feat(saml): wire SAML 2.0 SSO end-to-end (pure-Rust) + Settings/Storage UI consolidation (v0.5.1)

SAML SSO (the config was storage-only since v0.4.5; now it logs you in):
- New openpxe-core::saml — pure-Rust SP built on bergshamra (XML-DSig +
  exclusive c14n via RustCrypto, no OpenSSL/xmlsec/libxml2). The static
  musl binary stays C-free; samael was rejected for hard-requiring OpenSSL.
  * metadata.rs   — parse IdP EntityDescriptor (SSO URLs + signing certs),
                    build our SP metadata.
  * authn_request.rs — build + HTTP-Redirect-encode AuthnRequests.
  * response.rs   — verify the signature against the pinned IdP cert
                    (trusted_keys_only + strict_verification for XSW),
                    then enforce Status/Destination/Audience/time-bounds/
                    signature-scope. Stateless; returns the IDs the HTTP
                    layer needs.
- http-api saml_routes: GET /api/sso/login (302 to IdP), POST /api/sso/acs
  (verify -> InResponseTo correlation / IdP-initiated gating / assertion
  replay guard -> mint operator session -> 302), GET /api/sso/metadata.
  Added to the pre-auth allowlist; /api/sso config stays gated.
- SsoConfig gains entity_id (SP Entity ID, defaults to public base URL)
  and allow_idp_initiated (default off), mirroring FleetDM.
- Access model: any IdP-authenticated, cryptographically-verified user gets
  an operator session (single-tier; local admin remains the fallback owner).
- Login page: the "Sign in with <IdP>" button now drives the real flow and
  surfaces sso_error redirects.

UI consolidation:
- Removed the Advanced sidebar tab; folded its webhook-notifications +
  API-reference cards into a collapsible "Advanced" disclosure at the
  bottom of Settings.
- Merged the Storage tab's separate SMB and NFS cards into one "Remote
  shares" card with a protocol dropdown and a unified, protocol-badged
  table. No backend changes — same /api/smb-shares + /api/nfs-shares.

Tests: 17 SAML core tests (accept + reject tampered/unsigned/wrong-key/
wrong-audience/expired/future/wrong-issuer/non-success) and 6 ACS
integration tests (happy path, IdP-initiated gating, SP correlation,
replay, garbage). Full workspace: 206 tests green, clippy clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

.claude/settings.json

@@ -0,0 +1,16 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(cargo check *)",
+      "Bash(cargo build *)",
+      "Bash(cargo clippy *)",
+      "Bash(cargo fmt *)",
+      "Bash(cargo tree *)",
+      "Bash(cargo doc *)",
+      "Bash(cargo test --workspace --lib)",
+      "Bash(cargo test --workspace)",
+      "Bash(cargo --version)",
+      "Bash(rustc --version)"
+    ]
+  }
+}

Cargo.toml

@@ -12,7 +12,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.5.8"
+version = "0.5.1"
 edition = "2021"
 rust-version = "1.95"
 license = "MIT OR Apache-2.0"
@@ -36,25 +36,25 @@ tower = "0.5"
 tower-http = { version = "0.6", features = ["fs", "trace", "cors", "limit"] }
 hyper = "1.4"
 reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "stream", "json"] }
+mime = "0.3"
+mime_guess = "2.0"
 
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 toml = "0.8"
-# v0.5.4: layered config (TOML file + env). Pure-Rust, no C deps; keeps the
-# static-musl build OpenSSL-free. Replaces the hand-rolled apply_env mapping.
-figment = { version = "0.10", features = ["toml", "env"] }
 
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
 
 anyhow = "1.0"
-thiserror = "2.0"
+thiserror = "1.0"
 clap = { version = "4.5", features = ["derive", "env"] }
 uuid = { version = "1.10", features = ["v4", "serde"] }
 time = { version = "0.3", features = ["serde", "serde-human-readable", "formatting", "macros"] }
 sha2 = "0.10"
 hex = "0.4"
 bcrypt = "0.15"
+once_cell = "1.19"
 parking_lot = "0.12"
 rust-embed = { version = "8.5", features = ["include-exclude"] }
 
@@ -85,36 +85,6 @@ x509-parser = "0.18"
 flate2 = "1.1"
 base64 = "0.22"
 
-# v0.5.5: pure-Rust SSH/SFTP client for reading remote ISO libraries
-# over SFTP without a kernel mount.
-#
-# CRITICAL #1 — crypto backend: `default-features = false` +
-# `features = ["ring"]`. russh's *default* backend is `aws-lc-rs`, which
-# pulls `aws-lc-sys` (C code, fiddly under musl); the `ring` feature
-# instead reuses `ring 0.17` — the exact crate+version already in the
-# binary via rustls + bergshamra — so SFTP adds ZERO new C/crypto deps
-# and the static-musl build stays OpenSSL-free.
-#
-# CRITICAL #2 — pinned to EXACTLY 0.55.0, the newest russh that
-# coexists with bergshamra-crypto (our SAML core). The RustCrypto
-# ecosystem is mid-transition: bergshamra-crypto pins a constellation of
-# release-CANDIDATE crates (`pkcs8 =0.11.0-rc.11` and its matching
-# pkcs5/spki RCs) that are API-incompatible with the STABLE versions of
-# the same crates in the same semver bucket. russh 0.56+ pulls those
-# stable crates (`pkcs5 0.8`), which silently replaces bergshamra's RC
-# copies and breaks compilation. russh ≤0.55 stays on the previous stable
-# generation (`pkcs5 0.7`, `ssh-key 0.6`), which unifies with bergshamra's
-# *stable* deps and leaves the RC bucket untouched — verified to compile.
-# 0.55 still has the merged `russh::keys` API (keys merged at 0.50).
-# IMPORTANT: do NOT bump russh past 0.55 until bergshamra-crypto adopts
-# the stable RustCrypto generation; 0.56+ will not compile in this tree.
-#
-# SCP was deliberately rejected: the protocol is sequential-only (no
-# random access → no HTTP Range, unlike SFTP/NFS) and the mature SCP
-# crates wrap libssh2 (C + OpenSSL), which would break this build.
-russh = { version = "=0.55.0", default-features = false, features = ["ring"] }
-russh-sftp = "2.3"
-
 openpxe-core = { path = "crates/core" }
 openpxe-dhcp-proxy = { path = "crates/dhcp-proxy" }
 openpxe-tftp = { path = "crates/tftp" }

README.md

@@ -1,270 +1,301 @@
-<p align="center">
-  <img src="docs/openpxe-logo.svg" alt="OpenPXE" width="104" height="104" />
-</p>
+# OpenPXE
 
-<h1 align="center">OpenPXE</h1>
+Container-native PXE boot server. A Rust reimplementation of
+[iVentoy (ventoy/PXE)](https://github.com/ventoy/PXE), designed from scratch
+for Docker/OCI and OpenShift. Upload `.iso` files via the web UI; network
+clients PXE-boot them.
 
-<p align="center">
-  <strong>Container-native network boot &amp; OS deployment — built in Rust.</strong>
-</p>
+> **Status:** v0.4.1 / pre-beta. Phases 1–5 complete: full PXE stack,
+> Queued Deployment queue, NFS-share ISO sources, live tracing log + an
+> operator terminal, per-MAC host bindings, Prometheus `/metrics`,
+> light/dark theme toggle, animated OpenPXE imaging-progress widget,
+> chunked ISO uploads, and per-ISO boot passwords. The test suite and
+> clippy are part of the release checklist. Ready for real-hardware validation.
 
-<p align="center">
-  Drag in an ISO. PXE-boot and image an entire fleet from a browser.<br/>
-  No iPXE scripting. No <code>dnsmasq</code> + <code>tftpd</code> + Samba glue. No glibc. No garbage collector.
-</p>
+## Design non-negotiables
 
-<p align="center">
-  <img alt="release"   src="https://img.shields.io/badge/release-v0.5.5-2874d7" />
-  <img alt="license"   src="https://img.shields.io/badge/license-MIT%20%7C%20Apache--2.0-59824f" />
-  <img alt="rust"      src="https://img.shields.io/badge/built%20with-Rust-fb8841?logo=rust&logoColor=white" />
-  <img alt="container" src="https://img.shields.io/badge/container--native-OCI%20%C2%B7%20OpenShift-2496ED?logo=docker&logoColor=white" />
-  <img alt="binary"    src="https://img.shields.io/badge/static-musl%20%C2%B7%20~18MB-330f1f" />
-</p>
+1. **Fully offline / air-gap deployable.** Zero CDN assets. Zero external
+   HTTP calls from the server, the browser, or the generated iPXE scripts.
+   Build the container once, run forever disconnected.
+2. **iPXE is a backend implementation detail.** No `.ipxe` upload path, no
+   manual script editing, no iPXE terminology in the UI. Every knob in the
+   web UI maps to a specific script-generation behavior inside the binary.
+3. **The client trust store is off-limits.** No test-signed drivers, no
+   `bcdedit /set testsigning on`, no certificates injected into WinPE or
+   the target OS.
 
----
+## What it does
 
-OpenPXE turns bare-metal provisioning into a single container with a web UI. It's a
-ground-up Rust reimplementation of [iVentoy (ventoy/PXE)](https://github.com/ventoy/PXE),
-designed for Docker/OCI and OpenShift instead of a Windows desktop — so it drops onto
-an Unraid box, a Linux server, or a Kubernetes cluster and just runs.
+1. **DHCP proxy** (RFC 4578). Coexists with your existing DHCP server —
+   never assigns IPs. Listens on UDP 67 + UDP 4011.
+2. **TFTP server** (RFC 1350 + RFC 2347/2348/2349/7440 option negotiation)
+   that serves architecture-specific iPXE binaries to firmware PXE ROMs.
+3. **HTTP server** that serves the web UI, the generated iPXE boot scripts,
+   raw ISOs (with Range), and files inside ISOs without prior extraction.
+4. **ISO introspection**: auto-detects the distro family and generates the
+   appropriate kernel+initrd or wimboot chain. No manual config.
+5. **Hierarchical PXE menu** mirroring the Phase 2 spec:
+   ```
+   Default        > Boot from Local HDD
+   Installers     > Linux Installers  / Windows Installers
+   Tools          > Utilities / OpenPXE Shell / Network Card Info
+   Queued Deployment
+   ```
+6. **Queued Deployment queue** — the coordinated launch flow. A client that
+   selects *Queued Deployment* gets a numbered position and waits. The
+   operator picks an ISO in the web UI and fires it to every waiting
+   client simultaneously.
+7. **Web UI** (Netbox-style): sidebar nav (Dashboard / Network / Queue /
+   Storage / Hosts / Terminal / About), light + dark themes
+   (toggle top-right or press `T`), animated OpenPXE progress
+   widget when devices are imaging. All assets served from the binary —
+   no external requests.
+8. **Per-MAC host bindings.** Pin a MAC to a boot target and the client
+   skips the menu, chains straight through.
+9. **Prometheus metrics** at `/metrics` — DHCP replies by arch, TFTP
+   transfer counts and bytes, HTTP request counts by route, queue /
+   imaging gauges, uptime, build info. Plain text exposition format,
+   no external metrics framework dependency.
+8. **Settings API** lets you change the default boot-menu timeout (default
+   600s), the timeout action (stay / Local HDD / Queued Deployment), and
+   feature toggles like Windows ISO support. The iPXE scripts regenerate
+   on every request using current settings.
 
-Upload `.iso` files (or point at a remote share), and any machine on the network boots
-them — Linux installers, live tools, or stock Windows setup — with **zero iPXE knowledge
-required by the operator.**
+### Architectures supported on day one
 
-> **Status — v0.5.5, late pre-beta.** The full PXE stack, web UI, remote ISO libraries
-> (SMB/NFS/SFTP), Windows deployment, queued fleet rollout, SAML SSO, and Prometheus
-> metrics are implemented and test-covered. The release checklist gates every tag on the
-> full test suite + `clippy`. Currently in real-hardware validation.
+| DHCP option 93 | Architecture    | Binary served           |
+|----------------|-----------------|-------------------------|
+| `0x0000`       | Legacy x86 BIOS | `undionly.kpxe`         |
+| `0x0006`       | IA32 UEFI       | `snponly-i386.efi`      |
+| `0x0007`/`0x0009` | x86_64 UEFI  | `snponly.efi`           |
+| `0x000B`       | ARM64 UEFI      | `snponly-arm64.efi`     |
 
-## Why OpenPXE
+UEFI firmware that sends `HTTPClient` in option 60 is handled too — we
+skip TFTP and respond with an HTTP URL.
 
-Standing up network boot the traditional way means hand-wiring `dnsmasq`, a TFTP daemon,
-hand-written iPXE menu scripts, an HTTP server, and Samba — then keeping that fragile
-stack alive, and discovering none of it containerizes cleanly (kernel-mount NFS, raw
-sockets, `CAP_SYS_ADMIN`). iVentoy solved the UX beautifully, but it's a Windows GUI app.
-
-OpenPXE collapses that whole stack into **one statically-linked binary in one container**:
-
-- **A web UI does everything.** iPXE is an internal implementation detail — there is no
-  script upload, no `.ipxe` editing, no PXE jargon in the interface.
-- **It runs anywhere a container runs.** No kernel modules, no privileged mode — proxy-mode
-  DHCP + `NET_BIND_SERVICE` is the entire requirement. Verified on Unraid, plain Docker,
-  and OpenShift's restricted SCC.
-- **It's air-gap native.** Zero CDN assets, zero outbound calls from the server, browser,
-  or generated boot scripts. Build the image once, run it forever, disconnected.
-
-## Highlights
-
-#### Boot stack
-- **DHCP proxy** (RFC 4578) that coexists with your existing DHCP — it never hands out IPs.
-- **TFTP** (RFC 1350 + 2347/2348/2349/7440 option negotiation) serving arch-correct iPXE firmware.
-- **HTTP** serving the UI, generated boot scripts, raw ISOs (with byte-range), and files
-  *inside* ISOs with no prior extraction.
-- **Graphical iPXE boot menu** built from your uploads, with a PNG background and a clean
-  hierarchy — generated fresh on every request from current settings.
-
-#### ISO management & remote libraries
-- **Drag-and-drop chunked uploads** that don't 502 on multi-GB images.
-- **Automatic introspection** — detects the distro family and generates the right
-  kernel+initrd or Windows `wimboot` chain. No manual config.
-- **Remote ISO libraries, streamed on demand** (no local cache) over **SMB, NFS, or SFTP** —
-  see the table below.
-
-#### Fleet deployment
-- **Queued Deployment** — clients join a queue and wait; the operator fires one image at
-  every waiting machine simultaneously.
-- **Per-MAC host bindings** — pin a MAC straight to a target (with optional auto hostname,
-  auto IP, and an unattended answer file); it skips the menu and chains through.
-- **Unattended installs** — upload Kickstart / Preseed / Autoinstall / Windows answer files;
-  they're templated per-host (hostname / IP / MAC) and served only to booting clients.
-- **Windows deployment** from a stock Microsoft ISO — **every binary the client runs stays
-  Microsoft-signed** (details below).
-
-#### Operations & access
-- **SAML 2.0 single sign-on** (pure-Rust SP, no OpenSSL/xmlsec) alongside local accounts.
-- **Custom branding** — light / dark / PXE-client logos and favicon.
-- **Notifications** — Slack / Teams / Discord webhooks and SMTP email on boot events.
-- **Prometheus `/metrics`**, a built-in operator **terminal**, live tracing log, and
-  `/healthz` · `/readyz` probes.
-- **Layered config** — defaults → TOML file → `OPENPXE_*` env, in that order.
-
-## Built in Rust
-
-Rust isn't a checkbox here — it's why OpenPXE deploys the way it does:
-
-- **One static binary, ~18 MB.** Compiled to `x86_64-unknown-linux-musl` — no glibc, no
-  interpreter, no sidecar runtime. The runtime image is "binary + a few CLI tools."
-- **No garbage collector, async throughout.** A Tokio runtime drives DHCP, TFTP, HTTP, and
-  many concurrent multi-GB ISO streams on a tiny, predictable memory footprint — it idles
-  near-zero and never GC-pauses mid-transfer.
-- **Memory-safe by construction.** `unsafe` is **denied workspace-wide**; the only
-  exceptions are two small, individually-audited FFI calls (`statvfs` for disk usage and a
-  Samba `SIGHUP`).
-- **OpenSSL-free, pure-Rust crypto.** TLS via `rustls`/`ring`; the SAML Service Provider
-  does XML-DSig verification with RustCrypto — no `xmlsec`, no `libxml2`, no C crypto to
-  CVE-patch. Even the SMB/NFS/SFTP clients avoid C libraries.
-- **Sub-minute, reproducible container builds.** Cross-compiled with `cargo-zigbuild`
-  (zig as the linker) — a full image builds in well under a minute on a warm cache, with
-  no QEMU emulation.
-
-## Quick start
-
-### Run the container
+## Quick start — MVP container (recommended)
 
 ```bash
-# Build the self-contained image (iPXE binaries are fetched + built inside the Dockerfile).
-docker build -f deploy/docker/Dockerfile -t openpxe:0.5.5 .
+# 1. Pull bundled iPXE binaries (~2 MB, one-time).
+./scripts/fetch-ipxe.sh
 
-# Run it on the box plugged into your PXE network. Host networking is required in
-# proxy mode so the container sees DHCPDISCOVER broadcasts; set PUBLIC_IP to this
-# host's LAN address so advertised boot URLs are reachable.
-docker run -d --name openpxe --network host \
+# 2. Build the container image (~3 min first time).
+docker buildx build -f deploy/docker/Dockerfile -t openpxe:0.4.1 --load .
+
+# 3. Run it on the box plugged into your PXE network. Set PUBLIC_IP to
+#    this host's LAN address so advertised iPXE URLs are reachable.
+docker run -d --name openpxe \
+  --network host \
   -e OPENPXE_PUBLIC_IP=10.0.0.5 \
   -e OPENPXE_DHCP_MODE=proxy \
   -v $PWD/data/isos:/var/lib/openpxe/isos \
   -v $PWD/data/work:/var/lib/openpxe/work \
-  openpxe:0.5.5
+  openpxe:0.4.1
 
-# Open the UI and drop an ISO in.
+# 4. Open the UI and drop an ISO in.
 open http://10.0.0.5
 ```
 
-> On macOS/Windows, Docker runs inside a Linux VM, so "host network" means the VM — use
-> the `openpxe-dev` service in `docker-compose.yml` for API-only testing on a laptop:
-> `OPENPXE_PUBLIC_IP=127.0.0.1 docker compose up openpxe-dev`.
+Host networking is required in proxy mode so the container sees DHCPDISCOVER
+broadcasts from the PXE VLAN. On macOS/Windows hosts Docker runs in a Linux
+VM, so "host" means the VM — use `openpxe-dev` in `docker-compose.yml` for
+API-only testing on a laptop.
 
-### Build from source
+### Quick start — docker compose
 
 ```bash
-./scripts/fetch-ipxe.sh          # populate assets/ipxe/ (embedded at compile time)
-cargo run --release              # needs root or CAP_NET_BIND_SERVICE for :80/:69
+# MVP / API testing on a laptop (no DHCP, high ports):
+OPENPXE_PUBLIC_IP=127.0.0.1 docker compose up openpxe-dev
+# Real PXE deployment on a Linux host (host network, DHCP proxy on):
+OPENPXE_PUBLIC_IP=10.0.0.5  docker compose up openpxe
 ```
 
-### Pre-seed ISOs from a directory
+### Multi-arch build + push
+
+For deploying to x86_64 servers, build both arches in one manifest:
+
+```bash
+# One-time: bootstrap a multi-arch builder.
+docker buildx create --name openpxe-multi --driver docker-container --use
+
+# Build + push both linux/amd64 and linux/arm64 under one tag.
+docker buildx build --builder openpxe-multi \
+  --platform linux/amd64,linux/arm64 \
+  -t ghcr.io/YOUR-ORG/openpxe:0.4.1 \
+  --push \
+  -f deploy/docker/Dockerfile .
+```
+
+On an Apple Silicon host, the amd64 stage runs under QEMU emulation (~10-15 min for a cold cache). On a Linux x86_64 host, both arches build natively at normal speed. CI runners on GitHub Actions with `docker/build-push-action@v5` handle this cleanly.
+
+### Build from source (no container)
+
+```bash
+./scripts/fetch-ipxe.sh
+cargo run --release            # needs NET_BIND_SERVICE or root for :80/:69
+```
+
+### Container health probes
+
+| Endpoint    | Purpose                                                       |
+|-------------|---------------------------------------------------------------|
+| `/healthz`  | Liveness — HTTP stack alive. Always 200.                      |
+| `/readyz`   | Readiness — 200 only if iPXE binaries bundled + ISO dir OK.   |
+| `/api/status` | Full JSON status: versions, assets, counts, live settings, SMB state. |
+
+### Pre-seeding ISOs from a directory
+
+For CI, pre-baked homelab deployments, or a fresh PVC, the binary has a
+`seed` subcommand that imports every `*.iso` from a host path through the
+same pipeline the web UI uses (introspection + boot-entry generation):
 
 ```bash
 docker run --rm \
   -v /my/iso-library:/seed:ro \
   -v openpxe-data:/var/lib/openpxe/isos \
   -e OPENPXE_PUBLIC_IP=10.0.0.5 \
-  openpxe:0.5.5 seed --from /seed          # add --dry-run to preview
+  openpxe:0.4.1 seed --from /seed
+
+# Dry run first to see what would be imported:
+docker run --rm -v /my/iso-library:/seed:ro openpxe:0.4.1 seed --from /seed --dry-run
 ```
 
-## Remote ISO libraries
+### Environment overrides
 
-Point OpenPXE at a NAS and boot ISOs straight off it — **read on demand, no local copy**,
-so a 50-ISO library costs zero disk on the OpenPXE host. All three clients are userspace
-(no kernel mounts, no `CAP_SYS_ADMIN`); pick whichever your storage speaks.
+| Var                    | Default                     | Meaning                                |
+|------------------------|-----------------------------|----------------------------------------|
+| `OPENPXE_HTTP_PORT`   | `80`                        | Web UI + boot script HTTP port         |
+| `OPENPXE_TFTP_PORT`   | `69`                        | TFTP port                              |
+| `OPENPXE_DHCP_PORT`   | `67`                        | DHCP server-side port                  |
+| `OPENPXE_DHCP_MODE`   | `proxy`                     | `proxy` or `disabled`                  |
+| `OPENPXE_PUBLIC_IP`   | auto-detect                 | Advertised IP for clients. Startup **fails** if unset and auto-detect returns loopback. |
+| `OPENPXE_ISO_DIR`     | `/var/lib/openpxe/isos`    | Where uploaded ISOs live               |
+| `OPENPXE_WORK_DIR`    | `/var/lib/openpxe/work`    | Scratch + runtime settings             |
+| `OPENPXE_LOG`         | `info,openpxe=debug`       | `tracing` filter                       |
 
-| Protocol | Implementation | Auth | HTTP Range¹ |
-|----------|----------------|------|-------------|
-| **NFS** (v3) | Pure-Rust in-process client | Client-IP (server export list) | ✅ |
-| **SFTP** (SSH) | Pure-Rust in-process client (`russh`) | Password **or** SSH key · host-key TOFU | ✅ |
-| **SMB** / CIFS | Userspace `smbclient` | Guest or username/password | — |
-
-¹ Range support lets clients seek into a multi-GB ISO without downloading what comes
-before it — needed for kernel/initrd extraction and `httpdisk`-style boots. NFS and SFTP
-expose explicit offsets; the SMB CLI streams sequentially, so SMB-sourced ISOs serve whole-file.
-
-## Supported client architectures
-
-| DHCP option 93 | Architecture | Firmware served |
-|----------------|--------------|-----------------|
-| `0x0000` | Legacy x86 BIOS | `undionly.kpxe` |
-| `0x0006` | IA32 UEFI | `snponly-i386.efi` |
-| `0x0007` / `0x0009` | x86_64 UEFI | `snponly.efi` |
-| `0x000B` | ARM64 UEFI | `snponly-arm64.efi` |
-
-UEFI firmware that advertises `HTTPClient` (option 60) skips TFTP entirely and is handed an HTTP URL.
-
-## The boot menu, on a real client
+## What the boot menu looks like on a real client
 
 ```
-                        OpenPXE — network boot menu
+                        OpenPXE - network boot menu
 
  ------------------------- Default -------------------------
  Boot from Local HDD
- ----------------------- Installers ------------------------
+ ----------------------- Installers -----------------------
  Linux Installers   >
  Windows Installers >                (only if enabled in Settings)
  -------------------------- Tools --------------------------
- Tools              >    Utilities / OpenPXE Shell / NIC Info / Reboot
+ Tools              >                Utilities / Shell /
+                                     NIC Info / Reboot /
+                                     Exit and continue BIOS
  ---------------------- Queued Deployment ------------------
  Queued Deployment   (join queue)
 ```
 
-Linux/Windows submenus list images iVentoy-style with sizes:
+Linux/Windows submenus show file sizes iVentoy-style:
 
 ```
-                   OpenPXE — Linux Installers
+                   OpenPXE - Linux Installers
 
- [  4699 MB]  ubuntu-22.04.2-desktop-amd64
+ [  4376 MB]  CentOS-7-x86_64-DVD-1810
  [  2002 MB]  Fedora-Workstation-Live-x86_64-38-1.6
+ [  4699 MB]  ubuntu-22.04.2-desktop-amd64
             < Back to main menu
 ```
 
-The entire hierarchy is generated from what you upload and toggle — iPXE never surfaces.
-
-## Windows deployment
-
-Enable **Windows ISO support** in Settings, then upload a **stock, unmodified** Microsoft ISO:
-
-1. On upload, OpenPXE uses `wimlib-imagex` to inject exactly two plain-text files into the
-   WinPE image (`winpeshl.ini` + `startnet.cmd`) — no drivers, no certificates.
-2. The container's Samba `smbd` serves the extracted install tree on `:445`.
-3. The client chainloads `wimboot` → patched WinPE → Windows Setup running off the share.
-
-**Every executable the client runs is stock Microsoft-signed.** OpenPXE never ships
-drivers, never installs certificates into the client trust store, and never recommends
-`bcdedit /set testsigning on`. The SMB approach is adapted (re-implemented, not copied)
-from [Bootimus](https://github.com/garybowers/bootimus) (Apache-2.0). Port `445` must be
-directly reachable from clients; Windows 10/11 client SKUs are the tested target.
-
-## Configuration
-
-All settings have defaults and layer **defaults → TOML (`--config` / `OPENPXE_CONFIG`) →
-`OPENPXE_*` env**. The common knobs:
-
-| Var | Default | Meaning |
-|-----|---------|---------|
-| `OPENPXE_PUBLIC_IP` | auto-detect | IP advertised to clients. **Startup fails** if unset and auto-detect yields loopback. |
-| `OPENPXE_DHCP_MODE` | `proxy` | `proxy` or `disabled` |
-| `OPENPXE_HTTP_PORT` | `80` | Web UI + boot-script HTTP port |
-| `OPENPXE_TFTP_PORT` | `69` | TFTP port |
-| `OPENPXE_DHCP_PORT` | `67` | DHCP server-side port |
-| `OPENPXE_ISO_DIR` | `/var/lib/openpxe/isos` | Uploaded ISOs |
-| `OPENPXE_WORK_DIR` | `/var/lib/openpxe/work` | Scratch, settings, share + branding state |
-| `OPENPXE_LOG` | `info,openpxe=info` | `tracing` filter |
+iPXE never appears in the UI — the whole hierarchy above is generated from
+ISOs you upload via drag-and-drop in the web UI plus toggles in Settings.
 
