v0.5.7: skip PNG boot-menu background on legacy BIOS clients

The menu emitted `console --picture … || console`, relying on the trailing `|| console` to recover on iPXE builds without IMAGE_PNG + CONSOLE_FRAMEBUFFER. On legacy BIOS (`undionly.kpxe`, no PNG) the `--picture` attempt misbehaves before the fallback can recover — it tries to set a framebuffer mode the BIOS console can't honour — so the boot menu fails to render on BIOS clients. Fix: gate the command on `iseq ${platform} efi`, so BIOS (`pcbios`) clients never issue `console --picture` at all and drop straight to the plain text menu, while UEFI clients still get the graphical background. This is automatic and per-client — a mixed BIOS+UEFI fleet each gets the right treatment with no operator toggle. A PNG-less UEFI build (upstream i386-efi) still falls back gracefully through the same `|| console`. Menu snapshot updated to match. 254 tests pass, clippy clean. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
v0.5.6: advertise the HTTP port in client-facing boot URLs
2026-06-03 19:28:02 -04:00 · 2026-06-03 18:49:50 -04:00 · 2026-06-03 12:07:31 -04:00 · 2026-06-03 11:49:18 -04:00 · 2026-06-03 03:33:05 -04:00 · 2026-06-03 02:50:51 -04:00
29 changed files with 3375 additions and 539 deletions
@@ -12,7 +12,7 @@ members = [
 ]
 [workspace.package]
-version = "0.5.2"
+version = "0.5.7"
 edition = "2021"
 rust-version = "1.95"
 license = "MIT OR Apache-2.0"
@@ -36,25 +36,25 @@ tower = "0.5"
 tower-http = { version = "0.6", features = ["fs", "trace", "cors", "limit"] }
 hyper = "1.4"
 reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "stream", "json"] }
 mime = "0.3"
 mime_guess = "2.0"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 toml = "0.8"
 # v0.5.4: layered config (TOML file + env). Pure-Rust, no C deps; keeps the
 # static-musl build OpenSSL-free. Replaces the hand-rolled apply_env mapping.
 figment = { version = "0.10", features = ["toml", "env"] }
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
 anyhow = "1.0"
-thiserror = "1.0"
+thiserror = "2.0"
 clap = { version = "4.5", features = ["derive", "env"] }
 uuid = { version = "1.10", features = ["v4", "serde"] }
 time = { version = "0.3", features = ["serde", "serde-human-readable", "formatting", "macros"] }
 sha2 = "0.10"
 hex = "0.4"
 bcrypt = "0.15"
 once_cell = "1.19"
 parking_lot = "0.12"
 rust-embed = { version = "8.5", features = ["include-exclude"] }
@@ -85,6 +85,36 @@ x509-parser = "0.18"
 flate2 = "1.1"
 base64 = "0.22"
 # v0.5.5: pure-Rust SSH/SFTP client for reading remote ISO libraries
 # over SFTP without a kernel mount.
 #
 # CRITICAL #1 — crypto backend: `default-features = false` +
 # `features = ["ring"]`. russh's *default* backend is `aws-lc-rs`, which
 # pulls `aws-lc-sys` (C code, fiddly under musl); the `ring` feature
 # instead reuses `ring 0.17` — the exact crate+version already in the
 # binary via rustls + bergshamra — so SFTP adds ZERO new C/crypto deps
 # and the static-musl build stays OpenSSL-free.
 #
 # CRITICAL #2 — pinned to EXACTLY 0.55.0, the newest russh that
 # coexists with bergshamra-crypto (our SAML core). The RustCrypto
 # ecosystem is mid-transition: bergshamra-crypto pins a constellation of
 # release-CANDIDATE crates (`pkcs8 =0.11.0-rc.11` and its matching
 # pkcs5/spki RCs) that are API-incompatible with the STABLE versions of
 # the same crates in the same semver bucket. russh 0.56+ pulls those
 # stable crates (`pkcs5 0.8`), which silently replaces bergshamra's RC
 # copies and breaks compilation. russh ≤0.55 stays on the previous stable
 # generation (`pkcs5 0.7`, `ssh-key 0.6`), which unifies with bergshamra's
 # *stable* deps and leaves the RC bucket untouched — verified to compile.
 # 0.55 still has the merged `russh::keys` API (keys merged at 0.50).
 # IMPORTANT: do NOT bump russh past 0.55 until bergshamra-crypto adopts
 # the stable RustCrypto generation; 0.56+ will not compile in this tree.
 #
 # SCP was deliberately rejected: the protocol is sequential-only (no
 # random access → no HTTP Range, unlike SFTP/NFS) and the mature SCP
 # crates wrap libssh2 (C + OpenSSL), which would break this build.
 russh = { version = "=0.55.0", default-features = false, features = ["ring"] }
 russh-sftp = "2.3"
 openpxe-core = { path = "crates/core" }
 openpxe-dhcp-proxy = { path = "crates/dhcp-proxy" }
 openpxe-tftp = { path = "crates/tftp" }
@@ -1,301 +1,270 @@
-# OpenPXE
+<p align="center">
  <img src="docs/openpxe-logo.svg" alt="OpenPXE" width="104" height="104" />
 </p>
-Container-native PXE boot server. A Rust reimplementation of
+<h1 align="center">OpenPXE</h1>
 [iVentoy (ventoy/PXE)](https://github.com/ventoy/PXE), designed from scratch
 for Docker/OCI and OpenShift. Upload `.iso` files via the web UI; network
 clients PXE-boot them.
-> **Status:** v0.4.1 / pre-beta. Phases 1–5 complete: full PXE stack,
+<p align="center">
-> Queued Deployment queue, NFS-share ISO sources, live tracing log + an
+  <strong>Container-native network boot &amp; OS deployment — built in Rust.</strong>
-> operator terminal, per-MAC host bindings, Prometheus `/metrics`,
+</p>
 > light/dark theme toggle, animated OpenPXE imaging-progress widget,
 > chunked ISO uploads, and per-ISO boot passwords. The test suite and
 > clippy are part of the release checklist. Ready for real-hardware validation.
-## Design non-negotiables
+<p align="center">
  Drag in an ISO. PXE-boot and image an entire fleet from a browser.<br/>
  No iPXE scripting. No <code>dnsmasq</code> + <code>tftpd</code> + Samba glue. No glibc. No garbage collector.
 </p>
-1. **Fully offline / air-gap deployable.** Zero CDN assets. Zero external
+<p align="center">
-   HTTP calls from the server, the browser, or the generated iPXE scripts.
+  <img alt="release"   src="https://img.shields.io/badge/release-v0.5.5-2874d7" />
-   Build the container once, run forever disconnected.
+  <img alt="license"   src="https://img.shields.io/badge/license-MIT%20%7C%20Apache--2.0-59824f" />
-2. **iPXE is a backend implementation detail.** No `.ipxe` upload path, no
+  <img alt="rust"      src="https://img.shields.io/badge/built%20with-Rust-fb8841?logo=rust&logoColor=white" />
-   manual script editing, no iPXE terminology in the UI. Every knob in the
+  <img alt="container" src="https://img.shields.io/badge/container--native-OCI%20%C2%B7%20OpenShift-2496ED?logo=docker&logoColor=white" />
-   web UI maps to a specific script-generation behavior inside the binary.
+  <img alt="binary"    src="https://img.shields.io/badge/static-musl%20%C2%B7%20~18MB-330f1f" />
-3. **The client trust store is off-limits.** No test-signed drivers, no
+</p>
   `bcdedit /set testsigning on`, no certificates injected into WinPE or
   the target OS.
-## What it does
+---
-1. **DHCP proxy** (RFC 4578). Coexists with your existing DHCP server —
+OpenPXE turns bare-metal provisioning into a single container with a web UI. It's a
-   never assigns IPs. Listens on UDP 67 + UDP 4011.
+ground-up Rust reimplementation of [iVentoy (ventoy/PXE)](https://github.com/ventoy/PXE),
-2. **TFTP server** (RFC 1350 + RFC 2347/2348/2349/7440 option negotiation)
+designed for Docker/OCI and OpenShift instead of a Windows desktop — so it drops onto
-   that serves architecture-specific iPXE binaries to firmware PXE ROMs.
+an Unraid box, a Linux server, or a Kubernetes cluster and just runs.
 3. **HTTP server** that serves the web UI, the generated iPXE boot scripts,
   raw ISOs (with Range), and files inside ISOs without prior extraction.
 4. **ISO introspection**: auto-detects the distro family and generates the
   appropriate kernel+initrd or wimboot chain. No manual config.
 5. **Hierarchical PXE menu** mirroring the Phase 2 spec:
   ```
   Default        > Boot from Local HDD
   Installers     > Linux Installers  / Windows Installers
   Tools          > Utilities / OpenPXE Shell / Network Card Info
   Queued Deployment
   ```
 6. **Queued Deployment queue** — the coordinated launch flow. A client that
   selects *Queued Deployment* gets a numbered position and waits. The
   operator picks an ISO in the web UI and fires it to every waiting
   client simultaneously.
 7. **Web UI** (Netbox-style): sidebar nav (Dashboard / Network / Queue /
   Storage / Hosts / Terminal / About), light + dark themes
   (toggle top-right or press `T`), animated OpenPXE progress
   widget when devices are imaging. All assets served from the binary —
   no external requests.
 8. **Per-MAC host bindings.** Pin a MAC to a boot target and the client
   skips the menu, chains straight through.
 9. **Prometheus metrics** at `/metrics` — DHCP replies by arch, TFTP
   transfer counts and bytes, HTTP request counts by route, queue /
   imaging gauges, uptime, build info. Plain text exposition format,
   no external metrics framework dependency.
 8. **Settings API** lets you change the default boot-menu timeout (default
   600s), the timeout action (stay / Local HDD / Queued Deployment), and
   feature toggles like Windows ISO support. The iPXE scripts regenerate
   on every request using current settings.
-### Architectures supported on day one
+Upload `.iso` files (or point at a remote share), and any machine on the network boots
 them — Linux installers, live tools, or stock Windows setup — with **zero iPXE knowledge
 required by the operator.**
-| DHCP option 93 | Architecture    | Binary served           |
+> **Status — v0.5.5, late pre-beta.** The full PXE stack, web UI, remote ISO libraries
-|----------------|-----------------|-------------------------|
+> (SMB/NFS/SFTP), Windows deployment, queued fleet rollout, SAML SSO, and Prometheus
-| `0x0000`       | Legacy x86 BIOS | `undionly.kpxe`         |
+> metrics are implemented and test-covered. The release checklist gates every tag on the
-| `0x0006`       | IA32 UEFI       | `snponly-i386.efi`      |
+> full test suite + `clippy`. Currently in real-hardware validation.
 | `0x0007`/`0x0009` | x86_64 UEFI  | `snponly.efi`           |
 | `0x000B`       | ARM64 UEFI      | `snponly-arm64.efi`     |
-UEFI firmware that sends `HTTPClient` in option 60 is handled too — we
+## Why OpenPXE
 skip TFTP and respond with an HTTP URL.
-## Quick start — MVP container (recommended)
+Standing up network boot the traditional way means hand-wiring `dnsmasq`, a TFTP daemon,
 hand-written iPXE menu scripts, an HTTP server, and Samba — then keeping that fragile
 stack alive, and discovering none of it containerizes cleanly (kernel-mount NFS, raw
 sockets, `CAP_SYS_ADMIN`). iVentoy solved the UX beautifully, but it's a Windows GUI app.
 OpenPXE collapses that whole stack into **one statically-linked binary in one container**:
 - **A web UI does everything.** iPXE is an internal implementation detail — there is no
  script upload, no `.ipxe` editing, no PXE jargon in the interface.
 - **It runs anywhere a container runs.** No kernel modules, no privileged mode — proxy-mode
  DHCP + `NET_BIND_SERVICE` is the entire requirement. Verified on Unraid, plain Docker,
  and OpenShift's restricted SCC.
 - **It's air-gap native.** Zero CDN assets, zero outbound calls from the server, browser,
  or generated boot scripts. Build the image once, run it forever, disconnected.
 ## Highlights
 #### Boot stack
 - **DHCP proxy** (RFC 4578) that coexists with your existing DHCP — it never hands out IPs.
 - **TFTP** (RFC 1350 + 2347/2348/2349/7440 option negotiation) serving arch-correct iPXE firmware.
 - **HTTP** serving the UI, generated boot scripts, raw ISOs (with byte-range), and files
  *inside* ISOs with no prior extraction.
 - **Graphical iPXE boot menu** built from your uploads, with a PNG background and a clean
  hierarchy — generated fresh on every request from current settings.
 #### ISO management & remote libraries
 - **Drag-and-drop chunked uploads** that don't 502 on multi-GB images.
 - **Automatic introspection** — detects the distro family and generates the right
  kernel+initrd or Windows `wimboot` chain. No manual config.
 - **Remote ISO libraries, streamed on demand** (no local cache) over **SMB, NFS, or SFTP** —
  see the table below.
 #### Fleet deployment
 - **Queued Deployment** — clients join a queue and wait; the operator fires one image at
  every waiting machine simultaneously.
 - **Per-MAC host bindings** — pin a MAC straight to a target (with optional auto hostname,
  auto IP, and an unattended answer file); it skips the menu and chains through.
 - **Unattended installs** — upload Kickstart / Preseed / Autoinstall / Windows answer files;
  they're templated per-host (hostname / IP / MAC) and served only to booting clients.
 - **Windows deployment** from a stock Microsoft ISO — **every binary the client runs stays
  Microsoft-signed** (details below).
 #### Operations & access
 - **SAML 2.0 single sign-on** (pure-Rust SP, no OpenSSL/xmlsec) alongside local accounts.
 - **Custom branding** — light / dark / PXE-client logos and favicon.
 - **Notifications** — Slack / Teams / Discord webhooks and SMTP email on boot events.
 - **Prometheus `/metrics`**, a built-in operator **terminal**, live tracing log, and
  `/healthz` · `/readyz` probes.
 - **Layered config** — defaults → TOML file → `OPENPXE_*` env, in that order.
 ## Built in Rust
 Rust isn't a checkbox here — it's why OpenPXE deploys the way it does:
 - **One static binary, ~18 MB.** Compiled to `x86_64-unknown-linux-musl` — no glibc, no
  interpreter, no sidecar runtime. The runtime image is "binary + a few CLI tools."
 - **No garbage collector, async throughout.** A Tokio runtime drives DHCP, TFTP, HTTP, and
  many concurrent multi-GB ISO streams on a tiny, predictable memory footprint — it idles
  near-zero and never GC-pauses mid-transfer.
 - **Memory-safe by construction.** `unsafe` is **denied workspace-wide**; the only
  exceptions are two small, individually-audited FFI calls (`statvfs` for disk usage and a
  Samba `SIGHUP`).
 - **OpenSSL-free, pure-Rust crypto.** TLS via `rustls`/`ring`; the SAML Service Provider
  does XML-DSig verification with RustCrypto — no `xmlsec`, no `libxml2`, no C crypto to
  CVE-patch. Even the SMB/NFS/SFTP clients avoid C libraries.
 - **Sub-minute, reproducible container builds.** Cross-compiled with `cargo-zigbuild`
  (zig as the linker) — a full image builds in well under a minute on a warm cache, with
  no QEMU emulation.
 ## Quick start
 ### Run the container
 ```bash
-# 1. Pull bundled iPXE binaries (~2 MB, one-time).
+# Build the self-contained image (iPXE binaries are fetched + built inside the Dockerfile).
-./scripts/fetch-ipxe.sh
+docker build -f deploy/docker/Dockerfile -t openpxe:0.5.5 .
-# 2. Build the container image (~3 min first time).
+# Run it on the box plugged into your PXE network. Host networking is required in
-docker buildx build -f deploy/docker/Dockerfile -t openpxe:0.4.1 --load .
+# proxy mode so the container sees DHCPDISCOVER broadcasts; set PUBLIC_IP to this
-
+# host's LAN address so advertised boot URLs are reachable.
-# 3. Run it on the box plugged into your PXE network. Set PUBLIC_IP to
+docker run -d --name openpxe --network host \
 #    this host's LAN address so advertised iPXE URLs are reachable.
 docker run -d --name openpxe \
  --network host \
  -e OPENPXE_PUBLIC_IP=10.0.0.5 \
  -e OPENPXE_DHCP_MODE=proxy \
  -v $PWD/data/isos:/var/lib/openpxe/isos \
  -v $PWD/data/work:/var/lib/openpxe/work \
-  openpxe:0.4.1
+  openpxe:0.5.5
-# 4. Open the UI and drop an ISO in.
