);
+
+/// Compose the operator's uploaded raster (`Some`) — or the default
+/// OpenPXE mark (`None`) — into a full-screen 1024×768 PNG background
+/// and return the encoded bytes.
 ///
-/// Errors when the source can't be decoded or the encoded buffer can't
+/// Errors only when a provided `src_bytes` can't be decoded; the
-/// be written (only really fires on out-of-memory; the encoder itself
+/// `None` path and the PNG encode are infallible for our fixed canvas.
-/// is infallible for well-formed inputs).
+pub fn compose_pxe_background(src_bytes: Option<&[u8]>) -> Result<Vec<u8>, ImageError> {
-pub fn compose_pxe_logo(src_bytes: &[u8]) -> Result<Vec<u8>, ImageError> {
+    let mut canvas: RgbaImage = RgbaImage::from_pixel(CANVAS_W, CANVAS_H, BG);
-    let logo = image::load_from_memory(src_bytes)?;
+
-    // Resize-fit if the upload exceeds our bounding box. `Lanczos3`
+    match src_bytes {
-    // keeps the antialiasing crisp on the framebuffer console; it's a
+        Some(bytes) => {
-    // touch slower than `Triangle` but the operator hits this endpoint
+            let logo = image::load_from_memory(bytes)?;
-    // once per boot at most.
             let logo = downscale_to_fit(logo, LOGO_MAX_W, LOGO_MAX_H);
             let logo_rgba = logo.to_rgba8();
-
+            let off_x = CANVAS_W.saturating_sub(logo_rgba.width()) / 2;
-    // Transparent canvas. iPXE 1.21+ honours alpha-channel transparency
+            let off_y = LOGO_TOP_MARGIN.min(CANVAS_H.saturating_sub(logo_rgba.height()));
-    // on framebuffer consoles; older builds simply draw the alpha as
+            // `overlay` alpha-composites, so a transparent-background
-    // black, which still gives a sensible look.
+            // logo blends onto the dark field exactly as designed.
-    let mut canvas: RgbaImage = RgbaImage::from_pixel(CANVAS_W, CANVAS_H, Rgba([0, 0, 0, 0]));
-    let logo_w = logo_rgba.width();
-    let logo_h = logo_rgba.height();
-    // Horizontal center, top-margin from the top. Saturating math
-    // means a logo wider than CANVAS_W (shouldn't happen after the
-    // downscale above, but defensive) just sits flush-left.
-    let off_x = CANVAS_W.saturating_sub(logo_w) / 2;
-    let off_y = LOGO_TOP_MARGIN.min(CANVAS_H.saturating_sub(logo_h));
             image::imageops::overlay(&mut canvas, &logo_rgba, off_x.into(), off_y.into());
+        }
+        None => draw_default_mark(&mut canvas),
+    }
 
-    let mut out = Vec::with_capacity(64 * 1024);
+    let mut out = Vec::with_capacity(128 * 1024);
     DynamicImage::ImageRgba8(canvas).write_to(&mut Cursor::new(&mut out), ImageFormat::Png)?;
     Ok(out)
 }
 