 ## OpenShift
 
 ```bash
 oc apply -f deploy/openshift/
+oc -n openpxe get all
 oc -n openpxe get route openpxe -o jsonpath='{.spec.host}'
 ```
 
-The bundled `openpxe-scc` grants exactly `hostNetwork` (CNI overlays don't deliver L2
-broadcast into pod netns) and `NET_BIND_SERVICE` (to bind ports <1024) — nothing else.
-No raw sockets, no privileged mode. The Route covers `80/TCP`; PXE clients reach UDP
-67/69/4011 on the node's host IP directly.
+### Why a custom SCC?
 
-## Health & observability
+The default `restricted-v2` blocks `hostNetwork` and all capabilities. PXE
+cannot work without host network (CNI overlays don't deliver L2 broadcast
+into pod netns), and we need `NET_BIND_SERVICE` to bind <1024. The custom
+`openpxe-scc` grants exactly those two and nothing else. No raw sockets,
+no privileged mode — proxy-mode DHCP sidesteps the usual requirements.
 
-| Endpoint | Purpose |
-|----------|---------|
-| `/healthz` | Liveness — always 200 if the HTTP stack is up. |
-| `/readyz` | Readiness — 200 only once iPXE firmware is bundled and the ISO dir is reachable. |
-| `/api/status` | Full JSON: version, assets, counts, live settings, share + SMB state. |
-| `/metrics` | Prometheus text format — DHCP replies by arch, TFTP/HTTP counts, queue gauges, uptime. |
+### What's on host ports
+
+| Port     | Proto | Purpose                         |
+|----------|-------|---------------------------------|
+| 67       | UDP   | DHCP server (proxy replies)     |
+| 69       | UDP   | TFTP                            |
+| 4011     | UDP   | PXE Boot Server discovery       |
+| 80       | TCP   | Web UI + HTTP boot assets       |
+
+The OpenShift Route only covers 80/TCP. Clients on the PXE network talk to
+the node's host IP directly for UDP.
+
+## Windows support
+
+Enabled by toggling **Windows ISO support** under Settings. The flow:
+
+1. Upload a stock Microsoft Windows install ISO (vanilla, no pre-processing).
+2. On upload, OpenPXE extracts the ISO and uses `wimlib-imagex` to rewrite
+   image index 2 (WinPE) of `sources/boot.wim`. It injects exactly two
+   plain-text files:
+   - `Windows/System32/winpeshl.ini` — tells WinPE to run `startnet.cmd`.
+   - `Windows/System32/startnet.cmd` — runs `wpeinit`, waits for the SMB
+     host to be reachable, `net use Z: \\<server>\<share> /user:guest`,
+     then `Z:\setup.exe`.
+3. The container's Samba `smbd` serves the extracted install tree on :445.
+4. The client gets chainloaded into wimboot → patched WinPE → Windows Setup
+   running off the SMB share. **Every binary the client executes is stock
+   Microsoft-signed.**
+
+### What we never do
+
+- Ship drivers — signed, test-signed, or otherwise — that load on the client.
+- Install certificates into the target's trust store or WinPE boot policy.
+- Recommend `bcdedit /set testsigning on` or any equivalent signing-policy
+  weakening.
+
+### Credit & limitations
+
+The SMB-based approach is adapted from [Bootimus](https://github.com/garybowers/bootimus)
+(Apache-2.0). Re-implemented in Rust; no code was copied verbatim. Known
+operational constraints inherited from the design:
+
+- **Port 445 must be directly reachable from PXE clients.** `net use`
+  ignores alternate ports. In OpenShift this means `hostPort: 445` on the
+  deployment; on a host that already runs SMB it will collide.
+- Windows 10/11 client SKUs are the tested target. Server SKUs untested.
+- Hardware with NICs/storage controllers missing from WinPE's bundled
+  drivers will need a driver-pack injection step (not yet implemented).
+
+## Queued Deployment
+
+The coordinated launch flow, end to end:
+
+1. A client boots and picks **Queued Deployment** in the PXE menu (or falls
+   through on timeout with the default `timeout_action`).
+2. The client joins the queue, gets a numbered queue position, and enters a
+   long-poll loop (25s per request, auto-renewed).
+3. In the web UI's **Queued Deployment** tab, the operator sees each waiting
+   client with its MAC, IP, arch, and position.
+4. The operator selects an image and clicks **Launch for all waiting**.
+   The server broadcasts the assignment to every queued client via a
+   `tokio::sync::Notify`; each client's next poll returns the boot script
+   for the chosen image.
+5. Every client chains the same image at effectively the same moment. The
+   queue stays visible until the operator releases entries, which keeps a
+   useful audit trail during hardware testing.
+
+No user-facing iPXE anywhere in this flow. The client only ever runs
+scripts we generate; the operator only interacts with the web UI.
 
 ## Architecture
 
-Workspace of focused crates — `core`, `dhcp-proxy`, `tftp`, `http-api`, `iso-store`,
-`ipxe-assets`, `webui`, and the `openpxe` binary. See
-[`docs/architecture.md`](docs/architecture.md) for the protocol stack, crate layout, and
-the full decision log.
+See [`docs/architecture.md`](docs/architecture.md) for the protocol stack,
+crate layout, and the full decision log.
 
-## License
+## Licence
 
-Dual-licensed under **MIT OR Apache-2.0** — use whichever fits your project.
+MIT OR Apache-2.0.

crates/core/Cargo.toml

@@ -13,7 +13,6 @@ workspace = true
 serde.workspace = true
 serde_json.workspace = true
 toml.workspace = true
-figment.workspace = true
 thiserror.workspace = true
 anyhow.workspace = true
 tracing.workspace = true
@@ -39,9 +38,6 @@ base64.workspace = true
 
 [dev-dependencies]
 tempfile = "3.12"
-# v0.5.4: figment's `Jail` (hermetic env/file sandbox) for the config
-# loader tests lives behind the `test` feature.
-figment = { workspace = true, features = ["test"] }
 # v0.5.1: generate a throwaway self-signed signing cert/key so SAML
 # verification tests can produce genuinely signed SAMLResponses.
 rcgen = "0.13"

crates/core/src/branding.rs

@@ -1,23 +1,11 @@
 //! Operator-controlled branding overrides.
 //!
-//! v0.5.2 splits the single brand mark into **three independent slots**,
-//! FleetDM-style:
-//!
-//! * `light` — shown in the WebUI top-left and on the form-login page
-//!   when the active theme is light.
-//! * `dark` — same surfaces, when the active theme is dark.
-//! * `client` — the raster painted above the iPXE boot menu entries
-//!   (`/branding/pxe-logo`), i.e. what a PXE client sees on the screen.
-//!
-//! Each slot lives at `<work_dir>/branding/logo-<slot>.<ext>` and is
-//! served in preference to the bundled rainbow-horizon mark when present.
-//! Borrowed-from-FleetDM: tenant chrome, same product.
-//!
-//! Legacy continuity: a pre-v0.5.2 single `logo.<ext>` (recorded under
-//! the old `logo_filename`/`logo_mime` keys) is migrated on first load
-//! into both the `dark` and `client` slots — that preserves the previous
-//! behaviour (one mark fed both the dark WebUI and the PXE screen) until
-//! the operator uploads dedicated variants.
+//! The browser tab's logo (`/assets/logo.svg`) defaults to the bundled
+//! rainbow-horizon mark. Operators who deploy OpenPXE behind their own
+//! branding can upload a replacement that lives at
+//! `<work_dir>/branding/logo.<ext>` and is served in preference to the
+//! bundled SVG when present. Borrowed-from-FleetDM: tenant chrome, same
+//! product.
 //!
 //! Storage policy mirrors `HostBindings` / `BootLog`: in-memory cache is
 //! authoritative for the current process, disk is the source of truth on
@@ -47,104 +35,27 @@ pub const ALLOWED_LOGO_MIMES: &[&str] = &[
 /// puts a clear bound on memory + serialization cost.
 pub const MAX_LOGO_BYTES: usize = 2 * 1024 * 1024;
 
-/// Which branded surface a logo upload targets.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum LogoSlot {
-    /// WebUI + form-login page, light theme.
-    Light,
-    /// WebUI + form-login page, dark theme.
-    Dark,
-    /// iPXE boot-menu background seen by PXE clients.
-    Client,
-}
-
-impl LogoSlot {
-    #[must_use]
-    pub fn as_str(self) -> &'static str {
-        match self {
-            LogoSlot::Light => "light",
-            LogoSlot::Dark => "dark",
-            LogoSlot::Client => "client",
-        }
-    }
-
-    /// Parse a slot name from the URL path segment. Case-insensitive.
-    #[must_use]
-    pub fn parse(s: &str) -> Option<Self> {
-        match s.trim().to_ascii_lowercase().as_str() {
-            "light" => Some(LogoSlot::Light),
-            "dark" => Some(LogoSlot::Dark),
-            "client" => Some(LogoSlot::Client),
-            _ => None,
-        }
-    }
-}
-
-/// One brand-mark slot: a filename (relative to the branding dir) plus
-/// the MIME we cached at upload time so the HTTP layer can set the
-/// Content-Type without re-sniffing.
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-struct Slot {
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    filename: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    mime: Option<String>,
-}
-
-impl Slot {
-    fn clear_file(&mut self, dir: &Path) {
-        if let Some(name) = self.filename.take() {
-            let _ = std::fs::remove_file(dir.join(name));
-        }
-        self.mime = None;
-    }
-}
-
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 struct Inner {
-    #[serde(default)]
-    light: Slot,
-    #[serde(default)]
-    dark: Slot,
-    #[serde(default)]
-    client: Slot,
-    /// Monotonic counter bumped on every set/clear (any slot). Surfaces
-    /// as a cache-bust token (`/assets/logo.svg?r=<rev>`) so the browser
-    /// fetches the new bytes the moment the operator swaps a logo — the
-    /// app version alone can't do this since it doesn't change on upload.
-    /// Persisted so the token stays stable across restarts and keeps
-    /// climbing across multiple swaps.
+    /// File name (relative to the branding dir) for the active logo, if
+    /// any. Always under `<work_dir>/branding/`; never an absolute path
+    /// from the operator.
+    logo_filename: Option<String>,
+    /// MIME of the active logo, mirroring `logo_filename`. Cached here
+    /// so the HTTP layer can set Content-Type without re-sniffing.
+    logo_mime: Option<String>,
+    /// Monotonic counter bumped on every set/clear. Surfaces as a
+    /// cache-bust token (`/assets/logo.svg?r=<rev>`) so the browser
+    /// fetches the new bytes the moment the operator swaps the logo —
+    /// the app version alone can't do this since it doesn't change on
+    /// upload. Persisted so the token stays stable across restarts and
+    /// keeps climbing across multiple swaps.
     #[serde(default)]
     rev: u64,
-    // ── Legacy (pre-v0.5.2) single-logo keys ──────────────────────────
-    // Read on load for one-way migration into `dark` + `client`, then
-    // dropped from the persisted form (skip_serializing_if).
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    logo_filename: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    logo_mime: Option<String>,
-}
-
-impl Inner {
-    fn slot(&self, slot: LogoSlot) -> &Slot {
-        match slot {
-            LogoSlot::Light => &self.light,
-            LogoSlot::Dark => &self.dark,
-            LogoSlot::Client => &self.client,
-        }
-    }
-
-    fn slot_mut(&mut self, slot: LogoSlot) -> &mut Slot {
-        match slot {
-            LogoSlot::Light => &mut self.light,
-            LogoSlot::Dark => &mut self.dark,
-            LogoSlot::Client => &mut self.client,
-        }
-    }
 }
 
 /// In-memory + on-disk override registry. Cheap to clone; locks are
-/// brief. The `branding.json` cache lives alongside the active assets
+/// brief. The `branding.json` cache lives alongside the active asset
 /// inside `<work_dir>/branding/`.
 #[derive(Debug, Clone)]
 pub struct BrandingStore {
@@ -156,8 +67,7 @@ pub struct BrandingStore {
 impl BrandingStore {
     /// Load (or initialise empty) from `<work_dir>/branding/`. Tolerates
     /// missing directories, partial state, and corrupt JSON — a bad
-    /// cache should never block PXE for the network. Migrates a legacy
-    /// single-logo file into the dark + client slots.
+    /// cache should never block PXE for the network.
     #[must_use]
     pub fn load_or_default(work_dir: &Path) -> Self {
         let dir = work_dir.join("branding");
@@ -165,7 +75,25 @@ impl BrandingStore {
         let mut inner = Inner::default();
         if let Ok(text) = std::fs::read_to_string(&path) {
             match serde_json::from_str::<Inner>(&text) {
-                Ok(parsed) => inner = parsed,
+                Ok(parsed) => {
+                    // Sanity: if the JSON says we have a logo but the
+                    // file is gone, clear the in-memory pointer so
+                    // /assets/logo.svg falls back to the bundled SVG
+                    // rather than 500ing on a missing file.
+                    if let Some(name) = parsed.logo_filename.as_deref() {
+                        if dir.join(name).is_file() {
+                            inner = parsed;
+                        } else {
+                            tracing::warn!(
+                                target: "openpxe::branding",
+                                file = %name,
+                                "branding.json points at missing file; clearing"
+                            );
+                        }
+                    } else {
+                        inner = parsed;
+                    }
+                }
                 Err(e) => {
                     tracing::warn!(
                         target: "openpxe::branding",
@@ -174,242 +102,102 @@ impl BrandingStore {
                 }
             }
         }
-        let store = Self {
+        Self {
             dir: Arc::new(dir),
             inner: Arc::new(RwLock::new(inner)),
-        };
-        store.migrate_legacy();
-        store.prune_missing();
-        store
+        }
     }
 
-    /// One-way migration: a pre-v0.5.2 `logo.<ext>` becomes the dark +
-    /// client slots (the old single mark fed both the dark WebUI and the
-    /// PXE screen). Best-effort; failures leave the legacy file in place
-    /// rather than blocking startup.
-    fn migrate_legacy(&self) {
-        let (legacy_name, legacy_mime) = {
-            let g = self.inner.read();
-            (g.logo_filename.clone(), g.logo_mime.clone())
-        };
-        let Some(name) = legacy_name else { return };
-        let src = self.dir.join(&name);
-        if !src.is_file() {
-            // Legacy pointer is stale — just drop it.
-            let mut g = self.inner.write();
-            g.logo_filename = None;
-            g.logo_mime = None;
-            drop(g);
-            self.persist();
-            return;
-        }
-        let mime = legacy_mime.unwrap_or_else(|| "image/svg+xml".to_string());
-        let ext = ext_for_mime(&mime).unwrap_or("bin");
-        if let Ok(bytes) = std::fs::read(&src) {
-            // Seed dark + client only when those slots are still empty so
-            // a re-run (or a manual edit) never clobbers operator intent.
-            let needs_dark = self.inner.read().dark.filename.is_none();
-            let needs_client = self.inner.read().client.filename.is_none();
-            if needs_dark {
-                let _ = self.write_slot(LogoSlot::Dark, &mime, ext, &bytes);
-            }
-            if needs_client {
-                let _ = self.write_slot(LogoSlot::Client, &mime, ext, &bytes);
-            }
-        }
-        let _ = std::fs::remove_file(&src);
-        {
-            let mut g = self.inner.write();
-            g.logo_filename = None;
-            g.logo_mime = None;
-        }
-        self.persist();
-        tracing::info!(
-            target: "openpxe::branding",
-            "migrated legacy single logo into dark + client slots"
-        );
+    /// Absolute path to the active logo, if one is set and present on
+    /// disk. `None` means the HTTP layer should serve the bundled SVG.
+    #[must_use]
+    pub fn logo_path(&self) -> Option<PathBuf> {
+        let g = self.inner.read();
+        g.logo_filename.as_deref().map(|n| self.dir.join(n))
     }
 
-    /// Drop in-memory slot pointers whose backing file vanished from disk
-    /// so the HTTP layer falls back to the bundled mark instead of 500ing.
-    fn prune_missing(&self) {
-        let mut changed = false;
-        {
-            let mut g = self.inner.write();
-            for slot in [LogoSlot::Light, LogoSlot::Dark, LogoSlot::Client] {
-                let present = g
-                    .slot(slot)
-                    .filename
-                    .as_deref()
-                    .is_some_and(|n| self.dir.join(n).is_file());
-                if !present && g.slot(slot).filename.is_some() {
-                    g.slot_mut(slot).filename = None;
-                    g.slot_mut(slot).mime = None;
-                    changed = true;
+    /// MIME of the active logo, if any. The HTTP layer pairs this with
+    /// the bytes returned by [`Self::logo_path`].
+    #[must_use]
+    pub fn logo_mime(&self) -> Option<String> {
+        self.inner.read().logo_mime.clone()
+    }
+
+    /// Replace the active logo. Returns the chosen on-disk filename so
+    /// the caller can echo it back in the API response. Old logos are
+    /// removed best-effort.
+    pub fn set_logo(&self, mime: &str, ext: &str, bytes: &[u8]) -> std::io::Result<String> {
+        std::fs::create_dir_all(self.dir.as_path())?;
+        // Single canonical filename per upload — overwriting the old one
+        // (after clearing it) keeps the directory tidy and avoids any
+        // path-traversal concern: the operator never supplies the name.
+        let safe_ext = sanitize_ext(ext);
+        let filename = format!("logo.{safe_ext}");
+        let final_path = self.dir.join(&filename);
+        // Atomic write: tmp -> rename. Guarantees the file is either
+        // entirely the old logo or entirely the new one.
+        let tmp = final_path.with_extension(format!("{safe_ext}.tmp"));
+        std::fs::write(&tmp, bytes)?;
+        std::fs::rename(&tmp, &final_path)?;
+        // Clean up any sibling logo.<otherext> so there's exactly one
+        // canonical file at any time.
+        if let Ok(entries) = std::fs::read_dir(self.dir.as_path()) {
+            for e in entries.flatten() {
+                let p = e.path();
+                let name = p
+                    .file_name()
+                    .and_then(|s| s.to_str())
+                    .unwrap_or("");
+                if name.starts_with("logo.") && name != filename {
+                    let _ = std::fs::remove_file(&p);
                 }
             }
         }
-        if changed {
-            self.persist();
+
+        {
+            let mut g = self.inner.write();
+            g.logo_filename = Some(filename.clone());
+            g.logo_mime = Some(mime.to_string());
+            g.rev = g.rev.wrapping_add(1);
         }
-    }
-
-    /// Absolute path to the logo for `slot`, if set and present on disk.
-    #[must_use]
-    pub fn slot_path(&self, slot: LogoSlot) -> Option<PathBuf> {
-        let g = self.inner.read();
-        g.slot(slot).filename.as_deref().map(|n| self.dir.join(n))
-    }
-
-    /// MIME of the logo for `slot`, if any.
-    #[must_use]
-    pub fn slot_mime(&self, slot: LogoSlot) -> Option<String> {
-        self.inner.read().slot(slot).mime.clone()
-    }
-
-    /// Resolve the WebUI logo for a theme, with fallback: light falls
-    /// back to dark and vice-versa, so a single uploaded variant still
-    /// shows on both themes. Returns `(path, mime)` or `None` (→ bundled).
-    #[must_use]
-    pub fn web_logo(&self, theme_is_light: bool) -> Option<(PathBuf, String)> {
-        let (primary, secondary) = if theme_is_light {
-            (LogoSlot::Light, LogoSlot::Dark)
-        } else {
-            (LogoSlot::Dark, LogoSlot::Light)
-        };
-        let g = self.inner.read();
-        let chosen = if g.slot(primary).filename.is_some() {
-            primary
-        } else {
-            secondary
-        };
-        let s = g.slot(chosen);
-        s.filename.as_deref().map(|n| {
-            (
-                self.dir.join(n),
-                s.mime
-                    .clone()
-                    .unwrap_or_else(|| "image/svg+xml".to_string()),
-            )
-        })
-    }
-
-    /// Resolve the PXE client logo (no theme fallback — the PXE screen
-    /// has a single mark). Returns `(path, mime)` or `None` (→ default
-    /// composed background).
-    #[must_use]
-    pub fn client_logo(&self) -> Option<(PathBuf, String)> {
-        let g = self.inner.read();
-        let s = &g.client;
-        s.filename.as_deref().map(|n| {
-            (
-                self.dir.join(n),
-                s.mime
-                    .clone()
-                    .unwrap_or_else(|| "application/octet-stream".to_string()),
-            )
-        })
-    }
-
-    /// Replace the logo for `slot`. Returns the chosen on-disk filename so
-    /// the caller can echo it back in the API response.
-    pub fn set_logo(
-        &self,
-        slot: LogoSlot,
-        mime: &str,
-        ext: &str,
-        bytes: &[u8],
-    ) -> std::io::Result<String> {
-        let filename = self.write_slot(slot, mime, ext, bytes)?;
         self.persist();
         tracing::info!(
             target: "openpxe::branding",
-            slot = slot.as_str(), file = %filename, mime = %mime, size = bytes.len(),
+            file = %filename, mime = %mime, size = bytes.len(),
             "custom logo installed"
         );
         Ok(filename)
     }
 
-    /// Write the bytes for a slot and update the in-memory pointer + rev,
-    /// without persisting (the caller decides when to flush). Cleans up
-    /// any sibling `logo-<slot>.*` so there's exactly one file per slot.
-    fn write_slot(
-        &self,
-        slot: LogoSlot,
-        mime: &str,
-        ext: &str,
-        bytes: &[u8],
-    ) -> std::io::Result<String> {
-        std::fs::create_dir_all(self.dir.as_path())?;
-        let safe_ext = sanitize_ext(ext);
-        let stem = format!("logo-{}", slot.as_str());
-        let filename = format!("{stem}.{safe_ext}");
-        let final_path = self.dir.join(&filename);
-        // Atomic write: tmp -> rename.
-        let tmp = final_path.with_extension(format!("{safe_ext}.tmp"));
-        std::fs::write(&tmp, bytes)?;
-        std::fs::rename(&tmp, &final_path)?;
-        // Clean up any sibling `logo-<slot>.<otherext>`.
-        if let Ok(entries) = std::fs::read_dir(self.dir.as_path()) {
-            for e in entries.flatten() {
-                let p = e.path();
-                let name = p.file_name().and_then(|s| s.to_str()).unwrap_or("");
-                if name.starts_with(&format!("{stem}.")) && name != filename {
-                    let _ = std::fs::remove_file(&p);
-                }
-            }
-        }
-        let mut g = self.inner.write();
-        let s = g.slot_mut(slot);
-        s.filename = Some(filename.clone());
-        s.mime = Some(mime.to_string());
-        g.rev = g.rev.wrapping_add(1);
-        Ok(filename)
-    }
-
-    /// Drop the override for `slot` and return to the bundled / default.
-    pub fn clear_logo(&self, slot: LogoSlot) -> std::io::Result<()> {
-        {
+    /// Drop the override and return to the bundled SVG.
+    pub fn clear_logo(&self) -> std::io::Result<()> {
+        let removed = {
             let mut g = self.inner.write();
-            let dir = self.dir.as_path();
-            g.slot_mut(slot).clear_file(dir);
+            let removed = g.logo_filename.take();
+            g.logo_mime = None;
             g.rev = g.rev.wrapping_add(1);
+            removed
+        };
+        if let Some(name) = removed {
+            let p = self.dir.join(&name);
+            let _ = std::fs::remove_file(&p);
+            tracing::info!(target: "openpxe::branding", file = %name, "custom logo cleared");
         }
         self.persist();
-        tracing::info!(target: "openpxe::branding", slot = slot.as_str(), "custom logo cleared");
         Ok(())
     }
 
-    /// True if a custom logo is configured for `slot`.
+    /// Convenience: true if a custom logo is configured. Surfaces on
+    /// `/api/status` so the WebUI can show "Custom logo: yes" without
+    /// fetching the asset itself.
     #[must_use]
-    pub fn has_logo(&self, slot: LogoSlot) -> bool {
-        self.inner.read().slot(slot).filename.is_some()
+    pub fn has_logo(&self) -> bool {
+        self.inner.read().logo_filename.is_some()
     }
 
-    /// True if either WebUI theme slot has a custom logo — drives the
-    /// FleetDM-style full-width brand block (and the `has-custom-logo`
-    /// class) on the sidebar + login page.
-    #[must_use]
-    pub fn has_any_web_logo(&self) -> bool {
-        let g = self.inner.read();
-        g.light.filename.is_some() || g.dark.filename.is_some()
-    }
-
-    /// Presence triple `(light, dark, client)` for the `/api/me` and
-    /// `/api/status` bootstrap payloads.
-    #[must_use]
-    pub fn presence(&self) -> (bool, bool, bool) {
-        let g = self.inner.read();
-        (
-            g.light.filename.is_some(),
-            g.dark.filename.is_some(),
-            g.client.filename.is_some(),
-        )
-    }
-
-    /// Cache-bust token for the logo asset URLs. Changes on every
+    /// Cache-bust token for the logo asset URL. Changes on every
     /// set/clear so `/assets/logo.svg?r=<rev>` resolves to a fresh URL
-    /// whenever the operator swaps a brand mark. Stable otherwise.
+    /// whenever the operator swaps the brand mark. Stable otherwise.
     #[must_use]
     pub fn logo_rev(&self) -> u64 {
         self.inner.read().rev
@@ -479,87 +267,47 @@ mod tests {
     fn empty_after_load_when_no_branding_dir() {
         let dir = tempdir().unwrap();
         let b = BrandingStore::load_or_default(dir.path());
-        assert!(!b.has_logo(LogoSlot::Light));
-        assert!(!b.has_logo(LogoSlot::Dark));
-        assert!(!b.has_logo(LogoSlot::Client));
-        assert!(b.web_logo(false).is_none());
-        assert!(b.client_logo().is_none());
-        assert!(!b.has_any_web_logo());
+        assert!(!b.has_logo());
+        assert!(b.logo_path().is_none());
+        assert!(b.logo_mime().is_none());
     }
 
     #[test]
     fn set_clear_round_trip_persists() {
         let dir = tempdir().unwrap();
         let b = BrandingStore::load_or_default(dir.path());
-        let name = b
-            .set_logo(LogoSlot::Dark, "image/png", "png", b"\x89PNG\r\n\x1a\nfake")
-            .unwrap();
-        assert_eq!(name, "logo-dark.png");
-        assert!(b.has_logo(LogoSlot::Dark));
-        assert_eq!(b.slot_mime(LogoSlot::Dark).as_deref(), Some("image/png"));
-        let (p, _) = b.web_logo(false).unwrap();
+        let name = b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake").unwrap();
+        assert_eq!(name, "logo.png");
+        assert!(b.has_logo());
+        assert_eq!(b.logo_mime().as_deref(), Some("image/png"));
+        let p = b.logo_path().unwrap();
         assert!(p.is_file());
 
         // Re-open and confirm the override survives a restart.
         drop(b);
         let b2 = BrandingStore::load_or_default(dir.path());
-        assert!(b2.has_logo(LogoSlot::Dark));
-        assert_eq!(b2.slot_mime(LogoSlot::Dark).as_deref(), Some("image/png"));
+        assert!(b2.has_logo());
+        assert_eq!(b2.logo_mime().as_deref(), Some("image/png"));
 
         // Clear; the file goes away and has_logo flips off.
-        b2.clear_logo(LogoSlot::Dark).unwrap();
-        assert!(!b2.has_logo(LogoSlot::Dark));
+        b2.clear_logo().unwrap();
+        assert!(!b2.has_logo());
         assert!(!p.exists());
     }
 