+# Open the UI and drop an ISO in.
 open http://10.0.0.5
 ```
-Host networking is required in proxy mode so the container sees DHCPDISCOVER
+> On macOS/Windows, Docker runs inside a Linux VM, so "host network" means the VM — use
-broadcasts from the PXE VLAN. On macOS/Windows hosts Docker runs in a Linux
+> the `openpxe-dev` service in `docker-compose.yml` for API-only testing on a laptop:
-VM, so "host" means the VM — use `openpxe-dev` in `docker-compose.yml` for
+> `OPENPXE_PUBLIC_IP=127.0.0.1 docker compose up openpxe-dev`.
 API-only testing on a laptop.
-### Quick start — docker compose
+### Build from source
 ```bash
-# MVP / API testing on a laptop (no DHCP, high ports):
+./scripts/fetch-ipxe.sh          # populate assets/ipxe/ (embedded at compile time)
-OPENPXE_PUBLIC_IP=127.0.0.1 docker compose up openpxe-dev
+cargo run --release              # needs root or CAP_NET_BIND_SERVICE for :80/:69
 # Real PXE deployment on a Linux host (host network, DHCP proxy on):
 OPENPXE_PUBLIC_IP=10.0.0.5  docker compose up openpxe
 ```
-### Multi-arch build + push
+### Pre-seed ISOs from a directory
 For deploying to x86_64 servers, build both arches in one manifest:
 ```bash
 # One-time: bootstrap a multi-arch builder.
 docker buildx create --name openpxe-multi --driver docker-container --use
 # Build + push both linux/amd64 and linux/arm64 under one tag.
 docker buildx build --builder openpxe-multi \
  --platform linux/amd64,linux/arm64 \
  -t ghcr.io/YOUR-ORG/openpxe:0.4.1 \
  --push \
  -f deploy/docker/Dockerfile .
 ```
 On an Apple Silicon host, the amd64 stage runs under QEMU emulation (~10-15 min for a cold cache). On a Linux x86_64 host, both arches build natively at normal speed. CI runners on GitHub Actions with `docker/build-push-action@v5` handle this cleanly.
 ### Build from source (no container)
 ```bash
 ./scripts/fetch-ipxe.sh
 cargo run --release            # needs NET_BIND_SERVICE or root for :80/:69
 ```
 ### Container health probes
 | Endpoint    | Purpose                                                       |
 |-------------|---------------------------------------------------------------|
 | `/healthz`  | Liveness — HTTP stack alive. Always 200.                      |
 | `/readyz`   | Readiness — 200 only if iPXE binaries bundled + ISO dir OK.   |
 | `/api/status` | Full JSON status: versions, assets, counts, live settings, SMB state. |
 ### Pre-seeding ISOs from a directory
 For CI, pre-baked homelab deployments, or a fresh PVC, the binary has a
 `seed` subcommand that imports every `*.iso` from a host path through the
 same pipeline the web UI uses (introspection + boot-entry generation):
 ```bash
 docker run --rm \
  -v /my/iso-library:/seed:ro \
  -v openpxe-data:/var/lib/openpxe/isos \
  -e OPENPXE_PUBLIC_IP=10.0.0.5 \
-  openpxe:0.4.1 seed --from /seed
+  openpxe:0.5.5 seed --from /seed          # add --dry-run to preview
 # Dry run first to see what would be imported:
 docker run --rm -v /my/iso-library:/seed:ro openpxe:0.4.1 seed --from /seed --dry-run
 ```
-### Environment overrides
+## Remote ISO libraries
-| Var                    | Default                     | Meaning                                |
+Point OpenPXE at a NAS and boot ISOs straight off it — **read on demand, no local copy**,
-|------------------------|-----------------------------|----------------------------------------|
+so a 50-ISO library costs zero disk on the OpenPXE host. All three clients are userspace
-| `OPENPXE_HTTP_PORT`   | `80`                        | Web UI + boot script HTTP port         |
+(no kernel mounts, no `CAP_SYS_ADMIN`); pick whichever your storage speaks.
 | `OPENPXE_TFTP_PORT`   | `69`                        | TFTP port                              |
 | `OPENPXE_DHCP_PORT`   | `67`                        | DHCP server-side port                  |
 | `OPENPXE_DHCP_MODE`   | `proxy`                     | `proxy` or `disabled`                  |
 | `OPENPXE_PUBLIC_IP`   | auto-detect                 | Advertised IP for clients. Startup **fails** if unset and auto-detect returns loopback. |
 | `OPENPXE_ISO_DIR`     | `/var/lib/openpxe/isos`    | Where uploaded ISOs live               |
 | `OPENPXE_WORK_DIR`    | `/var/lib/openpxe/work`    | Scratch + runtime settings             |
 | `OPENPXE_LOG`         | `info,openpxe=debug`       | `tracing` filter                       |
-## What the boot menu looks like on a real client
+| Protocol | Implementation | Auth | HTTP Range¹ |
 |----------|----------------|------|-------------|
 | **NFS** (v3) | Pure-Rust in-process client | Client-IP (server export list) | ✅ |
 | **SFTP** (SSH) | Pure-Rust in-process client (`russh`) | Password **or** SSH key · host-key TOFU | ✅ |
 | **SMB** / CIFS | Userspace `smbclient` | Guest or username/password | — |
 ¹ Range support lets clients seek into a multi-GB ISO without downloading what comes
 before it — needed for kernel/initrd extraction and `httpdisk`-style boots. NFS and SFTP
 expose explicit offsets; the SMB CLI streams sequentially, so SMB-sourced ISOs serve whole-file.
 ## Supported client architectures
 | DHCP option 93 | Architecture | Firmware served |
 |----------------|--------------|-----------------|
 | `0x0000` | Legacy x86 BIOS | `undionly.kpxe` |
 | `0x0006` | IA32 UEFI | `snponly-i386.efi` |
 | `0x0007` / `0x0009` | x86_64 UEFI | `snponly.efi` |
 | `0x000B` | ARM64 UEFI | `snponly-arm64.efi` |
 UEFI firmware that advertises `HTTPClient` (option 60) skips TFTP entirely and is handed an HTTP URL.
 ## The boot menu, on a real client
 ```
-                        OpenPXE - network boot menu
+                        OpenPXE — network boot menu
 ------------------------- Default -------------------------
 Boot from Local HDD
- ----------------------- Installers -----------------------
+ ----------------------- Installers ------------------------
 Linux Installers   >
 Windows Installers >                (only if enabled in Settings)
 -------------------------- Tools --------------------------
- Tools              >                Utilities / Shell /
+ Tools              >    Utilities / OpenPXE Shell / NIC Info / Reboot
                                     NIC Info / Reboot /
                                     Exit and continue BIOS
 ---------------------- Queued Deployment ------------------
 Queued Deployment   (join queue)
 ```
-Linux/Windows submenus show file sizes iVentoy-style:
+Linux/Windows submenus list images iVentoy-style with sizes:
 ```
-                   OpenPXE - Linux Installers
+                   OpenPXE — Linux Installers
 [  4376 MB]  CentOS-7-x86_64-DVD-1810
 [  2002 MB]  Fedora-Workstation-Live-x86_64-38-1.6
 [  4699 MB]  ubuntu-22.04.2-desktop-amd64
 [  2002 MB]  Fedora-Workstation-Live-x86_64-38-1.6
            < Back to main menu
 ```
-iPXE never appears in the UI — the whole hierarchy above is generated from
+The entire hierarchy is generated from what you upload and toggle — iPXE never surfaces.
-ISOs you upload via drag-and-drop in the web UI plus toggles in Settings.
+
 ## Windows deployment
 Enable **Windows ISO support** in Settings, then upload a **stock, unmodified** Microsoft ISO:
 1. On upload, OpenPXE uses `wimlib-imagex` to inject exactly two plain-text files into the
   WinPE image (`winpeshl.ini` + `startnet.cmd`) — no drivers, no certificates.
 2. The container's Samba `smbd` serves the extracted install tree on `:445`.
 3. The client chainloads `wimboot` → patched WinPE → Windows Setup running off the share.
 **Every executable the client runs is stock Microsoft-signed.** OpenPXE never ships
 drivers, never installs certificates into the client trust store, and never recommends
 `bcdedit /set testsigning on`. The SMB approach is adapted (re-implemented, not copied)
 from [Bootimus](https://github.com/garybowers/bootimus) (Apache-2.0). Port `445` must be
 directly reachable from clients; Windows 10/11 client SKUs are the tested target.
 ## Configuration
 All settings have defaults and layer **defaults → TOML (`--config` / `OPENPXE_CONFIG`) →
 `OPENPXE_*` env**. The common knobs:
 | Var | Default | Meaning |
 |-----|---------|---------|
 | `OPENPXE_PUBLIC_IP` | auto-detect | IP advertised to clients. **Startup fails** if unset and auto-detect yields loopback. |
 | `OPENPXE_DHCP_MODE` | `proxy` | `proxy` or `disabled` |
 | `OPENPXE_HTTP_PORT` | `80` | Web UI + boot-script HTTP port |
 | `OPENPXE_TFTP_PORT` | `69` | TFTP port |
 | `OPENPXE_DHCP_PORT` | `67` | DHCP server-side port |
 | `OPENPXE_ISO_DIR` | `/var/lib/openpxe/isos` | Uploaded ISOs |
 | `OPENPXE_WORK_DIR` | `/var/lib/openpxe/work` | Scratch, settings, share + branding state |
 | `OPENPXE_LOG` | `info,openpxe=info` | `tracing` filter |
 ## OpenShift
 ```bash
 oc apply -f deploy/openshift/
 oc -n openpxe get all
 oc -n openpxe get route openpxe -o jsonpath='{.spec.host}'
 ```
-### Why a custom SCC?
+The bundled `openpxe-scc` grants exactly `hostNetwork` (CNI overlays don't deliver L2
 broadcast into pod netns) and `NET_BIND_SERVICE` (to bind ports <1024) — nothing else.
 No raw sockets, no privileged mode. The Route covers `80/TCP`; PXE clients reach UDP
 67/69/4011 on the node's host IP directly.
-The default `restricted-v2` blocks `hostNetwork` and all capabilities. PXE
+## Health & observability
 cannot work without host network (CNI overlays don't deliver L2 broadcast
 into pod netns), and we need `NET_BIND_SERVICE` to bind <1024. The custom
 `openpxe-scc` grants exactly those two and nothing else. No raw sockets,
 no privileged mode — proxy-mode DHCP sidesteps the usual requirements.
-### What's on host ports
+| Endpoint | Purpose |
-
+|----------|---------|
-| Port     | Proto | Purpose                         |
+| `/healthz` | Liveness — always 200 if the HTTP stack is up. |
-|----------|-------|---------------------------------|
+| `/readyz` | Readiness — 200 only once iPXE firmware is bundled and the ISO dir is reachable. |
-| 67       | UDP   | DHCP server (proxy replies)     |
+| `/api/status` | Full JSON: version, assets, counts, live settings, share + SMB state. |
-| 69       | UDP   | TFTP                            |
+| `/metrics` | Prometheus text format — DHCP replies by arch, TFTP/HTTP counts, queue gauges, uptime. |
 | 4011     | UDP   | PXE Boot Server discovery       |
 | 80       | TCP   | Web UI + HTTP boot assets       |
 The OpenShift Route only covers 80/TCP. Clients on the PXE network talk to
 the node's host IP directly for UDP.
 ## Windows support
 Enabled by toggling **Windows ISO support** under Settings. The flow:
 1. Upload a stock Microsoft Windows install ISO (vanilla, no pre-processing).
 2. On upload, OpenPXE extracts the ISO and uses `wimlib-imagex` to rewrite
   image index 2 (WinPE) of `sources/boot.wim`. It injects exactly two
   plain-text files:
   - `Windows/System32/winpeshl.ini` — tells WinPE to run `startnet.cmd`.
   - `Windows/System32/startnet.cmd` — runs `wpeinit`, waits for the SMB
     host to be reachable, `net use Z: \\<server>\<share> /user:guest`,
     then `Z:\setup.exe`.
 3. The container's Samba `smbd` serves the extracted install tree on :445.
 4. The client gets chainloaded into wimboot → patched WinPE → Windows Setup
   running off the SMB share. **Every binary the client executes is stock
   Microsoft-signed.**
 ### What we never do
 - Ship drivers — signed, test-signed, or otherwise — that load on the client.
 - Install certificates into the target's trust store or WinPE boot policy.
 - Recommend `bcdedit /set testsigning on` or any equivalent signing-policy
  weakening.
 ### Credit & limitations
 The SMB-based approach is adapted from [Bootimus](https://github.com/garybowers/bootimus)
 (Apache-2.0). Re-implemented in Rust; no code was copied verbatim. Known
 operational constraints inherited from the design:
 - **Port 445 must be directly reachable from PXE clients.** `net use`
  ignores alternate ports. In OpenShift this means `hostPort: 445` on the
  deployment; on a host that already runs SMB it will collide.
 - Windows 10/11 client SKUs are the tested target. Server SKUs untested.
 - Hardware with NICs/storage controllers missing from WinPE's bundled
  drivers will need a driver-pack injection step (not yet implemented).
 ## Queued Deployment
 The coordinated launch flow, end to end:
 1. A client boots and picks **Queued Deployment** in the PXE menu (or falls
   through on timeout with the default `timeout_action`).
 2. The client joins the queue, gets a numbered queue position, and enters a
   long-poll loop (25s per request, auto-renewed).
 3. In the web UI's **Queued Deployment** tab, the operator sees each waiting
   client with its MAC, IP, arch, and position.
 4. The operator selects an image and clicks **Launch for all waiting**.
   The server broadcasts the assignment to every queued client via a
   `tokio::sync::Notify`; each client's next poll returns the boot script
   for the chosen image.
 5. Every client chains the same image at effectively the same moment. The
   queue stays visible until the operator releases entries, which keeps a
   useful audit trail during hardware testing.
 No user-facing iPXE anywhere in this flow. The client only ever runs
 scripts we generate; the operator only interacts with the web UI.
 ## Architecture
-See [`docs/architecture.md`](docs/architecture.md) for the protocol stack,
+Workspace of focused crates — `core`, `dhcp-proxy`, `tftp`, `http-api`, `iso-store`,
-crate layout, and the full decision log.
+`ipxe-assets`, `webui`, and the `openpxe` binary. See
 [`docs/architecture.md`](docs/architecture.md) for the protocol stack, crate layout, and
 the full decision log.
-## Licence
+## License
-MIT OR Apache-2.0.
+Dual-licensed under **MIT OR Apache-2.0** — use whichever fits your project.
@@ -13,6 +13,7 @@ workspace = true
 serde.workspace = true
 serde_json.workspace = true
 toml.workspace = true
 figment.workspace = true
 thiserror.workspace = true
 anyhow.workspace = true
 tracing.workspace = true
@@ -38,6 +39,9 @@ base64.workspace = true
 [dev-dependencies]
 tempfile = "3.12"
 # v0.5.4: figment's `Jail` (hermetic env/file sandbox) for the config
 # loader tests lives behind the `test` feature.
 figment = { workspace = true, features = ["test"] }
 # v0.5.1: generate a throwaway self-signed signing cert/key so SAML
 # verification tests can produce genuinely signed SAMLResponses.
 rcgen = "0.13"
@@ -1,3 +1,5 @@
 use figment::providers::{Env, Format, Serialized, Toml};
 use figment::Figment;
 use serde::{Deserialize, Serialize};
 use std::net::{IpAddr, Ipv4Addr};
 use std::path::{Path, PathBuf};
@@ -56,6 +58,9 @@ pub enum DhcpMode {
    /// Disabled — rely on an external DHCP server that has been manually
    /// configured with `next-server` / `filename`. OpenPXE only serves TFTP
    /// + HTTP in this mode. Useful for home routers that can be pre-set.
    // `off`/`none` are accepted as aliases for backward-compat with the old
    // hand-rolled `apply_env`, which mapped them to Disabled.
    #[serde(alias = "off", alias = "none")]
    Disabled,
 }
@@ -129,48 +134,162 @@ impl Config {
        toml::from_str(&text).map_err(|e| crate::Error::Config(e.to_string()))
    }
-    /// Apply environment variable overrides. Env var names follow the pattern
+    /// Load configuration with layered precedence (v0.5.4, via `figment`):
-    /// `OPENPXE_<SECTION>_<FIELD>`, uppercase. Unknown vars are ignored.
+    /// built-in [`Default`] → optional TOML file → `OPENPXE_*` environment
-    /// Call this after loading the TOML file so env takes precedence.
+    /// (highest). Replaces the old `from_toml_file` + `apply_env` two-step
-    pub fn apply_env(&mut self) {
+    /// and now covers **every** field automatically (the previous hand-rolled
-        if let Ok(v) = std::env::var("OPENPXE_HTTP_PORT") {
+    /// mapping silently skipped `unattended_dir`, the bind addresses, etc.).