+/// Back-compat shim for the old name — callers that pass a raw logo and
+/// want it composited get the same result as `compose_pxe_background`
+/// with `Some`.
+pub fn compose_pxe_logo(src_bytes: &[u8]) -> Result<Vec<u8>, ImageError> {
+    compose_pxe_background(Some(src_bytes))
+}
+
+/// Paint a centered "rainbow-horizon" disc onto the dark canvas as the
+/// default brand mark when no operator logo is set. Pure pixel math —
+/// no font, no SVG rasterizer, no extra deps. A filled circle with a
+/// left-to-right hue sweep echoes the bundled `logo.svg` motif.
+// Casts here are all bounded small-range geometry (radius ≤ 90, canvas
+// ≤ 1024) — precision loss / wrap is structurally impossible.
+#[allow(clippy::cast_precision_loss, clippy::cast_possible_wrap)]
+fn draw_default_mark(canvas: &mut RgbaImage) {
+    let radius: i32 = 90;
+    let cx = (CANVAS_W / 2) as i32;
+    let cy = (LOGO_TOP_MARGIN + 100) as i32;
+    // Four-stop horizontal sweep across the disc (teal → blue → violet
+    // → magenta) — the OpenPXE palette.
+    let stops = [
+        [0x22u8, 0xd3, 0xaa],
+        [0x3b, 0x82, 0xf6],
+        [0x8b, 0x5c, 0xf6],
+        [0xec, 0x48, 0x99],
+    ];
+    let r2 = radius * radius;
+    for dy in -radius..=radius {
+        for dx in -radius..=radius {
+            if dx * dx + dy * dy > r2 {
+                continue;
+            }
+            // Position across the disc in [0,1] left→right.
+            let t = (f32::from(i16::try_from(dx + radius).unwrap_or(0)))
+                / (f32::from(i16::try_from(2 * radius).unwrap_or(1)));
+            let color = gradient_at(&stops, t);
+            // Soft edge: fade alpha in the outer 3px ring.
+            let dist = ((dx * dx + dy * dy) as f32).sqrt();
+            let alpha = if dist > (radius as f32 - 3.0) {
+                let edge = (radius as f32 - dist).clamp(0.0, 3.0) / 3.0;
+                (edge * 255.0) as u8
+            } else {
+                255
+            };
+            let px = cx + dx;
+            let py = cy + dy;
+            if px >= 0 && py >= 0 && (px as u32) < CANVAS_W && (py as u32) < CANVAS_H {
+                blend_pixel(canvas, px as u32, py as u32, color, alpha);
+            }
+        }
+    }
+}
+
+/// Linear interpolate across an N-stop palette at position `t` in [0,1].
+// `segments`/`idx` are ≤ palette length (4) — f32 cast is exact.
+#[allow(clippy::cast_precision_loss)]
+fn gradient_at(stops: &[[u8; 3]], t: f32) -> [u8; 3] {
+    let t = t.clamp(0.0, 1.0);
+    let segments = stops.len() - 1;
+    let scaled = t * segments as f32;
+    let idx = (scaled.floor() as usize).min(segments - 1);
+    let frac = scaled - idx as f32;
+    let a = stops[idx];
+    let b = stops[idx + 1];
+    [
+        lerp(a[0], b[0], frac),
+        lerp(a[1], b[1], frac),
+        lerp(a[2], b[2], frac),
+    ]
+}
+
+fn lerp(a: u8, b: u8, t: f32) -> u8 {
+    (f32::from(a) + (f32::from(b) - f32::from(a)) * t).round() as u8
+}
+
+/// Alpha-blend `color` at `alpha` over the existing canvas pixel.
+fn blend_pixel(canvas: &mut RgbaImage, x: u32, y: u32, color: [u8; 3], alpha: u8) {
+    let bg = canvas.get_pixel(x, y).0;
+    let a = f32::from(alpha) / 255.0;
+    let out = Rgba([
+        lerp(bg[0], color[0], a),
+        lerp(bg[1], color[1], a),
+        lerp(bg[2], color[2], a),
+        255,
+    ]);
+    canvas.put_pixel(x, y, out);
+}
+
 fn downscale_to_fit(img: DynamicImage, max_w: u32, max_h: u32) -> DynamicImage {
     let (w, h) = (img.width(), img.height());
     if w <= max_w && h <= max_h {
         return img;
     }
-    // Preserve aspect ratio. `resize` clamps to the smaller of the
-    // two scale factors so we never overshoot the bounding box.
     img.resize(max_w, max_h, FilterType::Lanczos3)
 }
 
@@ -99,54 +192,73 @@ mod tests {
     }
 
     #[test]
-    fn compose_emits_canvas_sized_png() {
+    fn custom_logo_emits_canvas_sized_png_with_dark_field() {
         let src = solid_png(120, 60, [200, 50, 50]);
-        let out = compose_pxe_logo(&src).unwrap();
+        let out = compose_pxe_background(Some(&src)).unwrap();
-        // Round-trip the output and confirm dimensions.
+        let img = image::load_from_memory(&out).unwrap().to_rgba8();
-        let img = image::load_from_memory(&out).unwrap();
         assert_eq!(img.width(), CANVAS_W);
         assert_eq!(img.height(), CANVAS_H);
+        // A far corner should be the opaque dark background fill, not
+        // transparent — this is a full background now, not a floating
+        // logo on transparency.
+        let corner = img.get_pixel(CANVAS_W - 1, CANVAS_H - 1);
+        assert_eq!(corner.0, BG.0, "corner should be the dark fill");
     }
 