     #[test]
-    fn web_logo_falls_back_across_themes() {
+    fn replacing_logo_removes_old_extension_sibling() {
+        // PNG then SVG; only the SVG should remain on disk.
         let dir = tempdir().unwrap();
         let b = BrandingStore::load_or_default(dir.path());
-        // Only dark uploaded — light theme falls back to it.
-        b.set_logo(LogoSlot::Dark, "image/png", "png", b"dark")
-            .unwrap();
-        let (p_light, _) = b.web_logo(true).expect("light falls back to dark");
-        assert!(p_light.ends_with("logo-dark.png"));
-        // Upload a distinct light — now light theme uses its own.
-        b.set_logo(LogoSlot::Light, "image/png", "png", b"light")
-            .unwrap();
-        let (p_light2, _) = b.web_logo(true).unwrap();
-        assert!(p_light2.ends_with("logo-light.png"));
-        // Client is independent and still unset.
-        assert!(b.client_logo().is_none());
-    }
-
-    #[test]
-    fn replacing_slot_removes_old_extension_sibling() {
-        let dir = tempdir().unwrap();
-        let b = BrandingStore::load_or_default(dir.path());
-        b.set_logo(
-            LogoSlot::Client,
-            "image/png",
-            "png",
-            b"\x89PNG\r\n\x1a\nfake",
-        )
-        .unwrap();
-        b.set_logo(
-            LogoSlot::Client,
-            "image/svg+xml",
-            "svg",
-            br#"<svg xmlns="http://www.w3.org/2000/svg"/>"#,
-        )
-        .unwrap();
+        b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake").unwrap();
+        b.set_logo("image/svg+xml", "svg", br#"<svg xmlns="http://www.w3.org/2000/svg"/>"#).unwrap();
         let entries: Vec<_> = std::fs::read_dir(dir.path().join("branding"))
             .unwrap()
             .filter_map(|e| e.ok().map(|e| e.file_name().to_string_lossy().into_owned()))
             .collect();
-        assert!(
-            entries.iter().any(|n| n == "logo-client.svg"),
-            "got {entries:?}"
-        );
-        assert!(
-            !entries.iter().any(|n| n == "logo-client.png"),
-            "stale PNG left over: {entries:?}"
-        );
+        assert!(entries.iter().any(|n| n == "logo.svg"), "got {entries:?}");
+        assert!(!entries.iter().any(|n| n == "logo.png"), "stale PNG left over: {entries:?}");
     }
 
     #[test]
@@ -567,92 +315,54 @@ mod tests {
         let dir = tempdir().unwrap();
         let b = BrandingStore::load_or_default(dir.path());
         assert_eq!(b.logo_rev(), 0);
-        b.set_logo(LogoSlot::Light, "image/png", "png", b"a")
-            .unwrap();
+        b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake").unwrap();
         assert_eq!(b.logo_rev(), 1);
-        b.set_logo(LogoSlot::Dark, "image/png", "png", b"b")
-            .unwrap();
+        b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake2").unwrap();
         assert_eq!(b.logo_rev(), 2);
-        b.clear_logo(LogoSlot::Light).unwrap();
+        b.clear_logo().unwrap();
         assert_eq!(b.logo_rev(), 3);
+        // Survives a restart.
         drop(b);
         let b2 = BrandingStore::load_or_default(dir.path());
         assert_eq!(b2.logo_rev(), 3);
     }
 
-    #[test]
-    fn legacy_single_logo_migrates_to_dark_and_client() {
-        // A pre-v0.5.2 branding.json + logo.png migrates on load.
-        let dir = tempdir().unwrap();
-        let brand_dir = dir.path().join("branding");
-        std::fs::create_dir_all(&brand_dir).unwrap();
-        std::fs::write(brand_dir.join("logo.png"), b"\x89PNG\r\n\x1a\nlegacy").unwrap();
-        // Hand-write the old shape (logo_filename/logo_mime, no slots).
-        std::fs::write(
-            brand_dir.join("branding.json"),
-            br#"{"logo_filename":"logo.png","logo_mime":"image/png","rev":4}"#,
-        )
-        .unwrap();
-        let b = BrandingStore::load_or_default(dir.path());
-        assert!(b.has_logo(LogoSlot::Dark), "dark seeded from legacy");
-        assert!(b.has_logo(LogoSlot::Client), "client seeded from legacy");
-        assert!(!b.has_logo(LogoSlot::Light), "light stays empty");
-        // The old logo.png is gone; per-slot files exist.
-        assert!(!brand_dir.join("logo.png").exists());
-        assert!(brand_dir.join("logo-dark.png").is_file());
-        assert!(brand_dir.join("logo-client.png").is_file());
-        // rev carried over from the legacy file and advanced as the two
-        // slots were seeded (each write bumps it), so it never regresses.
-        let migrated_rev = b.logo_rev();
-        assert!(
-            migrated_rev >= 4,
-            "rev should not regress below legacy: {migrated_rev}"
-        );
-        // And the migration is sticky across a restart (no re-migrate, no
-        // further rev churn).
-        drop(b);
-        let b2 = BrandingStore::load_or_default(dir.path());
-        assert!(b2.has_logo(LogoSlot::Dark));
-        assert!(b2.has_logo(LogoSlot::Client));
-        assert!(!b2.has_logo(LogoSlot::Light));
-        assert_eq!(b2.logo_rev(), migrated_rev, "restart must not re-migrate");
-    }
-
     #[test]
     fn sanitize_ext_strips_separators_and_path_chars() {
         assert_eq!(sanitize_ext("svg"), "svg");
+        // Path separators and non-alphanumerics filter out, leaving just
+        // letters. The remaining "etcpasswd" exceeds the 5-char cap so
+        // it collapses to `bin` rather than producing `etcpa`.
         assert_eq!(sanitize_ext("../etc/passwd"), "bin");
+        // Short alphanumeric strip-through stays itself.
         assert_eq!(sanitize_ext("../svg"), "svg");
         assert_eq!(sanitize_ext(""), "bin");
         assert_eq!(sanitize_ext("PNG"), "png");
+        // Anything past five chars is suspicious — collapse to `bin`.
         assert_eq!(sanitize_ext("svgvvvv"), "bin");
     }
 
     #[test]
     fn missing_file_referenced_by_json_resolves_to_empty() {
+        // If the operator nukes the file out from under the JSON cache,
+        // we should silently fall back to no-override rather than
+        // hanging on to a bogus path.
         let dir = tempdir().unwrap();
         let brand_dir = dir.path().join("branding");
         std::fs::create_dir_all(&brand_dir).unwrap();
-        // branding.json claims a dark slot whose file doesn't exist.
+        // Hand-write a branding.json claiming logo.png exists.
+        let inner = Inner {
+            logo_filename: Some("logo.png".into()),
+            logo_mime: Some("image/png".into()),
+            rev: 0,
+        };
         std::fs::write(
             brand_dir.join("branding.json"),
-            br#"{"dark":{"filename":"logo-dark.png","mime":"image/png"},"rev":1}"#,
+            serde_json::to_vec_pretty(&inner).unwrap(),
         )
         .unwrap();
         let b = BrandingStore::load_or_default(dir.path());
-        assert!(
-            !b.has_logo(LogoSlot::Dark),
-            "should fall back when referenced file is missing"
-        );
-    }
-
-    #[test]
-    fn slot_parse_round_trips() {
-        assert_eq!(LogoSlot::parse("light"), Some(LogoSlot::Light));
-        assert_eq!(LogoSlot::parse("DARK"), Some(LogoSlot::Dark));
-        assert_eq!(LogoSlot::parse(" client "), Some(LogoSlot::Client));
-        assert_eq!(LogoSlot::parse("nope"), None);
-        assert_eq!(LogoSlot::Light.as_str(), "light");
+        assert!(!b.has_logo(), "should fall back when referenced file is missing");
     }
 
     #[test]

crates/core/src/config.rs

@@ -1,5 +1,3 @@
-use figment::providers::{Env, Format, Serialized, Toml};
-use figment::Figment;
 use serde::{Deserialize, Serialize};
 use std::net::{IpAddr, Ipv4Addr};
 use std::path::{Path, PathBuf};
@@ -58,9 +56,6 @@ pub enum DhcpMode {
     /// Disabled — rely on an external DHCP server that has been manually
     /// configured with `next-server` / `filename`. OpenPXE only serves TFTP
     /// + HTTP in this mode. Useful for home routers that can be pre-set.
-    // `off`/`none` are accepted as aliases for backward-compat with the old
-    // hand-rolled `apply_env`, which mapped them to Disabled.
-    #[serde(alias = "off", alias = "none")]
     Disabled,
 }
 
@@ -79,11 +74,6 @@ pub struct Paths {
     /// Only used when `settings.windows_enabled = true`. Defaults to
     /// `/var/lib/openpxe/smb` in the container image.
     pub smb_dir: PathBuf,
-    /// v0.5.2: directory holding uploaded unattended-install answer files
-    /// (Kickstart / Preseed / Autoinstall / Windows answer files). Kept
-    /// separate from `iso_dir` so answer files never appear in the ISO
-    /// listing or the PXE menu. Defaults to `/var/lib/openpxe/unattended`.
-    pub unattended_dir: PathBuf,
 }
 
 impl Default for ServerConfig {
@@ -119,7 +109,6 @@ impl Default for Paths {
             ipxe_dir: PathBuf::from("/usr/share/openpxe/ipxe"),
             wimboot_path: None,
             smb_dir: PathBuf::from("/var/lib/openpxe/smb"),
-            unattended_dir: PathBuf::from("/var/lib/openpxe/unattended"),
         }
     }
 }
@@ -134,162 +123,48 @@ impl Config {
         toml::from_str(&text).map_err(|e| crate::Error::Config(e.to_string()))
     }
 
-    /// Load configuration with layered precedence (v0.5.4, via `figment`):
-    /// built-in [`Default`] → optional TOML file → `OPENPXE_*` environment
-    /// (highest). Replaces the old `from_toml_file` + `apply_env` two-step
-    /// and now covers **every** field automatically (the previous hand-rolled
-    /// mapping silently skipped `unattended_dir`, the bind addresses, etc.).
-    ///
-    /// The env layer preserves the historical flat names
-    /// (`OPENPXE_HTTP_PORT`, `OPENPXE_ISO_DIR`, …) so existing deployments
-    /// (the Unraid template, `entrypoint.sh`) keep working unchanged, and
-    /// additionally accepts the explicit nested form
-    /// `OPENPXE_<SECTION>__<FIELD>` (double underscore).
-    pub fn load(path: Option<&Path>) -> crate::Result<Self> {
-        let mut fig = Figment::from(Serialized::defaults(Config::default()));
-        if let Some(p) = path {
-            if p.exists() {
-                fig = fig.merge(Toml::file(p));
+    /// Apply environment variable overrides. Env var names follow the pattern
+    /// `OPENPXE_<SECTION>_<FIELD>`, uppercase. Unknown vars are ignored.
+    /// Call this after loading the TOML file so env takes precedence.
+    pub fn apply_env(&mut self) {
+        if let Ok(v) = std::env::var("OPENPXE_HTTP_PORT") {
+            if let Ok(p) = v.parse() {
+                self.server.http_port = p;
             }
         }
-        fig = fig.merge(env_provider());
-        fig.extract()
-            .map_err(|e| crate::Error::Config(e.to_string()))
-    }
-}
-
-/// The `OPENPXE_*` environment provider. Maps the historical flat variable
-/// names onto the nested [`Config`] fields, and also accepts the explicit
-/// `OPENPXE_SECTION__FIELD` nested form. Keys that match nothing (e.g.
-/// `OPENPXE_CONFIG`, `OPENPXE_UID` from the entrypoint) become stray
-/// top-level keys that `Config` ignores on extract.
-fn env_provider() -> Env {
-    Env::prefixed("OPENPXE_")
-        .map(|key| {
-            // Lowercase so the match is robust regardless of how the OS
-            // reports the var's case.
-            let k = key.as_str().to_ascii_lowercase();
-            let mapped = match k.as_str() {
-                "http_port" => "server.http_port",
-                "http_bind" => "server.http_bind",
-                "tftp_port" => "server.tftp_port",
-                "tftp_bind" => "server.tftp_bind",
-                "public_ip" => "server.public_ip",
-                "dhcp_port" => "network.dhcp_port",
-                "dhcp_bind" => "network.dhcp_bind",
-                "dhcp_mode" => "network.dhcp_mode",
-                "pxe_port" => "network.pxe_port",
-                "iso_dir" => "paths.iso_dir",
-                "work_dir" => "paths.work_dir",
-                "ipxe_dir" => "paths.ipxe_dir",
-                "smb_dir" => "paths.smb_dir",
-                "wimboot_path" => "paths.wimboot_path",
-                "unattended_dir" => "paths.unattended_dir",
-                // Unknown: support the explicit nested form
-                // (OPENPXE_SERVER__HTTP_PORT). `replace` is a no-op for the
-                // already-handled flat names above.
-                other => return other.replace("__", ".").into(),
+        if let Ok(v) = std::env::var("OPENPXE_TFTP_PORT") {
+            if let Ok(p) = v.parse() {
+                self.server.tftp_port = p;
+            }
+        }
+        if let Ok(v) = std::env::var("OPENPXE_DHCP_PORT") {
+            if let Ok(p) = v.parse() {
+                self.network.dhcp_port = p;
+            }
+        }
+        if let Ok(v) = std::env::var("OPENPXE_PUBLIC_IP") {
+            if let Ok(ip) = v.parse() {
+                self.server.public_ip = Some(ip);
+            }
+        }
+        if let Ok(v) = std::env::var("OPENPXE_DHCP_MODE") {
+            self.network.dhcp_mode = match v.to_ascii_lowercase().as_str() {
+                "proxy" => DhcpMode::Proxy,
+                "disabled" | "off" | "none" => DhcpMode::Disabled,
+                _ => self.network.dhcp_mode,
             };
-            mapped.into()
-        })
-        .split(".")
-}
-
-#[cfg(test)]
-mod tests {
-    // figment's `Jail::expect_with` closure returns `Result<(), figment::Error>`
-    // and `figment::Error` is large; that's the library's API, not ours.
-    #![allow(clippy::result_large_err)]
-    use super::*;
-
-    #[test]
-    fn defaults_load_when_no_file_or_env() {
-        figment::Jail::expect_with(|_jail| {
-            let c = Config::load(None).expect("load defaults");
-            assert_eq!(c.server.http_port, 80);
-            assert_eq!(c.network.dhcp_mode, DhcpMode::Proxy);
-            assert_eq!(c.paths.iso_dir, PathBuf::from("/var/lib/openpxe/isos"));
-            Ok(())
-        });
-    }
-
-    #[test]
-    fn legacy_flat_env_vars_still_apply() {
-        figment::Jail::expect_with(|jail| {
-            jail.set_env("OPENPXE_HTTP_PORT", "8123");
-            jail.set_env("OPENPXE_TFTP_PORT", "6900");
-            jail.set_env("OPENPXE_DHCP_PORT", "6767");
-            jail.set_env("OPENPXE_PXE_PORT", "4444");
-            jail.set_env("OPENPXE_PUBLIC_IP", "10.20.30.40");
-            jail.set_env("OPENPXE_DHCP_MODE", "disabled");
-            jail.set_env("OPENPXE_ISO_DIR", "/data/isos");
-            jail.set_env("OPENPXE_WORK_DIR", "/data/work");
-            jail.set_env("OPENPXE_IPXE_DIR", "/data/ipxe");
-            jail.set_env("OPENPXE_SMB_DIR", "/data/smb");
-            // v0.5.4: a field the old apply_env never covered.
-            jail.set_env("OPENPXE_UNATTENDED_DIR", "/data/unattended");
-            let c = Config::load(None).expect("load with env");
-            assert_eq!(c.server.http_port, 8123);
-            assert_eq!(c.server.tftp_port, 6900);
-            assert_eq!(c.network.dhcp_port, 6767);
-            assert_eq!(c.network.pxe_port, 4444);
-            assert_eq!(c.server.public_ip, Some("10.20.30.40".parse().unwrap()));
-            assert_eq!(c.network.dhcp_mode, DhcpMode::Disabled);
-            assert_eq!(c.paths.iso_dir, PathBuf::from("/data/isos"));
-            assert_eq!(c.paths.work_dir, PathBuf::from("/data/work"));
-            assert_eq!(c.paths.ipxe_dir, PathBuf::from("/data/ipxe"));
-            assert_eq!(c.paths.smb_dir, PathBuf::from("/data/smb"));
-            assert_eq!(c.paths.unattended_dir, PathBuf::from("/data/unattended"));
-            Ok(())
-        });
-    }
-
-    #[test]
-    fn dhcp_mode_off_alias_maps_to_disabled() {
-        figment::Jail::expect_with(|jail| {
-            jail.set_env("OPENPXE_DHCP_MODE", "off");
-            let c = Config::load(None).unwrap();
-            assert_eq!(c.network.dhcp_mode, DhcpMode::Disabled);
-            Ok(())
-        });
-    }
-
-    #[test]
-    fn nested_double_underscore_form_also_works() {
-        figment::Jail::expect_with(|jail| {
-            jail.set_env("OPENPXE_SERVER__HTTP_PORT", "9001");
-            let c = Config::load(None).unwrap();
-            assert_eq!(c.server.http_port, 9001);
-            Ok(())
-        });
-    }
-
-    #[test]
-    fn env_overrides_toml_file() {
-        figment::Jail::expect_with(|jail| {
-            jail.create_file(
-                "openpxe.toml",
-                "[server]\nhttp_port = 8080\n[paths]\niso_dir = \"/from/toml\"\n",
-            )?;
-            jail.set_env("OPENPXE_HTTP_PORT", "8443");
-            let c = Config::load(Some(Path::new("openpxe.toml"))).unwrap();
-            // env wins over TOML…
-            assert_eq!(c.server.http_port, 8443);
-            // …but TOML-only values still apply.
-            assert_eq!(c.paths.iso_dir, PathBuf::from("/from/toml"));
-            Ok(())
-        });
-    }
-
-    #[test]
-    fn unrelated_openpxe_env_vars_are_ignored() {
-        figment::Jail::expect_with(|jail| {
-            // entrypoint.sh sets these; they must not break config load.
-            jail.set_env("OPENPXE_UID", "10001");
-            jail.set_env("OPENPXE_CONFIG", "/etc/openpxe.toml");
-            let c = Config::load(None).expect("stray vars ignored");
-            assert_eq!(c.server.http_port, 80);
-            Ok(())
-        });
+        }
+        if let Ok(v) = std::env::var("OPENPXE_ISO_DIR") {
+            self.paths.iso_dir = PathBuf::from(v);
+        }
+        if let Ok(v) = std::env::var("OPENPXE_WORK_DIR") {
+            self.paths.work_dir = PathBuf::from(v);
+        }
+        if let Ok(v) = std::env::var("OPENPXE_IPXE_DIR") {
+            self.paths.ipxe_dir = PathBuf::from(v);
+        }
+        if let Ok(v) = std::env::var("OPENPXE_SMB_DIR") {
+            self.paths.smb_dir = PathBuf::from(v);
+        }
     }
 }

crates/core/src/encoding.rs

@@ -1,65 +0,0 @@
-//! Small, dependency-free encoding helpers shared across crates.
-//!
-//! v0.5.4: `pct_encode` and `xml_escape` were duplicated in the SAML
-//! modules and the HTTP layer; they live here now. They're deliberately
-//! hand-rolled rather than pulling in `percent-encoding` / `url`: the
-//! unreserved set below is exactly the RFC 3986 set that iPXE's
-//! `:uristring` modifier and the SAML HTTP-Redirect binding both expect,
-//! and a general-purpose URL crate escapes a different set.
-
-use std::fmt::Write as _;
-
-/// Percent-encode `s` per RFC 3986: the unreserved set
-/// (`A-Z` `a-z` `0-9` `-` `_` `.` `~`) passes through unchanged; every
-/// other byte becomes `%XX` (uppercase hex).
-#[must_use]
-pub fn pct_encode(s: &str) -> String {
-    let mut out = String::with_capacity(s.len());
-    for b in s.bytes() {
-        match b {
-            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => {
-                out.push(b as char);
-            }
-            _ => {
-                let _ = write!(out, "%{b:02X}");
-            }
-        }
-    }
-    out
-}
-
-/// Escape the five XML predefined entities so `s` is safe inside element
-/// text or a double-quoted attribute value.
-#[must_use]
-pub fn xml_escape(s: &str) -> String {
-    let mut out = String::with_capacity(s.len());
-    for c in s.chars() {
-        match c {
-            '&' => out.push_str("&"),
-            '<' => out.push_str("&lt;"),
-            '>' => out.push_str("&gt;"),
-            '"' => out.push_str("&quot;"),
-            '\'' => out.push_str("&apos;"),
-            _ => out.push(c),
-        }
-    }
-    out
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn pct_encode_unreserved_passthrough_else_hex() {
-        assert_eq!(pct_encode("node-7.lab_1~"), "node-7.lab_1~");
-        assert_eq!(pct_encode("aa:bb cc/?&="), "aa%3Abb%20cc%2F%3F%26%3D");
-        assert_eq!(pct_encode(""), "");
-    }
-
-    #[test]
-    fn xml_escape_all_five_entities() {
-        assert_eq!(xml_escape("a&b<c>\"d'e"), "a&amp;b&lt;c&gt;&quot;d&apos;e");
-        assert_eq!(xml_escape("plain text"), "plain text");
-    }
-}

crates/core/src/host_bindings.rs

@@ -21,8 +21,6 @@ use std::path::PathBuf;
 use std::sync::Arc;
 use time::OffsetDateTime;
 
-use crate::profile::DeployProfile;
-
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct HostBinding {
     /// Lowercase, colon-separated MAC (e.g. `aa:bb:cc:dd:ee:ff`). The
@@ -37,11 +35,6 @@ pub struct HostBinding {
     /// `"rack-3 spine"`). Empty if unset.
     #[serde(default)]
     pub label: String,
-    /// v0.5.2: optional unattended-install hints (auto hostname / IP /
-    /// answer-file id). Flattened into the binding JSON so pre-v0.5.2
-    /// `hosts.json` files (which lack these keys) still deserialize.
-    #[serde(default, flatten)]
-    pub profile: DeployProfile,
     #[serde(with = "time::serde::rfc3339")]
     pub created_at: OffsetDateTime,
     #[serde(with = "time::serde::rfc3339")]
@@ -101,31 +94,20 @@ impl HostBindings {
     }
 
     /// Insert or update. Returns the resulting binding (with timestamps).
-    /// The `profile` carries optional unattended-install hints (v0.5.2);
-    /// pass `DeployProfile::default()` for a plain pin.
-    pub fn upsert(
-        &self,
-        mac: &str,
-        target: &str,
-        label: &str,
-        profile: DeployProfile,
-    ) -> HostBinding {
+    pub fn upsert(&self, mac: &str, target: &str, label: &str) -> HostBinding {
         let key = normalize_mac(mac);
         let now = OffsetDateTime::now_utc();
-        let profile = profile.normalized();
         let binding = {
             let mut g = self.inner.write();
             let entry = g.by_mac.entry(key.clone()).or_insert_with(|| HostBinding {
                 mac: key.clone(),
                 target: target.to_string(),
                 label: label.to_string(),
-                profile: profile.clone(),
                 created_at: now,
                 updated_at: now,
             });
             entry.target = target.to_string();
             entry.label = label.to_string();
-            entry.profile = profile.clone();
             entry.updated_at = now;
             entry.clone()
         };
@@ -197,10 +179,6 @@ mod tests {
     use super::*;
     use tempfile::tempdir;
 
-    fn np() -> DeployProfile {
-        DeployProfile::default()
-    }
-
     #[test]
     fn normalize_handles_case_and_dashes() {
         assert_eq!(normalize_mac("AA:BB:CC:DD:EE:FF"), "aa:bb:cc:dd:ee:ff");
@@ -213,12 +191,7 @@ mod tests {
         let dir = tempdir().unwrap();
         let h = HostBindings::load_or_default(dir.path());
         assert!(h.is_empty());
-        h.upsert(
-            "AA:BB:CC:00:00:01",
-            "ubuntu-24-04-linux",
-            "rack-3 spine",
-            np(),
-        );
+        h.upsert("AA:BB:CC:00:00:01", "ubuntu-24-04-linux", "rack-3 spine");
         let found = h.lookup("aa-bb-cc-00-00-01").expect("lookup");
         assert_eq!(found.target, "ubuntu-24-04-linux");
         assert_eq!(found.label, "rack-3 spine");
@@ -229,8 +202,8 @@ mod tests {
     fn upsert_replaces_existing_target() {
         let dir = tempdir().unwrap();
         let h = HostBindings::load_or_default(dir.path());
-        h.upsert("aa:bb:cc:00:00:01", "old-target", "label1", np());
-        h.upsert("aa:bb:cc:00:00:01", "new-target", "label2", np());
+        h.upsert("aa:bb:cc:00:00:01", "old-target", "label1");
+        h.upsert("aa:bb:cc:00:00:01", "new-target", "label2");
         assert_eq!(h.len(), 1);
         let b = h.lookup("aa:bb:cc:00:00:01").unwrap();
         assert_eq!(b.target, "new-target");
@@ -241,7 +214,7 @@ mod tests {
     fn remove_works_and_reports_outcome() {
         let dir = tempdir().unwrap();
         let h = HostBindings::load_or_default(dir.path());
-        h.upsert("aa:bb:cc:00:00:01", "x", "", np());
+        h.upsert("aa:bb:cc:00:00:01", "x", "");
         assert!(h.remove("AA:BB:CC:00:00:01"));
         assert!(!h.remove("aa:bb:cc:00:00:01")); // already gone
         assert!(h.is_empty());
@@ -251,44 +224,11 @@ mod tests {
     fn round_trip_persists_to_disk() {
         let dir = tempdir().unwrap();
         let h = HostBindings::load_or_default(dir.path());
-        h.upsert("aa:bb:cc:00:00:01", "ubuntu-linux", "rack-3", np());
-        h.upsert("aa:bb:cc:00:00:02", "_local", "tom-laptop", np());
+        h.upsert("aa:bb:cc:00:00:01", "ubuntu-linux", "rack-3");
+        h.upsert("aa:bb:cc:00:00:02", "_local", "tom-laptop");
         drop(h);
         let h2 = HostBindings::load_or_default(dir.path());
         assert_eq!(h2.len(), 2);
         assert_eq!(h2.lookup("aa:bb:cc:00:00:02").unwrap().target, "_local");
     }
-
-    #[test]
-    fn profile_round_trips_to_disk() {
-        let dir = tempdir().unwrap();
-        let h = HostBindings::load_or_default(dir.path());
-        let prof = DeployProfile {
-            auto_hostname: Some("node-7".into()),
-            auto_ip: Some("10.0.0.7".into()),
-            unattended_file: Some("ubuntu-ks".into()),
-        };
-        h.upsert("aa:bb:cc:00:00:09", "ubuntu-linux", "lab", prof);
-        drop(h);
-        let h2 = HostBindings::load_or_default(dir.path());
-        let b = h2.lookup("aa:bb:cc:00:00:09").unwrap();
-        assert_eq!(b.profile.auto_hostname.as_deref(), Some("node-7"));
-        assert_eq!(b.profile.auto_ip.as_deref(), Some("10.0.0.7"));
-        assert_eq!(b.profile.unattended_file.as_deref(), Some("ubuntu-ks"));
-    }
-
-    #[test]
-    fn legacy_hosts_json_without_profile_still_loads() {
-        // A pre-v0.5.2 hosts.json has no profile keys at all.
-        let dir = tempdir().unwrap();
-        std::fs::write(
-            dir.path().join("hosts.json"),
-            br#"[{"mac":"aa:bb:cc:00:00:01","target":"_local","label":"old","created_at":"2024-01-01T00:00:00Z","updated_at":"2024-01-01T00:00:00Z"}]"#,
-        )
-        .unwrap();
-        let h = HostBindings::load_or_default(dir.path());
-        let b = h.lookup("aa:bb:cc:00:00:01").unwrap();
-        assert_eq!(b.target, "_local");
-        assert!(b.profile.is_empty());
-    }
 }