-            if let Ok(p) = v.parse() {
+    ///
-                self.server.http_port = p;
+    /// The env layer preserves the historical flat names
    /// (`OPENPXE_HTTP_PORT`, `OPENPXE_ISO_DIR`, …) so existing deployments
    /// (the Unraid template, `entrypoint.sh`) keep working unchanged, and
    /// additionally accepts the explicit nested form
    /// `OPENPXE_<SECTION>__<FIELD>` (double underscore).
    pub fn load(path: Option<&Path>) -> crate::Result<Self> {
        let mut fig = Figment::from(Serialized::defaults(Config::default()));
        if let Some(p) = path {
            if p.exists() {
                fig = fig.merge(Toml::file(p));
            }
        }
-        if let Ok(v) = std::env::var("OPENPXE_TFTP_PORT") {
+        fig = fig.merge(env_provider());
-            if let Ok(p) = v.parse() {
+        fig.extract()
-                self.server.tftp_port = p;
+            .map_err(|e| crate::Error::Config(e.to_string()))
    }
-        }
+}
-        if let Ok(v) = std::env::var("OPENPXE_DHCP_PORT") {
+
-            if let Ok(p) = v.parse() {
+/// The `OPENPXE_*` environment provider. Maps the historical flat variable
-                self.network.dhcp_port = p;
+/// names onto the nested [`Config`] fields, and also accepts the explicit
-            }
+/// `OPENPXE_SECTION__FIELD` nested form. Keys that match nothing (e.g.
-        }
+/// `OPENPXE_CONFIG`, `OPENPXE_UID` from the entrypoint) become stray
-        if let Ok(v) = std::env::var("OPENPXE_PUBLIC_IP") {
+/// top-level keys that `Config` ignores on extract.
-            if let Ok(ip) = v.parse() {
+fn env_provider() -> Env {
-                self.server.public_ip = Some(ip);
+    Env::prefixed("OPENPXE_")
-            }
+        .map(|key| {
-        }
+            // Lowercase so the match is robust regardless of how the OS
-        if let Ok(v) = std::env::var("OPENPXE_DHCP_MODE") {
+            // reports the var's case.
-            self.network.dhcp_mode = match v.to_ascii_lowercase().as_str() {
+            let k = key.as_str().to_ascii_lowercase();
-                "proxy" => DhcpMode::Proxy,
+            let mapped = match k.as_str() {
-                "disabled" | "off" | "none" => DhcpMode::Disabled,
+                "http_port" => "server.http_port",
-                _ => self.network.dhcp_mode,
+                "http_bind" => "server.http_bind",
                "tftp_port" => "server.tftp_port",
                "tftp_bind" => "server.tftp_bind",
                "public_ip" => "server.public_ip",
                "dhcp_port" => "network.dhcp_port",
                "dhcp_bind" => "network.dhcp_bind",
                "dhcp_mode" => "network.dhcp_mode",
                "pxe_port" => "network.pxe_port",
                "iso_dir" => "paths.iso_dir",
                "work_dir" => "paths.work_dir",
                "ipxe_dir" => "paths.ipxe_dir",
                "smb_dir" => "paths.smb_dir",
                "wimboot_path" => "paths.wimboot_path",
                "unattended_dir" => "paths.unattended_dir",
                // Unknown: support the explicit nested form
                // (OPENPXE_SERVER__HTTP_PORT). `replace` is a no-op for the
                // already-handled flat names above.
                other => return other.replace("__", ".").into(),
            };
            mapped.into()
        })
        .split(".")
 }
 #[cfg(test)]
 mod tests {
    // figment's `Jail::expect_with` closure returns `Result<(), figment::Error>`
    // and `figment::Error` is large; that's the library's API, not ours.
    #![allow(clippy::result_large_err)]
    use super::*;
    #[test]
    fn defaults_load_when_no_file_or_env() {
        figment::Jail::expect_with(|_jail| {
            let c = Config::load(None).expect("load defaults");
            assert_eq!(c.server.http_port, 80);
            assert_eq!(c.network.dhcp_mode, DhcpMode::Proxy);
            assert_eq!(c.paths.iso_dir, PathBuf::from("/var/lib/openpxe/isos"));
            Ok(())
        });
    }
-        if let Ok(v) = std::env::var("OPENPXE_ISO_DIR") {
+
-            self.paths.iso_dir = PathBuf::from(v);
+    #[test]
    fn legacy_flat_env_vars_still_apply() {
        figment::Jail::expect_with(|jail| {
            jail.set_env("OPENPXE_HTTP_PORT", "8123");
            jail.set_env("OPENPXE_TFTP_PORT", "6900");
            jail.set_env("OPENPXE_DHCP_PORT", "6767");
            jail.set_env("OPENPXE_PXE_PORT", "4444");
            jail.set_env("OPENPXE_PUBLIC_IP", "10.20.30.40");
            jail.set_env("OPENPXE_DHCP_MODE", "disabled");
            jail.set_env("OPENPXE_ISO_DIR", "/data/isos");
            jail.set_env("OPENPXE_WORK_DIR", "/data/work");
            jail.set_env("OPENPXE_IPXE_DIR", "/data/ipxe");
            jail.set_env("OPENPXE_SMB_DIR", "/data/smb");
            // v0.5.4: a field the old apply_env never covered.
            jail.set_env("OPENPXE_UNATTENDED_DIR", "/data/unattended");
            let c = Config::load(None).expect("load with env");
            assert_eq!(c.server.http_port, 8123);
            assert_eq!(c.server.tftp_port, 6900);
            assert_eq!(c.network.dhcp_port, 6767);
            assert_eq!(c.network.pxe_port, 4444);
            assert_eq!(c.server.public_ip, Some("10.20.30.40".parse().unwrap()));
            assert_eq!(c.network.dhcp_mode, DhcpMode::Disabled);
            assert_eq!(c.paths.iso_dir, PathBuf::from("/data/isos"));
            assert_eq!(c.paths.work_dir, PathBuf::from("/data/work"));
            assert_eq!(c.paths.ipxe_dir, PathBuf::from("/data/ipxe"));
            assert_eq!(c.paths.smb_dir, PathBuf::from("/data/smb"));
            assert_eq!(c.paths.unattended_dir, PathBuf::from("/data/unattended"));
            Ok(())
        });
    }
-        if let Ok(v) = std::env::var("OPENPXE_WORK_DIR") {
+
-            self.paths.work_dir = PathBuf::from(v);
+    #[test]
    fn dhcp_mode_off_alias_maps_to_disabled() {
        figment::Jail::expect_with(|jail| {
            jail.set_env("OPENPXE_DHCP_MODE", "off");
            let c = Config::load(None).unwrap();
            assert_eq!(c.network.dhcp_mode, DhcpMode::Disabled);
            Ok(())
        });
    }
-        if let Ok(v) = std::env::var("OPENPXE_IPXE_DIR") {
+
-            self.paths.ipxe_dir = PathBuf::from(v);
+    #[test]
    fn nested_double_underscore_form_also_works() {
        figment::Jail::expect_with(|jail| {
            jail.set_env("OPENPXE_SERVER__HTTP_PORT", "9001");
            let c = Config::load(None).unwrap();
            assert_eq!(c.server.http_port, 9001);
            Ok(())
        });
    }
-        if let Ok(v) = std::env::var("OPENPXE_SMB_DIR") {
+
-            self.paths.smb_dir = PathBuf::from(v);
+    #[test]
    fn env_overrides_toml_file() {
        figment::Jail::expect_with(|jail| {
            jail.create_file(
                "openpxe.toml",
                "[server]\nhttp_port = 8080\n[paths]\niso_dir = \"/from/toml\"\n",
            )?;
            jail.set_env("OPENPXE_HTTP_PORT", "8443");
            let c = Config::load(Some(Path::new("openpxe.toml"))).unwrap();
            // env wins over TOML…
            assert_eq!(c.server.http_port, 8443);
            // …but TOML-only values still apply.
            assert_eq!(c.paths.iso_dir, PathBuf::from("/from/toml"));
            Ok(())
        });
    }
    #[test]
    fn unrelated_openpxe_env_vars_are_ignored() {
        figment::Jail::expect_with(|jail| {
            // entrypoint.sh sets these; they must not break config load.
            jail.set_env("OPENPXE_UID", "10001");
            jail.set_env("OPENPXE_CONFIG", "/etc/openpxe.toml");
            let c = Config::load(None).expect("stray vars ignored");
            assert_eq!(c.server.http_port, 80);
            Ok(())
        });
    }
 }
@@ -0,0 +1,65 @@
 //! Small, dependency-free encoding helpers shared across crates.
 //!
 //! v0.5.4: `pct_encode` and `xml_escape` were duplicated in the SAML
 //! modules and the HTTP layer; they live here now. They're deliberately
 //! hand-rolled rather than pulling in `percent-encoding` / `url`: the
 //! unreserved set below is exactly the RFC 3986 set that iPXE's
 //! `:uristring` modifier and the SAML HTTP-Redirect binding both expect,
 //! and a general-purpose URL crate escapes a different set.
 use std::fmt::Write as _;
 /// Percent-encode `s` per RFC 3986: the unreserved set
 /// (`A-Z` `a-z` `0-9` `-` `_` `.` `~`) passes through unchanged; every
 /// other byte becomes `%XX` (uppercase hex).
 #[must_use]
 pub fn pct_encode(s: &str) -> String {
    let mut out = String::with_capacity(s.len());
    for b in s.bytes() {
        match b {
            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => {
                out.push(b as char);
            }
            _ => {
                let _ = write!(out, "%{b:02X}");
            }
        }
    }
    out
 }
 /// Escape the five XML predefined entities so `s` is safe inside element
 /// text or a double-quoted attribute value.
 #[must_use]
 pub fn xml_escape(s: &str) -> String {
    let mut out = String::with_capacity(s.len());
    for c in s.chars() {
        match c {
            '&' => out.push_str("&amp;"),
            '<' => out.push_str("&lt;"),
            '>' => out.push_str("&gt;"),
            '"' => out.push_str("&quot;"),
            '\'' => out.push_str("&apos;"),
            _ => out.push(c),
        }
    }
    out
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    #[test]
    fn pct_encode_unreserved_passthrough_else_hex() {
        assert_eq!(pct_encode("node-7.lab_1~"), "node-7.lab_1~");
        assert_eq!(pct_encode("aa:bb cc/?&="), "aa%3Abb%20cc%2F%3F%26%3D");
        assert_eq!(pct_encode(""), "");
    }
    #[test]
    fn xml_escape_all_five_entities() {
        assert_eq!(xml_escape("a&b<c>\"d'e"), "a&amp;b&lt;c&gt;&quot;d&apos;e");
        assert_eq!(xml_escape("plain text"), "plain text");
    }
 }
@@ -8,6 +8,7 @@ pub mod boot_log;
 pub mod branding;
 pub mod client;
 pub mod config;
 pub mod encoding;
 pub mod error;
 pub mod host_bindings;
 pub mod log_bus;
@@ -5,7 +5,6 @@
 //! appended as the `SAMLRequest` query parameter. AuthnRequests are sent
 //! unsigned in this release (the IdP must not require client signatures).
 use std::fmt::Write as _;
 use std::io::Write as _;
 use base64::Engine;
@@ -15,6 +14,7 @@ use time::format_description::well_known::Rfc3339;
 use time::OffsetDateTime;
 use super::{SamlError, SpParams};
 use crate::encoding::{pct_encode, xml_escape};
 const NS_PROTOCOL: &str = "urn:oasis:names:tc:SAML:2.0:protocol";
 const NS_ASSERTION: &str = "urn:oasis:names:tc:SAML:2.0:assertion";
@@ -79,37 +79,8 @@ fn deflate_base64(xml: &str) -> Result<String, SamlError> {
    Ok(base64::engine::general_purpose::STANDARD.encode(compressed))
 }
-/// Percent-encode a query-string component (RFC 3986 unreserved set passes
+// `pct_encode` + `xml_escape` now live in `openpxe_core::encoding` (v0.5.4)
-/// through; everything else is `%XX`).
+// — imported above.
 fn pct_encode(s: &str) -> String {
    let mut out = String::with_capacity(s.len() * 3);
    for b in s.bytes() {
        match b {
            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => {
                out.push(b as char);
            }
            _ => {
                let _ = write!(out, "%{b:02X}");
            }
        }
    }
    out
 }
 fn xml_escape(s: &str) -> String {
    let mut out = String::with_capacity(s.len());
    for c in s.chars() {
        match c {
            '&' => out.push_str("&amp;"),
            '<' => out.push_str("&lt;"),
            '>' => out.push_str("&gt;"),
            '"' => out.push_str("&quot;"),
            '\'' => out.push_str("&apos;"),
            _ => out.push(c),
        }
    }
    out
 }
 #[cfg(test)]
 mod tests {
@@ -7,6 +7,7 @@
 use base64::Engine;
 use super::{SamlError, SpParams};
 use crate::encoding::xml_escape;
 /// SAML 2.0 binding URIs.
 pub const BINDING_REDIRECT: &str = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect";
@@ -148,21 +149,7 @@ fn node_text(n: &roxmltree::Node<'_, '_>) -> String {
        .collect()
 }
-/// Minimal XML attribute/text escaping for the values we interpolate.
+// `xml_escape` now lives in `openpxe_core::encoding` (v0.5.4) — imported above.
 fn xml_escape(s: &str) -> String {
    let mut out = String::with_capacity(s.len());
    for c in s.chars() {
        match c {
            '&' => out.push_str("&amp;"),
            '<' => out.push_str("&lt;"),
            '>' => out.push_str("&gt;"),
            '"' => out.push_str("&quot;"),
            '\'' => out.push_str("&apos;"),
            _ => out.push(c),
        }
    }
    out
 }
 #[cfg(test)]
 mod tests {
@@ -33,8 +33,6 @@ thiserror.workspace = true
 anyhow.workspace = true
 bytes.workspace = true
 futures.workspace = true
 mime.workspace = true
 mime_guess.workspace = true
 uuid.workspace = true
 # v0.4.5 Forms auth: lock-free session store and cookie helpers.
 parking_lot.workspace = true
@@ -61,3 +59,9 @@ image = { version = "0.25", default-features = false, features = ["png"] }
 # replay, and IdP-initiated-gating flows exercise real signatures.
 rcgen = "0.13"
 bergshamra = { workspace = true }
 # v0.5.4: snapshot the generated iPXE menu so any unintended drift (a
 # dropped line, reordered item) is caught and reviewed, not silently shipped.
 insta = "1.40"
 # v0.5.4: stand up a mock HTTP server to exercise the SAML metadata-URL
 # fetch path (previously untested because it did a real network GET).
 wiremock = "0.6"
@@ -14,6 +14,7 @@
 //! | `/api/*`         | JSON/HTML API for the web UI                          |
 use crate::auth as auth_api;
 use crate::error::AppError;
 use crate::ipxe_script::{
    render_entry, render_family_menu, render_local_hdd, render_menu, render_nic_info,
    render_queue_entry, render_shell, render_tools_menu, render_util,
@@ -31,15 +32,15 @@ use axum::{
    Json, Router,
 };
 use openpxe_core::{
-    ext_for_mime, wol, BootEvent, ClientEvent, DeployProfile, Error, LogoSlot, NotifyConfig,
+    encoding::pct_encode, ext_for_mime, wol, BootEvent, ClientEvent, DeployProfile, Error,
-    Settings, SsoConfig, ALLOWED_LOGO_MIMES, MAX_LOGO_BYTES,
+    LogoSlot, NotifyConfig, Settings, SsoConfig, ALLOWED_LOGO_MIMES, MAX_LOGO_BYTES,
 };
 use openpxe_ipxe_assets::asset_bytes;
 use openpxe_iso_store::{
-    render_template, IsoCategory, IsoMeta, IsoSource, NfsAddRequest, SmbAddRequest, UnattendedKind,
+    render_template, IsoCategory, IsoMeta, IsoSource, NfsAddRequest, SftpAddRequest, SmbAddRequest,
-    UnattendedMeta,
+    SmbState, UnattendedKind, UnattendedMeta,
 };
-use serde::Deserialize;
+use serde::{Deserialize, Serialize};
 use serde_json::json;
 use std::net::SocketAddr;
 use std::time::Duration;
@@ -187,6 +188,15 @@ pub fn build_router(state: AppState) -> Router {
        )
        .route("/api/nfs-shares/:id", delete(api_nfs_shares_remove))
        .route("/api/nfs-shares/:id/scan", post(api_nfs_shares_scan))
        // v0.5.5: SFTP-over-SSH share manager (pure-Rust russh client).
        // Parallel to SMB/NFS so the UI reuses the same form/error/hint
        // rendering. Like NFS, SFTP-sourced ISOs support Range requests.
        .route(
            "/api/sftp-shares",
            get(api_sftp_shares_list).post(api_sftp_shares_add),
        )
        .route("/api/sftp-shares/:id", delete(api_sftp_shares_remove))
        .route("/api/sftp-shares/:id/scan", post(api_sftp_shares_scan))
        // Phase 4: Network info (read-only) + DNS edit.