     #[test]
-    fn small_logo_centered_at_top_margin() {
+    fn custom_logo_painted_in_top_band() {
         let src = solid_png(100, 40, [10, 200, 10]);
-        let out = compose_pxe_logo(&src).unwrap();
+        let out = compose_pxe_background(Some(&src)).unwrap();
         let canvas = image::load_from_memory(&out).unwrap().to_rgba8();
-        // Pixel just inside the logo box should match the source color
-        // (alpha=255). Pixel near a far corner of the canvas should be
-        // the transparent background.
         let cx = (CANVAS_W - 100) / 2;
         let cy = LOGO_TOP_MARGIN;
         let inside = canvas.get_pixel(cx + 10, cy + 10);
-        assert_eq!(inside.0[3], 255, "logo pixel should be opaque");
+        assert!(
-        assert!(inside.0[0] < 100 && inside.0[1] > 100 && inside.0[2] < 100, "color mismatch: {inside:?}");
+            inside.0[1] > 100 && inside.0[0] < 100,
-        let corner = canvas.get_pixel(CANVAS_W - 1, CANVAS_H - 1);
+            "logo pixel color mismatch: {inside:?}"
-        assert_eq!(corner.0[3], 0, "canvas corner should be transparent");
+        );
     }
 
     #[test]
-    fn oversize_logo_is_downscaled_to_bounding_box() {
+    fn default_background_is_dark_with_a_painted_mark() {
-        // 4000×800 image — bigger than LOGO_MAX_W and LOGO_MAX_H in
+        let out = compose_pxe_background(None).unwrap();
-        // both axes. After downscale the output must fit; we re-decode
-        // the canvas, count non-transparent pixels, and confirm none
-        // sit outside the expected band.
-        let src = solid_png(4000, 800, [50, 50, 200]);
-        let out = compose_pxe_logo(&src).unwrap();
         let canvas = image::load_from_memory(&out).unwrap().to_rgba8();
-        // Span row at the top margin should have non-transparent
+        assert_eq!(canvas.width(), CANVAS_W);
-        // pixels somewhere; rows past the LOGO_TOP_MARGIN + LOGO_MAX_H
+        assert_eq!(canvas.height(), CANVAS_H);
-        // should be entirely transparent.
+        // Corner is dark fill.
-        let bottom_band_y = LOGO_TOP_MARGIN + LOGO_MAX_H + 10;
+        assert_eq!(canvas.get_pixel(2, CANVAS_H - 2).0, BG.0);
-        for x in 0..CANVAS_W {
+        // Center of the disc is not the background fill (something was
-            let p = canvas.get_pixel(x, bottom_band_y);
+        // painted there).
-            assert_eq!(p.0[3], 0, "row {bottom_band_y} should be transparent at x={x}");
+        let center = canvas.get_pixel(CANVAS_W / 2, LOGO_TOP_MARGIN + 100);
+        assert_ne!(center.0, BG.0, "default mark should paint over the field");
     }
+
+    #[test]
+    fn webp_or_jpeg_input_is_accepted_and_transcoded_to_png() {
+        // Encode a JPEG and confirm the compositor decodes it and emits
+        // a valid PNG (iPXE only eats PNG, so transcoding is the point).
+        let img: ImageBuffer<Rgb<u8>, Vec<u8>> = ImageBuffer::from_pixel(80, 80, Rgb([90, 90, 90]));
+        let mut jpeg = Vec::new();
+        DynamicImage::ImageRgb8(img)
+            .write_to(&mut Cursor::new(&mut jpeg), ImageFormat::Jpeg)
+            .unwrap();
+        let out = compose_pxe_background(Some(&jpeg)).unwrap();
+        // Output must be a PNG (magic bytes) of canvas size.
+        assert_eq!(&out[..8], b"\x89PNG\r\n\x1a\n");
+        let img = image::load_from_memory(&out).unwrap();
+        assert_eq!(img.width(), CANVAS_W);
     }
 