crates/core/src/lib.rs

@@ -8,13 +8,11 @@ pub mod boot_log;
 pub mod branding;
 pub mod client;
 pub mod config;
-pub mod encoding;
 pub mod error;
 pub mod host_bindings;
 pub mod log_bus;
 pub mod metrics;
 pub mod notify;
-pub mod profile;
 pub mod queue;
 pub mod saml;
 pub mod settings;
@@ -24,7 +22,7 @@ pub mod wol;
 pub use arch::{ClientArch, FirmwareClass};
 pub use auth::{AdminAccount, AdminPublic, AdminStore};
 pub use boot_log::{BootEvent, BootLog};
-pub use branding::{ext_for_mime, BrandingStore, LogoSlot, ALLOWED_LOGO_MIMES, MAX_LOGO_BYTES};
+pub use branding::{ext_for_mime, BrandingStore, ALLOWED_LOGO_MIMES, MAX_LOGO_BYTES};
 pub use client::{ClientEvent, ClientRegistry, ClientSnapshot};
 pub use config::{Config, DhcpMode, NetworkConfig, Paths, ServerConfig};
 pub use error::{Error, Result};
@@ -32,7 +30,6 @@ pub use host_bindings::{normalize_mac, HostBinding, HostBindings};
 pub use log_bus::{LogBus, LogBusLayer, LogLine};
 pub use metrics::{HttpRoute, Metrics};
 pub use notify::{NotifyConfig, NotifyKind, NotifyStore};
-pub use profile::DeployProfile;
 pub use queue::{DeploymentQueue, QueueEntry};
 pub use saml::{IdpMetadata, SamlError, SpParams, VerifiedPrincipal, VerifiedResponse};
 pub use settings::{Settings, SettingsStore, TimeoutAction};

crates/core/src/profile.rs

@@ -1,122 +0,0 @@
-//! Per-host deployment profile.
-//!
-//! v0.5.2: a small, optional bundle of "what should this machine do when
-//! it images" attached to either a pinned host binding ([`crate::HostBinding`])
-//! or a queued device ([`crate::QueueEntry`]). All three fields are
-//! optional and independent:
-//!
-//! * `auto_hostname` — substituted into the served unattended answer file
-//!   (`{{HOSTNAME}}`) so the installer sets the machine name.
-//! * `auto_ip` — substituted as `{{IP}}`. OpenPXE is a DHCP **proxy** and
-//!   does not hand out leases, so this is applied by the installer as a
-//!   static-network directive inside the answer file, not by DHCP.
-//! * `unattended_file` — the id of an uploaded file in the unattended
-//!   store (Kickstart / Preseed / Autoinstall / Windows answer file). When
-//!   set, the boot chain injects the appropriate kernel argument so the
-//!   install runs unattended.
-
-use serde::{Deserialize, Serialize};
-
-/// Optional deployment hints carried on a host pin or a queue entry.
-///
-/// The fields are flattened into `HostBinding` / `QueueEntry` on the wire
-/// (so existing JSON stays compatible via `#[serde(default)]`); this type
-/// is the in-code bundle the boot chain consumes.
-#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub struct DeployProfile {
-    /// Hostname to set on the imaged machine (`{{HOSTNAME}}`). Empty/None
-    /// leaves the installer default.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub auto_hostname: Option<String>,
-    /// Static IPv4/IPv6 the installer should configure (`{{IP}}`). Stored
-    /// as a free-form string — validated lightly at the HTTP layer.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub auto_ip: Option<String>,
-    /// Id of an uploaded file in the unattended store. Empty/None means
-    /// "no unattended install — boot interactively".
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub unattended_file: Option<String>,
-}
-
-/// Cap on the stored hostname / IP strings — generous for any real value
-/// but bounds what an operator can stuff into the JSON.
-pub const MAX_PROFILE_FIELD_LEN: usize = 255;
-
-impl DeployProfile {
-    /// True when nothing is set — lets call sites skip work entirely.
-    #[must_use]
-    pub fn is_empty(&self) -> bool {
-        self.auto_hostname.is_none() && self.auto_ip.is_none() && self.unattended_file.is_none()
-    }
-
-    /// True when an unattended file is selected (drives boot-chain injection).
-    #[must_use]
-    pub fn has_unattended(&self) -> bool {
-        self.unattended_file
-            .as_deref()
-            .is_some_and(|s| !s.trim().is_empty())
-    }
-
-    /// Normalise: trim every field and collapse empty strings to `None`
-    /// so persisted JSON never carries `""` for an unset value.
-    #[must_use]
-    pub fn normalized(mut self) -> Self {
-        fn clean(v: Option<String>) -> Option<String> {
-            v.map(|s| s.trim().to_string())
-                .filter(|s| !s.is_empty())
-                .map(|s| s.chars().take(MAX_PROFILE_FIELD_LEN).collect())
-        }
-        self.auto_hostname = clean(self.auto_hostname);
-        self.auto_ip = clean(self.auto_ip);
-        self.unattended_file = clean(self.unattended_file);
-        self
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn empty_profile_is_empty() {
-        assert!(DeployProfile::default().is_empty());
-        assert!(!DeployProfile::default().has_unattended());
-    }
-
-    #[test]
-    fn normalize_trims_and_nulls_empty() {
-        let p = DeployProfile {
-            auto_hostname: Some("  node-7  ".into()),
-            auto_ip: Some("   ".into()),
-            unattended_file: Some(String::new()),
-        }
-        .normalized();
-        assert_eq!(p.auto_hostname.as_deref(), Some("node-7"));
-        assert_eq!(p.auto_ip, None);
-        assert_eq!(p.unattended_file, None);
-        assert!(!p.is_empty());
-    }
-
-    #[test]
-    fn has_unattended_detects_real_id() {
-        let p = DeployProfile {
-            unattended_file: Some("ubuntu-ks".into()),
-            ..Default::default()
-        };
-        assert!(p.has_unattended());
-    }
-
-    #[test]
-    fn long_field_is_capped() {
-        let long = "a".repeat(1000);
-        let p = DeployProfile {
-            auto_hostname: Some(long),
-            ..Default::default()
-        }
-        .normalized();
-        assert_eq!(
-            p.auto_hostname.as_deref().map(str::len),
-            Some(MAX_PROFILE_FIELD_LEN)
-        );
-    }
-}

crates/core/src/queue.rs

@@ -21,7 +21,6 @@ use time::OffsetDateTime;
 use tokio::sync::Notify;
 use uuid::Uuid;
 
-use crate::profile::DeployProfile;
 use crate::ClientArch;
 
 /// Per-client queue state visible to the WebUI.
@@ -38,11 +37,6 @@ pub struct QueueEntry {
     #[serde(with = "time::serde::rfc3339")]
     pub last_poll_at: OffsetDateTime,
     pub assigned_target: Option<String>,
-    /// v0.5.2: optional per-device deployment profile set via the queue
-    /// "Profile" button (auto hostname / IP / unattended file). Flattened
-    /// so the JSON stays flat alongside the other queue fields.
-    #[serde(default, flatten)]
-    pub profile: DeployProfile,
 }
 
 #[derive(Debug)]
@@ -55,7 +49,6 @@ struct QueueEntryInner {
     joined_at: OffsetDateTime,
     last_poll_at: OffsetDateTime,
     assigned_target: Option<String>,
-    profile: DeployProfile,
     /// Broadcast primitive that wakes the long-poll as soon as an
     /// assignment lands — no polling on our side, no sleep-loops.
     notify: Arc<Notify>,
@@ -72,7 +65,6 @@ impl QueueEntryInner {
             joined_at: self.joined_at,
             last_poll_at: self.last_poll_at,
             assigned_target: self.assigned_target.clone(),
-            profile: self.profile.clone(),
         }
     }
 }
@@ -118,7 +110,6 @@ impl DeploymentQueue {
             joined_at: now,
             last_poll_at: now,
             assigned_target: None,
-            profile: DeployProfile::default(),
             notify: Arc::new(Notify::new()),
         };
         let snap = inner.snapshot();
@@ -142,29 +133,6 @@ impl DeploymentQueue {
         Some(g.snapshot())
     }
 
-    /// Operator sets (or clears) the deployment profile for a queued
-    /// device via the WebUI "Profile" button. Returns the updated
-    /// snapshot, or `None` if the entry has since been released.
-    pub fn set_profile(&self, entry_id: &str, profile: DeployProfile) -> Option<QueueEntry> {
-        let mut guard = self.inner.write();
-        let g = guard.get_mut(entry_id)?;
-        g.profile = profile.normalized();
-        Some(g.snapshot())
-    }
-
-    /// Look up the deployment profile for a queued MAC, if any. Used by
-    /// the boot chain to inject an unattended file / template the
-    /// hostname + IP when an assigned device chains to its target.
-    #[must_use]
-    pub fn profile_for_mac(&self, mac: &str) -> Option<DeployProfile> {
-        let guard = self.inner.read();
-        guard
-            .values()
-            .find(|g| g.mac == mac)
-            .map(|g| g.profile.clone())
-            .filter(|p| !p.is_empty())
-    }
-
     /// Operator assigns an ISO entry (boot_entry id) to one or more clients.
     /// Returns the number of queue entries that were updated. Entries not in the
     /// queue are silently skipped.

crates/core/src/saml/authn_request.rs

@@ -5,6 +5,7 @@
 //! appended as the `SAMLRequest` query parameter. AuthnRequests are sent
 //! unsigned in this release (the IdP must not require client signatures).
 
+use std::fmt::Write as _;
 use std::io::Write as _;
 
 use base64::Engine;
@@ -14,7 +15,6 @@ use time::format_description::well_known::Rfc3339;
 use time::OffsetDateTime;
 
 use super::{SamlError, SpParams};
-use crate::encoding::{pct_encode, xml_escape};
 
 const NS_PROTOCOL: &str = "urn:oasis:names:tc:SAML:2.0:protocol";
 const NS_ASSERTION: &str = "urn:oasis:names:tc:SAML:2.0:assertion";
@@ -79,8 +79,37 @@ fn deflate_base64(xml: &str) -> Result<String, SamlError> {
     Ok(base64::engine::general_purpose::STANDARD.encode(compressed))
 }
 
-// `pct_encode` + `xml_escape` now live in `openpxe_core::encoding` (v0.5.4)
-// — imported above.
+/// Percent-encode a query-string component (RFC 3986 unreserved set passes
+/// through; everything else is `%XX`).
+fn pct_encode(s: &str) -> String {
+    let mut out = String::with_capacity(s.len() * 3);
+    for b in s.bytes() {
+        match b {
+            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => {
+                out.push(b as char);
+            }
+            _ => {
+                let _ = write!(out, "%{b:02X}");
+            }
+        }
+    }
+    out
+}
+
+fn xml_escape(s: &str) -> String {
+    let mut out = String::with_capacity(s.len());
+    for c in s.chars() {
+        match c {
+            '&' => out.push_str("&amp;"),
+            '<' => out.push_str("&lt;"),
+            '>' => out.push_str("&gt;"),
+            '"' => out.push_str("&quot;"),
+            '\'' => out.push_str("&apos;"),
+            _ => out.push(c),
+        }
+    }
+    out
+}
 
 #[cfg(test)]
 mod tests {

crates/core/src/saml/metadata.rs

@@ -7,7 +7,6 @@
 use base64::Engine;
 
 use super::{SamlError, SpParams};
-use crate::encoding::xml_escape;
 
 /// SAML 2.0 binding URIs.
 pub const BINDING_REDIRECT: &str = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect";
@@ -149,7 +148,21 @@ fn node_text(n: &roxmltree::Node<'_, '_>) -> String {
         .collect()
 }
 
-// `xml_escape` now lives in `openpxe_core::encoding` (v0.5.4) — imported above.
+/// Minimal XML attribute/text escaping for the values we interpolate.
+fn xml_escape(s: &str) -> String {
+    let mut out = String::with_capacity(s.len());
+    for c in s.chars() {
+        match c {
+            '&' => out.push_str("&amp;"),
+            '<' => out.push_str("&lt;"),
+            '>' => out.push_str("&gt;"),
+            '"' => out.push_str("&quot;"),
+            '\'' => out.push_str("&apos;"),
+            _ => out.push(c),
+        }
+    }
+    out
+}
 
 #[cfg(test)]
 mod tests {

crates/http-api/Cargo.toml

@@ -33,6 +33,8 @@ thiserror.workspace = true
 anyhow.workspace = true
 bytes.workspace = true
 futures.workspace = true
+mime.workspace = true
+mime_guess.workspace = true
 uuid.workspace = true
 # v0.4.5 Forms auth: lock-free session store and cookie helpers.
 parking_lot.workspace = true
@@ -59,9 +61,3 @@ image = { version = "0.25", default-features = false, features = ["png"] }
 # replay, and IdP-initiated-gating flows exercise real signatures.
 rcgen = "0.13"
 bergshamra = { workspace = true }
-# v0.5.4: snapshot the generated iPXE menu so any unintended drift (a
-# dropped line, reordered item) is caught and reviewed, not silently shipped.
-insta = "1.40"
-# v0.5.4: stand up a mock HTTP server to exercise the SAML metadata-URL
-# fetch path (previously untested because it did a real network GET).
-wiremock = "0.6"

crates/http-api/src/auth.rs

@@ -317,7 +317,7 @@ pub async fn api_me(State(state): State<AppState>, headers: axum::http::HeaderMa
     // screens can render the FleetDM-style full-width custom logo (and
     // cache-bust it) without an extra round trip. `/api/me` is public,
     // and the logo asset is public, so this leaks nothing sensitive.
-    let has_custom_logo = state.branding.has_any_web_logo();
+    let has_custom_logo = state.branding.has_logo();
     let logo_rev = state.branding.logo_rev();
     if !state.admin.is_configured() {
         return (

crates/http-api/src/error.rs

@@ -1,92 +0,0 @@
-//! Uniform HTTP error mapping for the API layer (v0.5.4).
-//!
-//! Before this, ~40 handlers in `app.rs` hand-wrote
-//! `match … { Err(e) => (StatusCode::…, format!("{e}")).into_response() }`,
-//! and the `openpxe_core::Error` → status mapping drifted between them
-//! (e.g. `Invalid` → 400 in most places, 404 in one). [`AppError`] wraps
-//! `openpxe_core::Error` so a handler can return `Result<T, AppError>` and
-//! `?` its way out, getting one consistent status + body. The body stays
-//! plain-text (matching the previous `(StatusCode, String)` responses) so
-//! existing clients and tests see no shape change; 5xx detail is logged
-//! and returned verbatim exactly as before.
-//!
-//! Handlers with *intentional* domain-specific statuses (e.g. a duplicate
-//! share → 409, a still-open chunked upload → 409) keep their explicit
-//! returns — `AppError` is for the common case, not a straitjacket.
-
-use axum::http::StatusCode;
-use axum::response::{IntoResponse, Response};
-use openpxe_core::Error as CoreError;
-
-/// Newtype over [`openpxe_core::Error`] with a uniform [`IntoResponse`].
-#[derive(Debug)]
-pub struct AppError(pub CoreError);
-
-impl From<CoreError> for AppError {
-    fn from(e: CoreError) -> Self {
-        AppError(e)
-    }
-}
-
-impl From<std::io::Error> for AppError {
-    fn from(e: std::io::Error) -> Self {
-        AppError(CoreError::Io(e))
-    }
-}
-
-impl AppError {
-    /// The HTTP status this error maps to. Public so handlers (and tests)
-    /// can reason about the mapping in one place.
-    #[must_use]
-    pub fn status(&self) -> StatusCode {
-        match self.0 {
-            CoreError::NotFound(_) => StatusCode::NOT_FOUND,
-            CoreError::Invalid(_) => StatusCode::BAD_REQUEST,
-            CoreError::Config(_) | CoreError::Io(_) | CoreError::Other(_) => {
-                StatusCode::INTERNAL_SERVER_ERROR
-            }
-        }
-    }
-}
-
-impl IntoResponse for AppError {
-    fn into_response(self) -> Response {
-        let status = self.status();
-        // Match the prior hand-written responses: the 4xx arms returned the
-        // bare inner message (not the `Display` prefix), so a UI showing
-        // `await r.text()` reads "metadata too long", not "invalid input:
-        // metadata too long". 5xx keeps the full `Display` string.
-        let body = match &self.0 {
-            CoreError::Invalid(m) | CoreError::NotFound(m) => m.clone(),
-            other => other.to_string(),
-        };
-        if status.is_server_error() {
-            // Log the full detail server-side; the body still carries it
-            // (unchanged from the prior `format!("{e}")` behaviour), but the
-            // log line is what an operator greps for.
-            tracing::error!(target: "openpxe::http", error = %self.0, "request failed");
-        }
-        (status, body).into_response()
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn status_mapping_is_consistent() {
-        assert_eq!(
-            AppError(CoreError::NotFound("x".into())).status(),
-            StatusCode::NOT_FOUND
-        );
-        assert_eq!(
-            AppError(CoreError::Invalid("x".into())).status(),
-            StatusCode::BAD_REQUEST
-        );
-        assert_eq!(
-            AppError(CoreError::Config("x".into())).status(),
-            StatusCode::INTERNAL_SERVER_ERROR
-        );
-    }
-}

crates/http-api/src/ipxe_script.rs

@@ -61,24 +61,16 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
     // returns a full-screen 1024×768 PNG now — the operator's logo on a
     // dark field, or a default OpenPXE mark when none is uploaded. The
     // `--top 290` reserves the top band (where the logo paints) so the
-    // menu text lands below it.
-    //
-    // v0.5.7: gate the whole command behind `iseq ${platform} efi`.
-    // `console --picture` needs IMAGE_PNG + CONSOLE_FRAMEBUFFER, which
-    // only our from-source UEFI binaries carry (x86_64/arm64 UEFI — see
-    // deploy/docker/Dockerfile). The fetched BIOS `undionly.kpxe` has
-    // neither, and on legacy BIOS the `--picture` attempt misbehaves
-    // *before* the trailing `|| console` fallback can recover (it tries
-    // to set a framebuffer mode the BIOS console can't honour). Guarding
-    // on platform means BIOS clients never issue the command at all —
-    // they drop straight to the plain text menu — while UEFI clients
-    // still get the graphical background. A PNG-less UEFI build (e.g. the
-    // upstream i386-efi baseline) still falls back gracefully through the
-    // same `|| console`. No operator toggle needed; mixed BIOS+UEFI
-    // fleets each get the right treatment automatically.
+    // menu text lands below it. On an iPXE build *with* `IMAGE_PNG` +
+    // `CONSOLE_FRAMEBUFFER` (our x86_64 UEFI binaries, built from source
+    // — see deploy/docker/Dockerfile) this paints the background and
+    // overlays the menu. On a build *without* PNG support (the fetched
+    // BIOS/i386/arm64 binaries) the whole `console --picture …` command
+    // fails and the `|| console` resets to a clean full-screen text
+    // menu. Either way there's no ASCII placeholder anymore.
     let _ = writeln!(
         s,
-        "iseq ${{platform}} efi && console --picture {base}/branding/pxe-logo --top 290 || console"
+        "console --picture {base}/branding/pxe-logo --top 290 || console"
     );
     // Map iPXE's ${{buildarch}} + ${{platform}} into the human form the
     // user asked for (e.g. "x86 BIOS", "x86_64 UEFI", "arm64 UEFI").
@@ -109,13 +101,12 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
     } else {
         let _ = writeln!(s, "item --gap -- (no Linux ISOs uploaded)");
     }
-    // v0.5.8: Windows just works — no Settings toggle. Show the Windows
-    // installers submenu whenever a Windows ISO is present; entries boot
-    // via HTTP sanboot of the raw ISO, so no SMB/extraction is required.
-    if has_family(isos, is_windows_family) {
+    if settings.windows_enabled && has_family(isos, is_windows_family) {
         let _ = writeln!(s, "item windows          Windows Installers  >");
-    } else {
+    } else if settings.windows_enabled {
         let _ = writeln!(s, "item --gap -- (no Windows ISOs uploaded)");
+    } else {
+        let _ = writeln!(s, "item --gap -- (Windows support disabled in Settings)");
     }
     let _ = writeln!(
         s,
@@ -469,21 +460,8 @@ pub fn render_queue_entry(base_url: &str) -> String {
 }
 
 /// Per-entry boot script (same as Phase 1, with extra_kernel_args appended).
-///
-/// `unattended_args` (v0.5.2) carries the per-host unattended-install
-/// kernel arguments (`inst.ks=…`, `auto=true … url=…`, or
-/// `autoinstall ds=nocloud-net;s=…`) when the requesting MAC has a
-/// deployment profile with an answer file selected. It's appended to the
-/// Linux kernel command line after the operator's global extra args, and
-/// ignored for Windows (wimboot) / sanboot entries which don't take a
-/// kernel cmdline.
 #[must_use]
-pub fn render_entry(
-    entry: &BootEntry,
-    settings: &Settings,
-    base_url: &str,
-    unattended_args: Option<&str>,
-) -> String {
+pub fn render_entry(entry: &BootEntry, settings: &Settings, base_url: &str) -> String {
     let mut s = String::new();
     let base = base_url.trim_end_matches('/');
     let _ = writeln!(s, "#!ipxe");
@@ -499,12 +477,6 @@ pub fn render_entry(
                 cmdline.push(' ');
                 cmdline.push_str(settings.extra_kernel_args.trim());
             }
-            if let Some(extra) = unattended_args {
-                if !extra.trim().is_empty() {
-                    cmdline.push(' ');
-                    cmdline.push_str(extra.trim());
-                }
-            }
             let _ = writeln!(s, "kernel {base}/{kernel_url} {cmdline}");
             for u in initrd_urls {
                 let _ = writeln!(s, "initrd {base}/{u}");
@@ -702,22 +674,6 @@ mod password_tests {
         assert!(s.contains("arm64 UEFI"), "{s}");
     }
 
-    // v0.5.4: a full snapshot of the rendered top menu. The fragment
-    // `assert!`s above check specific invariants; this catches *any* other
-    // drift (a reordered item, a dropped line, changed spacing) so it's
-    // reviewed deliberately. The OpenPXE version is filtered out so the
-    // snapshot doesn't churn on every release bump.
-    #[test]
-    fn render_menu_snapshot() {
-        // Normalize the compile-time version so the snapshot doesn't churn
-        // on every release bump (no insta `filters` feature needed).
-        let rendered = render_menu(&[], &Settings::default(), "http://10.0.0.5").replace(
-            concat!("OpenPXE v", env!("CARGO_PKG_VERSION")),
-            "OpenPXE vX.Y.Z",
-        );
-        insta::assert_snapshot!(rendered);
-    }
-
     #[test]
     fn generated_scripts_do_not_emit_bare_or_trailing_fallbacks() {
         let settings = Settings::default();

crates/http-api/src/lib.rs

@@ -15,7 +15,6 @@
 
 pub mod app;
 pub mod auth;
-pub mod error;
 pub mod ipxe_script;
 pub mod iso_fs;
 pub mod log_stream;

crates/http-api/src/saml_routes.rs

@@ -336,35 +336,3 @@ fn redirect_with_session(location: &str, session: &str) -> Response {
             IntoResponse::into_response,
         )
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use wiremock::matchers::method;
-    use wiremock::{Mock, MockServer, ResponseTemplate};
-
-    // v0.5.4: exercise the SAML metadata-URL fetch against a mock server —
-    // previously this path did a real network GET and had no coverage.
-    #[tokio::test]
-    async fn fetch_metadata_returns_body_on_200() {
-        let server = MockServer::start().await;
-        let xml = "<EntityDescriptor>idp</EntityDescriptor>";
-        Mock::given(method("GET"))
-            .respond_with(ResponseTemplate::new(200).set_body_string(xml))
-            .mount(&server)
-            .await;
-        let got = fetch_metadata(&server.uri()).await.expect("fetch ok");
-        assert_eq!(got, xml);
-    }
-
-    #[tokio::test]
-    async fn fetch_metadata_errors_on_non_2xx() {
-        let server = MockServer::start().await;
-        Mock::given(method("GET"))
-            .respond_with(ResponseTemplate::new(503))
-            .mount(&server)
-            .await;
-        let err = fetch_metadata(&server.uri()).await.unwrap_err();
-        assert!(matches!(err, SamlError::Metadata(_)), "got {err:?}");
-    }
-}

crates/http-api/src/snapshots/openpxe_http_api__ipxe_script__password_tests__render_menu_snapshot.snap

@@ -1,36 +0,0 @@
----
-source: crates/http-api/src/ipxe_script.rs
-expression: rendered
----
-#!ipxe
-# OpenPXE top-level menu - auto-generated, do not edit
-set base-url http://10.0.0.5
-set esc:hex 1b
-set cls ${esc:string}[2J
-iseq ${platform} efi && console --picture http://10.0.0.5/branding/pxe-logo --top 290 || console
-set arch-label ${buildarch} ${platform}
-iseq ${buildarch} i386   && iseq ${platform} pcbios && set arch-label x86 BIOS         || iseq ${buildarch} x86_64 && iseq ${platform} efi    && set arch-label x86_64 UEFI      || iseq ${buildarch} arm64  && iseq ${platform} efi    && set arch-label arm64 UEFI       || true
-:menu
-menu OpenPXE - network boot menu
-item --gap
-item --gap -- ------------------------- Default -------------------------
-item local            Boot from Local HDD
-item --gap -- ----------------------- Installers -----------------------
-item --gap -- (no Linux ISOs uploaded)
-item --gap -- (no Windows ISOs uploaded)
-item --gap -- -------------------------- Tools --------------------------
-item tools            Tools  >
-item --gap -- ---------------------- Queued Deployment ---------------------
-item queue            Queued Deployment  (join queue)
-item --gap
-item --key x exit     Exit iPXE
-item --gap
-item --gap --                 OpenPXE vX.Y.Z  -  ${arch-label}
-choose --default queue --timeout 600000 target || goto menu
-iseq ${target} local   && chain http://10.0.0.5/boot/_local.ipxe        || goto menu
-iseq ${target} linux   && chain http://10.0.0.5/boot/_linux_menu.ipxe   || goto menu
-iseq ${target} windows && chain http://10.0.0.5/boot/_windows_menu.ipxe || goto menu
-iseq ${target} tools   && chain http://10.0.0.5/boot/_tools_menu.ipxe   || goto menu
-iseq ${target} queue   && chain http://10.0.0.5/boot/_queue.ipxe         || goto menu
-iseq ${target} exit    && exit                                 || goto menu
-goto menu

crates/http-api/src/state.rs

@@ -5,9 +5,7 @@ use openpxe_core::{
     AdminStore, BootLog, BrandingStore, ClientRegistry, DeploymentQueue, HostBindings, LogBus,
     Metrics, NotifyStore, SettingsStore, SsoStore,
 };
-use openpxe_iso_store::{
-    IsoStore, NfsShareManager, SftpShareManager, SmbManager, SmbShareManager, UnattendedStore,
-};
+use openpxe_iso_store::{IsoStore, NfsShareManager, SmbManager, SmbShareManager};
 use std::sync::Arc;
 use time::OffsetDateTime;
 
@@ -69,18 +67,6 @@ pub struct AppState {
     /// In-process (no subprocess); supports HTTP Range requests on
     /// NFS-sourced ISOs because NFSv3 READ3 takes an explicit offset.
     pub nfs_shares: NfsShareManager,
-    /// v0.5.5: SFTP-over-SSH share manager — pure-Rust userspace
-    /// consumer via `russh` + `russh-sftp` (ring backend, no OpenSSL).
-    /// Ships alongside SMB/NFS as the third remote-library protocol.
-    /// In-process (no subprocess, no kernel mount); supports HTTP Range
-    /// requests because SFTP opens a seekable file handle. Authenticates
-    /// the server's SSH host key on a trust-on-first-use basis.
-    pub sftp_shares: SftpShareManager,
-    /// v0.5.2: uploaded unattended-install answer files (Kickstart /
-    /// Preseed / Autoinstall / Windows answer files). Served on demand to
-    /// booting clients with per-host hostname/IP/MAC templating; lives in
-    /// its own directory, never the ISO listing or PXE menu.
-    pub unattended: UnattendedStore,
     /// Browser chunked upload state. Multipart uploads still go straight
     /// through `IsoStore`, but the UI uses sessions so large ISO transfers
     /// can show deterministic progress and leave visible partial files.