        .route("/api/network", get(api_network).put(api_network_put))
        // Phase 4: live-log stream + recent buffer for the Terminal tab.
@@ -241,12 +251,12 @@ async fn api_sso_get(State(state): State<AppState>) -> Json<SsoConfig> {
    Json(state.sso.snapshot())
 }
-async fn api_sso_put(State(state): State<AppState>, Json(body): Json<SsoConfig>) -> Response {
+async fn api_sso_put(
-    match state.sso.replace(body) {
+    State(state): State<AppState>,
-        Ok(cfg) => (StatusCode::OK, Json(cfg)).into_response(),
+    Json(body): Json<SsoConfig>,
-        Err(Error::Invalid(msg)) => (StatusCode::BAD_REQUEST, msg).into_response(),
+) -> Result<Json<SsoConfig>, AppError> {
-        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
+    // v0.5.4: `?` + AppError centralizes Invalid→400 / _→500.
-    }
+    Ok(Json(state.sso.replace(body)?))
 }
 // ─── UI ────────────────────────────────────────────────────────────────────
@@ -855,6 +865,57 @@ async fn iso_raw(
                Err(e) => (StatusCode::BAD_GATEWAY, format!("nfs stream: {e}")).into_response(),
            }
        }
        IsoSource::Sftp {
            share_id,
            relative_path,
        } => {
            // v0.5.5: SFTP sources support Range requests because SFTP
            // opens a seekable file handle (seek to offset, then bounded
            // reads). Identical handling to the NFS arm above.
            let total = meta.size_bytes;
            let range = match parse_range(headers.get(header::RANGE), total) {
                Some(triple) => triple,
                None if headers.get(header::RANGE).is_some() => {
                    return Response::builder()
                        .status(StatusCode::RANGE_NOT_SATISFIABLE)
                        .header(header::CONTENT_RANGE, format!("bytes */{total}"))
                        .body(Body::empty())
                        .unwrap();
                }
                // No Range header — serve the whole file.
                None => (0, total.saturating_sub(1), false),
            };
            let (start, end, partial) = range;
            let len = if total == 0 { 0 } else { end - start + 1 };
            let max_len = if total == 0 { None } else { Some(len) };
            match state
                .sftp_shares
                .stream_iso(share_id, relative_path, start, max_len)
                .await
            {
                Ok(stream) => {
                    let body = Body::from_stream(stream);
                    let status = if partial {
                        StatusCode::PARTIAL_CONTENT
                    } else {
                        StatusCode::OK
                    };
                    let mut builder = Response::builder()
                        .status(status)
                        .header(header::CONTENT_TYPE, "application/octet-stream")
                        .header(header::ACCEPT_RANGES, "bytes")
                        .header(header::CONTENT_LENGTH, len);
                    if partial {
                        builder = builder.header(
                            header::CONTENT_RANGE,
                            format!("bytes {start}-{end}/{total}"),
                        );
                    }
                    builder.body(body).unwrap()
                }
                Err(e) => (StatusCode::BAD_GATEWAY, format!("sftp stream: {e}")).into_response(),
            }
        }
    }
 }
@@ -1198,14 +1259,12 @@ async fn api_branding_upload(
 async fn api_branding_clear(
    State(state): State<AppState>,
    AxumPath(slot): AxumPath<String>,
-) -> Response {
+) -> Result<Response, AppError> {
    let Some(slot) = LogoSlot::parse(&slot) else {
-        return (StatusCode::BAD_REQUEST, "unknown logo slot").into_response();
+        return Ok((StatusCode::BAD_REQUEST, "unknown logo slot").into_response());
    };
-    match state.branding.clear_logo(slot) {
+    state.branding.clear_logo(slot)?;
-        Ok(()) => StatusCode::NO_CONTENT.into_response(),
+    Ok(StatusCode::NO_CONTENT.into_response())
        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
    }
 }
 // ─── Unattended answer files (v0.5.2) ──────────────────────────────────────
@@ -1221,7 +1280,9 @@ async fn api_unattended_list(State(state): State<AppState>) -> Json<serde_json::
 async fn api_unattended_upload(
    State(state): State<AppState>,
    mut multipart: Multipart,
-) -> Response {
+) -> Result<Response, AppError> {
    // v0.5.4: the answer-file add() maps Invalid→400 / _→500 via `?`+AppError.
    // The multipart-shape 400s (missing field/filename) stay explicit.
    while let Ok(Some(field)) = multipart.next_field().await {
        let name = field.name().unwrap_or("").to_string();
        if name != "file" && name != "unattended" {
@@ -1229,19 +1290,18 @@ async fn api_unattended_upload(
        }
        let filename = field.file_name().map(str::to_string).unwrap_or_default();
        if filename.trim().is_empty() {
-            return (StatusCode::BAD_REQUEST, "missing filename on upload").into_response();
+            return Ok((StatusCode::BAD_REQUEST, "missing filename on upload").into_response());
        }
        let bytes = match field.bytes().await {
            Ok(b) => b,
-            Err(e) => return (StatusCode::BAD_REQUEST, format!("read body: {e}")).into_response(),
+            Err(e) => {
-        };
+                return Ok((StatusCode::BAD_REQUEST, format!("read body: {e}")).into_response())
        return match state.unattended.add(&filename, &bytes).await {
            Ok(meta) => (StatusCode::CREATED, Json(meta)).into_response(),
            Err(Error::Invalid(msg)) => (StatusCode::BAD_REQUEST, msg).into_response(),
            Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
        };
            }
-    (StatusCode::BAD_REQUEST, "no 'file' part").into_response()
+        };
        let meta = state.unattended.add(&filename, &bytes).await?;
        return Ok((StatusCode::CREATED, Json(meta)).into_response());
    }
    Ok((StatusCode::BAD_REQUEST, "no 'file' part").into_response())
 }
 async fn api_unattended_delete(
@@ -1379,23 +1439,7 @@ fn build_query(pairs: &[(&str, Option<&str>)]) -> String {
    out
 }
-/// Minimal RFC 3986 percent-encoding for query values (unreserved set
+// `pct_encode` lives in `openpxe_core::encoding` (v0.5.4) — imported above.
 /// passes through; everything else becomes `%XX`).
 fn pct_encode(s: &str) -> String {
    use std::fmt::Write as _;
    let mut out = String::with_capacity(s.len());
    for b in s.bytes() {
        match b {
            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => {
                out.push(b as char);
            }
            _ => {
                let _ = write!(out, "%{b:02X}");
            }
        }
    }
    out
 }
 /// Encode `(hostname, ip, mac)` into a single base64url path segment for
 /// the cloud-init seed directory. Empty values become empty fields.
@@ -1506,6 +1550,19 @@ async fn api_docs() -> Json<serde_json::Value> {
                     "summary": "Re-list a share for new ISOs."},
                ],
            },
            {
                "name": "SFTP shares",
                "endpoints": [
                    {"method": "GET", "path": "/api/sftp-shares",
                     "summary": "List configured SFTP-over-SSH shares with connection state and iso counts."},
                    {"method": "POST", "path": "/api/sftp-shares",
                     "summary": "Register an SFTP share. Body: { server, export, username, port?, password? | private_key? + passphrase? }. The server's SSH host key is pinned trust-on-first-use."},
                    {"method": "DELETE", "path": "/api/sftp-shares/:id",
                     "summary": "Forget a share, drop its entries from the ISO store, and scrub its credentials file."},
                    {"method": "POST", "path": "/api/sftp-shares/:id/scan",
                     "summary": "Re-list a share for new ISOs."},
                ],
            },
            {
                "name": "Network",
                "endpoints": [
@@ -1948,7 +2005,51 @@ async fn api_list_clients(State(state): State<AppState>) -> Json<serde_json::Val
    Json(json!({ "clients": state.clients.list() }))
 }
-async fn api_status(State(state): State<AppState>) -> Json<serde_json::Value> {
+/// Per-theme branding presence, nested under [`StatusResponse::branding`].
 #[derive(Serialize)]
 struct BrandingStatus {
    light: bool,
    dark: bool,
    client: bool,
    rev: u64,
 }
 /// Dashboard status payload. v0.5.4: this replaced a 25-key hand-built
 /// `json!` blob — the typed struct makes the contract with the WebUI
 /// compile-checked. Field names ARE the JSON keys; do not rename without
 /// updating `crates/webui/src/app.js` (a `full_flow` test guards the set).
 /// `settings` / `smb` / `started_at` embed their own `Serialize` impls so
 /// the wire shape is byte-identical to the previous `json!` output.
 #[derive(Serialize)]
 struct StatusResponse {
    version: &'static str,
    public_base_url: String,
    iso_count: usize,
    client_count: usize,
    queue_count: usize,
    imaging_count: usize,
    waiting_count: usize,
    ipxe_assets: Vec<String>,
    settings: Settings,
    smb: Option<SmbState>,
    smb_share_count: usize,
    smb_share_reachable: usize,
    nfs_share_count: usize,
    nfs_share_reachable: usize,
    sftp_share_count: usize,
    sftp_share_reachable: usize,
    host_bindings: usize,
    custom_logo: bool,
    branding: BrandingStatus,
    unattended_count: usize,
    uptime_secs: i64,
    started_at: time::OffsetDateTime,
    nic_name: String,
    subnet_mask: String,
    gateway: String,
 }
 async fn api_status(State(state): State<AppState>) -> Json<StatusResponse> {
    let smb = state.smb.as_ref().map(|s| s.snapshot());
    // v0.4.65+v0.4.67: external storage shares — SMB (userspace
    // smbclient) and NFS (in-process nfs3_client). Dashboard tile
@@ -1957,6 +2058,9 @@ async fn api_status(State(state): State<AppState>) -> Json<serde_json::Value> {
    let smb_reachable = smb_shares.iter().filter(|m| m.reachable).count();
    let nfs_shares = state.nfs_shares.list();
    let nfs_reachable = nfs_shares.iter().filter(|m| m.reachable).count();
    // v0.5.5: SFTP shares fold into the same "reachable shares" tile.
    let sftp_shares = state.sftp_shares.list();
    let sftp_reachable = sftp_shares.iter().filter(|m| m.reachable).count();
    let isos = state.iso_store.list();
    let clients = state.clients.list();
    let queue_entries = state.queue.list();
@@ -1977,43 +2081,46 @@ async fn api_status(State(state): State<AppState>) -> Json<serde_json::Value> {
        .set_queue_counts(queue_entries.len() as u64, imaging as u64);
    state
        .metrics
-        .set_nfs_active((smb_reachable + nfs_reachable) as u64);
+        .set_nfs_active((smb_reachable + nfs_reachable + sftp_reachable) as u64);
    state.metrics.record_http(openpxe_core::HttpRoute::Api);
    let now = time::OffsetDateTime::now_utc();
    let uptime_secs = (now - state.started_at).whole_seconds().max(0);
-    Json(json!({
+    Json(StatusResponse {
-        "version": env!("CARGO_PKG_VERSION"),
+        version: env!("CARGO_PKG_VERSION"),
-        "public_base_url": state.public_base_url,
+        public_base_url: state.public_base_url.clone(),
-        "iso_count": isos.len(),
+        iso_count: isos.len(),
-        "client_count": clients.len(),
+        client_count: clients.len(),
-        "queue_count": queue_entries.len(),
+        queue_count: queue_entries.len(),
-        "imaging_count": imaging,
+        imaging_count: imaging,
-        "waiting_count": waiting,
+        waiting_count: waiting,
-        "ipxe_assets": openpxe_ipxe_assets::list_assets(),
+        ipxe_assets: openpxe_ipxe_assets::list_assets(),
-        "settings": state.settings.snapshot(),
+        settings: state.settings.snapshot(),
-        "smb": smb,
+        smb,
-        "smb_share_count": smb_shares.len(),
+        smb_share_count: smb_shares.len(),
-        "smb_share_reachable": smb_reachable,
+        smb_share_reachable: smb_reachable,
-        // v0.4.67: NFSv3 share counts. The dashboard tile sums these
+        // v0.4.67: NFSv3 share counts. The dashboard tile sums these with
-        // with the SMB counts above ("N shares reachable") so the
+        // the SMB counts above ("N shares reachable") so the top-line
-        // top-line metric works regardless of protocol mix.
+        // metric works regardless of protocol mix.
-        "nfs_share_count": nfs_shares.len(),
+        nfs_share_count: nfs_shares.len(),
-        "nfs_share_reachable": nfs_reachable,
+        nfs_share_reachable: nfs_reachable,
-        "host_bindings": state.hosts.len(),
+        // v0.5.5: SFTP share counts, summed into the same dashboard tile.
-        "custom_logo": state.branding.has_any_web_logo(),
+        sftp_share_count: sftp_shares.len(),
-        "branding": {
+        sftp_share_reachable: sftp_reachable,
-            "light": state.branding.has_logo(LogoSlot::Light),
+        host_bindings: state.hosts.len(),
-            "dark": state.branding.has_logo(LogoSlot::Dark),
+        custom_logo: state.branding.has_any_web_logo(),
-            "client": state.branding.has_logo(LogoSlot::Client),
+        branding: BrandingStatus {
-            "rev": state.branding.logo_rev(),
+            light: state.branding.has_logo(LogoSlot::Light),
            dark: state.branding.has_logo(LogoSlot::Dark),
            client: state.branding.has_logo(LogoSlot::Client),
            rev: state.branding.logo_rev(),
        },
-        "unattended_count": state.unattended.len(),
+        unattended_count: state.unattended.len(),
-        "uptime_secs": uptime_secs,
+        uptime_secs,
-        "started_at": state.started_at,
+        started_at: state.started_at,
-        "nic_name": state.nic_name,
+        nic_name: state.nic_name.clone(),
-        "subnet_mask": state.subnet_mask,
+        subnet_mask: state.subnet_mask.clone(),
-        "gateway": state.gateway,
+        gateway: state.gateway.clone(),
-    }))
+    })
 }
 async fn api_get_settings(State(state): State<AppState>) -> Json<Settings> {
@@ -2322,6 +2429,48 @@ async fn api_nfs_shares_scan(
    }
 }
 // ─── SFTP share API (v0.5.5) ───────────────────────────────────────────────
 //
 // Parallel to the NFS shares API. The pure-Rust `russh` + `russh-sftp`
 // client gives us in-process listing and streaming, no subprocess. Like
 // NFS (and unlike SMB), SFTP-sourced ISOs support HTTP Range requests —
 // SFTP opens a seekable file handle. Auth is password OR SSH private
 // key; the server's host key is pinned trust-on-first-use.
 async fn api_sftp_shares_list(State(state): State<AppState>) -> Json<serde_json::Value> {
    Json(json!({ "shares": state.sftp_shares.list() }))
 }
 async fn api_sftp_shares_add(
    State(state): State<AppState>,
    Json(req): Json<SftpAddRequest>,
 ) -> Response {
    match state.sftp_shares.add(req).await {
        Ok(s) => (StatusCode::CREATED, Json(s)).into_response(),
        Err(err) => (StatusCode::BAD_REQUEST, Json(err)).into_response(),
    }
 }
 async fn api_sftp_shares_remove(
    State(state): State<AppState>,
    AxumPath(id): AxumPath<String>,
 ) -> Response {
    match state.sftp_shares.remove(&id).await {
        Ok(()) => StatusCode::NO_CONTENT.into_response(),
        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
    }
 }
 async fn api_sftp_shares_scan(
    State(state): State<AppState>,
    AxumPath(id): AxumPath<String>,
 ) -> Response {
    match state.sftp_shares.rescan(&id).await {
        Ok(n) => Json(json!({ "ok": true, "iso_count": n })).into_response(),
        Err(e) => (StatusCode::BAD_REQUEST, format!("{e}")).into_response(),
    }
 }
 // ─── Network info API ──────────────────────────────────────────────────────
 async fn api_network(State(state): State<AppState>) -> Json<serde_json::Value> {
@@ -2689,7 +2838,16 @@ async fn api_metrics(State(state): State<AppState>) -> Response {
        .iter()
        .filter(|m| m.reachable)
        .count();
-    state.metrics.set_nfs_active((smb_ok + nfs_ok) as u64);
+    // v0.5.5: SFTP shares fold into the same reachable-shares gauge.
    let sftp_ok = state
        .sftp_shares
        .list()
        .iter()
        .filter(|m| m.reachable)
        .count();
    state
        .metrics
        .set_nfs_active((smb_ok + nfs_ok + sftp_ok) as u64);
    let now = time::OffsetDateTime::now_utc();
    let uptime = (now - state.started_at).whole_seconds().max(0) as u64;
@@ -0,0 +1,92 @@
 //! Uniform HTTP error mapping for the API layer (v0.5.4).
 //!