     #[test]
     fn unsupported_bytes_returns_error_not_panic() {
-        let r = compose_pxe_logo(b"\xde\xad\xbe\xef not an image");
+        let r = compose_pxe_background(Some(b"\xde\xad\xbe\xef not an image"));
         assert!(r.is_err());
     }
+
+    #[test]
+    fn gradient_endpoints_match_stops() {
+        let stops = [[0, 0, 0], [255, 255, 255]];
+        assert_eq!(gradient_at(&stops, 0.0), [0, 0, 0]);
+        assert_eq!(gradient_at(&stops, 1.0), [255, 255, 255]);
+    }
 }

crates/webui/src/app.css

@@ -117,6 +117,20 @@ code, kbd { font-family: var(--mono); font-size: 12.5px;
   letter-spacing: 0.2px;
   color: var(--fg);
 }
+
+/* v0.4.69: FleetDM-style full-width custom logo. When the operator has
+   uploaded a custom brand mark, the sidebar header drops the bundled
+   26px mark + "OpenPXE" wordmark and instead lets the uploaded image
+   span the header — left-aligned, capped at 200x50, scaled to fit
+   without distortion. The wordmark is hidden so the operator's logo is
+   the sole brand element (their logo presumably already contains their
+   name). The bundled-default case keeps the mark + wordmark. */
+.sidebar .brand.has-custom-logo { gap: 0; }
+.sidebar .brand.has-custom-logo img {
+  width: auto; height: 50px; max-width: 200px;
+  object-fit: contain; object-position: left center; flex: none;
+}
+.sidebar .brand.has-custom-logo strong { display: none; }
 .sidebar nav { padding: 10px 0; flex: 1; overflow-y: auto; }
 .sidebar nav a {
   display: flex; align-items: center; gap: 10px;

crates/webui/src/app.js

@@ -116,6 +116,46 @@
     return root;
   }
 
+  // Disk-space card. Free + used + total for the volume hosting the ISO
+  // directory, with a coloured bar. Warns at 80% and goes red at 95% so
+  // the operator sees the runway shrinking before uploads start failing
+  // with ENOSPC. Shared by the Storage tab and the Dashboard (v0.4.68).
+  function diskSpaceCard(disk) {
+    const total = Number(disk.total_bytes || 0);
+    const avail = Number(disk.available_bytes || 0);
+    const used  = Number(disk.used_bytes  || 0);
+    const pctUsed = total > 0 ? (used / total) * 100 : 0;
+    let barClass = 'diskbar';
+    if (pctUsed >= 95)      barClass += ' full';
+    else if (pctUsed >= 80) barClass += ' warn';
+    return el('div', {class:'card'}, [
+      el('header', {}, [
+        el('h2', {}, 'Disk space'),
+        el('span', {class:'sub'},
+          total > 0 ? (pctUsed.toFixed(1) + '% used') : 'unavailable'),
+      ]),
+      el('div', {class:'body'}, [
+        el('div', {style:'color:var(--fg-dim);font-size:12px;word-break:break-all'},
+          disk.path ? ('Volume: ' + disk.path) : 'Volume path unknown'),
+        el('div', {class: barClass},
+          el('div', {class:'fill',
+            style:'width:' + Math.min(100, pctUsed).toFixed(1) + '%'})),
+        el('div', {class:'disk-meta'}, [
+          el('span', {}, ['Used ',  el('strong', {}, fmtBytes(used))]),
+          el('span', {}, ['Free ',  el('strong', {}, fmtBytes(avail))]),
+          el('span', {}, ['Total ', el('strong', {}, fmtBytes(total))]),
+        ]),
+        pctUsed >= 95
+          ? el('p', {class:'msg err', style:'margin-top:10px'},
+              '⚠ Less than 5% free. Remove old ISOs or grow the volume before uploading more.')
+          : (pctUsed >= 80
+              ? el('p', {class:'msg', style:'color:var(--warn);margin-top:10px'},
+                  'Volume is getting full. Consider pruning old ISOs.')
+              : null),
+      ]),
+    ]);
+  }
+
   // Categorize an ISO row's "bootable now" status — drives the amber
   // tint borrowed from Bootimus v0.1.62. Returns {ok, reason}.
   function bootability(iso, settings) {
@@ -142,6 +182,13 @@
       const isos = await getJSON('/api/isos');
       const clients = (await getJSON('/api/clients')).clients || [];
       const entries = (await getJSON('/api/queue')).entries || [];
+      // v0.4.68: surface the same disk-space card the Storage tab shows,
+      // so operators see capacity at a glance from the landing page.
+      // Tolerate the endpoint being unavailable (e.g. statvfs failure)
+      // the same way the Storage tab does.
+      const disk = await getJSON('/api/storage/disk').catch(() => ({
+        total_bytes: 0, available_bytes: 0, used_bytes: 0, path: '?',
+      }));
 
       const ipxeOk = (status.ipxe_assets || []).length > 0;
       const stats = el('div', {class: 'statstrip'}, [
@@ -222,7 +269,7 @@
             '⚠ ' + i.filename + ' — ' + b.reason)))
       ]) : null;
 