crates/http-api/src/terminal.rs

@@ -96,8 +96,6 @@ async fn dispatch(state: &AppState, argv: &[String]) -> Result<String, String> {
         "share" | "smb-share" => smb_share_command(state, tail).await,
         "smb" => smb_command(state, tail).await,
         "nfs" => nfs_share_command(state, tail).await,
-        // v0.5.5: SFTP-over-SSH remote shares (in-process russh client).
-        "sftp" => sftp_share_command(state, tail).await,
         "log" => log_command(state, tail),
         "whoami" => Ok("operator".to_string()),
         "echo" => Ok(tail.join(" ")),
@@ -120,21 +118,17 @@ fn status_text(s: &AppState) -> String {
     // v0.4.67: NFSv3 sources too.
     let nfs_shares = s.nfs_shares.list();
     let nfs_reachable = nfs_shares.iter().filter(|m| m.reachable).count();
-    // v0.5.5: SFTP-over-SSH sources too.
-    let sftp_shares = s.sftp_shares.list();
-    let sftp_reachable = sftp_shares.iter().filter(|m| m.reachable).count();
     format!(
         "OpenPXE {ver}\n\
          base url:     {base}\n\
          interface:    {nic}\n\
          uptime:       {up}\n\
-         isos:         {n_isos}  (local: {n_local}, smb: {n_smb}, nfs: {n_nfs}, sftp: {n_sftp})\n\
+         isos:         {n_isos}  (local: {n_local}, smb: {n_smb}, nfs: {n_nfs})\n\
          clients:      {n_clients}\n\
          queue:        {n_entries}\n\
          smb server:   {smb}\n\
          smb shares:   {n_smb_total} configured ({n_smb_active} reachable)\n\
-         nfs shares:   {n_nfs_total} configured ({n_nfs_active} reachable)\n\
-         sftp shares:  {n_sftp_total} configured ({n_sftp_active} reachable)\n",
+         nfs shares:   {n_nfs_total} configured ({n_nfs_active} reachable)\n",
         ver = env!("CARGO_PKG_VERSION"),
         base = s.public_base_url,
         nic = if s.nic_name.is_empty() {
@@ -156,10 +150,6 @@ fn status_text(s: &AppState) -> String {
             .iter()
             .filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Nfs { .. }))
             .count(),
-        n_sftp = isos
-            .iter()
-            .filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Sftp { .. }))
-            .count(),
         n_clients = clients.len(),
         n_entries = queue_entries.len(),
         smb = smb.map_or_else(|| "(disabled)".into(), |s| format!("{s:?}")),
@@ -167,8 +157,6 @@ fn status_text(s: &AppState) -> String {
         n_smb_active = smb_reachable,
         n_nfs_total = nfs_shares.len(),
         n_nfs_active = nfs_reachable,
-        n_sftp_total = sftp_shares.len(),
-        n_sftp_active = sftp_reachable,
     )
 }
 
@@ -189,8 +177,6 @@ fn isos_text(s: &AppState) -> String {
             openpxe_iso_store::IsoSource::Smb { share_id, .. } => format!("smb:{share_id}"),
             // v0.4.67: NFSv3 via in-process nfs3_client.
             openpxe_iso_store::IsoSource::Nfs { share_id, .. } => format!("nfs:{share_id}"),
-            // v0.5.5: SFTP-over-SSH via in-process russh.
-            openpxe_iso_store::IsoSource::Sftp { share_id, .. } => format!("sftp:{share_id}"),
         };
         let _ = writeln!(
             out,
@@ -335,9 +321,11 @@ async fn smb_share_command(s: &AppState, args: &[String]) -> Result<String, Stri
         }
         Some("add") => {
             // share add //server/share [guest|user:password]
-            let target = args.get(1).ok_or_else(|| {
-                "usage: share add //server/share [guest|user:password]".to_string()
-            })?;
+            let target = args
+                .get(1)
+                .ok_or_else(|| {
+                    "usage: share add //server/share [guest|user:password]".to_string()
+                })?;
             // Accept either `//server/share` (UNC-style) or
             // `server:share` (shorter to type).
             let stripped = target.trim_start_matches('/').trim_start_matches('\\');
@@ -413,7 +401,11 @@ async fn nfs_share_command(s: &AppState, args: &[String]) -> Result<String, Stri
                 return Ok("(no NFS shares configured)".into());
             }
             let mut out = String::new();
-            let _ = writeln!(out, "{:<24} {:<7} {:<6} TARGET", "ID", "STATUS", "ISOS");
+            let _ = writeln!(
+                out,
+                "{:<24} {:<7} {:<6} TARGET",
+                "ID", "STATUS", "ISOS"
+            );
             for m in shares {
                 let status = if m.reachable { "ok" } else { "down" };
                 let _ = writeln!(
@@ -484,104 +476,6 @@ async fn nfs_share_command(s: &AppState, args: &[String]) -> Result<String, Stri
     }
 }
 
-// ── sftp (v0.5.5) ────────────────────────────────────────────────────────
-//
-// Parallel to nfs_share_command. The terminal `add` only supports
-// password auth — pasting a multiline PEM private key through the
-// terminal is impractical, so key-based shares are added via the WebUI.
-
-async fn sftp_share_command(s: &AppState, args: &[String]) -> Result<String, String> {
-    match args.first().map(String::as_str) {
-        None | Some("list") => {
-            let shares = s.sftp_shares.list();
-            if shares.is_empty() {
-                return Ok("(no SFTP shares configured)".into());
-            }
-            let mut out = String::new();
-            let _ = writeln!(out, "{:<24} {:<7} {:<6} TARGET", "ID", "STATUS", "ISOS");
-            for m in shares {
-                let status = if m.reachable { "ok" } else { "down" };
-                let _ = writeln!(
-                    out,
-                    "{:<24} {:<7} {:<6} {}@{}:{}",
-                    truncate(&m.id, 24),
-                    status,
-                    m.iso_count,
-                    m.username,
-                    m.server,
-                    m.export,
-                );
-                if let Some(e) = m.last_error {
-                    let _ = writeln!(out, "    error: {e}");
-                }
-                if let Some(h) = m.last_hint {
-                    let _ = writeln!(out, "    hint:  {h}");
-                }
-            }
-            Ok(out)
-        }
-        Some("add") => {
-            // sftp add <user>@<server>:<export> <password> [port]
-            let target = args.get(1).ok_or_else(|| {
-                "usage: sftp add <user>@<server>:<export> <password> [port] \
-                 (key auth: use the WebUI)"
-                    .to_string()
-            })?;
-            let password = args
-                .get(2)
-                .ok_or_else(|| "a password is required (key auth: use the WebUI)".to_string())?;
-            let (user, rest) = target
-                .split_once('@')
-                .ok_or_else(|| "target must be 'user@server:/export'".to_string())?;
-            let (server, export) = rest
-                .split_once(':')
-                .ok_or_else(|| "target must be 'user@server:/export'".to_string())?;
-            let port = args.get(3).and_then(|s| s.parse::<u16>().ok());
-            let req = openpxe_iso_store::SftpAddRequest {
-                server: server.to_string(),
-                export: export.to_string(),
-                username: Some(user.to_string()),
-                port,
-                password: Some(password.clone()),
-                private_key: None,
-                passphrase: None,
-            };
-            match s.sftp_shares.add(req).await {
-                Ok(m) => Ok(format!("added {} ({} isos)", m.id, m.iso_count)),
-                Err(e) => {
-                    let mut out = format!("add failed: {}", e.error);
-                    if let Some(h) = e.hint {
-                        out.push_str("\nhint: ");
-                        out.push_str(&h);
-                    }
-                    Err(out)
-                }
-            }
-        }
-        Some("remove") => {
-            let id = args
-                .get(1)
-                .ok_or_else(|| "usage: sftp remove <id>".to_string())?;
-            match s.sftp_shares.remove(id).await {
-                Ok(()) => Ok(format!("removed {id}")),
-                Err(e) => Err(format!("remove failed: {e}")),
-            }
-        }
-        Some("scan") => {
-            let id = args
-                .get(1)
-                .ok_or_else(|| "usage: sftp scan <id>".to_string())?;
-            match s.sftp_shares.rescan(id).await {
-                Ok(n) => Ok(format!("re-scanned {id}: {n} isos")),
-                Err(e) => Err(format!("scan failed: {e}")),
-            }
-        }
-        Some(other) => Err(format!(
-            "unknown sftp subcommand: {other}\ntry: sftp [list|add|remove|scan]"
-        )),
-    }
-}
-
 // ── smb ────────────────────────────────────────────────────────────────
 
 #[allow(clippy::unused_async)]
@@ -728,11 +622,6 @@ OpenPXE terminal — available commands:
   nfs remove <id>                   forget an NFS share
   nfs scan <id>                     re-list an NFS share for new ISOs
 
-  sftp list                         list configured SFTP-over-SSH shares
-  sftp add <user>@<srv>:<export> <pass> [port]   add an SFTP share (key auth: WebUI)
-  sftp remove <id>                  forget an SFTP share
-  sftp scan <id>                    re-list an SFTP share for new ISOs
-
   smb status                        outbound Samba state (Windows install media)
   smb start | stop | reload         control the outbound smbd
 

crates/http-api/src/uploads.rs

@@ -9,7 +9,6 @@
 use bytes::Bytes;
 use openpxe_core::{Error, Result};
 use openpxe_iso_store::{IsoMeta, IsoStore, UploadHandle};
-use parking_lot::RwLock;
 use serde::Serialize;
 use std::collections::HashMap;
 use std::sync::Arc;
@@ -20,11 +19,7 @@ const DEFAULT_CHUNK_SIZE: u64 = 8 * 1024 * 1024;
 
 #[derive(Clone, Default)]
 pub struct UploadSessions {
-    // v0.5.4: the registry is a sync `parking_lot::RwLock` — it's only ever
-    // briefly read/inserted/removed to look up a session, never held across
-    // an `.await`. The per-session lock below stays a `tokio::sync::Mutex`
-    // because `write_chunk` / `finish` are awaited while it's held.
-    inner: Arc<RwLock<HashMap<String, Arc<Mutex<UploadSession>>>>>,
+    inner: Arc<Mutex<HashMap<String, Arc<Mutex<UploadSession>>>>>,
 }
 
 struct UploadSession {
@@ -72,7 +67,8 @@ impl UploadSessions {
         };
 
         self.inner
-            .write()
+            .lock()
+            .await
             .insert(upload_id.clone(), Arc::new(Mutex::new(session)));
 
         Ok(UploadStarted {
@@ -92,7 +88,7 @@ impl UploadSessions {
         chunk: Bytes,
         complete: bool,
     ) -> Result<UploadAppend> {
-        let Some(session_lock) = self.inner.read().get(upload_id).cloned() else {
+        let Some(session_lock) = self.inner.lock().await.get(upload_id).cloned() else {
             return Err(Error::Invalid(format!("no such upload '{upload_id}'")));
         };
 
@@ -123,7 +119,7 @@ impl UploadSessions {
         if let Err(e) = handle.write_chunk(&chunk).await {
             let handle = session.handle.take();
             drop(session);
-            self.inner.write().remove(upload_id);
+            self.inner.lock().await.remove(upload_id);
             if let Some(handle) = handle {
                 let _ = handle.abort().await;
             }
@@ -160,11 +156,11 @@ impl UploadSessions {
         let meta = match handle.finish(store).await {
             Ok(meta) => meta,
             Err(e) => {
-                self.inner.write().remove(upload_id);
+                self.inner.lock().await.remove(upload_id);
                 return Err(e);
             }
         };
-        self.inner.write().remove(upload_id);
+        self.inner.lock().await.remove(upload_id);
         Ok(UploadAppend::Complete {
             offset: new_offset,
             iso: Box::new(meta),
@@ -172,7 +168,7 @@ impl UploadSessions {
     }
 
     pub async fn abort(&self, upload_id: &str) -> Result<()> {
-        let Some(session_lock) = self.inner.write().remove(upload_id) else {
+        let Some(session_lock) = self.inner.lock().await.remove(upload_id) else {
             return Err(Error::Invalid(format!("no such upload '{upload_id}'")));
         };
         let mut session = session_lock.lock().await;

crates/http-api/tests/full_flow.rs

@@ -14,7 +14,7 @@ use axum::body::Body;
 use axum::http::{header, Request, StatusCode};
 use openpxe_core::{ClientRegistry, DeploymentQueue, HostBindings, LogBus, Metrics, SettingsStore};
 use openpxe_http_api::{build_router, AppState};
-use openpxe_iso_store::{IsoStore, NfsShareManager, SftpShareManager, SmbShareManager};
+use openpxe_iso_store::{IsoStore, NfsShareManager, SmbShareManager};
 use tempfile::tempdir;
 use tower::ServiceExt;
 
@@ -96,9 +96,6 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
     let settings = SettingsStore::load_or_default(dir.path());
     let smb_shares = SmbShareManager::new(dir.path(), iso_store.clone());
     let nfs_shares = NfsShareManager::new(dir.path(), iso_store.clone());
-    let sftp_shares = SftpShareManager::new(dir.path(), iso_store.clone());
-    let unattended = openpxe_iso_store::UnattendedStore::new(dir.path().join("unattended"));
-    unattended.ensure_dir().await.unwrap();
     let log_bus = LogBus::new(64);
     let hosts = HostBindings::load_or_default(dir.path());
     let boot_log = openpxe_core::BootLog::load_or_default(dir.path());
@@ -125,8 +122,6 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
         smb: None,
         smb_shares,
         nfs_shares,
-        sftp_shares,
-        unattended,
         uploads: openpxe_http_api::uploads::UploadSessions::default(),
         log_bus,
         started_at: time::OffsetDateTime::now_utc(),
@@ -693,7 +688,7 @@ async fn log_recent_returns_buffered_lines() {
 }
 
 #[tokio::test]
-async fn windows_iso_renders_clean_sanboot_script_with_no_trust_store_writes() {
+async fn windows_iso_renders_clean_wimboot_script_with_no_trust_store_writes() {
     // Synthesize an ISO with a Windows volume label + the sources/boot.wim
     // sentinel so introspection labels it WindowsPe with has_boot_wim.
     let mut buf = vec![0u8; 32 * 2048];
@@ -763,35 +758,38 @@ async fn windows_iso_renders_clean_sanboot_script_with_no_trust_store_writes() {
         "introspection should detect sources/boot.wim sentinel"
     );
 
-    // v0.5.8: Windows boots via iPXE HTTP sanboot of the raw ISO — no SMB,
-    // no extraction, no in-ISO file serving, no operator toggle. The boot
-    // entry is a `san_boot_iso` kind pointing at the raw image.
+    // The boot entry should be a wimboot kind with the canonical 5-file
+    // chain documented in the LinusTechTips iPXE-Windows guide.
     let entry = &meta["boot_entries"][0];
-    assert_eq!(entry["kind"]["kind"], "san_boot_iso");
-    let iso_url = entry["kind"]["iso_url"].as_str().unwrap();
-    assert!(
-        std::path::Path::new(iso_url)
-            .extension()
-            .is_some_and(|e| e.eq_ignore_ascii_case("iso")),
-        "sanboot should target the raw ISO, got: {iso_url}"
-    );
+    assert_eq!(entry["kind"]["kind"], "wimboot");
+    let files = entry["kind"]["files"].as_array().unwrap();
+    let names: Vec<&str> = files.iter().map(|f| f[0].as_str().unwrap()).collect();
+    assert!(names.contains(&"bootmgr"));
+    assert!(names.contains(&"bootmgr.efi"));
+    assert!(names.contains(&"bcd"));
+    assert!(names.contains(&"boot.sdi"));
+    assert!(names.contains(&"boot.wim"));
 
     // Render the entry script and verify:
-    //   1. It uses `sanboot` against the raw ISO over HTTP
-    //   2. NO trust-store / driver / testsigning operations slip in
+    //   1. It uses wimboot
+    //   2. All 5 files are referenced via `initrd --name`
+    //   3. NO trust-store / driver / testsigning operations slip in
     let entry_id = entry["id"].as_str().unwrap();
     let url = format!("/boot/{entry_id}.ipxe");
     let (s, body) = get(&app, &url).await;
     assert_eq!(s, StatusCode::OK);
     let script = String::from_utf8(body).unwrap();
+    assert!(script.contains("kernel "), "missing kernel line:\n{script}");
     assert!(
-        script.contains("sanboot"),
-        "missing sanboot line:\n{script}"
-    );
-    assert!(
-        script.contains(&format!("/{iso_url}")),
-        "sanboot should reference the raw ISO url:\n{script}"
+        script.contains("ipxe/wimboot"),
+        "missing wimboot loader:\n{script}"
     );
+    for tag in ["bootmgr", "bootmgr.efi", "bcd", "boot.sdi", "boot.wim"] {
+        assert!(
+            script.contains(&format!("initrd --name {tag}")),
+            "missing `initrd --name {tag}` line:\n{script}"
+        );
+    }
     // Hard guarantees we never want to see in any client-facing script.
     let lower = script.to_lowercase();
     for forbidden in [
@@ -1490,8 +1488,7 @@ async fn api_docs_lists_known_endpoints() {
         "/api/isos",
         "/api/isos/:id/category",
         "/api/storage/disk",
-        "/api/branding/logo/:slot",
-        "/api/unattended",
+        "/api/branding/logo",
         "/api/boot-log",
         "/metrics",
     ] {
@@ -1512,7 +1509,7 @@ async fn branding_clear_when_no_logo_is_no_content() {
         .oneshot(
             Request::builder()
                 .method("DELETE")
-                .uri("/api/branding/logo/dark")
+                .uri("/api/branding/logo")
                 .body(Body::empty())
                 .unwrap(),
         )
@@ -1535,60 +1532,6 @@ async fn status_exposes_custom_logo_flag() {
     );
 }
 
-/// v0.5.4 guard: the typed `StatusResponse` must keep every key the WebUI
-/// (`crates/webui/src/app.js`) reads off `/api/status`. If a refactor drops
-/// or renames one, the dashboard silently breaks — this catches it.
-#[tokio::test]
-async fn status_contract_has_all_ui_keys() {
-    let (state, _dir) = build_state().await;
-    let app = build_router(state);
-    let (s, body) = get(&app, "/api/status").await;
-    assert_eq!(s, StatusCode::OK);
-    let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
-    for key in [
-        "version",
-        "public_base_url",
-        "iso_count",
-        "client_count",
-        "queue_count",
-        "imaging_count",
-        "waiting_count",
-        "ipxe_assets",
-        "settings",
-        "smb_share_count",
-        "smb_share_reachable",
-        "nfs_share_count",
-        "nfs_share_reachable",
-        "host_bindings",
-        "custom_logo",
-        "branding",
-        "unattended_count",
-        "uptime_secs",
-        "started_at",
-        "nic_name",
-        "subnet_mask",
-        "gateway",
-    ] {
-        assert!(
-            v.get(key).is_some(),
-            "/api/status missing UI key '{key}': {v}"
-        );
-    }
-    // Nested branding presence the Settings tab reads.
-    for key in ["light", "dark", "client", "rev"] {
-        assert!(
-            v["branding"].get(key).is_some(),
-            "/api/status branding missing '{key}': {v}"
-        );
-    }
-    // started_at must remain an RFC3339 string (the UI does fmtUptime on
-    // uptime_secs but renders started_at as text), not a serialized struct.
-    assert!(
-        v["started_at"].is_string(),
-        "started_at should serialize as a string: {v}"
-    );
-}
-
 async fn put_json(router: &axum::Router, path: &str, body: &str) -> (StatusCode, Vec<u8>) {
     let res = router
         .clone()
@@ -2007,7 +1950,6 @@ async fn pxe_background_falls_back_to_default_for_svg_upload() {
     state
         .branding
         .set_logo(
-            openpxe_core::LogoSlot::Client,
             "image/svg+xml",
             "svg",
             br#"<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 8 8"/>"#,
@@ -2043,10 +1985,7 @@ async fn pxe_logo_composes_to_1024x768_png() {
     // the iPXE menu always paints at consistent dimensions.
     let (state, _dir) = build_state().await;
     let png = tiny_png();
-    state
-        .branding
-        .set_logo(openpxe_core::LogoSlot::Client, "image/png", "png", &png)
-        .unwrap();
+    state.branding.set_logo("image/png", "png", &png).unwrap();
     let app = build_router(state);
     let res = app
         .clone()
@@ -2086,10 +2025,7 @@ async fn pxe_logo_endpoint_is_public_after_admin_setup() {
     // auth allowlist gates `/api/*` only.
     let (state, _dir) = build_state().await;
     let png = tiny_png();
-    state
-        .branding
-        .set_logo(openpxe_core::LogoSlot::Client, "image/png", "png", &png)
-        .unwrap();
+    state.branding.set_logo("image/png", "png", &png).unwrap();
     let app = build_router(state);
     // Configure an admin so the middleware kicks in.
     let (s, _, _) = post_collect(
@@ -2104,201 +2040,6 @@ async fn pxe_logo_endpoint_is_public_after_admin_setup() {
     assert_eq!(s, StatusCode::OK);
 }
 
-// ─── v0.5.2: unattended files + deployment profiles ─────────────────────────
-
-async fn post_multipart(
-    router: &axum::Router,
-    path: &str,
-    ct: &str,
-    body: Vec<u8>,
-) -> (StatusCode, Vec<u8>) {
-    let res = router
-        .clone()
-        .oneshot(
-            Request::builder()
-                .method("POST")
-                .uri(path)
-                .header("content-type", ct)
-                .body(Body::from(body))
-                .unwrap(),
-        )
-        .await
-        .unwrap();
-    let status = res.status();
-    let body = axum::body::to_bytes(res.into_body(), usize::MAX)
-        .await
-        .unwrap()
-        .to_vec();
-    (status, body)
-}
-
-#[tokio::test]
-async fn unattended_upload_list_serve_and_template() {
-    let (state, _dir) = build_state().await;
-    let app = build_router(state);
-    let ks = b"install\nnetwork --hostname={{HOSTNAME}} --ip={{IP}}\n%packages\n@core\n%end\n";
-    let (ct, body) = multipart_iso_body("rocky.ks", ks);
-    let (s, b) = post_multipart(&app, "/api/unattended", &ct, body).await;
-    assert_eq!(s, StatusCode::CREATED, "{}", String::from_utf8_lossy(&b));
-    let m: serde_json::Value = serde_json::from_slice(&b).unwrap();
-    assert_eq!(m["kind"], "kickstart");
-    let id = m["id"].as_str().unwrap().to_string();
-
-    let (s, b) = get(&app, "/api/unattended").await;
-    assert_eq!(s, StatusCode::OK);
-    let v: serde_json::Value = serde_json::from_slice(&b).unwrap();
-    assert_eq!(v["files"].as_array().unwrap().len(), 1);
-
-    // Public serve substitutes the query tokens.
-    let (s, b) = get(
-        &app,
-        &format!("/unattended/{id}?hostname=node7&ip=10.0.0.7"),
-    )
-    .await;
-    assert_eq!(s, StatusCode::OK);
-    let text = String::from_utf8_lossy(&b);
-    assert!(text.contains("--hostname=node7"), "got: {text}");
-    assert!(text.contains("--ip=10.0.0.7"), "got: {text}");
-    assert!(!text.contains("{{"), "tokens left unrendered: {text}");
-
-    // Delete.
-    let res = app
-        .clone()
-        .oneshot(
-            Request::builder()
-                .method("DELETE")
-                .uri(format!("/api/unattended/{id}"))
-                .body(Body::empty())
-                .unwrap(),
-        )
-        .await
-        .unwrap();
-    assert_eq!(res.status(), StatusCode::NO_CONTENT);
-    let (_, b) = get(&app, "/api/unattended").await;
-    let v: serde_json::Value = serde_json::from_slice(&b).unwrap();
-    assert_eq!(v["files"].as_array().unwrap().len(), 0);
-}
-
-#[tokio::test]
-async fn unattended_upload_rejects_bad_type() {
-    let (state, _dir) = build_state().await;
-    let app = build_router(state);
-    let (ct, body) = multipart_iso_body("evil.sh", b"#!/bin/sh\n");
-    let (s, _) = post_multipart(&app, "/api/unattended", &ct, body).await;
-    assert_eq!(s, StatusCode::BAD_REQUEST);
-}
-
-#[tokio::test]
-async fn host_pin_with_unattended_injects_kickstart_arg() {
-    let (state, _dir) = build_state().await;
-    let app = build_router(state.clone());
-    // Upload a Linux ISO → synthesises the `fake-alpine-linux` LinuxKernel entry.
-    let (ct, body) = multipart_iso_body("fake-alpine.iso", &fake_alpine_iso());
-    let (s, _) = post_multipart(&app, "/api/isos", &ct, body).await;
-    assert_eq!(s, StatusCode::CREATED);
-    // Upload a kickstart.
-    let (ct, body) = multipart_iso_body("ks.ks", b"install\n%packages\n@core\n%end\n");
-    let (s, b) = post_multipart(&app, "/api/unattended", &ct, body).await;
-    assert_eq!(s, StatusCode::CREATED);
-    let ks_id = serde_json::from_slice::<serde_json::Value>(&b).unwrap()["id"]
-        .as_str()
-        .unwrap()
-        .to_string();
-    // Pin a MAC to the Linux entry with the unattended profile.
-    let mac = "aa:bb:cc:dd:ee:01";
-    let pin = format!(
-        r#"{{"mac":"{mac}","target":"fake-alpine-linux","label":"lab","auto_hostname":"node7","auto_ip":"10.0.0.7","unattended_file":"{ks_id}"}}"#
-    );
-    let (s, b) = post_json(&app, "/api/hosts", &pin).await;
-    assert_eq!(s, StatusCode::CREATED, "{}", String::from_utf8_lossy(&b));
-    // Boot the entry as that MAC; the kernel line should carry inst.ks=.
-    let (s, b) = get(&app, &format!("/boot/fake-alpine-linux.ipxe?mac={mac}")).await;
-    assert_eq!(s, StatusCode::OK);
-    let script = String::from_utf8_lossy(&b);
-    assert!(
-        script.contains("inst.ks="),
-        "no kickstart arg injected:\n{script}"
-    );
-    assert!(
-        script.contains("hostname=node7"),
-        "hostname not passed:\n{script}"
-    );
-}
-
-#[tokio::test]
-async fn host_pin_rejects_unknown_unattended_file() {
-    let (state, _dir) = build_state().await;
-    let app = build_router(state.clone());
-    let (ct, body) = multipart_iso_body("fake-alpine.iso", &fake_alpine_iso());
-    let (s, _) = post_multipart(&app, "/api/isos", &ct, body).await;
-    assert_eq!(s, StatusCode::CREATED);
-    let pin = r#"{"mac":"aa:bb:cc:dd:ee:02","target":"fake-alpine-linux","unattended_file":"does-not-exist"}"#;
-    let (s, _) = post_json(&app, "/api/hosts", pin).await;
-    assert_eq!(s, StatusCode::BAD_REQUEST);
-}
-
-#[tokio::test]
-async fn host_pin_rejects_bad_auto_ip() {
-    let (state, _dir) = build_state().await;
-    let app = build_router(state.clone());
-    let (ct, body) = multipart_iso_body("fake-alpine.iso", &fake_alpine_iso());
-    let (s, _) = post_multipart(&app, "/api/isos", &ct, body).await;
-    assert_eq!(s, StatusCode::CREATED);
-    let pin = r#"{"mac":"aa:bb:cc:dd:ee:03","target":"fake-alpine-linux","auto_ip":"not-an-ip"}"#;
-    let (s, _) = post_json(&app, "/api/hosts", pin).await;
-    assert_eq!(s, StatusCode::BAD_REQUEST);
-}
-
-#[tokio::test]
-async fn per_theme_logo_and_favicon_serve() {
-    let (state, _dir) = build_state().await;
-    // Light slot only; dark falls back to it, favicon stays bundled.
-    let png = tiny_png();
-    state
-        .branding
-        .set_logo(openpxe_core::LogoSlot::Light, "image/png", "png", &png)
-        .unwrap();
-    let app = build_router(state);
-    // Light theme → the uploaded PNG.
-    let (s, b) = get(&app, "/assets/logo.svg?theme=light").await;
-    assert_eq!(s, StatusCode::OK);
-    assert!(b.starts_with(b"\x89PNG"), "light slot should serve the PNG");
-    // Dark theme → falls back to the light PNG (only slot set).
-    let (s, b) = get(&app, "/assets/logo.svg?theme=dark").await;
-    assert_eq!(s, StatusCode::OK);
-    assert!(
-        b.starts_with(b"\x89PNG"),
-        "dark should fall back to light PNG"
-    );
-    // Favicon is always the bundled SVG, never the custom raster.
-    let (s, b) = get(&app, "/assets/favicon.svg").await;
-    assert_eq!(s, StatusCode::OK);
-    let txt = String::from_utf8_lossy(&b);
-    assert!(txt.contains("<svg"), "favicon must be the bundled SVG mark");
-}
-
-#[tokio::test]
-async fn branding_slot_rejects_unknown_and_client_svg() {
-    let (state, _dir) = build_state().await;
-    let app = build_router(state);
-    // Unknown slot name → 400.
-    let (ct, body) = multipart_iso_body("logo.png", &tiny_png());
-    let (s, _) = post_multipart(&app, "/api/branding/logo/sideways", &ct, body).await;
-    assert_eq!(s, StatusCode::BAD_REQUEST);
-    // SVG into the client (PXE) slot → 400 (raster-only).
-    let svg = br#"<svg xmlns="http://www.w3.org/2000/svg"/>"#;
-    let boundary = "----OpenPxeTestBoundary1234";
-    let mut b = Vec::new();
-    b.extend_from_slice(format!("--{boundary}\r\n").as_bytes());
-    b.extend_from_slice(b"Content-Disposition: form-data; name=\"file\"; filename=\"l.svg\"\r\n");
-    b.extend_from_slice(b"Content-Type: image/svg+xml\r\n\r\n");
-    b.extend_from_slice(svg);
-    b.extend_from_slice(format!("\r\n--{boundary}--\r\n").as_bytes());
-    let ct = format!("multipart/form-data; boundary={boundary}");
-    let (s, _) = post_multipart(&app, "/api/branding/logo/client", &ct, b).await;
-    assert_eq!(s, StatusCode::BAD_REQUEST);
-}
-
 // ─── v0.5.1: SAML SSO flow ──────────────────────────────────────────────────
 //
 // The core crate exhaustively tests signature verification + semantic
@@ -2404,16 +2145,8 @@ fn urlencode(s: &str) -> String {
             }
             _ => {
                 out.push('%');
-                out.push(
-                    char::from_digit((b >> 4) as u32, 16)
-                        .unwrap()
-                        .to_ascii_uppercase(),
-                );
-                out.push(
-                    char::from_digit((b & 0xf) as u32, 16)
-                        .unwrap()
-                        .to_ascii_uppercase(),
-                );
+                out.push(char::from_digit((b >> 4) as u32, 16).unwrap().to_ascii_uppercase());
+                out.push(char::from_digit((b & 0xf) as u32, 16).unwrap().to_ascii_uppercase());
             }
         }
     }