 //! Before this, ~40 handlers in `app.rs` hand-wrote
 //! `match … { Err(e) => (StatusCode::…, format!("{e}")).into_response() }`,
 //! and the `openpxe_core::Error` → status mapping drifted between them
 //! (e.g. `Invalid` → 400 in most places, 404 in one). [`AppError`] wraps
 //! `openpxe_core::Error` so a handler can return `Result<T, AppError>` and
 //! `?` its way out, getting one consistent status + body. The body stays
 //! plain-text (matching the previous `(StatusCode, String)` responses) so
 //! existing clients and tests see no shape change; 5xx detail is logged
 //! and returned verbatim exactly as before.
 //!
 //! Handlers with *intentional* domain-specific statuses (e.g. a duplicate
 //! share → 409, a still-open chunked upload → 409) keep their explicit
 //! returns — `AppError` is for the common case, not a straitjacket.
 use axum::http::StatusCode;
 use axum::response::{IntoResponse, Response};
 use openpxe_core::Error as CoreError;
 /// Newtype over [`openpxe_core::Error`] with a uniform [`IntoResponse`].
 #[derive(Debug)]
 pub struct AppError(pub CoreError);
 impl From<CoreError> for AppError {
    fn from(e: CoreError) -> Self {
        AppError(e)
    }
 }
 impl From<std::io::Error> for AppError {
    fn from(e: std::io::Error) -> Self {
        AppError(CoreError::Io(e))
    }
 }
 impl AppError {
    /// The HTTP status this error maps to. Public so handlers (and tests)
    /// can reason about the mapping in one place.
    #[must_use]
    pub fn status(&self) -> StatusCode {
        match self.0 {
            CoreError::NotFound(_) => StatusCode::NOT_FOUND,
            CoreError::Invalid(_) => StatusCode::BAD_REQUEST,
            CoreError::Config(_) | CoreError::Io(_) | CoreError::Other(_) => {
                StatusCode::INTERNAL_SERVER_ERROR
            }
        }
    }
 }
 impl IntoResponse for AppError {
    fn into_response(self) -> Response {
        let status = self.status();
        // Match the prior hand-written responses: the 4xx arms returned the
        // bare inner message (not the `Display` prefix), so a UI showing
        // `await r.text()` reads "metadata too long", not "invalid input:
        // metadata too long". 5xx keeps the full `Display` string.
        let body = match &self.0 {
            CoreError::Invalid(m) | CoreError::NotFound(m) => m.clone(),
            other => other.to_string(),
        };
        if status.is_server_error() {
            // Log the full detail server-side; the body still carries it
            // (unchanged from the prior `format!("{e}")` behaviour), but the
            // log line is what an operator greps for.
            tracing::error!(target: "openpxe::http", error = %self.0, "request failed");
        }
        (status, body).into_response()
    }
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    #[test]
    fn status_mapping_is_consistent() {
        assert_eq!(
            AppError(CoreError::NotFound("x".into())).status(),
            StatusCode::NOT_FOUND
        );
        assert_eq!(
            AppError(CoreError::Invalid("x".into())).status(),
            StatusCode::BAD_REQUEST
        );
        assert_eq!(
            AppError(CoreError::Config("x".into())).status(),
            StatusCode::INTERNAL_SERVER_ERROR
        );
    }
 }
@@ -61,16 +61,24 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
    // returns a full-screen 1024×768 PNG now — the operator's logo on a
    // dark field, or a default OpenPXE mark when none is uploaded. The
    // `--top 290` reserves the top band (where the logo paints) so the
-    // menu text lands below it. On an iPXE build *with* `IMAGE_PNG` +
+    // menu text lands below it.
-    // `CONSOLE_FRAMEBUFFER` (our x86_64 UEFI binaries, built from source
+    //
-    // — see deploy/docker/Dockerfile) this paints the background and
+    // v0.5.7: gate the whole command behind `iseq ${platform} efi`.
-    // overlays the menu. On a build *without* PNG support (the fetched
+    // `console --picture` needs IMAGE_PNG + CONSOLE_FRAMEBUFFER, which
-    // BIOS/i386/arm64 binaries) the whole `console --picture …` command
+    // only our from-source UEFI binaries carry (x86_64/arm64 UEFI — see
-    // fails and the `|| console` resets to a clean full-screen text
+    // deploy/docker/Dockerfile). The fetched BIOS `undionly.kpxe` has
-    // menu. Either way there's no ASCII placeholder anymore.
+    // neither, and on legacy BIOS the `--picture` attempt misbehaves
    // *before* the trailing `|| console` fallback can recover (it tries
    // to set a framebuffer mode the BIOS console can't honour). Guarding
    // on platform means BIOS clients never issue the command at all —
    // they drop straight to the plain text menu — while UEFI clients
    // still get the graphical background. A PNG-less UEFI build (e.g. the
    // upstream i386-efi baseline) still falls back gracefully through the
    // same `|| console`. No operator toggle needed; mixed BIOS+UEFI
    // fleets each get the right treatment automatically.
    let _ = writeln!(
        s,
-        "console --picture {base}/branding/pxe-logo --top 290 || console"
+        "iseq ${{platform}} efi && console --picture {base}/branding/pxe-logo --top 290 || console"
    );
    // Map iPXE's ${{buildarch}} + ${{platform}} into the human form the
    // user asked for (e.g. "x86 BIOS", "x86_64 UEFI", "arm64 UEFI").
@@ -693,6 +701,22 @@ mod password_tests {
        assert!(s.contains("arm64 UEFI"), "{s}");
    }
    // v0.5.4: a full snapshot of the rendered top menu. The fragment
    // `assert!`s above check specific invariants; this catches *any* other
    // drift (a reordered item, a dropped line, changed spacing) so it's
    // reviewed deliberately. The OpenPXE version is filtered out so the
    // snapshot doesn't churn on every release bump.
    #[test]
    fn render_menu_snapshot() {
        // Normalize the compile-time version so the snapshot doesn't churn
        // on every release bump (no insta `filters` feature needed).
        let rendered = render_menu(&[], &Settings::default(), "http://10.0.0.5").replace(
            concat!("OpenPXE v", env!("CARGO_PKG_VERSION")),
            "OpenPXE vX.Y.Z",
        );
        insta::assert_snapshot!(rendered);
    }
    #[test]
    fn generated_scripts_do_not_emit_bare_or_trailing_fallbacks() {
        let settings = Settings::default();
@@ -15,6 +15,7 @@
 pub mod app;
 pub mod auth;
 pub mod error;
 pub mod ipxe_script;
 pub mod iso_fs;
 pub mod log_stream;
@@ -336,3 +336,35 @@ fn redirect_with_session(location: &str, session: &str) -> Response {
            IntoResponse::into_response,
        )
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    use wiremock::matchers::method;
    use wiremock::{Mock, MockServer, ResponseTemplate};
    // v0.5.4: exercise the SAML metadata-URL fetch against a mock server —
    // previously this path did a real network GET and had no coverage.
    #[tokio::test]
    async fn fetch_metadata_returns_body_on_200() {
        let server = MockServer::start().await;
        let xml = "<EntityDescriptor>idp</EntityDescriptor>";
        Mock::given(method("GET"))
            .respond_with(ResponseTemplate::new(200).set_body_string(xml))
            .mount(&server)
            .await;
        let got = fetch_metadata(&server.uri()).await.expect("fetch ok");
        assert_eq!(got, xml);
    }
    #[tokio::test]
    async fn fetch_metadata_errors_on_non_2xx() {
        let server = MockServer::start().await;
        Mock::given(method("GET"))
            .respond_with(ResponseTemplate::new(503))
            .mount(&server)
            .await;
        let err = fetch_metadata(&server.uri()).await.unwrap_err();
        assert!(matches!(err, SamlError::Metadata(_)), "got {err:?}");
    }
 }
@@ -0,0 +1,36 @@
 ---
 source: crates/http-api/src/ipxe_script.rs
 expression: rendered
 ---
 #!ipxe
 # OpenPXE top-level menu - auto-generated, do not edit
 set base-url http://10.0.0.5
 set esc:hex 1b
 set cls ${esc:string}[2J
 iseq ${platform} efi && console --picture http://10.0.0.5/branding/pxe-logo --top 290 || console
 set arch-label ${buildarch} ${platform}
 iseq ${buildarch} i386   && iseq ${platform} pcbios && set arch-label x86 BIOS         || iseq ${buildarch} x86_64 && iseq ${platform} efi    && set arch-label x86_64 UEFI      || iseq ${buildarch} arm64  && iseq ${platform} efi    && set arch-label arm64 UEFI       || true
 :menu
 menu OpenPXE - network boot menu
 item --gap
 item --gap -- ------------------------- Default -------------------------
 item local            Boot from Local HDD
 item --gap -- ----------------------- Installers -----------------------
 item --gap -- (no Linux ISOs uploaded)
 item --gap -- (Windows support disabled in Settings)
 item --gap -- -------------------------- Tools --------------------------
 item tools            Tools  >
 item --gap -- ---------------------- Queued Deployment ---------------------
 item queue            Queued Deployment  (join queue)
 item --gap
 item --key x exit     Exit iPXE
 item --gap
 item --gap --                 OpenPXE vX.Y.Z  -  ${arch-label}
 choose --default queue --timeout 600000 target || goto menu
 iseq ${target} local   && chain http://10.0.0.5/boot/_local.ipxe        || goto menu
 iseq ${target} linux   && chain http://10.0.0.5/boot/_linux_menu.ipxe   || goto menu
 iseq ${target} windows && chain http://10.0.0.5/boot/_windows_menu.ipxe || goto menu
 iseq ${target} tools   && chain http://10.0.0.5/boot/_tools_menu.ipxe   || goto menu
 iseq ${target} queue   && chain http://10.0.0.5/boot/_queue.ipxe         || goto menu
 iseq ${target} exit    && exit                                 || goto menu
 goto menu
@@ -5,7 +5,9 @@ use openpxe_core::{
    AdminStore, BootLog, BrandingStore, ClientRegistry, DeploymentQueue, HostBindings, LogBus,
    Metrics, NotifyStore, SettingsStore, SsoStore,
 };
-use openpxe_iso_store::{IsoStore, NfsShareManager, SmbManager, SmbShareManager, UnattendedStore};
+use openpxe_iso_store::{
    IsoStore, NfsShareManager, SftpShareManager, SmbManager, SmbShareManager, UnattendedStore,
 };
 use std::sync::Arc;
 use time::OffsetDateTime;
@@ -67,6 +69,13 @@ pub struct AppState {
    /// In-process (no subprocess); supports HTTP Range requests on
    /// NFS-sourced ISOs because NFSv3 READ3 takes an explicit offset.
    pub nfs_shares: NfsShareManager,
    /// v0.5.5: SFTP-over-SSH share manager — pure-Rust userspace
    /// consumer via `russh` + `russh-sftp` (ring backend, no OpenSSL).
    /// Ships alongside SMB/NFS as the third remote-library protocol.
    /// In-process (no subprocess, no kernel mount); supports HTTP Range
    /// requests because SFTP opens a seekable file handle. Authenticates
    /// the server's SSH host key on a trust-on-first-use basis.
    pub sftp_shares: SftpShareManager,
    /// v0.5.2: uploaded unattended-install answer files (Kickstart /
    /// Preseed / Autoinstall / Windows answer files). Served on demand to
    /// booting clients with per-host hostname/IP/MAC templating; lives in
@@ -96,6 +96,8 @@ async fn dispatch(state: &AppState, argv: &[String]) -> Result<String, String> {
        "share" | "smb-share" => smb_share_command(state, tail).await,
        "smb" => smb_command(state, tail).await,
        "nfs" => nfs_share_command(state, tail).await,
        // v0.5.5: SFTP-over-SSH remote shares (in-process russh client).
        "sftp" => sftp_share_command(state, tail).await,
        "log" => log_command(state, tail),
        "whoami" => Ok("operator".to_string()),
        "echo" => Ok(tail.join(" ")),
@@ -118,17 +120,21 @@ fn status_text(s: &AppState) -> String {
    // v0.4.67: NFSv3 sources too.
    let nfs_shares = s.nfs_shares.list();
    let nfs_reachable = nfs_shares.iter().filter(|m| m.reachable).count();
    // v0.5.5: SFTP-over-SSH sources too.
    let sftp_shares = s.sftp_shares.list();
    let sftp_reachable = sftp_shares.iter().filter(|m| m.reachable).count();
    format!(
        "OpenPXE {ver}\n\
         base url:     {base}\n\
         interface:    {nic}\n\
         uptime:       {up}\n\
-         isos:         {n_isos}  (local: {n_local}, smb: {n_smb}, nfs: {n_nfs})\n\
+         isos:         {n_isos}  (local: {n_local}, smb: {n_smb}, nfs: {n_nfs}, sftp: {n_sftp})\n\
         clients:      {n_clients}\n\
         queue:        {n_entries}\n\
         smb server:   {smb}\n\
         smb shares:   {n_smb_total} configured ({n_smb_active} reachable)\n\
-         nfs shares:   {n_nfs_total} configured ({n_nfs_active} reachable)\n",
+         nfs shares:   {n_nfs_total} configured ({n_nfs_active} reachable)\n\
         sftp shares:  {n_sftp_total} configured ({n_sftp_active} reachable)\n",
        ver = env!("CARGO_PKG_VERSION"),
        base = s.public_base_url,
        nic = if s.nic_name.is_empty() {
@@ -150,6 +156,10 @@ fn status_text(s: &AppState) -> String {
            .iter()
            .filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Nfs { .. }))
            .count(),
        n_sftp = isos
            .iter()
            .filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Sftp { .. }))
            .count(),
        n_clients = clients.len(),
        n_entries = queue_entries.len(),
        smb = smb.map_or_else(|| "(disabled)".into(), |s| format!("{s:?}")),
@@ -157,6 +167,8 @@ fn status_text(s: &AppState) -> String {
        n_smb_active = smb_reachable,
        n_nfs_total = nfs_shares.len(),
        n_nfs_active = nfs_reachable,
        n_sftp_total = sftp_shares.len(),
        n_sftp_active = sftp_reachable,
    )
 }
@@ -177,6 +189,8 @@ fn isos_text(s: &AppState) -> String {
            openpxe_iso_store::IsoSource::Smb { share_id, .. } => format!("smb:{share_id}"),
            // v0.4.67: NFSv3 via in-process nfs3_client.
            openpxe_iso_store::IsoSource::Nfs { share_id, .. } => format!("nfs:{share_id}"),
            // v0.5.5: SFTP-over-SSH via in-process russh.
            openpxe_iso_store::IsoSource::Sftp { share_id, .. } => format!("sftp:{share_id}"),
        };
        let _ = writeln!(
            out,
@@ -321,9 +335,7 @@ async fn smb_share_command(s: &AppState, args: &[String]) -> Result<String, Stri
        }
        Some("add") => {
            // share add //server/share [guest|user:password]
-            let target = args
+            let target = args.get(1).ok_or_else(|| {
                .get(1)
                .ok_or_else(|| {
                "usage: share add //server/share [guest|user:password]".to_string()
            })?;
            // Accept either `//server/share` (UNC-style) or
@@ -401,11 +413,7 @@ async fn nfs_share_command(s: &AppState, args: &[String]) -> Result<String, Stri
                return Ok("(no NFS shares configured)".into());
            }
            let mut out = String::new();
-            let _ = writeln!(
+            let _ = writeln!(out, "{:<24} {:<7} {:<6} TARGET", "ID", "STATUS", "ISOS");
                out,
                "{:<24} {:<7} {:<6} TARGET",
                "ID", "STATUS", "ISOS"
            );
            for m in shares {
                let status = if m.reachable { "ok" } else { "down" };
                let _ = writeln!(
@@ -476,6 +484,104 @@ async fn nfs_share_command(s: &AppState, args: &[String]) -> Result<String, Stri
    }
 }
 // ── sftp (v0.5.5) ────────────────────────────────────────────────────────
 //
 // Parallel to nfs_share_command. The terminal `add` only supports
 // password auth — pasting a multiline PEM private key through the
 // terminal is impractical, so key-based shares are added via the WebUI.