-      return el('div', {class:'grid'}, [stats, recentBlock, problemsBlock].filter(Boolean));
+      return el('div', {class:'grid'}, [stats, diskSpaceCard(disk), recentBlock, problemsBlock].filter(Boolean));
     },
 
     network: async () => {
@@ -737,7 +784,7 @@
       const nfsMsg = el('div', {class:'msg'});
       const nfsServerIn = el('input', {type:'text', placeholder:'10.0.0.5'});
       const nfsExportIn = el('input', {type:'text', placeholder:'/srv/isos'});
-      const addNfs = el('button', {onclick: async () => {
+      const addNfs = el('button', {style:'margin-top:14px', onclick: async () => {
         if (!nfsServerIn.value || !nfsExportIn.value) {
           nfsMsg.replaceChildren(document.createTextNode('Server and export are required.'));
           nfsMsg.className = 'msg err'; return;
@@ -794,45 +841,7 @@
         el('span'),
       ])) : [el('div', {class:'empty'}, 'No NFS shares configured.')];
 
-      // Disk-space card. Free + used + total for the volume hosting the
+      const diskCard = diskSpaceCard(disk);
-      // ISO directory, with a coloured bar. Warns at 80% and goes red at
-      // 95% so the operator sees the runway shrinking before uploads
-      // start failing with ENOSPC.
-      const total = Number(disk.total_bytes || 0);
-      const avail = Number(disk.available_bytes || 0);
-      const used  = Number(disk.used_bytes  || 0);
-      const pctUsed = total > 0 ? (used / total) * 100 : 0;
-      let barClass = 'diskbar';
-      if (pctUsed >= 95)      barClass += ' full';
-      else if (pctUsed >= 80) barClass += ' warn';
-      const diskCard = el('div', {class:'card'}, [
-        el('header', {}, [
-          el('h2', {}, 'Disk space'),
-          el('span', {class:'sub'},
-            total > 0
-              ? (pctUsed.toFixed(1) + '% used')
-              : 'unavailable'),
-        ]),
-        el('div', {class:'body'}, [
-          el('div', {style:'color:var(--fg-dim);font-size:12px;word-break:break-all'},
-            disk.path ? ('Volume: ' + disk.path) : 'Volume path unknown'),
-          el('div', {class: barClass},
-            el('div', {class:'fill',
-              style:'width:' + Math.min(100, pctUsed).toFixed(1) + '%'})),
-          el('div', {class:'disk-meta'}, [
-            el('span', {}, ['Used ',  el('strong', {}, fmtBytes(used))]),
-            el('span', {}, ['Free ',  el('strong', {}, fmtBytes(avail))]),
-            el('span', {}, ['Total ', el('strong', {}, fmtBytes(total))]),
-          ]),
-          pctUsed >= 95
-            ? el('p', {class:'msg err', style:'margin-top:10px'},
-                '⚠ Less than 5% free. Remove old ISOs or grow the volume before uploading more.')
-            : (pctUsed >= 80
-                ? el('p', {class:'msg', style:'color:var(--warn);margin-top:10px'},
-                    'Volume is getting full. Consider pruning old ISOs.')
-                : null),
-        ]),
-      ]);
 