crates/iso-store/Cargo.toml

@@ -39,10 +39,6 @@ image = { version = "0.25", default-features = false, features = ["png", "jpeg",
 # kernel mount. See crates/iso-store/src/nfs_share.rs for usage.
 nfs3_client = { workspace = true }
 nfs3_types = { workspace = true }
-# v0.5.5: pure-Rust SSH/SFTP client (ring backend) for the SFTP remote
-# share path. See crates/iso-store/src/sftp_share.rs for usage.
-russh = { workspace = true }
-russh-sftp = { workspace = true }
 # Needed for the Stream trait that wraps the mpsc receiver feeding
 # NFS read-loop bytes into axum's Body::from_stream.
 futures = { workspace = true }

crates/iso-store/src/introspect.rs

@@ -85,37 +85,12 @@ pub fn introspect(path: &Path) -> IntrospectionReport {
         read_total += n;
     }
 
-    // `sources/boot.wim` is the definitive Windows-install-media marker
-    // when the ISO exposes ASCII (ISO9660/Joliet) names. `contains_ascii`
-    // is case-insensitive, so one form covers BOOT.WIM / boot.wim and the
-    // backslash variant.
     if contains_ascii(&haystack, b"sources/boot.wim")
-        || contains_ascii(&haystack, b"sources\\boot.wim")
+        || contains_ascii(&haystack, b"SOURCES/BOOT.WIM")
+        || contains_ascii(&haystack, b"SOURCES\\BOOT.WIM")
     {
         report.has_boot_wim = true;
-        report.family = DistroFamily::WindowsPe;
-    }
-
-    // v0.5.8: broaden Windows detection. Modern Windows 10/11 ISOs are
-    // UDF — filenames are stored as UTF-16 (so the ASCII scan above misses
-    // them) and the volume label is a cryptic Microsoft string (so
-    // `family_from_label` misses it too). Booting is via HTTP sanboot of
-    // the raw ISO (no boot.wim extraction), so we only need the *family*.
-    // Catch the common cases: well-known Windows markers in either ASCII
-    // or UTF-16LE within the first 16 MiB, plus a filename hint.
-    if report.family == DistroFamily::Unknown {
-        let head = &haystack[..haystack.len().min(16 * 1024 * 1024)];
-        let ascii_markers: [&[u8]; 4] = [
-            b"bootmgr",
-            b"sources/install.wim",
-            b"sources/install.esd",
-            b"efi/microsoft",
-        ];
-        let utf16_markers = ["bootmgr", "boot.wim", "install.wim", "microsoft"];
-        let looks_windows = ascii_markers.iter().any(|m| contains_ascii(head, m))
-            || utf16_markers.iter().any(|m| contains_utf16le_ci(head, m))
-            || filename_looks_windows(path);
-        if looks_windows {
+        if report.family == DistroFamily::Unknown {
             report.family = DistroFamily::WindowsPe;
         }
     }
@@ -183,45 +158,6 @@ fn contains_ascii(haystack: &[u8], needle: &[u8]) -> bool {
         .any(|w| w.eq_ignore_ascii_case(needle))
 }
 
-/// Case-insensitive search for an ASCII string encoded as UTF-16LE — the
-/// way UDF (and thus modern Windows ISOs) store filenames. Each character
-/// is two bytes: the ASCII low byte (compared case-insensitively) followed
-/// by a 0 high byte. v0.5.8.
-fn contains_utf16le_ci(haystack: &[u8], ascii: &str) -> bool {
-    let n = ascii.len();
-    if n == 0 || haystack.len() < n * 2 {
-        return false;
-    }
-    let lower: Vec<u8> = ascii.bytes().map(|b| b.to_ascii_lowercase()).collect();
-    haystack.windows(n * 2).any(|w| {
-        lower
-            .iter()
-            .enumerate()
-            .all(|(i, &c)| w[i * 2 + 1] == 0 && w[i * 2].to_ascii_lowercase() == c)
-    })
-}
-
-/// Filename heuristic: a stock Windows ISO almost always carries an obvious
-/// token in its name (e.g. `..._windows_11_...`, `Win10`, `winserver`).
-/// Used only as a last-resort family hint when the content scan and volume
-/// label are inconclusive. v0.5.8.
-fn filename_looks_windows(path: &Path) -> bool {
-    let name = path
-        .file_name()
-        .and_then(|s| s.to_str())
-        .unwrap_or("")
-        .to_ascii_lowercase();
-    const TOKENS: [&str; 6] = [
-        "windows",
-        "winpe",
-        "win10",
-        "win11",
-        "winserver",
-        "win-server",
-    ];
-    TOKENS.iter().any(|t| name.contains(t))
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -243,38 +179,4 @@ mod tests {
         assert_eq!(family_from_label("ARCH_202604"), DistroFamily::Arch);
         assert_eq!(family_from_label("weird-custom"), DistroFamily::Unknown);
     }
-
-    #[test]
-    fn utf16le_marker_matches_case_insensitively() {
-        // "boot.wim" encoded UTF-16LE, mixed case — UDF stores Windows
-        // filenames this way, which the ASCII scan can't see.
-        let s = "BOOT.WIM";
-        let utf16: Vec<u8> = s.bytes().flat_map(|b| [b, 0]).collect();
-        let mut hay = vec![0u8; 8];
-        hay.extend_from_slice(&utf16);
-        hay.extend_from_slice(&[1, 2, 3]);
-        assert!(contains_utf16le_ci(&hay, "boot.wim"));
-        assert!(contains_utf16le_ci(&hay, "Boot.Wim"));
-        assert!(!contains_utf16le_ci(&hay, "install.wim"));
-        // An ASCII (not UTF-16) occurrence must NOT match the UTF-16 scan.
-        assert!(!contains_utf16le_ci(b"boot.wim plain ascii", "boot.wim"));
-    }
-
-    #[test]
-    fn filename_hint_catches_windows_isos() {
-        use std::path::Path;
-        assert!(filename_looks_windows(Path::new(
-            "en-us_windows_11_iot_enterprise_ltsc_2024_x64_dvd.iso"
-        )));
-        assert!(filename_looks_windows(Path::new(
-            "Win10_22H2_English_x64.iso"
-        )));
-        assert!(filename_looks_windows(Path::new("winserver2022.iso")));
-        assert!(!filename_looks_windows(Path::new(
-            "ubuntu-24.04-desktop.iso"
-        )));
-        assert!(!filename_looks_windows(Path::new(
-            "Rocky-9.4-x86_64-dvd.iso"
-        )));
-    }
 }

crates/iso-store/src/lib.rs

@@ -20,11 +20,9 @@ pub mod entry;
 pub mod introspect;
 pub mod nfs_share;
 pub mod pxe_logo;
-pub mod sftp_share;
 pub mod smb;
 pub mod smb_share;
 pub mod store;
-pub mod unattended;
 pub mod windows;
 
 pub use entry::{BootEntry, BootKind, KernelArgs};
@@ -41,18 +39,8 @@ pub use smb_share::{SmbAddRequest, SmbShare, SmbShareError, SmbShareManager, Smb
 // "works in any container" property as SMB, plus support for HTTP
 // Range requests because NFSv3 READ3 takes an explicit offset.
 pub use nfs_share::{NfsAddRequest, NfsShare, NfsShareError, NfsShareManager, NfsStream};
-// v0.5.5: SFTP-over-SSH remote shares via the pure-Rust `russh` +
-// `russh-sftp` crates (ring backend — no OpenSSL, no new C deps). Like
-// NFS, supports HTTP Range requests because SFTP opens a seekable file
-// handle. See crates/iso-store/src/sftp_share.rs.
-pub use sftp_share::{
-    SftpAddRequest, SftpAuthKind, SftpShare, SftpShareError, SftpShareManager, SftpStream,
-};
 pub use store::{
-    generate_boot_entries_for, slugify_str, IsoCategory, IsoMeta, IsoSource, IsoStore, UploadHandle,
-};
-pub use unattended::{
-    classify as classify_unattended, render_template, UnattendedKind, UnattendedMeta,
-    UnattendedStore, MAX_UNATTENDED_BYTES,
+    generate_boot_entries_for, slugify_str, IsoCategory, IsoMeta, IsoSource, IsoStore,
+    UploadHandle,
 };
 pub use windows::{WimPatcher, WinPatchState};

crates/iso-store/src/store.rs

@@ -24,10 +24,6 @@ use tokio::io::AsyncWriteExt;
 /// `nfs3_client` crate (in-process, no subprocess). Same "works in
 /// any container" property as SMB, plus Range requests work because
 /// NFSv3 READ3 takes an explicit offset.
-/// `Sftp` (v0.5.5) — remote SFTP-over-SSH share, streamed via the
-/// pure-Rust `russh` + `russh-sftp` crates (in-process). Like NFS it
-/// supports HTTP Range requests because SFTP opens a seekable file
-/// handle (`SSH_FXP_READ` at offset).
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(tag = "kind", rename_all = "snake_case")]
 pub enum IsoSource {
@@ -46,13 +42,6 @@ pub enum IsoSource {
         /// Filename at the export root.
         relative_path: String,
     },
-    /// v0.5.5: SFTP-over-SSH via the in-process `russh` + `russh-sftp`
-    /// crates.
-    Sftp {
-        share_id: String,
-        /// Filename at the export root.
-        relative_path: String,
-    },
 }
 
 /// Where the ISO lands in the PXE menu hierarchy.
@@ -310,11 +299,11 @@ impl IsoStore {
                     None
                 }
             }
-            // SMB, NFS, and SFTP sources have no local path — they're
+            // SMB and NFS sources have no local path — they're
             // streamed in-process. Callers must inspect the source
             // kind first and dispatch to the appropriate share
             // manager.
-            IsoSource::Smb { .. } | IsoSource::Nfs { .. } | IsoSource::Sftp { .. } => None,
+            IsoSource::Smb { .. } | IsoSource::Nfs { .. } => None,
         }
     }
 
@@ -374,9 +363,9 @@ impl IsoStore {
     pub fn drop_external_source(&self, share_id: &str) {
         let mut g = self.inner.write();
         g.isos.retain(|_, m| match &m.source {
-            IsoSource::Smb { share_id: sid, .. }
-            | IsoSource::Nfs { share_id: sid, .. }
-            | IsoSource::Sftp { share_id: sid, .. } => sid != share_id,
+            IsoSource::Smb { share_id: sid, .. } | IsoSource::Nfs { share_id: sid, .. } => {
+                sid != share_id
+            }
             IsoSource::Local => true,
         });
     }
@@ -557,22 +546,22 @@ fn generate_boot_entries(id: &str, filename: &str, r: &IntrospectionReport) -> V
         .clone()
         .unwrap_or_else(|| filename.to_string());
     match r.family {
-        DistroFamily::WindowsPe => {
-            // v0.5.8: boot Windows directly via iPXE HTTP sanboot. iPXE
-            // exposes the raw ISO as an emulated CD backed by on-demand
-            // HTTP range reads, and Windows Setup boots from it. This
-            // replaces the old wimboot+SMB chain, which (a) needed an SMB
-            // server the host often can't provide (port 445 collisions),
-            // (b) served in-ISO files via an ISO9660 lookup that failed on
-            // UDF-only Windows 11 ISOs, and (c) required an operator
-            // toggle. sanboot needs none of that — just the HTTP port,
-            // which works in any environment. The unmodified, stock ISO is
-            // served at iso/<id>.iso; nothing is injected into Windows.
+        DistroFamily::WindowsPe if r.has_boot_wim => {
+            // Standard wimboot chain. Paths are in-ISO; the HTTP layer maps
+            // `iso/<id>/<path>` to on-disk extraction via ISO9660 lookup.
+            let base = format!("iso/{id}");
             vec![BootEntry {
-                id: format!("{id}-windows"),
-                title: format!("{title} (Windows)"),
-                kind: BootKind::SanBootIso {
-                    iso_url: format!("iso/{id}.iso"),
+                id: format!("{id}-winpe"),
+                title: format!("{title} (Windows / wimboot)"),
+                kind: BootKind::Wimboot {
+                    wimboot_url: "ipxe/wimboot".to_string(),
+                    files: vec![
+                        ("bootmgr".into(), format!("{base}/bootmgr")),
+                        ("bootmgr.efi".into(), format!("{base}/bootmgr.efi")),
+                        ("bcd".into(), format!("{base}/boot/bcd")),
+                        ("boot.sdi".into(), format!("{base}/boot/boot.sdi")),
+                        ("boot.wim".into(), format!("{base}/sources/boot.wim")),
+                    ],
                 },
             }]
         }
@@ -670,10 +659,7 @@ mod tests {
         // good.
         let s = linux_cmdline(DistroFamily::DebianUbuntu, "ubuntu-24-04");
         assert!(s.contains("boot=casper"), "{s}");
-        assert!(
-            s.contains("iso-url=${base-url}/iso/ubuntu-24-04.iso"),
-            "{s}"
-        );
+        assert!(s.contains("iso-url=${base-url}/iso/ubuntu-24-04.iso"), "{s}");
         assert!(s.contains("ds=nocloud"), "{s}");
         assert!(s.contains("ip=dhcp"), "{s}");
         assert!(!s.contains("netboot=url"), "legacy option leaked: {s}");

crates/iso-store/src/unattended.rs

@@ -1,412 +0,0 @@
-//! Unattended-install answer-file store (v0.5.2).
-//!
-//! Operators upload the answer file their installer expects — a RHEL/
-//! Fedora **Kickstart**, a Debian **Preseed**, an Ubuntu **Autoinstall**
-//! cloud-init user-data, or a Windows **answer file** (`autounattend.xml`)
-//! — and OpenPXE serves it on demand to the booting machine. Files live
-//! in their own directory (`<unattended_dir>/`), deliberately *not* under
-//! `iso_dir`, so they never appear in the ISO listing or the PXE menu.
-//!
-//! Storage mirrors [`crate::store::IsoStore`]: in-memory map authoritative
-//! for the process, sidecar `*.meta.json` on disk is the source of truth on
-//! restart. The raw answer file sits beside it as `<id>.file`.
-//!
-//! Templating is applied at *serve* time, not store time — see
-//! [`render_template`]. The stored bytes are exactly what the operator
-//! uploaded; per-host hostname/IP/MAC values are substituted into a copy
-//! when the file is fetched for a specific client.
-
-use crate::store::slugify_str;
-use openpxe_core::{Error, Result};
-use parking_lot::RwLock;
-use serde::{Deserialize, Serialize};
-use std::collections::HashMap;
-use std::path::PathBuf;
-use std::sync::Arc;
-use time::OffsetDateTime;
-
-/// Disk + memory cap for one answer file. Kickstarts/preseeds/cloud-init
-/// configs are a few KB; 1 MiB is a comfortable ceiling that still bounds
-/// abuse.
-pub const MAX_UNATTENDED_BYTES: usize = 1024 * 1024;
-
-/// Which installer the answer file targets. Drives the kernel-argument
-/// injection in the boot chain.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum UnattendedKind {
-    /// RHEL / Fedora / CentOS / AlmaLinux / Rocky — `inst.ks=<url>`.
-    Kickstart,
-    /// Debian / older Ubuntu — `auto=true priority=critical url=<url>`.
-    Preseed,
-    /// Ubuntu 20.04+ Subiquity autoinstall — cloud-init NoCloud:
-    /// `autoinstall ds=nocloud-net;s=<url>/`.
-    Autoinstall,
-    /// Windows Setup answer file (`autounattend.xml`). Served, not
-    /// auto-injected (Windows reads it from media/USB, not a kernel arg).
-    AnswerFile,
-    /// Couldn't classify — stored + served, no auto-injection.
-    #[default]
-    Unknown,
-}
-
-impl UnattendedKind {
-    #[must_use]
-    pub fn label(self) -> &'static str {
-        match self {
-            UnattendedKind::Kickstart => "Kickstart",
-            UnattendedKind::Preseed => "Preseed",
-            UnattendedKind::Autoinstall => "Autoinstall",
-            UnattendedKind::AnswerFile => "Answer file",
-            UnattendedKind::Unknown => "Unknown",
-        }
-    }
-}
-
-/// Lowercase file extension (no dot), or `None` if there isn't one.
-fn ext_lower(filename: &str) -> Option<String> {
-    std::path::Path::new(filename)
-        .extension()
-        .and_then(|e| e.to_str())
-        .map(str::to_ascii_lowercase)
-}
-
-/// Classify an upload from its filename + a peek at its content. Best
-/// effort: extension first, then a content sniff to disambiguate the
-/// `.cfg` case (both Kickstart and Preseed use it).
-#[must_use]
-pub fn classify(filename: &str, content: &[u8]) -> UnattendedKind {
-    let lower_name = filename.to_ascii_lowercase();
-    let ext = ext_lower(filename);
-    let text = String::from_utf8_lossy(&content[..content.len().min(8192)]);
-    let looks_preseed = text.contains("d-i ") || text.contains("preseed/");
-    let looks_kickstart = text.contains("%packages")
-        || text.contains("\nlang ")
-        || text.contains("\nkeyboard ")
-        || text.contains("bootloader --")
-        || text.starts_with("install");
-    let looks_cloud_init = text.contains("autoinstall")
-        || text.contains("#cloud-config")
-        || text.contains("version: 1");
-
-    match ext.as_deref() {
-        Some("ks") => return UnattendedKind::Kickstart,
-        Some("seed") => return UnattendedKind::Preseed,
-        Some("xml") => return UnattendedKind::AnswerFile,
-        Some("yaml" | "yml") => return UnattendedKind::Autoinstall,
-        Some("cfg") => {
-            return if looks_kickstart && !looks_preseed {
-                UnattendedKind::Kickstart
-            } else {
-                UnattendedKind::Preseed
-            };
-        }
-        _ => {}
-    }
-    if lower_name == "user-data" {
-        return UnattendedKind::Autoinstall;
-    }
-    // No recognised extension — fall back to content sniffing.
-    if looks_cloud_init {
-        UnattendedKind::Autoinstall
-    } else if looks_kickstart {
-        UnattendedKind::Kickstart
-    } else if looks_preseed {
-        UnattendedKind::Preseed
-    } else {
-        UnattendedKind::Unknown
-    }
-}
-
-/// True if the filename carries an extension we accept for upload. We
-/// also accept the bare `user-data` name (cloud-init NoCloud convention).
-#[must_use]
-pub fn is_accepted_filename(filename: &str) -> bool {
-    if filename.trim().eq_ignore_ascii_case("user-data") {
-        return true;
-    }
-    matches!(
-        ext_lower(filename).as_deref(),
-        Some("ks" | "cfg" | "seed" | "yaml" | "yml" | "xml")
-    )
-}
-
-/// Sidecar metadata for a stored answer file.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct UnattendedMeta {
-    /// URL-safe slug, unique within the store.
-    pub id: String,
-    /// Original upload filename, shown in the UI.
-    pub filename: String,
-    pub kind: UnattendedKind,
-    pub size_bytes: u64,
-    #[serde(with = "time::serde::rfc3339")]
-    pub uploaded_at: OffsetDateTime,
-}
-
-#[derive(Debug, Default)]
-struct Inner {
-    files: HashMap<String, UnattendedMeta>,
-}
-
-/// In-memory + on-disk answer-file registry. Cheap to clone.
-#[derive(Debug, Clone)]
-pub struct UnattendedStore {
-    dir: Arc<PathBuf>,
-    inner: Arc<RwLock<Inner>>,
-}
-
-impl UnattendedStore {
-    #[must_use]
-    pub fn new(dir: PathBuf) -> Self {
-        Self {
-            dir: Arc::new(dir),
-            inner: Arc::new(RwLock::new(Inner::default())),
-        }
-    }
-
-    pub async fn ensure_dir(&self) -> Result<()> {
-        tokio::fs::create_dir_all(self.dir.as_path()).await?;
-        Ok(())
-    }
-
-    /// Scan the directory on startup, loading every `*.meta.json` sidecar.
-    pub async fn load_from_disk(&self) -> Result<()> {
-        self.ensure_dir().await?;
-        let mut entries = tokio::fs::read_dir(self.dir.as_path()).await?;
-        while let Some(e) = entries.next_entry().await? {
-            let p = e.path();
-            let is_meta = p
-                .file_name()
-                .and_then(|s| s.to_str())
-                .is_some_and(|n| n.ends_with(".meta.json"));
-            if !is_meta {
-                continue;
-            }
-            if let Ok(text) = tokio::fs::read_to_string(&p).await {
-                if let Ok(meta) = serde_json::from_str::<UnattendedMeta>(&text) {
-                    self.inner.write().files.insert(meta.id.clone(), meta);
-                }
-            }
-        }
-        Ok(())
-    }
-
-    fn data_path(&self, id: &str) -> PathBuf {
-        self.dir.join(format!("{id}.file"))
-    }
-
-    fn meta_path(&self, id: &str) -> PathBuf {
-        self.dir.join(format!("{id}.meta.json"))
-    }
-
-    /// Mint a unique slug from the upload filename's stem.
-    fn unique_id(&self, filename: &str) -> String {
-        let stem = filename.rsplit_once('.').map_or(filename, |(s, _)| s);
-        let base = {
-            let s = slugify_str(stem);
-            if s.is_empty() {
-                "unattended".to_string()
-            } else {
-                s
-            }
-        };
-        let g = self.inner.read();
-        if !g.files.contains_key(&base) {
-            return base;
-        }
-        for n in 1.. {
-            let candidate = format!("{base}-{n}");
-            if !g.files.contains_key(&candidate) {
-                return candidate;
-            }
-        }
-        unreachable!("u64 ids exhausted")
-    }
-
-    /// Store an uploaded answer file. Validates type + size, classifies,
-    /// writes the bytes + a sidecar, and returns the new metadata.
-    pub async fn add(&self, filename: &str, bytes: &[u8]) -> Result<UnattendedMeta> {
-        if !is_accepted_filename(filename) {
-            return Err(Error::Invalid(format!(
-                "unsupported answer-file type '{filename}'. Accepted: .ks, .cfg, .seed, .yaml, .yml, .xml, user-data"
-            )));
-        }
-        if bytes.len() > MAX_UNATTENDED_BYTES {
-            return Err(Error::Invalid(format!(
-                "answer file too large ({} bytes, max {MAX_UNATTENDED_BYTES})",
-                bytes.len()
-            )));
-        }
-        self.ensure_dir().await?;
-        let kind = classify(filename, bytes);
-        let id = self.unique_id(filename);
-        let meta = UnattendedMeta {
-            id: id.clone(),
-            filename: filename.to_string(),
-            kind,
-            size_bytes: bytes.len() as u64,
-            uploaded_at: OffsetDateTime::now_utc(),
-        };
-        // Atomic data write: tmp -> rename.
-        let data = self.data_path(&id);
-        let tmp = data.with_extension("file.tmp");
-        tokio::fs::write(&tmp, bytes).await?;
-        tokio::fs::rename(&tmp, &data).await?;
-        let meta_text = serde_json::to_string_pretty(&meta).map_err(|e| Error::Other(e.into()))?;
-        tokio::fs::write(self.meta_path(&id), meta_text).await?;
-        self.inner.write().files.insert(id.clone(), meta.clone());
-        tracing::info!(
-            target: "openpxe::unattended",
-            id = %id, file = %filename, kind = ?kind, size = bytes.len(),
-            "unattended answer file stored"
-        );
-        Ok(meta)
-    }
-
-    #[must_use]
-    pub fn list(&self) -> Vec<UnattendedMeta> {
-        let g = self.inner.read();
-        let mut v: Vec<_> = g.files.values().cloned().collect();
-        v.sort_by_key(|m| std::cmp::Reverse(m.uploaded_at));
-        v
-    }
-
-    #[must_use]
-    pub fn get(&self, id: &str) -> Option<UnattendedMeta> {
-        self.inner.read().files.get(id).cloned()
-    }
-
-    /// Read the raw stored bytes for `id`.
-    pub async fn read(&self, id: &str) -> Result<Vec<u8>> {
-        if !self.inner.read().files.contains_key(id) {
-            return Err(Error::NotFound(format!("no unattended file '{id}'")));
-        }
-        let bytes = tokio::fs::read(self.data_path(id)).await?;
-        Ok(bytes)
-    }
-
-    /// Remove a file + its sidecar. Returns true if something was removed.
-    pub async fn remove(&self, id: &str) -> bool {
-        let existed = self.inner.write().files.remove(id).is_some();
-        if existed {
-            let _ = tokio::fs::remove_file(self.data_path(id)).await;
-            let _ = tokio::fs::remove_file(self.meta_path(id)).await;
-        }
-        existed
-    }
-
-    #[must_use]
-    pub fn len(&self) -> usize {
-        self.inner.read().files.len()
-    }
-
-    #[must_use]
-    pub fn is_empty(&self) -> bool {
-        self.len() == 0
-    }
-}
-
-/// Substitute the per-host template tokens into an answer file at serve
-/// time. Recognised tokens (case-sensitive, double-brace): `{{HOSTNAME}}`,
-/// `{{IP}}`, `{{MAC}}`. Unset values render as an empty string so a
-/// half-filled profile never leaves a literal `{{IP}}` in the file.
-#[must_use]
-pub fn render_template(
-    content: &str,
-    mac: Option<&str>,
-    hostname: Option<&str>,
-    ip: Option<&str>,
-) -> String {
-    content
-        .replace("{{HOSTNAME}}", hostname.unwrap_or(""))
-        .replace("{{IP}}", ip.unwrap_or(""))
-        .replace("{{MAC}}", mac.unwrap_or(""))
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use tempfile::tempdir;
-
-    #[test]
-    fn classify_by_extension() {
-        assert_eq!(
-            classify(" subiquity.yaml", b""),
-            UnattendedKind::Autoinstall
-        );
-        assert_eq!(classify("ks.ks", b""), UnattendedKind::Kickstart);
-        assert_eq!(classify("preseed.seed", b""), UnattendedKind::Preseed);
-        assert_eq!(
-            classify("autounattend.xml", b"<xml/>"),
-            UnattendedKind::AnswerFile
-        );
-        assert_eq!(classify("user-data", b""), UnattendedKind::Autoinstall);
-    }
-
-    #[test]
-    fn classify_cfg_by_content() {
-        assert_eq!(
-            classify("answer.cfg", b"d-i debian-installer/locale string en_US"),
-            UnattendedKind::Preseed
-        );
-        assert_eq!(
-            classify("answer.cfg", b"install\n%packages\n@core\n%end\n"),
-            UnattendedKind::Kickstart
-        );
-    }
-
-    #[test]
-    fn accepted_filenames() {
-        assert!(is_accepted_filename("a.ks"));
-        assert!(is_accepted_filename("USER-DATA".to_lowercase().as_str()));
-        assert!(is_accepted_filename("autounattend.XML"));
-        assert!(!is_accepted_filename("evil.sh"));
-        assert!(!is_accepted_filename("image.iso"));
-    }
-
-    #[test]
-    fn template_substitutes_and_blanks_unset() {
-        let body = "ip={{IP}} host={{HOSTNAME}} mac={{MAC}}";
-        let out = render_template(body, Some("aa:bb"), Some("node1"), None);
-        assert_eq!(out, "ip= host=node1 mac=aa:bb");
-    }
-
-    #[tokio::test]
-    async fn add_list_read_remove_round_trip() {
-        let dir = tempdir().unwrap();
-        let s = UnattendedStore::new(dir.path().join("unattended"));
-        let meta = s
-            .add("rocky.ks", b"install\n%packages\n@core\n%end\n")
-            .await
-            .unwrap();
-        assert_eq!(meta.kind, UnattendedKind::Kickstart);
-        assert_eq!(s.len(), 1);
-        let got = s.read(&meta.id).await.unwrap();
-        assert!(got.starts_with(b"install"));
-        // Survives a reload.
-        let s2 = UnattendedStore::new(dir.path().join("unattended"));
-        s2.load_from_disk().await.unwrap();
-        assert!(s2.get(&meta.id).is_some());
-        assert!(s2.remove(&meta.id).await);
-        assert!(s2.get(&meta.id).is_none());
-    }
-
-    #[tokio::test]
-    async fn rejects_bad_type_and_oversize() {
-        let dir = tempdir().unwrap();
-        let s = UnattendedStore::new(dir.path().join("unattended"));
-        assert!(s.add("evil.sh", b"#!/bin/sh").await.is_err());
-        let big = vec![b'x'; MAX_UNATTENDED_BYTES + 1];
-        assert!(s.add("big.ks", &big).await.is_err());
-    }
-
-    #[tokio::test]
-    async fn ids_are_unique() {
-        let dir = tempdir().unwrap();
-        let s = UnattendedStore::new(dir.path().join("unattended"));
-        let a = s.add("ks.ks", b"install").await.unwrap();
-        let b = s.add("ks.ks", b"install").await.unwrap();
-        assert_ne!(a.id, b.id);
-    }
-}