 async fn sftp_share_command(s: &AppState, args: &[String]) -> Result<String, String> {
    match args.first().map(String::as_str) {
        None | Some("list") => {
            let shares = s.sftp_shares.list();
            if shares.is_empty() {
                return Ok("(no SFTP shares configured)".into());
            }
            let mut out = String::new();
            let _ = writeln!(out, "{:<24} {:<7} {:<6} TARGET", "ID", "STATUS", "ISOS");
            for m in shares {
                let status = if m.reachable { "ok" } else { "down" };
                let _ = writeln!(
                    out,
                    "{:<24} {:<7} {:<6} {}@{}:{}",
                    truncate(&m.id, 24),
                    status,
                    m.iso_count,
                    m.username,
                    m.server,
                    m.export,
                );
                if let Some(e) = m.last_error {
                    let _ = writeln!(out, "    error: {e}");
                }
                if let Some(h) = m.last_hint {
                    let _ = writeln!(out, "    hint:  {h}");
                }
            }
            Ok(out)
        }
        Some("add") => {
            // sftp add <user>@<server>:<export> <password> [port]
            let target = args.get(1).ok_or_else(|| {
                "usage: sftp add <user>@<server>:<export> <password> [port] \
                 (key auth: use the WebUI)"
                    .to_string()
            })?;
            let password = args
                .get(2)
                .ok_or_else(|| "a password is required (key auth: use the WebUI)".to_string())?;
            let (user, rest) = target
                .split_once('@')
                .ok_or_else(|| "target must be 'user@server:/export'".to_string())?;
            let (server, export) = rest
                .split_once(':')
                .ok_or_else(|| "target must be 'user@server:/export'".to_string())?;
            let port = args.get(3).and_then(|s| s.parse::<u16>().ok());
            let req = openpxe_iso_store::SftpAddRequest {
                server: server.to_string(),
                export: export.to_string(),
                username: Some(user.to_string()),
                port,
                password: Some(password.clone()),
                private_key: None,
                passphrase: None,
            };
            match s.sftp_shares.add(req).await {
                Ok(m) => Ok(format!("added {} ({} isos)", m.id, m.iso_count)),
                Err(e) => {
                    let mut out = format!("add failed: {}", e.error);
                    if let Some(h) = e.hint {
                        out.push_str("\nhint: ");
                        out.push_str(&h);
                    }
                    Err(out)
                }
            }
        }
        Some("remove") => {
            let id = args
                .get(1)
                .ok_or_else(|| "usage: sftp remove <id>".to_string())?;
            match s.sftp_shares.remove(id).await {
                Ok(()) => Ok(format!("removed {id}")),
                Err(e) => Err(format!("remove failed: {e}")),
            }
        }
        Some("scan") => {
            let id = args
                .get(1)
                .ok_or_else(|| "usage: sftp scan <id>".to_string())?;
            match s.sftp_shares.rescan(id).await {
                Ok(n) => Ok(format!("re-scanned {id}: {n} isos")),
                Err(e) => Err(format!("scan failed: {e}")),
            }
        }
        Some(other) => Err(format!(
            "unknown sftp subcommand: {other}\ntry: sftp [list|add|remove|scan]"
        )),
    }
 }
 // ── smb ────────────────────────────────────────────────────────────────
 #[allow(clippy::unused_async)]
@@ -622,6 +728,11 @@ OpenPXE terminal — available commands:
  nfs remove <id>                   forget an NFS share
  nfs scan <id>                     re-list an NFS share for new ISOs
  sftp list                         list configured SFTP-over-SSH shares
  sftp add <user>@<srv>:<export> <pass> [port]   add an SFTP share (key auth: WebUI)
  sftp remove <id>                  forget an SFTP share
  sftp scan <id>                    re-list an SFTP share for new ISOs
  smb status                        outbound Samba state (Windows install media)
  smb start | stop | reload         control the outbound smbd
@@ -9,6 +9,7 @@
 use bytes::Bytes;
 use openpxe_core::{Error, Result};
 use openpxe_iso_store::{IsoMeta, IsoStore, UploadHandle};
 use parking_lot::RwLock;
 use serde::Serialize;
 use std::collections::HashMap;
 use std::sync::Arc;
@@ -19,7 +20,11 @@ const DEFAULT_CHUNK_SIZE: u64 = 8 * 1024 * 1024;
 #[derive(Clone, Default)]
 pub struct UploadSessions {
-    inner: Arc<Mutex<HashMap<String, Arc<Mutex<UploadSession>>>>>,
+    // v0.5.4: the registry is a sync `parking_lot::RwLock` — it's only ever
    // briefly read/inserted/removed to look up a session, never held across
    // an `.await`. The per-session lock below stays a `tokio::sync::Mutex`
    // because `write_chunk` / `finish` are awaited while it's held.
    inner: Arc<RwLock<HashMap<String, Arc<Mutex<UploadSession>>>>>,
 }
 struct UploadSession {
@@ -67,8 +72,7 @@ impl UploadSessions {
        };
        self.inner
-            .lock()
+            .write()
            .await
            .insert(upload_id.clone(), Arc::new(Mutex::new(session)));
        Ok(UploadStarted {
@@ -88,7 +92,7 @@ impl UploadSessions {
        chunk: Bytes,
        complete: bool,
    ) -> Result<UploadAppend> {
-        let Some(session_lock) = self.inner.lock().await.get(upload_id).cloned() else {
+        let Some(session_lock) = self.inner.read().get(upload_id).cloned() else {
            return Err(Error::Invalid(format!("no such upload '{upload_id}'")));
        };
@@ -119,7 +123,7 @@ impl UploadSessions {
        if let Err(e) = handle.write_chunk(&chunk).await {
            let handle = session.handle.take();
            drop(session);
-            self.inner.lock().await.remove(upload_id);
+            self.inner.write().remove(upload_id);
            if let Some(handle) = handle {
                let _ = handle.abort().await;
            }
@@ -156,11 +160,11 @@ impl UploadSessions {
        let meta = match handle.finish(store).await {
            Ok(meta) => meta,
            Err(e) => {
-                self.inner.lock().await.remove(upload_id);
+                self.inner.write().remove(upload_id);
                return Err(e);
            }
        };
-        self.inner.lock().await.remove(upload_id);
+        self.inner.write().remove(upload_id);
        Ok(UploadAppend::Complete {
            offset: new_offset,
            iso: Box::new(meta),
@@ -168,7 +172,7 @@ impl UploadSessions {
    }
    pub async fn abort(&self, upload_id: &str) -> Result<()> {
-        let Some(session_lock) = self.inner.lock().await.remove(upload_id) else {
+        let Some(session_lock) = self.inner.write().remove(upload_id) else {
            return Err(Error::Invalid(format!("no such upload '{upload_id}'")));
        };
        let mut session = session_lock.lock().await;
@@ -14,7 +14,7 @@ use axum::body::Body;
 use axum::http::{header, Request, StatusCode};
 use openpxe_core::{ClientRegistry, DeploymentQueue, HostBindings, LogBus, Metrics, SettingsStore};
 use openpxe_http_api::{build_router, AppState};
-use openpxe_iso_store::{IsoStore, NfsShareManager, SmbShareManager};
+use openpxe_iso_store::{IsoStore, NfsShareManager, SftpShareManager, SmbShareManager};
 use tempfile::tempdir;
 use tower::ServiceExt;
@@ -96,6 +96,7 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
    let settings = SettingsStore::load_or_default(dir.path());
    let smb_shares = SmbShareManager::new(dir.path(), iso_store.clone());
    let nfs_shares = NfsShareManager::new(dir.path(), iso_store.clone());
    let sftp_shares = SftpShareManager::new(dir.path(), iso_store.clone());
    let unattended = openpxe_iso_store::UnattendedStore::new(dir.path().join("unattended"));
    unattended.ensure_dir().await.unwrap();
    let log_bus = LogBus::new(64);
@@ -124,6 +125,7 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
        smb: None,
        smb_shares,
        nfs_shares,
        sftp_shares,
        unattended,
        uploads: openpxe_http_api::uploads::UploadSessions::default(),
        log_bus,
@@ -1536,6 +1538,60 @@ async fn status_exposes_custom_logo_flag() {
    );
 }
 /// v0.5.4 guard: the typed `StatusResponse` must keep every key the WebUI
 /// (`crates/webui/src/app.js`) reads off `/api/status`. If a refactor drops
 /// or renames one, the dashboard silently breaks — this catches it.
 #[tokio::test]
 async fn status_contract_has_all_ui_keys() {
    let (state, _dir) = build_state().await;
    let app = build_router(state);
    let (s, body) = get(&app, "/api/status").await;
    assert_eq!(s, StatusCode::OK);
    let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
    for key in [
        "version",
        "public_base_url",
        "iso_count",
        "client_count",
        "queue_count",
        "imaging_count",
        "waiting_count",
        "ipxe_assets",
        "settings",
        "smb_share_count",
        "smb_share_reachable",
        "nfs_share_count",
        "nfs_share_reachable",
        "host_bindings",
        "custom_logo",
        "branding",
        "unattended_count",
        "uptime_secs",
        "started_at",
        "nic_name",
        "subnet_mask",
        "gateway",
    ] {
        assert!(
            v.get(key).is_some(),
            "/api/status missing UI key '{key}': {v}"
        );
    }
    // Nested branding presence the Settings tab reads.
    for key in ["light", "dark", "client", "rev"] {
        assert!(
            v["branding"].get(key).is_some(),
            "/api/status branding missing '{key}': {v}"
        );
    }
    // started_at must remain an RFC3339 string (the UI does fmtUptime on
    // uptime_secs but renders started_at as text), not a serialized struct.
    assert!(
        v["started_at"].is_string(),
        "started_at should serialize as a string: {v}"
    );
 }
 async fn put_json(router: &axum::Router, path: &str, body: &str) -> (StatusCode, Vec<u8>) {
    let res = router
        .clone()
@@ -39,6 +39,10 @@ image = { version = "0.25", default-features = false, features = ["png", "jpeg",
 # kernel mount. See crates/iso-store/src/nfs_share.rs for usage.
 nfs3_client = { workspace = true }
 nfs3_types = { workspace = true }
 # v0.5.5: pure-Rust SSH/SFTP client (ring backend) for the SFTP remote
 # share path. See crates/iso-store/src/sftp_share.rs for usage.
 russh = { workspace = true }
 russh-sftp = { workspace = true }
 # Needed for the Stream trait that wraps the mpsc receiver feeding
 # NFS read-loop bytes into axum's Body::from_stream.
 futures = { workspace = true }
@@ -20,6 +20,7 @@ pub mod entry;
 pub mod introspect;
 pub mod nfs_share;
 pub mod pxe_logo;
 pub mod sftp_share;
 pub mod smb;
 pub mod smb_share;
 pub mod store;
@@ -40,6 +41,13 @@ pub use smb_share::{SmbAddRequest, SmbShare, SmbShareError, SmbShareManager, Smb
 // "works in any container" property as SMB, plus support for HTTP
 // Range requests because NFSv3 READ3 takes an explicit offset.
 pub use nfs_share::{NfsAddRequest, NfsShare, NfsShareError, NfsShareManager, NfsStream};
 // v0.5.5: SFTP-over-SSH remote shares via the pure-Rust `russh` +
 // `russh-sftp` crates (ring backend — no OpenSSL, no new C deps). Like
 // NFS, supports HTTP Range requests because SFTP opens a seekable file
 // handle. See crates/iso-store/src/sftp_share.rs.
 pub use sftp_share::{
    SftpAddRequest, SftpAuthKind, SftpShare, SftpShareError, SftpShareManager, SftpStream,
 };
 pub use store::{
    generate_boot_entries_for, slugify_str, IsoCategory, IsoMeta, IsoSource, IsoStore, UploadHandle,
 };
@@ -24,6 +24,10 @@ use tokio::io::AsyncWriteExt;
 /// `nfs3_client` crate (in-process, no subprocess). Same "works in
 /// any container" property as SMB, plus Range requests work because
 /// NFSv3 READ3 takes an explicit offset.
 /// `Sftp` (v0.5.5) — remote SFTP-over-SSH share, streamed via the
 /// pure-Rust `russh` + `russh-sftp` crates (in-process). Like NFS it
 /// supports HTTP Range requests because SFTP opens a seekable file
 /// handle (`SSH_FXP_READ` at offset).
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(tag = "kind", rename_all = "snake_case")]
 pub enum IsoSource {
@@ -42,6 +46,13 @@ pub enum IsoSource {
        /// Filename at the export root.
        relative_path: String,
    },
    /// v0.5.5: SFTP-over-SSH via the in-process `russh` + `russh-sftp`
    /// crates.
    Sftp {
        share_id: String,
        /// Filename at the export root.
        relative_path: String,
    },
 }
 /// Where the ISO lands in the PXE menu hierarchy.
@@ -299,11 +310,11 @@ impl IsoStore {
                    None
                }
            }
-            // SMB and NFS sources have no local path — they're
+            // SMB, NFS, and SFTP sources have no local path — they're
            // streamed in-process. Callers must inspect the source
            // kind first and dispatch to the appropriate share
            // manager.
-            IsoSource::Smb { .. } | IsoSource::Nfs { .. } => None,
+            IsoSource::Smb { .. } | IsoSource::Nfs { .. } | IsoSource::Sftp { .. } => None,
        }
    }
@@ -363,9 +374,9 @@ impl IsoStore {
    pub fn drop_external_source(&self, share_id: &str) {
        let mut g = self.inner.write();
        g.isos.retain(|_, m| match &m.source {
-            IsoSource::Smb { share_id: sid, .. } | IsoSource::Nfs { share_id: sid, .. } => {
+            IsoSource::Smb { share_id: sid, .. }
-                sid != share_id
+            | IsoSource::Nfs { share_id: sid, .. }
-            }
+            | IsoSource::Sftp { share_id: sid, .. } => sid != share_id,
            IsoSource::Local => true,
        });
    }
@@ -659,7 +670,10 @@ mod tests {
        // good.
        let s = linux_cmdline(DistroFamily::DebianUbuntu, "ubuntu-24-04");
        assert!(s.contains("boot=casper"), "{s}");
-        assert!(s.contains("iso-url=${base-url}/iso/ubuntu-24-04.iso"), "{s}");
+        assert!(
            s.contains("iso-url=${base-url}/iso/ubuntu-24-04.iso"),
            "{s}"
        );
        assert!(s.contains("ds=nocloud"), "{s}");
        assert!(s.contains("ip=dhcp"), "{s}");
        assert!(!s.contains("netboot=url"), "legacy option leaked: {s}");
@@ -9,7 +9,7 @@ use openpxe_core::{
 };
 use openpxe_dhcp_proxy::DhcpProxyServer;
 use openpxe_http_api::{build_router, AppState};
-use openpxe_iso_store::{IsoStore, NfsShareManager, SmbManager, SmbShareManager};
+use openpxe_iso_store::{IsoStore, NfsShareManager, SftpShareManager, SmbManager, SmbShareManager};
 use openpxe_tftp::TftpServer;
 use std::net::{Ipv4Addr, SocketAddr};
 use std::path::PathBuf;
@@ -59,11 +59,10 @@ async fn main() -> anyhow::Result<()> {
    init_tracing(log_bus.clone());
    let cli = Cli::parse();
-    let mut config = match &cli.config {
+    // v0.5.4: layered load via figment — defaults → optional TOML → env.
-        Some(p) if p.exists() => Config::from_toml_file(p)?,
+    // The OPENPXE_* env layer keeps the historical flat names (see
-        _ => Config::default(),
+    // `Config::load`), so existing deployments are unaffected.
-    };
+    let config = Config::load(cli.config.as_deref())?;
    config.apply_env();
    // Dispatch subcommands before bringing up the server.
    if let Some(cmd) = cli.command {
@@ -95,14 +94,19 @@ async fn main() -> anyhow::Result<()> {
            }
        },
    };
-    let public_base_url = format!("http://{our_ip}");
+    // v0.5.6: the advertised base URL must carry the HTTP port. Every
    // client-facing URL (the DHCP-proxy iPXE filename, UEFI HTTP boot,
    // and the menu's kernel/initrd/ISO links) is derived from this one
    // string, so omitting the port silently pointed PXE clients at :80 —
    // breaking every non-80 deployment (e.g. the Unraid template's 4200,
    // chosen to dodge the webGUI). See `build_public_base_url`.
    let public_base_url = build_public_base_url(our_ip, config.server.http_port);
    let iso_store = IsoStore::new(config.paths.iso_dir.clone());
    iso_store.load_from_disk().await?;
    // v0.5.2: unattended answer-file store (Kickstart/Preseed/Autoinstall/
    // Windows answer files). Separate directory from the ISO store.
-    let unattended =
+    let unattended = openpxe_iso_store::UnattendedStore::new(config.paths.unattended_dir.clone());
        openpxe_iso_store::UnattendedStore::new(config.paths.unattended_dir.clone());
    if let Err(e) = unattended.load_from_disk().await {
        tracing::warn!(
            target: "openpxe::unattended",
@@ -156,6 +160,19 @@ async fn main() -> anyhow::Result<()> {
        );
    }
    // v0.5.5: SFTP-over-SSH share manager — pure-Rust in-process
    // consumer via `russh` + `russh-sftp` (ring backend, no OpenSSL).