       return el('div', {class:'grid'}, [
         diskCard,

crates/webui/src/index.html

@@ -13,7 +13,7 @@
        on the asset handlers, the practical caching window is one
        version. -->
   <link rel="stylesheet" href="/assets/app.css?v={{ASSET_VERSION}}" />
-  <link rel="icon" type="image/svg+xml" href="/assets/logo.svg?v={{ASSET_VERSION}}" />
+  <link rel="icon" type="image/svg+xml" href="/assets/logo.svg?v={{ASSET_VERSION}}&r={{LOGO_REV}}" />
   <!-- Theme is read from localStorage *before* paint to avoid the
        dark→light flash on every navigation. Falls back to the OS
        preference and finally to dark. -->
@@ -32,8 +32,8 @@
 <body>
 <div class="shell">
   <aside class="sidebar">
-    <div class="brand">
+    <div class="{{BRAND_CLASS}}">
-      <img src="/assets/logo.svg?v={{ASSET_VERSION}}" alt="OpenPXE" />
+      <img src="/assets/logo.svg?v={{ASSET_VERSION}}&r={{LOGO_REV}}" alt="OpenPXE" />
       <strong>OpenPXE</strong>
     </div>
     <nav>

crates/webui/src/lib.rs

@@ -17,11 +17,34 @@
 ///   when we know the new one is incompatible. Combined with
 ///   `Cache-Control: no-cache, must-revalidate` on the asset handlers,
 ///   the worst-case caching window is one version.
+/// * `logo_rev` is appended to the brand-mark and favicon URLs as an
+///   extra `&r=…` token. Unlike `asset_version` it changes every time
+///   the operator swaps the custom logo, so the top-left mark updates
+///   immediately on the next page load instead of being pinned to the
+///   release version (which only changes on upgrade). `index.html`
+///   itself is served `no-cache`, so the fresh token lands as soon as
+///   the operator reloads after an upload.
+/// * `has_custom_logo` switches the sidebar brand block between the
+///   bundled mark + "OpenPXE" wordmark (false) and a FleetDM-style
+///   full-width custom logo with the wordmark hidden (true). Rendered
+///   server-side so there's no flash of the default mark before JS runs.
 #[must_use]
-pub fn index_html(base_url: &str, asset_version: &str) -> String {
+pub fn index_html(
+    base_url: &str,
+    asset_version: &str,
+    logo_rev: u64,
+    has_custom_logo: bool,
+) -> String {
+    let brand_class = if has_custom_logo {
+        "brand has-custom-logo"
+    } else {
+        "brand"
+    };
     INDEX_HTML
         .replace("{{BASE_URL}}", base_url)
         .replace("{{ASSET_VERSION}}", asset_version)
+        .replace("{{LOGO_REV}}", &logo_rev.to_string())
+        .replace("{{BRAND_CLASS}}", brand_class)
 }
 
 #[must_use]

deploy/docker/Dockerfile

@@ -17,14 +17,11 @@
 ARG RUST_VERSION=1.95
 
 ########## fetch iPXE binaries + wimboot ##########
-# v0.4.62: kept on the boot.ipxe.org pre-builds for the moment. We
+# Pulls the upstream boot.ipxe.org pre-builds (no PNG support) plus
-# want PNG support (so `console --picture` paints the operator's logo
+# wimboot. These cover the arches we don't build from source here:
-# on the PXE menu) but the obvious path — adding a new `ipxe-build`
+# BIOS undionly.kpxe and i386-efi (which need a 32-bit x86 toolchain),
-# stage that compiles iPXE from source with `IMAGE_PNG` enabled —
+# and serve as the baseline that the PNG-enabled x86_64/arm64 UEFI
-# runs into a QEMU/gcc instability when cross-emulating x86_64 on
+# binaries from the `ipxe-build` stage overlay on top of.
-# arm64 build hosts (intermittent `cc1` segfaults). The compositor
-# at /branding/pxe-logo is already wired so when the iPXE rebuild
-# lands (on native x86_64 hardware), no other code change is needed.
 FROM debian:12-slim AS fetch
 RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates \
  && rm -rf /var/lib/apt/lists/*
@@ -32,6 +29,36 @@ WORKDIR /src
 COPY scripts/fetch-ipxe.sh scripts/fetch-ipxe.sh
 RUN mkdir -p assets/ipxe && bash scripts/fetch-ipxe.sh
 