crates/openpxe/src/main.rs

@@ -9,7 +9,7 @@ use openpxe_core::{
 };
 use openpxe_dhcp_proxy::DhcpProxyServer;
 use openpxe_http_api::{build_router, AppState};
-use openpxe_iso_store::{IsoStore, NfsShareManager, SftpShareManager, SmbManager, SmbShareManager};
+use openpxe_iso_store::{IsoStore, NfsShareManager, SmbManager, SmbShareManager};
 use openpxe_tftp::TftpServer;
 use std::net::{Ipv4Addr, SocketAddr};
 use std::path::PathBuf;
@@ -59,10 +59,11 @@ async fn main() -> anyhow::Result<()> {
     init_tracing(log_bus.clone());
 
     let cli = Cli::parse();
-    // v0.5.4: layered load via figment — defaults → optional TOML → env.
-    // The OPENPXE_* env layer keeps the historical flat names (see
-    // `Config::load`), so existing deployments are unaffected.
-    let config = Config::load(cli.config.as_deref())?;
+    let mut config = match &cli.config {
+        Some(p) if p.exists() => Config::from_toml_file(p)?,
+        _ => Config::default(),
+    };
+    config.apply_env();
 
     // Dispatch subcommands before bringing up the server.
     if let Some(cmd) = cli.command {
@@ -94,25 +95,10 @@ async fn main() -> anyhow::Result<()> {
             }
         },
     };
-    // v0.5.6: the advertised base URL must carry the HTTP port. Every
-    // client-facing URL (the DHCP-proxy iPXE filename, UEFI HTTP boot,
-    // and the menu's kernel/initrd/ISO links) is derived from this one
-    // string, so omitting the port silently pointed PXE clients at :80 —
-    // breaking every non-80 deployment (e.g. the Unraid template's 4200,
-    // chosen to dodge the webGUI). See `build_public_base_url`.
-    let public_base_url = build_public_base_url(our_ip, config.server.http_port);
+    let public_base_url = format!("http://{our_ip}");
 
     let iso_store = IsoStore::new(config.paths.iso_dir.clone());
     iso_store.load_from_disk().await?;
-    // v0.5.2: unattended answer-file store (Kickstart/Preseed/Autoinstall/
-    // Windows answer files). Separate directory from the ISO store.
-    let unattended = openpxe_iso_store::UnattendedStore::new(config.paths.unattended_dir.clone());
-    if let Err(e) = unattended.load_from_disk().await {
-        tracing::warn!(
-            target: "openpxe::unattended",
-            "could not load unattended files on startup: {e}"
-        );
-    }
     let clients = ClientRegistry::new();
     let queue = DeploymentQueue::new();
     let settings = SettingsStore::load_or_default(&config.paths.work_dir);
@@ -160,19 +146,6 @@ async fn main() -> anyhow::Result<()> {
         );
     }
 
-    // v0.5.5: SFTP-over-SSH share manager — pure-Rust in-process
-    // consumer via `russh` + `russh-sftp` (ring backend, no OpenSSL).
-    // The third remote-library protocol alongside SMB/NFS; like NFS it
-    // works in any container (no subprocess, no kernel mount) and
-    // supports HTTP Range requests because SFTP file handles seek.
-    let sftp_shares = SftpShareManager::new(&config.paths.work_dir, iso_store.clone());
-    if let Err(e) = sftp_shares.load_and_rescan().await {
-        tracing::warn!(
-            target: "openpxe::sftp",
-            "could not reload SFTP shares on startup: {e}"
-        );
-    }
-
     // Sniff network details for the Network tab. None of these are
     // required for PXE to work — they're informational, surfaced in the
     // UI so an operator doesn't have to drop to a shell to find their
@@ -201,8 +174,6 @@ async fn main() -> anyhow::Result<()> {
         smb: Some(smb.clone()),
         smb_shares: smb_shares.clone(),
         nfs_shares: nfs_shares.clone(),
-        sftp_shares: sftp_shares.clone(),
-        unattended: unattended.clone(),
         uploads: openpxe_http_api::uploads::UploadSessions::default(),
         log_bus: log_bus.clone(),
         started_at: time::OffsetDateTime::now_utc(),
@@ -351,20 +322,6 @@ async fn seed_from_dir(
 /// a loopback address (which would give every PXE client an unreachable
 /// `http://127.0.0.1/...`). Users in multi-homed setups should set
 /// `OPENPXE_PUBLIC_IP` explicitly.
-/// Build the base URL advertised to PXE clients. The port is included
-/// unless it's the HTTP default (80), keeping the common case clean
-/// (`http://10.0.0.5`) while a remapped port (`http://10.0.0.5:4200`)
-/// stays reachable. This is the single source of truth for every
-/// client-facing URL — the DHCP-proxy iPXE filename, UEFI HTTP boot, and
-/// the boot menu's kernel/initrd/ISO links all derive from it.
-fn build_public_base_url(ip: Ipv4Addr, http_port: u16) -> String {
-    if http_port == 80 {
-        format!("http://{ip}")
-    } else {
-        format!("http://{ip}:{http_port}")
-    }
-}
-
 fn detect_primary_ipv4() -> Option<Ipv4Addr> {
     // First try: route to the public internet. `UdpSocket::connect` to a
     // well-known external address causes the OS to populate `local_addr`
@@ -498,26 +455,3 @@ fn prefix_to_dotted(prefix: u8) -> String {
         mask & 0xff
     )
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn public_base_url_includes_non_default_port() {
-        // The v0.5.6 regression guard: a remapped HTTP port (e.g. the
-        // Unraid template's 4200) MUST appear in the advertised URL, or
-        // PXE clients fetch :80 — the wrong service — and boot fails.
-        let ip: Ipv4Addr = "192.168.1.49".parse().unwrap();
-        assert_eq!(build_public_base_url(ip, 4200), "http://192.168.1.49:4200");
-        assert_eq!(build_public_base_url(ip, 8080), "http://192.168.1.49:8080");
-    }
-
-    #[test]
-    fn public_base_url_omits_default_port() {
-        // Port 80 stays clean (no `:80`) so the common case reads nicely
-        // and matches what every browser/iPXE assumes by default.
-        let ip: Ipv4Addr = "10.0.0.5".parse().unwrap();
-        assert_eq!(build_public_base_url(ip, 80), "http://10.0.0.5");
-    }
-}

crates/webui/src/app.css

@@ -304,14 +304,6 @@ button.ghost { background: transparent; color: var(--fg); border: 1px solid var(
 button.ghost:hover { background: var(--bg-panel-2); color: var(--fg); }
 button.danger { background: transparent; color: var(--err); border: 1px solid color-mix(in srgb, var(--err) 35%, transparent); }
 button.danger:hover { background: color-mix(in srgb, var(--err) 14%, transparent); color: var(--err); }
-/* v0.5.3: unified spacing for a card's primary action button(s). Any
-   button that sits as a direct child of a card body (Save, Bind, Add,
-   Launch, …) gets the same gap above it so it never butts against the
-   form. Inline buttons inside table rows / toolbars / logo slots /
-   modal action bars are nested deeper, so the `>` keeps them untouched.
-   Adjacent action buttons on one row (e.g. Save + Send test) share the
-   margin and stay aligned. */
-.card .body > button { margin-top: 16px; }
 
 label.field {
   display: grid; gap: 4px; margin-bottom: 14px;
@@ -848,67 +840,3 @@ tr.unbootable td:first-child { border-left: 3px solid var(--warn); }
   border: 1px solid var(--border);
   color: var(--fg-dim);
 }
-
-/* ── v0.5.2: three-slot branding (light / dark / client) ─────────── */
-.logo-slots {
-  display: grid;
-  grid-template-columns: repeat(3, 1fr);
-  gap: 12px;
-}
-@media (max-width: 720px) { .logo-slots { grid-template-columns: 1fr; } }
-.logo-slot {
-  display: flex; flex-direction: column; gap: 8px;
-  padding: 12px;
-  background: var(--bg-panel-2);
-  border: 1px solid var(--border);
-  border-radius: var(--radius);
-}
-.logo-slot-head { display: flex; align-items: center; justify-content: space-between; gap: 8px; }
-.logo-slot-head .name { color: var(--fg); font-weight: 600; font-size: 13px; }
-.logo-slot .swatch {
-  height: 64px;
-  display: flex; align-items: center; justify-content: center;
-  background: var(--bg); border: 1px solid var(--border);
-  border-radius: var(--radius);
-}
-.logo-slot .swatch img { max-width: 90%; max-height: 52px; object-fit: contain; }
-.logo-slot-hint { color: var(--fg-dim); font-size: 11.5px; }
-
-/* ── v0.5.2: login local/SSO separation ─────────────────────────── */
-.auth-card .auth-divider {
-  display: flex; align-items: center; text-align: center;
-  color: var(--fg-dimmer); font-size: 11px; text-transform: uppercase;
-  letter-spacing: 0.08em;
-  margin: 16px 0 12px;
-}
-.auth-card .auth-divider::before,
-.auth-card .auth-divider::after {
-  content: ""; flex: 1; height: 1px; background: var(--border-soft);
-}
-.auth-card .auth-divider span { padding: 0 10px; }
-.auth-card .sso-block .sso-btn { margin-top: 0; }
-.auth-card .sso-btn {
-  display: flex; align-items: center; justify-content: center; gap: 8px;
-}
-.auth-card .sso-btn .sso-logo { width: 16px; height: 16px; object-fit: contain; flex: none; }
-
-/* ── v0.5.2: modal (queue Profile editor) ───────────────────────── */
-.modal-overlay {
-  position: fixed; inset: 0; z-index: 200;
-  display: flex; align-items: center; justify-content: center;
-  background: rgba(0, 0, 0, 0.55);
-  padding: 24px;
-}
-.modal-box {
-  width: 100%; max-width: 520px;
-  background: var(--bg-panel);
-  border: 1px solid var(--border);
-  border-radius: var(--radius-lg);
-  box-shadow: var(--shadow-card);
-  padding: 22px;
-}
-.modal-box h2 { margin: 0 0 14px; font-size: 16px; font-weight: 600; color: var(--fg); }
-.modal-actions {
-  display: flex; justify-content: flex-end; gap: 10px; margin-top: 18px;
-}
-.modal-actions .submit { width: auto; padding: 8px 18px; }

crates/webui/src/app.js

@@ -160,101 +160,21 @@
   // tint borrowed from Bootimus v0.1.62. Returns {ok, reason}.
   function bootability(iso, settings) {
     const fam = iso.introspection.family;
-    // v0.5.8: Windows ISOs boot via iPXE HTTP sanboot of the raw image —
-    // no Settings toggle, no SMB, no size limit. Always bootable.
-    if (fam === 'windows_pe') {
-      return { ok: true };
+    const isWin = fam === 'windows_pe';
+    if (isWin && !settings.windows_enabled) {
+      return { ok: false, reason: 'Windows boot disabled in Settings' };
     }
-    if (!iso.introspection.kernel_path) {
-      // Not Windows and no Linux kernel/initrd detected. Small images can
-      // still try the sanboot fallback; large ones almost certainly aren't
-      // network-bootable installers (e.g. appliance bundles like VMware
-      // VCSA) — flag them clearly instead of with a Linux-centric message.
+    if (!isWin && !iso.introspection.kernel_path && fam !== 'windows_pe') {
+      // Linux without a detected kernel falls through to sanboot which
+      // rarely works for >1 GiB ISOs.
       if (iso.size_bytes > 1.5 * 1024 * 1024 * 1024) {
-        return { ok: false, reason: "not a recognized network-bootable installer (no Windows or Linux boot files found) — this image can't be PXE-booted" };
+        return { ok: false, reason: 'no kernel/initrd detected; ISO too large for sanboot fallback' };
       }
       return { ok: true, warn: 'no kernel detected — sanboot fallback may not work' };
     }
     return { ok: true };
   }
 
-  // v0.5.2: pretty label for an unattended file's detected kind.
-  function unattendedKindLabel(k) {
-    return ({
-      kickstart: 'Kickstart', preseed: 'Preseed', autoinstall: 'Autoinstall',
-      answer_file: 'Answer file', unknown: 'Unknown',
-    })[k] || (k || 'Unknown');
-  }
-
-  // v0.5.2: build the shared "deployment profile" field group — auto
-  // hostname, auto IP, and an unattended-file picker — reused by the
-  // Hosts pin form and the Queue "Profile" modal. `files` is the
-  // /api/unattended list; `profile` seeds the current values. Returns the
-  // wrapper element plus a `read()` that yields the API body shape.
-  function buildProfileFields(profile, files, layoutClass) {
-    profile = profile || {};
-    files = files || [];
-    const hostnameInput = el('input', {type:'text', spellcheck:'false',
-      placeholder:'e.g. node-7', value: profile.auto_hostname || ''});
-    const ipInput = el('input', {type:'text', spellcheck:'false',
-      placeholder:'e.g. 10.0.0.7', value: profile.auto_ip || ''});
-    const sel = el('select', {},
-      [el('option', {value:''}, '— none —')].concat(
-        files.map(f => el('option', {value: f.id},
-          f.filename + ' · ' + unattendedKindLabel(f.kind)))));
-    sel.value = profile.unattended_file || '';
-    const wrap = el('div', {class: layoutClass || 'form-row cols-3'}, [
-      el('label', {class:'field'}, [
-        el('span', {class:'name'}, 'Auto hostname (optional)'), hostnameInput]),
-      el('label', {class:'field'}, [
-        el('span', {class:'name'}, 'Auto IP address (optional)'), ipInput]),
-      el('label', {class:'field'}, [
-        el('span', {class:'name'}, 'Unattended file'), sel]),
-    ]);
-    return {
-      wrap,
-      read() {
-        return {
-          auto_hostname: hostnameInput.value.trim() || null,
-          auto_ip: ipInput.value.trim() || null,
-          unattended_file: sel.value || null,
-        };
-      },
-    };
-  }
-
-  // v0.5.2: minimal modal overlay. `onSave(msgEl)` runs on Save and may
-  // return a falsy value to keep the modal open (e.g. on validation
-  // error) or anything truthy to close it.
-  function openModal(titleText, contentEls, onSave) {
-    const overlay = el('div', {class:'modal-overlay'});
-    const close = () => { if (overlay.parentNode) overlay.parentNode.removeChild(overlay); };
-    const msg = el('div', {class:'msg', style:'margin-top:10px'});
-    const cancelBtn = el('button', {class:'ghost', type:'button', onclick: close}, 'Cancel');
-    const saveBtn = el('button', {class:'submit', type:'button'}, 'Save');
-    saveBtn.onclick = async () => {
-      saveBtn.disabled = true;
-      try {
-        const ok = await onSave(msg);
-        if (ok) close();
-      } finally {
-        saveBtn.disabled = false;
-      }
-    };
-    overlay.addEventListener('click', (e) => { if (e.target === overlay) close(); });
-    document.addEventListener('keydown', function esc(e) {
-      if (e.key === 'Escape') { close(); document.removeEventListener('keydown', esc); }
-    });
-    overlay.appendChild(el('div', {class:'modal-box'}, [
-      el('h2', {}, titleText),
-      ...(Array.isArray(contentEls) ? contentEls : [contentEls]),
-      msg,
-      el('div', {class:'modal-actions'}, [cancelBtn, saveBtn]),
-    ]));
-    document.body.appendChild(overlay);
-    return { close };
-  }
-
   // ── views ────────────────────────────────────────────────────────
   const views = {
     dashboard: async () => {
@@ -294,11 +214,11 @@
           el('div', {class: 'trend'},
             isos.filter(i => i.introspection.family === 'windows_pe').length + ' Windows · ' +
             isos.filter(i => i.introspection.family !== 'windows_pe').length + ' Linux  ·  ' +
-            // v0.4.67+v0.5.5: count all remote-share protocols. Label
-            // generically since operators may use any mix of SMB/NFS/SFTP.
-            ((status.smb_share_reachable || 0) + (status.nfs_share_reachable || 0) + (status.sftp_share_reachable || 0)) +
+            // v0.4.67: count both protocols. Label generically since
+            // operators may be using one, the other, or both.
+            ((status.smb_share_reachable || 0) + (status.nfs_share_reachable || 0)) +
             ' remote share' +
-            (((status.smb_share_reachable || 0) + (status.nfs_share_reachable || 0) + (status.sftp_share_reachable || 0)) === 1 ? '' : 's')),
+            (((status.smb_share_reachable || 0) + (status.nfs_share_reachable || 0)) === 1 ? '' : 's')),
         ])),
         el('div', {class: 'card'}, el('div', {class: 'stat'}, [
           el('div', {class: 'label'}, 'Uptime'),
@@ -399,11 +319,9 @@
     },
 
     queue: async () => {
-      const [{ entries = [] }, isos, unattRes] = await Promise.all([
+      const [{ entries = [] }, isos] = await Promise.all([
         getJSON('/api/queue'), getJSON('/api/isos'),
-        getJSON('/api/unattended').catch(() => ({ files: [] })),
       ]);
-      const unattendedFiles = unattRes.files || [];
       const targets = isos.flatMap(i => i.boot_entries.map(e => ({
         id: e.id, title: e.title + '  — ' + familyLabel(i.introspection.family)
       })));
@@ -426,51 +344,21 @@
 
       const track = entries.length
         ? el('div', {class:'queue-track'},
-            entries.map(g => {
-              const prof = g.profile || {};
-              const hasProfile = prof.auto_hostname || prof.auto_ip || prof.unattended_file;
-              const profSummary = hasProfile
-                ? el('div', {class:'meta', style:'margin-top:2px'},
-                    '⚙ ' + [
-                      prof.auto_hostname ? 'host ' + prof.auto_hostname : null,
-                      prof.auto_ip ? 'ip ' + prof.auto_ip : null,
-                      prof.unattended_file ? 'unattended: ' + prof.unattended_file : null,
-                    ].filter(Boolean).join(' · '))
-                : null;
-              return el('div', {class:'queue-row' + (g.assigned_target ? ' assigned' : '')}, [
-                el('div', {class:'pos'}, '#' + g.position),
-                el('div', {}, [
-                  el('div', {class:'mac'}, g.mac),
-                  el('div', {class:'meta'},
-                    (g.ip ? String(g.ip) + ' · ' : '') + archLabel(g.arch) + ' · joined ' + fmtAgo(g.joined_at)),
-                  profSummary,
-                ]),
-                el('div', {}, g.assigned_target
-                  ? el('span', {class:'tag ok'}, '→ ' + g.assigned_target)
-                  : el('span', {class:'tag accent'}, 'waiting')),
-                // v0.5.2: per-device deployment profile (auto hostname/IP +
-                // unattended file), same fields as a Hosts pin.
-                el('button', {class: hasProfile ? 'accent' : 'ghost', onclick: () => {
-                  const fields = buildProfileFields(prof, unattendedFiles, 'form-row');
-                  openModal('Deployment profile · ' + g.mac, [
-                    el('p', {class:'msg', style:'margin-bottom:12px'},
-                      'On assignment this device boots with the chosen unattended ' +
-                      'file; {{HOSTNAME}}/{{IP}}/{{MAC}} are filled into the answer file.'),
-                    fields.wrap,
-                  ], async (msg) => {
-                    const r = await putJSON('/api/queue/' + encodeURIComponent(g.id) + '/profile', fields.read());
-                    if (r.ok) { render('queue'); return true; }
-                    msg.textContent = 'Save failed: ' + (await r.text());
-                    msg.className = 'msg err';
-                    return false;
-                  });
-                }}, 'Profile'),
-                el('button', {class:'ghost', onclick: async () => {
-                  await fetch('/api/queue/' + encodeURIComponent(g.id), {method:'DELETE'});
-                  render('queue');
-                }}, 'Release'),
-              ]);
-            })
+            entries.map(g => el('div', {class:'queue-row' + (g.assigned_target ? ' assigned' : '')}, [
+              el('div', {class:'pos'}, '#' + g.position),
+              el('div', {}, [
+                el('div', {class:'mac'}, g.mac),
+                el('div', {class:'meta'},
+                  (g.ip ? String(g.ip) + ' · ' : '') + archLabel(g.arch) + ' · joined ' + fmtAgo(g.joined_at)),
+              ]),
+              el('div', {}, g.assigned_target
+                ? el('span', {class:'tag ok'}, '→ ' + g.assigned_target)
+                : el('span', {class:'tag accent'}, 'waiting')),
+              el('button', {class:'ghost', onclick: async () => {
+                await fetch('/api/queue/' + encodeURIComponent(g.id), {method:'DELETE'});
+                render('queue');
+              }}, 'Release'),
+            ]))
           )
         : el('div', {class:'empty'},
             'No clients queued. Boot a client and choose "Queued Deployment" in the PXE menu.');
@@ -511,20 +399,16 @@
       // v0.4.67: NFSv3 added back as an in-process Rust client
       // (nfs3_client crate). Both protocols available side-by-side;
       // operators pick whichever their NAS prefers.
-      const [isos, settings, smbRes, nfsRes, sftpRes, disk, unattRes] = await Promise.all([
+      const [isos, settings, smbRes, nfsRes, disk] = await Promise.all([
         getJSON('/api/isos'), getJSON('/api/settings'),
         getJSON('/api/smb-shares'),
         getJSON('/api/nfs-shares'),
-        getJSON('/api/sftp-shares'),
         getJSON('/api/storage/disk').catch(() => ({
           total_bytes: 0, available_bytes: 0, used_bytes: 0, path: '?',
         })),
-        getJSON('/api/unattended').catch(() => ({ files: [] })),
       ]);
       const shares = smbRes.shares || [];
       const nfsShares = nfsRes.shares || [];
-      const sftpShares = sftpRes.shares || [];
-      const unattendedFiles = unattRes.files || [];
 
       // ── Upload card ──
       const drop = el('div', {class:'drop', id:'drop'}, [
@@ -536,9 +420,6 @@
                                 style:'display:none', id:'file'});
       const prog = el('div', {class:'progress', id:'prog'}, el('div', {class:'bar', id:'bar'}));
       const upMsg = el('div', {class:'msg', id:'upmsg'});
-      // v0.5.8: cancel button — shown only while an upload is in flight.
-      const cancelUpload = el('button', {class:'danger', type:'button',
-        style:'display:none;margin-top:12px', id:'cancel-upload'}, 'Cancel upload');
 
       drop.onclick = () => file.click();
       drop.addEventListener('dragover', e => { e.preventDefault(); drop.classList.add('hover'); });
@@ -581,16 +462,6 @@
         };
 
         let uploadId = null;
-        // v0.5.8: cancel + leave-page guard. The AbortController stops the
-        // in-flight chunk; the beforeunload listener warns the operator
-        // that navigating away aborts the upload (the server-side partial
-        // is then cleaned up by the DELETE in the catch below).
-        const ac = new AbortController();
-        let canceled = false;
-        const warnLeave = (e) => { e.preventDefault(); e.returnValue = ''; return ''; };
-        window.addEventListener('beforeunload', warnLeave);
-        cancelUpload.style.display = '';
-        cancelUpload.onclick = () => { canceled = true; ac.abort(); };
         setStatus('Preparing upload for ' + f.name + ' (' + fmtBytes(f.size) + ')');
         prog.classList.add('active');
         bar.style.width = '1%';
@@ -617,7 +488,6 @@
                 'x-openpxe-upload-complete': complete ? 'true' : 'false',
               },
               body: f.slice(offset, end),
-              signal: ac.signal,
             });
             if (!r.ok) throw new Error(await failText(r));
             const j = await r.json();
@@ -633,15 +503,8 @@
             try { await fetch('/api/uploads/' + encodeURIComponent(uploadId), {method: 'DELETE'}); }
             catch {}
           }
-          if (canceled || (err && err.name === 'AbortError')) {
-            setStatus('Upload canceled — partial file discarded.', '');
-          } else {
-            setStatus('Upload failed: ' + (err && err.message ? err.message : String(err)), 'err');
-          }
+          setStatus('Upload failed: ' + (err && err.message ? err.message : String(err)), 'err');
         } finally {
-          window.removeEventListener('beforeunload', warnLeave);
-          cancelUpload.style.display = 'none';
-          cancelUpload.onclick = null;
           prog.classList.remove('active');
           if (!upMsg.className.includes('ok')) bar.style.width = '0';
         }
@@ -653,11 +516,7 @@
       // *next* row of the table. Keeps the markup flat and avoids the
       // overhead of a real modal.
       const rowsAndEditors = [];
-      // v0.5.8: list Available images alphabetically by filename
-      // (case-insensitive, natural numeric order) instead of newest-first.
-      const sortedIsos = [...isos].sort((a, b) =>
-        (a.filename || '').localeCompare(b.filename || '', undefined, { sensitivity: 'base', numeric: true }));
-      sortedIsos.forEach(i => {
+      isos.forEach(i => {
         const b = bootability(i, settings);
         // v0.4.65: SMB userspace consumer (smbclient).
         // v0.4.67: NFS back as in-process Rust client (nfs3_client).
@@ -853,13 +712,10 @@
         shareMsg.className = 'msg err';
       };
 