    // The third remote-library protocol alongside SMB/NFS; like NFS it
    // works in any container (no subprocess, no kernel mount) and
    // supports HTTP Range requests because SFTP file handles seek.
    let sftp_shares = SftpShareManager::new(&config.paths.work_dir, iso_store.clone());
    if let Err(e) = sftp_shares.load_and_rescan().await {
        tracing::warn!(
            target: "openpxe::sftp",
            "could not reload SFTP shares on startup: {e}"
        );
    }
    // Sniff network details for the Network tab. None of these are
    // required for PXE to work — they're informational, surfaced in the
    // UI so an operator doesn't have to drop to a shell to find their
@@ -184,6 +201,7 @@ async fn main() -> anyhow::Result<()> {
        smb: Some(smb.clone()),
        smb_shares: smb_shares.clone(),
        nfs_shares: nfs_shares.clone(),
        sftp_shares: sftp_shares.clone(),
        unattended: unattended.clone(),
        uploads: openpxe_http_api::uploads::UploadSessions::default(),
        log_bus: log_bus.clone(),
@@ -333,6 +351,20 @@ async fn seed_from_dir(
 /// a loopback address (which would give every PXE client an unreachable
 /// `http://127.0.0.1/...`). Users in multi-homed setups should set
 /// `OPENPXE_PUBLIC_IP` explicitly.
 /// Build the base URL advertised to PXE clients. The port is included
 /// unless it's the HTTP default (80), keeping the common case clean
 /// (`http://10.0.0.5`) while a remapped port (`http://10.0.0.5:4200`)
 /// stays reachable. This is the single source of truth for every
 /// client-facing URL — the DHCP-proxy iPXE filename, UEFI HTTP boot, and
 /// the boot menu's kernel/initrd/ISO links all derive from it.
 fn build_public_base_url(ip: Ipv4Addr, http_port: u16) -> String {
    if http_port == 80 {
        format!("http://{ip}")
    } else {
        format!("http://{ip}:{http_port}")
    }
 }
 fn detect_primary_ipv4() -> Option<Ipv4Addr> {
    // First try: route to the public internet. `UdpSocket::connect` to a
    // well-known external address causes the OS to populate `local_addr`
@@ -466,3 +498,26 @@ fn prefix_to_dotted(prefix: u8) -> String {
        mask & 0xff
    )
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    #[test]
    fn public_base_url_includes_non_default_port() {
        // The v0.5.6 regression guard: a remapped HTTP port (e.g. the
        // Unraid template's 4200) MUST appear in the advertised URL, or
        // PXE clients fetch :80 — the wrong service — and boot fails.
        let ip: Ipv4Addr = "192.168.1.49".parse().unwrap();
        assert_eq!(build_public_base_url(ip, 4200), "http://192.168.1.49:4200");
        assert_eq!(build_public_base_url(ip, 8080), "http://192.168.1.49:8080");
    }
    #[test]
    fn public_base_url_omits_default_port() {
        // Port 80 stays clean (no `:80`) so the common case reads nicely
        // and matches what every browser/iPXE assumes by default.
        let ip: Ipv4Addr = "10.0.0.5".parse().unwrap();
        assert_eq!(build_public_base_url(ip, 80), "http://10.0.0.5");
    }
 }
@@ -304,6 +304,14 @@ button.ghost { background: transparent; color: var(--fg); border: 1px solid var(
 button.ghost:hover { background: var(--bg-panel-2); color: var(--fg); }
 button.danger { background: transparent; color: var(--err); border: 1px solid color-mix(in srgb, var(--err) 35%, transparent); }
 button.danger:hover { background: color-mix(in srgb, var(--err) 14%, transparent); color: var(--err); }
 /* v0.5.3: unified spacing for a card's primary action button(s). Any
   button that sits as a direct child of a card body (Save, Bind, Add,
   Launch, …) gets the same gap above it so it never butts against the
   form. Inline buttons inside table rows / toolbars / logo slots /
   modal action bars are nested deeper, so the `>` keeps them untouched.
   Adjacent action buttons on one row (e.g. Save + Send test) share the
   margin and stay aligned. */
 .card .body > button { margin-top: 16px; }
 label.field {
  display: grid; gap: 4px; margin-bottom: 14px;
@@ -291,11 +291,11 @@
          el('div', {class: 'trend'},
            isos.filter(i => i.introspection.family === 'windows_pe').length + ' Windows · ' +
            isos.filter(i => i.introspection.family !== 'windows_pe').length + ' Linux  ·  ' +
-            // v0.4.67: count both protocols. Label generically since
+            // v0.4.67+v0.5.5: count all remote-share protocols. Label
-            // operators may be using one, the other, or both.
+            // generically since operators may use any mix of SMB/NFS/SFTP.
-            ((status.smb_share_reachable || 0) + (status.nfs_share_reachable || 0)) +
+            ((status.smb_share_reachable || 0) + (status.nfs_share_reachable || 0) + (status.sftp_share_reachable || 0)) +
            ' remote share' +
-            (((status.smb_share_reachable || 0) + (status.nfs_share_reachable || 0)) === 1 ? '' : 's')),
+            (((status.smb_share_reachable || 0) + (status.nfs_share_reachable || 0) + (status.sftp_share_reachable || 0)) === 1 ? '' : 's')),
        ])),
        el('div', {class: 'card'}, el('div', {class: 'stat'}, [
          el('div', {class: 'label'}, 'Uptime'),
@@ -508,10 +508,11 @@
      // v0.4.67: NFSv3 added back as an in-process Rust client
      // (nfs3_client crate). Both protocols available side-by-side;
      // operators pick whichever their NAS prefers.
-      const [isos, settings, smbRes, nfsRes, disk, unattRes] = await Promise.all([
+      const [isos, settings, smbRes, nfsRes, sftpRes, disk, unattRes] = await Promise.all([
        getJSON('/api/isos'), getJSON('/api/settings'),
        getJSON('/api/smb-shares'),
        getJSON('/api/nfs-shares'),
        getJSON('/api/sftp-shares'),
        getJSON('/api/storage/disk').catch(() => ({
          total_bytes: 0, available_bytes: 0, used_bytes: 0, path: '?',
        })),
@@ -519,6 +520,7 @@
      ]);
      const shares = smbRes.shares || [];
      const nfsShares = nfsRes.shares || [];
      const sftpShares = sftpRes.shares || [];
      const unattendedFiles = unattRes.files || [];
      // ── Upload card ──
@@ -829,6 +831,7 @@
      const protoSelect = el('select', {}, [
        el('option', {value:'nfs'}, 'NFS (NFSv3)'),
        el('option', {value:'smb'}, 'SMB / CIFS'),
        el('option', {value:'sftp'}, 'SFTP (SSH)'),
      ]);
      // SMB inputs.
@@ -893,18 +896,65 @@
        ]),
      ]);
      // SFTP inputs (v0.5.5). Pure-Rust russh client, in-process, so
      // SFTP-sourced ISOs support HTTP Range like NFS. Auth is password
      // OR an SSH private key (PEM, optional passphrase); the server's
      // host key is pinned trust-on-first-use on the first connect.
      const sftpServerIn = el('input', {type:'text', placeholder:'10.0.0.5'});
      const sftpExportIn = el('input', {type:'text', placeholder:'/srv/isos'});
      const sftpUserIn = el('input', {type:'text', placeholder:'root'});
      const sftpPortIn = el('input', {type:'number', placeholder:'22', min:'1', max:'65535'});
      const sftpAuthMode = el('select', {}, [
        el('option', {value:'password'}, 'Password'),
        el('option', {value:'key'}, 'SSH private key'),
      ]);
      const sftpPassIn = el('input', {type:'password', placeholder:'••••••••'});
      const sftpKeyIn = el('textarea', {rows:'4',
        placeholder:'-----BEGIN OPENSSH PRIVATE KEY-----',
        style:'width:100%;font-family:ui-monospace,monospace;font-size:12px;resize:vertical'});
      const sftpPassphraseIn = el('input', {type:'password',
        placeholder:'(only if the private key is encrypted)'});
      const sftpPassBlock = el('label', {class:'field'},
        [el('span', {class:'name'}, 'Password'), sftpPassIn]);
      const sftpKeyBlock = el('div', {}, [
        el('label', {class:'field'},
          [el('span', {class:'name'}, 'SSH private key (PEM)'), sftpKeyIn]),
        el('label', {class:'field', style:'margin-top:10px'},
          [el('span', {class:'name'}, 'Key passphrase (optional)'), sftpPassphraseIn]),
      ]);
      const syncSftpAuth = () => {
        const key = sftpAuthMode.value === 'key';
        sftpPassBlock.style.display = key ? 'none' : '';
        sftpKeyBlock.style.display = key ? '' : 'none';
      };
      sftpAuthMode.addEventListener('change', syncSftpAuth);
      syncSftpAuth();
      const sftpFields = el('div', {}, [
        el('div', {class:'form-row cols-2'}, [
          el('label', {class:'field'}, [el('span', {class:'name'}, 'SSH server'), sftpServerIn]),
          el('label', {class:'field'}, [el('span', {class:'name'}, 'Export path'), sftpExportIn]),
        ]),
        el('div', {class:'form-row cols-3', style:'margin-top:14px'}, [
          el('label', {class:'field'}, [el('span', {class:'name'}, 'Username'), sftpUserIn]),
          el('label', {class:'field'}, [el('span', {class:'name'}, 'Port'), sftpPortIn]),
          el('label', {class:'field'}, [el('span', {class:'name'}, 'Auth'), sftpAuthMode]),
        ]),
        el('div', {style:'margin-top:14px'}, [sftpPassBlock, sftpKeyBlock]),
      ]);
      // Swap the visible field block + clear any stale message.
      const syncProto = () => {
-        const nfs = protoSelect.value === 'nfs';
+        const p = protoSelect.value;
-        smbFields.style.display = nfs ? 'none' : '';
+        smbFields.style.display = p === 'smb' ? '' : 'none';
-        nfsFields.style.display = nfs ? '' : 'none';
+        nfsFields.style.display = p === 'nfs' ? '' : 'none';
        sftpFields.style.display = p === 'sftp' ? '' : 'none';
        shareMsg.replaceChildren();
        shareMsg.className = 'msg';
      };
      protoSelect.addEventListener('change', syncProto);
      // One add button; dispatches to the selected protocol's endpoint.
-      const addShare = el('button', {style:'margin-top:14px', onclick: async () => {
+      const addShare = el('button', {onclick: async () => {
        if (protoSelect.value === 'smb') {
          if (!smbServer.value || !smbShare.value) {
            shareMsg.replaceChildren(document.createTextNode('Server and share name are required.'));
@@ -924,6 +974,40 @@
            shareMsg.className = 'msg ok';
            render('storage');
          } else { await showShareError(r); }
        } else if (protoSelect.value === 'sftp') {
          if (!sftpServerIn.value || !sftpExportIn.value || !sftpUserIn.value) {
            shareMsg.replaceChildren(document.createTextNode('Server, export, and username are required.'));
            shareMsg.className = 'msg err'; return;
          }
          const useKey = sftpAuthMode.value === 'key';
          if (useKey && !sftpKeyIn.value.trim()) {
            shareMsg.replaceChildren(document.createTextNode('Paste the SSH private key, or switch Auth to Password.'));
            shareMsg.className = 'msg err'; return;
          }
          if (!useKey && !sftpPassIn.value) {
            shareMsg.replaceChildren(document.createTextNode('Password is required, or switch Auth to SSH private key.'));
            shareMsg.className = 'msg err'; return;
          }
          shareMsg.replaceChildren(document.createTextNode('Connecting…'));
          shareMsg.className = 'msg';
          const body = {
            server: sftpServerIn.value,
            export: sftpExportIn.value,
            username: sftpUserIn.value,
          };
          if (sftpPortIn.value) { body.port = parseInt(sftpPortIn.value, 10); }
          if (useKey) {
            body.private_key = sftpKeyIn.value;
            if (sftpPassphraseIn.value) { body.passphrase = sftpPassphraseIn.value; }
          } else {
            body.password = sftpPassIn.value;
          }
          const r = await postJSON('/api/sftp-shares', body);
          if (r.ok) {
            shareMsg.replaceChildren(document.createTextNode('Connected.'));
            shareMsg.className = 'msg ok';
            render('storage');
          } else { await showShareError(r); }
        } else {
          if (!nfsServerIn.value || !nfsExportIn.value) {
            shareMsg.replaceChildren(document.createTextNode('Server and export are required.'));
@@ -962,9 +1046,36 @@
        el('span'),
      ]));
-      const totalShares = shares.length + nfsShares.length;
+      const sftpRowEls = sftpShares.map(m => el('div', {class: 'nfs-row' + (m.reachable ? '' : ' down')}, [
        el('span', {class: 'dot ' + (m.reachable ? 'ok' : 'err')}),
        el('div', {}, [
          el('div', {class:'id'}, [el('span', {class:'proto-badge'}, 'SFTP'),
            document.createTextNode(m.username + '@' + m.server + ':' + m.export)]),
          el('div', {class:'meta'},
            'SSH · ' + (m.auth === 'key' ? 'key' : 'password') + ' · ' +
            (m.reachable ? m.iso_count + ' isos' : 'not reachable')),
          m.host_key_fingerprint
            ? el('div', {style:'margin-top:4px;opacity:.65;font-size:11px;font-family:ui-monospace,monospace;word-break:break-all'},
                'host key ' + m.host_key_fingerprint)
            : null,
          m.last_error ? el('div', {class:'err'}, '⚠ ' + m.last_error) : null,
          m.last_hint ? el('div', {style:'margin-top:4px;opacity:.78;font-size:12px'}, m.last_hint) : null,
        ]),
        el('button', {class:'ghost', onclick: async () => {
          const r = await postJSON('/api/sftp-shares/' + encodeURIComponent(m.id) + '/scan', {});
          if (r.ok) render('storage');
        }}, 'Re-scan'),
        el('button', {class:'danger', onclick: async () => {
          if (!confirm('Forget ' + m.server + ':' + m.export + '?')) return;
          await fetch('/api/sftp-shares/' + encodeURIComponent(m.id), {method:'DELETE'});
          render('storage');
        }}, 'Remove'),
        el('span'),
      ]));
      const totalShares = shares.length + nfsShares.length + sftpShares.length;
      const remoteRows = totalShares
-        ? [...smbRowEls, ...nfsRowEls]
+        ? [...smbRowEls, ...nfsRowEls, ...sftpRowEls]
        : [el('div', {class:'empty'}, 'No remote shares configured.')];
      syncProto();
@@ -1071,13 +1182,13 @@
              ]),
              el('span'),
            ]),
-            el('div', {style:'margin-top:14px'}, [smbFields, nfsFields]),
+            el('div', {style:'margin-top:14px'}, [smbFields, nfsFields, sftpFields]),
            addShare, shareMsg,
            el('div', {style:'margin-top:18px;display:grid;gap:8px'}, remoteRows),
            el('p', {class:'msg', style:'margin-top:14px'},
              'Remote .iso libraries are read on demand — no local cache to ' +
-              'preserve disk usage. Support for NFS 3.0 and SMB. Ensure that ' +
+              'preserve disk usage. Support for NFS 3.0, SMB, and SFTP (SSH). ' +
-              'the hosts IP address is provisioned.'),
+              'Ensure that the hosts IP address is provisioned.'),
          ]),
        ]),
        el('div', {class:'card'}, [
@@ -1411,7 +1522,7 @@
      // beneath the input row instead of butting against the password
      // fields. Mirrors the `Save SSO settings` button below for visual
      // parity between the two settings cards.