+########## build PNG-enabled iPXE from source ##########
+# v0.4.69: THE graphical-boot-menu unlock. iVentoy paints a PNG
+# background on the PXE screen using stock iPXE built with
+# CONSOLE_FRAMEBUFFER + IMAGE_PNG + CONSOLE_CMD; the public iPXE
+# binaries omit those, so `console --picture` is a no-op on them.
+# We build our own from upstream with that thin config delta.
+#
+# The historical blocker was cc1 segfaulting when an amd64 gcc ran
+# under QEMU emulation on an arm64 host. The fix: pin this stage to
+# $BUILDPLATFORM (the NATIVE builder arch — arm64 on an Apple-Silicon
+# Mac, amd64 in x86 CI) and cross-compile with a real cross toolchain
+# (CROSS_COMPILE=x86_64-linux-gnu-). The compiler runs native and
+# emits x86_64 — no emulation, no segfault. arm64-efi builds natively.
+FROM --platform=$BUILDPLATFORM debian:12-slim AS ipxe-build
+# libc6-dev is REQUIRED and easy to miss under --no-install-recommends:
+# iPXE's host utilities (elf2efi, zbin) compile with the native gcc and
+# pull <stdint.h>; without the native libc headers gcc's #include_next
+# falls through to iPXE's freestanding headers and dies on bits/stdint.h.
+# The target (iPXE firmware) code is -ffreestanding/-nostdinc, so the
+# x86_64 cross toolchain needs NO cross libc headers.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        git make perl gcc binutils libc6-dev \
+        gcc-x86-64-linux-gnu binutils-x86-64-linux-gnu \
+        ca-certificates \
+ && rm -rf /var/lib/apt/lists/*
+WORKDIR /src
+COPY scripts/build-ipxe.sh scripts/build-ipxe.sh
+COPY deploy/ipxe/local/ deploy/ipxe/local/
+RUN mkdir -p assets/ipxe && bash scripts/build-ipxe.sh /src/assets/ipxe
+
 ########## build openpxe ##########
 FROM rust:${RUST_VERSION}-bookworm AS build
 WORKDIR /src
@@ -64,7 +91,14 @@ RUN apt-get update \
 # `cargo build`, which is slow and can exhaust small Colima/CI disks.
 COPY Cargo.toml Cargo.lock ./
 COPY crates/ crates/
+# Baseline binaries (BIOS / i386 / wimboot), then overlay the
+# PNG-enabled x86_64 + arm64 UEFI binaries built from source. The
+# overlay wins for snponly.efi / ipxe.efi / snponly-arm64.efi so the
+# common modern clients get the graphical background; the rest keep the
+# upstream no-PNG binaries and the menu's `|| console` text fallback.
 COPY --from=fetch /src/assets/ipxe /src/assets/ipxe
+COPY --from=ipxe-build /src/assets/ipxe/snponly.efi /src/assets/ipxe/snponly.efi
+COPY --from=ipxe-build /src/assets/ipxe/ipxe.efi /src/assets/ipxe/ipxe.efi
 
 # Cache cargo registry + target across builds. The mtime touch is
 # belt-and-suspenders: cargo occasionally misses mtime-only changes on

deploy/ipxe/local/console.h

@@ -0,0 +1,14 @@
+/*
+ * OpenPXE iPXE build override — console options.
+ *
+ * Included at the end of config/console.h. CONSOLE_FRAMEBUFFER is the
+ * unified graphical framebuffer console (EFI GOP on UEFI, VESA on
+ * BIOS); it's what `console --picture` paints into. This is the same
+ * single flag iVentoy enables for its graphical PXE screen.
+ *
+ * We *add* the framebuffer console rather than replacing the default
+ * EFI/BIOS text consoles, so text output still works before/after the
+ * picture is set.
+ */
+
+#define CONSOLE_FRAMEBUFFER

deploy/ipxe/local/general.h

@@ -0,0 +1,23 @@
+/*
+ * OpenPXE iPXE build override — general options.
+ *
+ * iPXE includes <config/local/general.h> at the end of config/general.h,
+ * so anything defined here is layered on top of the stock defaults
+ * without editing upstream files. We enable exactly the features the
+ * graphical PXE boot menu needs:
+ *
+ *   IMAGE_PNG    - PNG decoder, so `console --picture <png>` can paint
+ *                  the operator's logo / OpenPXE background.
+ *   IMAGE_PNM    - Netpbm decoder (cheap; harmless belt-and-suspenders).
+ *   CONSOLE_CMD  - the `console` command itself. Without it you get
+ *                  "console: command not found" even with a framebuffer.
+ *
+ * (CONSOLE_FRAMEBUFFER lives in config/local/console.h.)
+ *
+ * Everything else stays at upstream defaults — we are intentionally a
+ * thin, auditable delta over stock iPXE so the UBDL/GPL story is simple.
+ */
+
+#define IMAGE_PNG
+#define IMAGE_PNM
+#define CONSOLE_CMD

scripts/build-ipxe.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+# Build PNG-enabled iPXE binaries from source.
+#
+# Why from source: the official boot.ipxe.org binaries (and the
+# Debian-packaged ones) are NOT built with CONSOLE_FRAMEBUFFER +
+# IMAGE_PNG + CONSOLE_CMD, so `console --picture` is a no-op on them —
+# you can't paint a graphical boot-menu background. iVentoy solves this
+# by shipping its own iPXE build with exactly those three flags; we do
+# the same, from upstream iPXE, with a thin auditable config delta
+# (deploy/ipxe/local/{general,console}.h).
+#
+# Why a real cross-compiler instead of QEMU: building amd64 iPXE by
+# emulating an amd64 gcc under QEMU on an arm64 host intermittently
+# segfaults cc1 (the reason this was stuck for ~8 releases). Running a
+# NATIVE arm64 gcc that cross-targets x86_64 (CROSS_COMPILE=
+# x86_64-linux-gnu-) sidesteps emulation entirely — the compiler is a
+# native binary, it just emits x86_64 objects. This stage is meant to
+# run on $BUILDPLATFORM (the native builder arch), NOT the emulated
+# target platform.
+#
+# Outputs (into $DEST), using the filenames OpenPXE's arch mapping
+# expects:
+#   snponly.efi   x86_64 UEFI, PNG-enabled
+#   ipxe.efi      x86_64 UEFI, PNG-enabled (bundled drivers)
+#
+# We build ONLY x86_64 UEFI, always via the x86_64 cross toolchain
+# (`x86_64-linux-gnu-gcc`). That's deliberately host-arch-agnostic: it
+# works whether this stage runs on an arm64 Mac builder or an amd64 CI
+# runner, because the cross compiler runs native and emits x86_64
+# either way. Building arm64-efi or BIOS here would re-introduce a
+# dependency on the host arch (native arm64 build) or a 32-bit multilib
+# toolchain — so those arches keep their upstream-fetched (no-PNG)
+# binaries and fall back to the menu's clean `|| console` text screen.
+# Modern PXE clients are overwhelmingly x86_64 UEFI, which get the full
+# graphical background.
+
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+DEST="${1:-$ROOT/assets/ipxe}"
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+
+# Pinned upstream iPXE. Rolling master is fine functionally, but a pin
+# keeps builds reproducible and protects against a transient master
+# breakage. Bump deliberately.
+IPXE_REPO="https://github.com/ipxe/ipxe.git"
+IPXE_REF="${IPXE_REF:-master}"
+
+echo ">> cloning iPXE ($IPXE_REF)"
+git clone --depth 1 --branch "$IPXE_REF" "$IPXE_REPO" "$WORK/ipxe" 2>/dev/null \
+  || git clone "$IPXE_REPO" "$WORK/ipxe"
+SRC="$WORK/ipxe/src"
+
+echo ">> applying OpenPXE config overrides (PNG + framebuffer + console cmd)"
+mkdir -p "$SRC/config/local"
+cp "$ROOT/deploy/ipxe/local/general.h" "$SRC/config/local/general.h"
+cp "$ROOT/deploy/ipxe/local/console.h" "$SRC/config/local/console.h"
+
+mkdir -p "$DEST"
+
+# x86_64 UEFI — cross-compiled with the native arm64 gcc targeting
+# x86_64. HOST_CC stays the native cc for iPXE's build-time utilities
+# (elf2efi, zbin, …); only the target objects use the cross compiler.
+echo ">> building x86_64 UEFI (snponly.efi, ipxe.efi)"
+make -C "$SRC" -j"$(nproc)" \
+  CROSS_COMPILE=x86_64-linux-gnu- \
+  bin-x86_64-efi/snponly.efi \
+  bin-x86_64-efi/ipxe.efi
+cp "$SRC/bin-x86_64-efi/snponly.efi" "$DEST/snponly.efi"
+cp "$SRC/bin-x86_64-efi/ipxe.efi"    "$DEST/ipxe.efi"
+
+echo ">> iPXE build complete:"
+ls -l "$DEST"/snponly.efi "$DEST"/ipxe.efi