-      const accountSave = el('button', {style:'margin-top:6px', onclick: async () => {
+      const accountSave = el('button', {onclick: async () => {
        accountMsg.textContent = ''; accountMsg.className = 'msg';
        if (!currentPw.value) {
          accountMsg.textContent = 'Current password is required.';
@@ -1549,7 +1660,7 @@
      };
      ssoMode.onchange = refreshSsoFields;
      const ssoMsg = el('div', {class:'msg', style:'margin-top:8px'});
-      const ssoSave = el('button', {style:'margin-top:16px', onclick: async () => {
+      const ssoSave = el('button', {onclick: async () => {
        ssoMsg.textContent = ''; ssoMsg.className = 'msg';
        const payload = {
          enabled: ssoEnabled.checked,
@@ -1630,13 +1741,17 @@
      const logoMsg = el('div', {class:'msg', style:'margin-top:10px'});
      const bust = '?v=' + Date.now(); // bust the preview cache after a change
      const brandingPresence = status.branding || { light:false, dark:false, client:false };
      // Each swatch previews on a background matching where the mark
      // lands (light page / dark page / dark PXE screen), independent of
      // the operator's current page theme — so the Dark slot always reads
      // as dark even while viewing Settings in light mode.
      const slotDefs = [
        { slot:'light',  title:'Light mode', preview:'/assets/logo.svg?theme=light' + '&' + bust.slice(1),
-          hint:'Shown on light-theme pages.', accept:'image/svg+xml,image/png,image/jpeg,image/webp,image/gif' },
+          swatchBg:'#f4f5f7', hint:'Shown on light-theme pages.', accept:'image/svg+xml,image/png,image/jpeg,image/webp,image/gif' },
        { slot:'dark',   title:'Dark mode',  preview:'/assets/logo.svg?theme=dark' + '&' + bust.slice(1),
-          hint:'Shown on dark-theme pages.', accept:'image/svg+xml,image/png,image/jpeg,image/webp,image/gif' },
+          swatchBg:'#0e1014', hint:'Shown on dark-theme pages.', accept:'image/svg+xml,image/png,image/jpeg,image/webp,image/gif' },
        { slot:'client', title:'Client',     preview:'/branding/pxe-logo' + bust,
-          hint:'Above the PXE boot menu.', accept:'image/png,image/jpeg,image/webp,image/gif' },
+          swatchBg:'#0e1014', hint:'Above the PXE boot menu.', accept:'image/png,image/jpeg,image/webp,image/gif' },
      ];
      const slotCol = (def) => {
        const set = !!brandingPresence[def.slot];
@@ -1662,7 +1777,7 @@
            el('span', {class:'name'}, def.title),
            set ? el('span', {class:'tag ok'}, 'set') : el('span', {class:'tag'}, 'default'),
          ]),
-          el('div', {class:'swatch', style: def.slot === 'light' ? 'background:#f4f5f7' : ''},
+          el('div', {class:'swatch', style:'background:' + def.swatchBg},
            el('img', {src: def.preview, alt: def.title + ' logo'})),
          el('div', {class:'logo-slot-hint'}, def.hint),
          el('div', {style:'display:flex;gap:6px;flex-wrap:wrap'}, [
@@ -1795,13 +1910,13 @@
        smtp_implicit_tls: sTls.checked,
      });
-      const saveBtn = el('button', {style:'margin-top:16px', onclick: async () => {
+      const saveBtn = el('button', {onclick: async () => {
        nMsg.textContent = 'Saving…'; nMsg.className = 'msg';
        const r = await putJSON('/api/notify', collectNotify());
        if (r.ok) { nMsg.textContent = 'Saved.'; nMsg.className = 'msg ok'; render('settings'); }
        else { nMsg.textContent = 'Save failed: ' + (await r.text()); nMsg.className = 'msg err'; }
      }}, 'Save notification settings');
-      const testBtn = el('button', {class:'ghost', style:'margin-top:16px;margin-left:8px',
+      const testBtn = el('button', {class:'ghost', style:'margin-left:8px',
        onclick: async () => {
          nMsg.textContent = 'Sending test…'; nMsg.className = 'msg';
          // Save first so the test uses exactly what's on screen.
@@ -60,35 +60,41 @@ COPY deploy/ipxe/local/ deploy/ipxe/local/
 RUN mkdir -p assets/ipxe && bash scripts/build-ipxe.sh /src/assets/ipxe
 ########## build openpxe ##########
-FROM rust:${RUST_VERSION}-bookworm AS build
+# v0.5.2: cross-compile the Rust binary NATIVELY — no QEMU.
 WORKDIR /src
 # v0.4.5: build a fully static musl binary (matches Bootimus v0.1.70's
 # move). The resulting `/openpxe` has no glibc dependency at all, which:
 #   - Lets the runtime stage be any Linux distro (we still ship Debian
 #     slim for the `samba` / `wimtools` / `nfs-common` shellouts, but a
 #     scratch/distroless variant becomes a one-line swap).
 #   - Cuts a class of "GLIBC_2.39 not found" surprises when running on
 #     older RHEL/Rocky hosts that don't match Debian 12's libc version.
 #   - Sidesteps cross-compilation snags (the binary is its own world).
 #
-# x86_64-unknown-linux-musl is fully static by default (no extra
+# This stage is pinned to $BUILDPLATFORM (the builder's native arch — arm64
-# RUSTFLAGS needed). musl-tools provides the linker.
+# on an Apple-Silicon Mac, amd64 in x86 CI), exactly like `ipxe-build`. The
 # Rust compiler therefore runs at full native speed and emits an
 # x86_64-unknown-linux-musl binary via `cargo-zigbuild`, which uses `zig cc`
 # as the cross-linker (it bundles the musl sysroot for every target, so
 # there's no fiddly cross-gcc toolchain to assemble).
 #
 # Why this replaced the old `FROM rust ... --platform=linux/amd64` build:
 # that ran the *entire* compiler under QEMU x86_64 emulation on the arm64
 # host. It was ~15x slower (a single crate took >20 min) and the emulated
 # gcc/linker intermittently SIGSEGV'd or hung mid-link. Cross-compiling
 # sidesteps emulation entirely — the build is minutes, not half an hour,
 # and is deterministic.
 #
 # The output is still a fully static musl binary with no glibc dependency,
 # so the runtime stage stays free to be any Linux distro.
 FROM --platform=$BUILDPLATFORM rust:${RUST_VERSION}-bookworm AS build
 WORKDIR /src
 # zig (via the `ziglang` pip package — cargo-zigbuild auto-discovers it as
 # `python3 -m ziglang`) supplies the x86_64 musl sysroot + linker.
 # cargo-zigbuild is the thin cargo wrapper that wires zig in as the linker.
 RUN apt-get update \
- && apt-get install -y --no-install-recommends musl-tools \
+ && apt-get install -y --no-install-recommends python3 python3-pip \
 && rm -rf /var/lib/apt/lists/* \
- && rustup target add x86_64-unknown-linux-musl
+ && rustup target add x86_64-unknown-linux-musl \
 && pip3 install --no-cache-dir --break-system-packages ziglang \
 && cargo install --locked cargo-zigbuild
 # Copy the whole workspace in one go. We used to do a two-pass "cache-prime
 # with stubs, then real build" dance for dep-compile reuse; that turned out
 # to silently serve stale stub binaries when cargo's fingerprint didn't
 # notice the source swap. A single build is ~1.5 min longer on cold cache
 # but guarantees the binary reflects the sources we copied.
 # Do not copy rust-toolchain.toml into the image. The local workspace pins
 # developer tooling, but inside Docker we intentionally use the Rust version
 # selected by the base image. Copying rust-toolchain.toml with
 # `channel = "stable"` makes rustup download a second full toolchain during
-# `cargo build`, which is slow and can exhaust small Colima/CI disks.
+# the build, which is slow and can exhaust small Colima/CI disks.
 COPY Cargo.toml Cargo.lock ./
 COPY crates/ crates/
 # Baseline binaries (BIOS / i386 / wimboot), then overlay the
@@ -100,13 +106,11 @@ COPY --from=fetch /src/assets/ipxe /src/assets/ipxe
 COPY --from=ipxe-build /src/assets/ipxe/snponly.efi /src/assets/ipxe/snponly.efi
 COPY --from=ipxe-build /src/assets/ipxe/ipxe.efi /src/assets/ipxe/ipxe.efi
-# Cache cargo registry + target across builds. The mtime touch is
+# Cache cargo registry + target across builds. `cargo zigbuild` runs the
-# belt-and-suspenders: cargo occasionally misses mtime-only changes on
+# native rustc (fast) and links for x86_64-musl with zig — no emulation.
 # networked FS; this forces a fingerprint check.
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
    --mount=type=cache,target=/src/target,sharing=locked \
-    find crates -name '*.rs' -exec touch {} + && \
+    cargo zigbuild --release --target x86_64-unknown-linux-musl --bin openpxe && \
    cargo build --release --target x86_64-unknown-linux-musl --bin openpxe && \
    cp target/x86_64-unknown-linux-musl/release/openpxe /openpxe && \
    ls -l /openpxe
@@ -0,0 +1,21 @@
 <svg viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg" role="img" aria-label="OpenPXE">
  <title>OpenPXE</title>
  <!-- Static README mark: the "rainbow-horizon" medallion from the web UI,
       with the SMIL animation removed so it renders reliably as an <img>
       on Gitea/GitHub. -->
  <defs>
    <linearGradient id="opxRainbow" x1="0" y1="0" x2="1" y2="0">
      <stop offset="0%"     stop-color="#330f1f"/>
      <stop offset="12.56%" stop-color="#c83228"/>
      <stop offset="25.06%" stop-color="#fb8841"/>
      <stop offset="37.56%" stop-color="#d3dd92"/>
      <stop offset="50.06%" stop-color="#59824f"/>
      <stop offset="62.06%" stop-color="#002414"/>
      <stop offset="74.06%" stop-color="#00143d"/>
      <stop offset="86.06%" stop-color="#2874d7"/>
      <stop offset="100%"   stop-color="#99c2ff"/>
    </linearGradient>
  </defs>
  <circle cx="12" cy="12" r="10.5" fill="url(#opxRainbow)"
          stroke="rgba(0,0,0,0.18)" stroke-width="0.6"/>
 </svg>
Author	SHA1	Message	Date
Miles WardandClaude Opus 4.8	ac433b30e9	v0.5.7: skip PNG boot-menu background on legacy BIOS clients The menu emitted `console --picture … \|\| console`, relying on the trailing `\|\| console` to recover on iPXE builds without IMAGE_PNG + CONSOLE_FRAMEBUFFER. On legacy BIOS (`undionly.kpxe`, no PNG) the `--picture` attempt misbehaves before the fallback can recover — it tries to set a framebuffer mode the BIOS console can't honour — so the boot menu fails to render on BIOS clients. Fix: gate the command on `iseq ${platform} efi`, so BIOS (`pcbios`) clients never issue `console --picture` at all and drop straight to the plain text menu, while UEFI clients still get the graphical background. This is automatic and per-client — a mixed BIOS+UEFI fleet each gets the right treatment with no operator toggle. A PNG-less UEFI build (upstream i386-efi) still falls back gracefully through the same `\|\| console`. Menu snapshot updated to match. 254 tests pass, clippy clean. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>	2026-06-03 19:28:02 -04:00
Miles WardandClaude Opus 4.8	c0d17fa9ca	v0.5.6: advertise the HTTP port in client-facing boot URLs The base URL handed to PXE clients was built as `http://{ip}` with no port, ignoring OPENPXE_HTTP_PORT. Every client-facing URL derives from it — the DHCP-proxy iPXE filename, UEFI HTTP boot, and the boot menu's kernel/initrd/ISO links — so any non-80 deployment told clients to fetch :80 (the wrong service). On Unraid that's the webGUI, which 301s to https; iPXE (no TLS) then fails the chain with "Operation not supported". This broke the exact configuration the Unraid template recommends (HTTP port 4200, to avoid the webGUI on :80). Fix: build_public_base_url(ip, port) includes the port unless it's 80, so http://10.0.0.5 stays clean while http://10.0.0.5:4200 is reachable. One source of truth, so the whole URL surface is corrected at once. Regression-tested (port included for 4200/8080, omitted for 80). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>	2026-06-03 18:49:50 -04:00
Miles WardandClaude Opus 4.8	edf3a69daa	docs: rewrite README — production/VC-ready, logo + v0.5.5 feature set Replaces the stale v0.4.1 README with a polished, accurate overview: centered brand-mark header + tagline + badges, a "Why OpenPXE" pitch, a scannable Highlights section, and a "Built in Rust" section framed on real properties (single ~18MB static musl binary, no GC, async Tokio, workspace-wide unsafe deny, OpenSSL-free pure-Rust crypto, sub-minute zigbuild images). Surfaces everything shipped since v0.4.1: SMB + NFS + SFTP remote ISO libraries (with a comparison table), SAML SSO, branding, notifications, unattended installs, per-MAC host bindings, and layered figment config. Quick-start, env table, OpenShift, and health/observability all updated to v0.5.5. Adds docs/openpxe-logo.svg (render-safe static copy of the web-UI mark) for the header. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>	2026-06-03 12:07:31 -04:00
Miles WardandClaude Opus 4.8	44a2212abe	v0.5.5: SFTP-over-SSH remote shares (russh, pure-Rust, ring backend) Adds SFTP as a third remote ISO-library protocol alongside SMB and NFS. Pure-Rust russh + russh-sftp on the ring crypto backend — no kernel mount, no subprocess, no OpenSSL, no new C deps. Like NFS (and unlike SMB), SFTP-sourced ISOs support HTTP Range requests because SFTP opens a seekable file handle. - iso-store: SftpShareManager (connect/auth/READDIR/seekable stream), IsoSource::Sftp, password OR SSH-key auth, trust-on-first-use host-key pinning, 0600 credential sidecar with a restart-safe derived path. - http-api: /api/sftp-shares routes, Range-aware ISO dispatch arm, status/metrics counts, /api/docs entry, `sftp` terminal commands. - webui: "SFTP (SSH)" protocol option with a password/key auth toggle, host-key fingerprint display, dashboard tile, updated copy. SCP was deliberately rejected: sequential-only (no Range) and its crates wrap libssh2 (C + OpenSSL), which would break the static-musl build. russh is pinned to =0.55.0: russh 0.61 needs the stable RustCrypto generation (pkcs8 0.11), which is API-incompatible with the release- candidate crates bergshamra-crypto pins (pkcs8 =0.11.0-rc.11). 0.55 is the newest russh on the prior generation (pkcs8 0.7) that coexists. Do not bump past 0.55 until bergshamra adopts stable RustCrypto. 252 tests pass, clippy clean, static musl x86_64 binary (ring already present via rustls + bergshamra, so no new crypto/C deps). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>	2026-06-03 11:49:18 -04:00
Miles WardandClaude Opus 4.8	674a69f93b	v0.5.4: code-cleanup pass (AppError, figment config, encoding dedup, typed status, deps) Final cleanup before hardware testing. No behaviour changes; 248 tests green, clippy clean. #1 AppError newtype (http-api/src/error.rs) with one IntoResponse mapping (NotFound→404, Invalid→400, _→500) + From<core::Error>/From<io::Error>. Converted the clearly-safe handlers (sso_put, unattended_upload, branding_clear) to `?`; intentionally left handlers with bespoke status semantics (Invalid→404 on category, 409 on duplicate share / open upload) explicit so no asserted status changes. #2 figment-based Config::load (defaults → TOML → env). Keeps the historical flat OPENPXE_* names (Unraid/entrypoint compatible) AND adds the nested OPENPXE_SECTION__FIELD form; now covers every field (apply_env had silently skipped unattended_dir + bind addrs). 6 Jail tests prove backward-compat. Removed the hand-rolled apply_env. #3 thiserror 1→2; dropped unused mime/mime_guess/once_cell deps. #4 Re-evaluated: Duration::from_hours/from_mins are stable on the pinned 1.95 toolchain and clippy prefers them — kept the readable form (the "unstable" premise didn't hold; MSRV is intentionally 1.95). #5 insta snapshot of the rendered iPXE menu (version-filtered) + wiremock coverage of the SAML metadata-URL fetch (200 + non-2xx). #6 api_status → typed StatusResponse struct (was a 25-key json! blob) with a full_flow guard test asserting every UI key + the started_at string shape. Deferred the /api/docs typed conversion (lowest value, highest churn, zero functional benefit). #7 pct_encode/xml_escape de-duplicated into openpxe_core::encoding (were copied across app.rs + the SAML modules). No new crates. #8 UploadSessions registry → parking_lot::RwLock (sync, never held across .await); per-session lock stays tokio::Mutex. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>	2026-06-03 03:33:05 -04:00
Miles WardandClaude Opus 4.8	7358013093	v0.5.3: dark-mode branding preview + unified button spacing UI polish: - Settings → Branding: each logo swatch now previews on a background matching where the mark lands (light page / dark page / dark PXE screen) regardless of the current page theme, so the Dark slot reads as dark even while viewing Settings in light mode. - Site-wide button spacing: add one rule (`.card .body > button`) giving every primary card action button the same gap above it, and drop the ad-hoc per-button inline margins (14/16/6px) so the look is uniform. Fixes the Hosts → "Bind MAC to target" button butting against the form. (Boot-menu highlight intentionally unchanged — a rotating-RGB highlight isn't possible in iPXE's static single-draw menu; deferred to a future custom-renderer effort.) Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>	2026-06-03 02:50:51 -04:00
Miles WardandClaude Opus 4.8	a906c47f53	build: native arm64→x86_64-musl cross-compile (cargo-zigbuild), no QEMU The Rust `build` stage previously ran the entire compiler under QEMU x86_64 emulation on the arm64 builder. That was ~15x slower (one crate took >20 min) and the emulated gcc/linker intermittently SIGSEGV'd or hung mid-link (observed again building v0.5.2). Pin the stage to $BUILDPLATFORM (native arm64 on Apple Silicon, amd64 in CI) and cross-compile to x86_64-unknown-linux-musl with cargo-zigbuild — zig cc supplies the musl sysroot + linker. rustc runs natively; no emulation. Build drops from ~30 min to a few minutes and is deterministic. Output is the same fully static musl binary (verified: x86_64, not a dynamic executable, 0 OpenSSL strings). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>	2026-05-31 17:46:50 -04:00