-      // Protocol picker — swaps which field block is visible. v0.5.2:
-      // NFS is the default (listed first) — it has no credential fields,
-      // so the form lands cleaner than the SMB guest/user/password row.
+      // Protocol picker — swaps which field block is visible.
       const protoSelect = el('select', {}, [
-        el('option', {value:'nfs'}, 'NFS (NFSv3)'),
         el('option', {value:'smb'}, 'SMB / CIFS'),
-        el('option', {value:'sftp'}, 'SFTP (SSH)'),
+        el('option', {value:'nfs'}, 'NFS (NFSv3)'),
       ]);
 
       // SMB inputs.
@@ -924,65 +780,18 @@
         ]),
       ]);
 
-      // SFTP inputs (v0.5.5). Pure-Rust russh client, in-process, so
-      // SFTP-sourced ISOs support HTTP Range like NFS. Auth is password
-      // OR an SSH private key (PEM, optional passphrase); the server's
-      // host key is pinned trust-on-first-use on the first connect.
-      const sftpServerIn = el('input', {type:'text', placeholder:'10.0.0.5'});
-      const sftpExportIn = el('input', {type:'text', placeholder:'/srv/isos'});
-      const sftpUserIn = el('input', {type:'text', placeholder:'root'});
-      const sftpPortIn = el('input', {type:'number', placeholder:'22', min:'1', max:'65535'});
-      const sftpAuthMode = el('select', {}, [
-        el('option', {value:'password'}, 'Password'),
-        el('option', {value:'key'}, 'SSH private key'),
-      ]);
-      const sftpPassIn = el('input', {type:'password', placeholder:'••••••••'});
-      const sftpKeyIn = el('textarea', {rows:'4',
-        placeholder:'-----BEGIN OPENSSH PRIVATE KEY-----',
-        style:'width:100%;font-family:ui-monospace,monospace;font-size:12px;resize:vertical'});
-      const sftpPassphraseIn = el('input', {type:'password',
-        placeholder:'(only if the private key is encrypted)'});
-      const sftpPassBlock = el('label', {class:'field'},
-        [el('span', {class:'name'}, 'Password'), sftpPassIn]);
-      const sftpKeyBlock = el('div', {}, [
-        el('label', {class:'field'},
-          [el('span', {class:'name'}, 'SSH private key (PEM)'), sftpKeyIn]),
-        el('label', {class:'field', style:'margin-top:10px'},
-          [el('span', {class:'name'}, 'Key passphrase (optional)'), sftpPassphraseIn]),
-      ]);
-      const syncSftpAuth = () => {
-        const key = sftpAuthMode.value === 'key';
-        sftpPassBlock.style.display = key ? 'none' : '';
-        sftpKeyBlock.style.display = key ? '' : 'none';
-      };
-      sftpAuthMode.addEventListener('change', syncSftpAuth);
-      syncSftpAuth();
-      const sftpFields = el('div', {}, [
-        el('div', {class:'form-row cols-2'}, [
-          el('label', {class:'field'}, [el('span', {class:'name'}, 'SSH server'), sftpServerIn]),
-          el('label', {class:'field'}, [el('span', {class:'name'}, 'Export path'), sftpExportIn]),
-        ]),
-        el('div', {class:'form-row cols-3', style:'margin-top:14px'}, [
-          el('label', {class:'field'}, [el('span', {class:'name'}, 'Username'), sftpUserIn]),
-          el('label', {class:'field'}, [el('span', {class:'name'}, 'Port'), sftpPortIn]),
-          el('label', {class:'field'}, [el('span', {class:'name'}, 'Auth'), sftpAuthMode]),
-        ]),
-        el('div', {style:'margin-top:14px'}, [sftpPassBlock, sftpKeyBlock]),
-      ]);
-
       // Swap the visible field block + clear any stale message.
       const syncProto = () => {
-        const p = protoSelect.value;
-        smbFields.style.display = p === 'smb' ? '' : 'none';
-        nfsFields.style.display = p === 'nfs' ? '' : 'none';
-        sftpFields.style.display = p === 'sftp' ? '' : 'none';
+        const nfs = protoSelect.value === 'nfs';
+        smbFields.style.display = nfs ? 'none' : '';
+        nfsFields.style.display = nfs ? '' : 'none';
         shareMsg.replaceChildren();
         shareMsg.className = 'msg';
       };
       protoSelect.addEventListener('change', syncProto);
 
       // One add button; dispatches to the selected protocol's endpoint.
-      const addShare = el('button', {onclick: async () => {
+      const addShare = el('button', {style:'margin-top:14px', onclick: async () => {
         if (protoSelect.value === 'smb') {
           if (!smbServer.value || !smbShare.value) {
             shareMsg.replaceChildren(document.createTextNode('Server and share name are required.'));
@@ -1002,40 +811,6 @@
             shareMsg.className = 'msg ok';
             render('storage');
           } else { await showShareError(r); }
-        } else if (protoSelect.value === 'sftp') {
-          if (!sftpServerIn.value || !sftpExportIn.value || !sftpUserIn.value) {
-            shareMsg.replaceChildren(document.createTextNode('Server, export, and username are required.'));
-            shareMsg.className = 'msg err'; return;
-          }
-          const useKey = sftpAuthMode.value === 'key';
-          if (useKey && !sftpKeyIn.value.trim()) {
-            shareMsg.replaceChildren(document.createTextNode('Paste the SSH private key, or switch Auth to Password.'));
-            shareMsg.className = 'msg err'; return;
-          }
-          if (!useKey && !sftpPassIn.value) {
-            shareMsg.replaceChildren(document.createTextNode('Password is required, or switch Auth to SSH private key.'));
-            shareMsg.className = 'msg err'; return;
-          }
-          shareMsg.replaceChildren(document.createTextNode('Connecting…'));
-          shareMsg.className = 'msg';
-          const body = {
-            server: sftpServerIn.value,
-            export: sftpExportIn.value,
-            username: sftpUserIn.value,
-          };
-          if (sftpPortIn.value) { body.port = parseInt(sftpPortIn.value, 10); }
-          if (useKey) {
-            body.private_key = sftpKeyIn.value;
-            if (sftpPassphraseIn.value) { body.passphrase = sftpPassphraseIn.value; }
-          } else {
-            body.password = sftpPassIn.value;
-          }
-          const r = await postJSON('/api/sftp-shares', body);
-          if (r.ok) {
-            shareMsg.replaceChildren(document.createTextNode('Connected.'));
-            shareMsg.className = 'msg ok';
-            render('storage');
-          } else { await showShareError(r); }
         } else {
           if (!nfsServerIn.value || !nfsExportIn.value) {
             shareMsg.replaceChildren(document.createTextNode('Server and export are required.'));
@@ -1074,125 +849,19 @@
         el('span'),
       ]));
 
-      const sftpRowEls = sftpShares.map(m => el('div', {class: 'nfs-row' + (m.reachable ? '' : ' down')}, [
-        el('span', {class: 'dot ' + (m.reachable ? 'ok' : 'err')}),
-        el('div', {}, [
-          el('div', {class:'id'}, [el('span', {class:'proto-badge'}, 'SFTP'),
-            document.createTextNode(m.username + '@' + m.server + ':' + m.export)]),
-          el('div', {class:'meta'},
-            'SSH · ' + (m.auth === 'key' ? 'key' : 'password') + ' · ' +
-            (m.reachable ? m.iso_count + ' isos' : 'not reachable')),
-          m.host_key_fingerprint
-            ? el('div', {style:'margin-top:4px;opacity:.65;font-size:11px;font-family:ui-monospace,monospace;word-break:break-all'},
-                'host key ' + m.host_key_fingerprint)
-            : null,
-          m.last_error ? el('div', {class:'err'}, '⚠ ' + m.last_error) : null,
-          m.last_hint ? el('div', {style:'margin-top:4px;opacity:.78;font-size:12px'}, m.last_hint) : null,
-        ]),
-        el('button', {class:'ghost', onclick: async () => {
-          const r = await postJSON('/api/sftp-shares/' + encodeURIComponent(m.id) + '/scan', {});
-          if (r.ok) render('storage');
-        }}, 'Re-scan'),
-        el('button', {class:'danger', onclick: async () => {
-          if (!confirm('Forget ' + m.server + ':' + m.export + '?')) return;
-          await fetch('/api/sftp-shares/' + encodeURIComponent(m.id), {method:'DELETE'});
-          render('storage');
-        }}, 'Remove'),
-        el('span'),
-      ]));
-
-      const totalShares = shares.length + nfsShares.length + sftpShares.length;
+      const totalShares = shares.length + nfsShares.length;
       const remoteRows = totalShares
-        ? [...smbRowEls, ...nfsRowEls, ...sftpRowEls]
+        ? [...smbRowEls, ...nfsRowEls]
         : [el('div', {class:'empty'}, 'No remote shares configured.')];
       syncProto();
 
       const diskCard = diskSpaceCard(disk);
 
-      // ── Advanced: unattended answer-file upload (v0.5.2) ──
-      // Mirrors the Settings "Advanced" disclosure. Kickstart / Preseed /
-      // Autoinstall / Windows answer files land in their own directory
-      // (never the ISO listing or PXE menu) and are referenced by host
-      // pins + queue profiles.
-      const unattMsg = el('div', {class:'msg', style:'margin-top:10px'});
-      const unattFile = el('input', {
-        type:'file',
-        accept:'.ks,.cfg,.seed,.yaml,.yml,.xml',
-        style:'display:none', id:'unatt-file',
-      });
-      async function uploadUnattended(f) {
-        const fd = new FormData(); fd.append('file', f, f.name);
-        unattMsg.textContent = 'Uploading ' + f.name + ' (' + fmtBytes(f.size) + ')…';
-        unattMsg.className = 'msg';
-        const r = await fetch('/api/unattended', {method:'POST', body: fd});
-        if (r.ok) {
-          unattMsg.textContent = 'Stored ' + f.name + '.';
-          unattMsg.className = 'msg ok';
-          render('storage');
-        } else {
-          unattMsg.textContent = 'Upload failed: ' + (await r.text());
-          unattMsg.className = 'msg err';
-        }
-      }
-      const unattDrop = el('div', {class:'drop', id:'unatt-drop'}, [
-        el('div', {}, 'Drop a Kickstart, Preseed, Autoinstall, or Answer File here.'),
-        el('div', {style:'font-size:12px;margin-top:6px'},
-          'Accepted: .ks · .cfg · .seed · .yaml · .yml · .xml (or user-data). ' +
-          'Use {{HOSTNAME}}, {{IP}}, {{MAC}} as placeholders — they are filled in per host at boot.'),
-      ]);
-      unattDrop.onclick = () => unattFile.click();
-      unattDrop.addEventListener('dragover', e => { e.preventDefault(); unattDrop.classList.add('hover'); });
-      unattDrop.addEventListener('dragleave', () => unattDrop.classList.remove('hover'));
-      unattDrop.addEventListener('drop', e => {
-        e.preventDefault(); unattDrop.classList.remove('hover');
-        if (e.dataTransfer.files[0]) uploadUnattended(e.dataTransfer.files[0]);
-      });
-      unattFile.onchange = () => { if (unattFile.files[0]) uploadUnattended(unattFile.files[0]); };
-
-      const unattRows = unattendedFiles.length
-        ? unattendedFiles.map(f => el('div', {class:'nfs-row'}, [
-            el('span', {class:'dot ok'}),
-            el('div', {}, [
-              el('div', {class:'id'}, [
-                el('span', {class:'proto-badge'}, unattendedKindLabel(f.kind)),
-                document.createTextNode(f.filename),
-              ]),
-              el('div', {class:'meta'}, fmtBytes(f.size_bytes) + ' · id ' + f.id),
-            ]),
-            el('span'),
-            el('button', {class:'danger', onclick: async () => {
-              if (!confirm('Delete unattended file ' + f.filename + '?')) return;
-              await fetch('/api/unattended/' + encodeURIComponent(f.id), {method:'DELETE'});
-              render('storage');
-            }}, 'Delete'),
-            el('span'),
-          ]))
-        : [el('div', {class:'empty'}, 'No unattended files yet.')];
-
-      const unattendedAdvanced = el('details', {class:'advanced-disclosure', style:'margin-top:18px'}, [
-        el('summary', {class:'advanced-summary'}, 'Advanced'),
-        el('div', {class:'card', style:'margin-top:14px'}, [
-          el('header', {}, [
-            el('h2', {}, 'Unattended file upload'),
-            el('span', {class:'sub'}, unattendedFiles.length + ' file' + (unattendedFiles.length === 1 ? '' : 's')),
-          ]),
-          el('div', {class:'body'}, [
-            unattDrop, unattFile, unattMsg,
-            el('div', {style:'margin-top:16px;display:grid;gap:8px'}, unattRows),
-            el('p', {class:'msg', style:'margin-top:14px'},
-              'These answer files drive unattended installs. Attach one to a ' +
-              'host pin (Hosts tab) or a queued device (Queue → Profile); on ' +
-              'boot OpenPXE injects the matching kernel argument and serves the ' +
-              'file with the host’s name/IP filled in. Stored separately from ISOs.'),
-          ]),
-        ]),
-      ]);
-
-      return el('div', {}, [el('div', {class:'grid'}, [
+      return el('div', {class:'grid'}, [
         diskCard,
         el('div', {class:'card'}, [
           el('header', {}, el('h2', {}, 'Upload ISO')),
-          el('div', {class:'body'}, [drop, file, prog, upMsg, cancelUpload]),
+          el('div', {class:'body'}, [drop, file, prog, upMsg]),
         ]),
         // v0.5.1: SMB + NFS unified into one "Remote shares" card with a
         // protocol dropdown. Backend endpoints are unchanged; this is a
@@ -1210,13 +879,20 @@
               ]),
               el('span'),
             ]),
-            el('div', {style:'margin-top:14px'}, [smbFields, nfsFields, sftpFields]),
+            el('div', {style:'margin-top:14px'}, [smbFields, nfsFields]),
             addShare, shareMsg,
             el('div', {style:'margin-top:18px;display:grid;gap:8px'}, remoteRows),
             el('p', {class:'msg', style:'margin-top:14px'},
-              'Remote .iso libraries are read on demand — no local cache to ' +
-              'preserve disk usage. Support for NFS 3.0, SMB, and SFTP (SSH). ' +
-              'Ensure that the hosts IP address is provisioned.'),
+              'Remote ISO libraries are read on demand — no local cache, no ' +
+              'double disk usage. SMB/CIFS is read in userspace via Samba’s ' +
+              'smbclient; NFSv3 via a pure-Rust in-process client. Both work in ' +
+              'any container (Unraid, OpenShift restricted SCC, plain Docker) with ' +
+              'no kernel modules and no CAP_SYS_ADMIN. SMB supports guest or ' +
+              'user/password; most NAS appliances expose ISO libraries as ' +
+              'guest-readable. NFSv3 auth is AUTH_SYS only — gate access by ' +
+              'allowing this OpenPXE host’s IP in the server’s export list. ' +
+              'NFS-sourced ISOs also support HTTP Range (seek into a 5 GB ISO ' +
+              'without reading what precedes the offset); SMB streams sequentially.'),
           ]),
         ]),
         el('div', {class:'card'}, [
@@ -1226,17 +902,15 @@
           ]),
           isoTable,
         ]),
-      ]), unattendedAdvanced]);
+      ]);
     },
 
     hosts: async () => {
-      const [{ hosts = [] }, isos, bootLogRes, unattRes] = await Promise.all([
+      const [{ hosts = [] }, isos, bootLogRes] = await Promise.all([
         getJSON('/api/hosts'), getJSON('/api/isos'),
         getJSON('/api/boot-log').catch(() => ({ events: [] })),
-        getJSON('/api/unattended').catch(() => ({ files: [] })),
       ]);
       const bootEvents = bootLogRes.events || [];
-      const unattendedFiles = unattRes.files || [];
       const targets = isos.flatMap(i => i.boot_entries.map(e => ({
         id: e.id, title: e.title + '  — ' + familyLabel(i.introspection.family),
       })));
@@ -1255,20 +929,14 @@
         .concat(reserved.map(t => el('option', {value: t.id}, t.title)))
         .concat(targets.map(t => el('option', {value: t.id}, t.title))));
       const msg = el('div', {class:'msg'});
-      // v0.5.2: optional unattended-install profile — auto hostname, auto
-      // IP, and an answer-file picker. On boot, a bound MAC with an
-      // unattended file selected has the right kernel arg injected
-      // (inst.ks / preseed url / autoinstall ds=nocloud) and the
-      // hostname/IP templated into the served answer file.
-      const profileFields = buildProfileFields({}, unattendedFiles, 'form-row cols-3');
 
       const upsertBtn = el('button', {onclick: async () => {
         if (!macInput.value || !targetSel.value) {
           msg.textContent = 'MAC and target are required.'; msg.className = 'msg err'; return;
         }
-        const r = await postJSON('/api/hosts', Object.assign({
+        const r = await postJSON('/api/hosts', {
           mac: macInput.value, target: targetSel.value, label: labelInput.value,
-        }, profileFields.read()));
+        });
         if (r.ok) {
           msg.textContent = 'Saved.'; msg.className = 'msg ok';
           render('hosts');
@@ -1294,18 +962,10 @@
           }
           setTimeout(() => { wakeBtn.textContent = original; wakeBtn.disabled = false; }, 2500);
         }}, 'Wake');
-        const autoDeploy = (h.auto_hostname || h.auto_ip || h.unattended_file)
-          ? el('div', {style:'font-size:12px;line-height:1.5'}, [
-              h.unattended_file ? el('div', {}, [el('span', {class:'tag accent'}, 'unattended'), document.createTextNode(' ' + h.unattended_file)]) : null,
-              h.auto_hostname ? el('div', {class:'mono'}, 'host: ' + h.auto_hostname) : null,
-              h.auto_ip ? el('div', {class:'mono'}, 'ip: ' + h.auto_ip) : null,
-            ])
-          : el('span', {class:'tag'}, '—');
         return el('tr', {}, [
           el('td', {class:'mono'}, h.mac),
           el('td', {}, h.label || el('span', {class:'tag'}, '(unlabeled)')),
           el('td', {class:'mono'}, h.target),
-          el('td', {}, autoDeploy),
           el('td', {}, fmtAgo(h.updated_at)),
           el('td', {style:'text-align:right;white-space:nowrap'}, [
             wakeBtn,
@@ -1322,8 +982,7 @@
         ? el('table', {}, [
             el('thead', {}, el('tr', {}, [
               el('th',{},'MAC'), el('th',{},'Label'),
-              el('th',{},'Target'), el('th',{},'Auto-deploy'),
-              el('th',{},'Updated'), el('th',{},''),
+              el('th',{},'Target'), el('th',{},'Updated'), el('th',{},''),
             ])),
             el('tbody', {}, rows),
           ])
@@ -1343,13 +1002,10 @@
                   'Built-in shortcuts skip the menu entirely. Per-ISO entries chain straight to the boot script.'),
               ]),
             ]),
-            el('div', {style:'margin-top:16px'}, profileFields.wrap),
             upsertBtn, msg,
             el('p', {class:'msg', style:'margin-top:14px'},
               'When a client with a bound MAC requests boot.ipxe, OpenPXE ' +
-              'short-circuits past the interactive menu and chains directly. ' +
-              'If an unattended file is selected, the matching kernel argument ' +
-              'is injected and the hostname/IP are templated into the answer file.'),
+              'short-circuits past the interactive menu and chains directly.'),
           ]),
         ]),
         el('div', {class:'card'}, [
@@ -1532,6 +1188,7 @@
         getJSON('/api/notify').catch(() => ({ enabled:false, kind:'slack' })),
         getJSON('/api/docs').catch(() => ({ groups: [] })),
       ]);
+      const hasLogo = !!status.custom_logo;
 
       // ── Account card (Forms admin credentials, v0.4.5).
       // Sonarr/Radarr-style: the admin enters their current password
@@ -1550,7 +1207,7 @@
       // beneath the input row instead of butting against the password
       // fields. Mirrors the `Save SSO settings` button below for visual
       // parity between the two settings cards.
-      const accountSave = el('button', {onclick: async () => {
+      const accountSave = el('button', {style:'margin-top:6px', onclick: async () => {
         accountMsg.textContent = ''; accountMsg.className = 'msg';
         if (!currentPw.value) {
           accountMsg.textContent = 'Current password is required.';
@@ -1675,8 +1332,7 @@
       // Hint that used to live under the URL field; surfaced once below
       // the whole row so it doesn't compete with the in-grid layout.
       const urlHint = el('p', {class:'msg', style:'margin-top:10px;margin-bottom:0'},
-        'OpenPXE fetches this metadata URL at sign-in to verify the IdP’s signature. ' +
-        'Any IdP-authenticated user gets an operator session.');
+        'OpenPXE will fetch the metadata URL once SSO sign-in lands; v0.4.63 stores it.');
       const refreshSsoFields = () => {
         if (ssoMode.value === 'url') {
           urlWrap.style.display = ''; xmlWrap.style.display = 'none';
@@ -1688,7 +1344,7 @@
       };
       ssoMode.onchange = refreshSsoFields;
       const ssoMsg = el('div', {class:'msg', style:'margin-top:8px'});
-      const ssoSave = el('button', {onclick: async () => {
+      const ssoSave = el('button', {style:'margin-top:16px', onclick: async () => {
         ssoMsg.textContent = ''; ssoMsg.className = 'msg';
         const payload = {
           enabled: ssoEnabled.checked,
@@ -1700,7 +1356,7 @@
         const r = await putJSON('/api/sso', payload);
         if (r.ok) {
           ssoMsg.textContent = ssoEnabled.checked
-            ? 'SSO saved and live. The login page now shows a “Sign in with …” button.'
+            ? 'SSO configuration saved. Runtime sign-in flow ships in a future release.'
             : 'SSO configuration saved (disabled).';
           ssoMsg.className = 'msg ok';
         } else {
@@ -1715,17 +1371,16 @@
           el('span', {class:'sub'},
             sso.enabled
               ? (sso.metadata_url || sso.metadata
-                  ? 'live · active'
+                  ? 'configured · runtime pending'
                   : 'enabled but missing source')
               : 'disabled'),
         ]),
         el('div', {class:'body'}, [
           el('p', {class:'msg', style:'margin-bottom:14px'},
-            'SAML single sign-on is live. With it enabled, the login page shows ' +
-            'a “Sign in with …” button that hands off to your IdP; OpenPXE ' +
-            'verifies the signed assertion against the IdP metadata and mints an ' +
-            'operator session for any authenticated user. The local administrator ' +
-            'account above always remains available as a fallback.'),
+            'Configure your SAML IdP today; OpenPXE persists the metadata so ' +
+            'when SSO sign-in lights up in a future release, no operator ' +
+            're-entry is needed. The local administrator account above is ' +
+            'always available as a fallback owner regardless of SSO state.'),
           el('label', {class:'check', style:'margin-bottom:14px;max-width:280px'}, [
             ssoEnabled,
             el('span', {}, 'Enable single sign-on'),
@@ -1760,83 +1415,72 @@
       // referenced by `refreshSsoFields` are attached.
       refreshSsoFields();
 
-      // ── Custom logos (v0.5.2). Three independent slots on one row,
-      // FleetDM-style: Light + Dark feed the WebUI top-left and the form
-      // login page (whichever theme is active picks its variant); Client
-      // is the raster painted above the PXE boot menu. Each slot has a
-      // preview, an upload (PNG/SVG/JPEG/WebP/GIF up to 2 MB; the Client
-      // slot is raster-only), and a clear.
+      // ── Custom logo upload.
+      // Single-file drop-zone; PNG/SVG/JPEG/WebP/GIF up to 2 MB.
+      // Persisted as <work_dir>/branding/logo.<ext> and served from
+      // /assets/logo.svg in preference to the bundled mark.
+      const logoFile = el('input', {
+        type:'file',
+        accept:'image/svg+xml,image/png,image/jpeg,image/webp,image/gif',
+        style:'display:none', id:'logo-file',
+      });
       const logoMsg = el('div', {class:'msg', style:'margin-top:10px'});
-      const bust = '?v=' + Date.now(); // bust the preview cache after a change
-      const brandingPresence = status.branding || { light:false, dark:false, client:false };
-      // Each swatch previews on a background matching where the mark
-      // lands (light page / dark page / dark PXE screen), independent of
-      // the operator's current page theme — so the Dark slot always reads
-      // as dark even while viewing Settings in light mode.
-      const slotDefs = [
-        { slot:'light',  title:'Light mode', preview:'/assets/logo.svg?theme=light' + '&' + bust.slice(1),
-          swatchBg:'#f4f5f7', hint:'Shown on light-theme pages.', accept:'image/svg+xml,image/png,image/jpeg,image/webp,image/gif' },
-        { slot:'dark',   title:'Dark mode',  preview:'/assets/logo.svg?theme=dark' + '&' + bust.slice(1),
-          swatchBg:'#0e1014', hint:'Shown on dark-theme pages.', accept:'image/svg+xml,image/png,image/jpeg,image/webp,image/gif' },
-        { slot:'client', title:'Client',     preview:'/branding/pxe-logo' + bust,
-          swatchBg:'#0e1014', hint:'Above the PXE boot menu.', accept:'image/png,image/jpeg,image/webp,image/gif' },
-      ];
-      const slotCol = (def) => {
-        const set = !!brandingPresence[def.slot];
-        const input = el('input', {type:'file', accept:def.accept, style:'display:none'});
-        input.onchange = async () => {
-          if (!input.files[0]) return;
-          const f = input.files[0];
-          const fd = new FormData(); fd.append('file', f, f.name);
-          logoMsg.textContent = 'Uploading ' + def.title + ' logo (' + fmtBytes(f.size) + ')…';
-          logoMsg.className = 'msg';
-          const r = await fetch('/api/branding/logo/' + def.slot, {method:'POST', body: fd});
-          if (r.ok) {
-            logoMsg.textContent = def.title + ' logo installed. Reloading…';
-            logoMsg.className = 'msg ok';
-            setTimeout(() => location.reload(), 600);
-          } else {
-            logoMsg.textContent = 'Upload failed: ' + (await r.text());
-            logoMsg.className = 'msg err';
-          }
-        };
-        return el('div', {class:'logo-slot'}, [
-          el('div', {class:'logo-slot-head'}, [
-            el('span', {class:'name'}, def.title),
-            set ? el('span', {class:'tag ok'}, 'set') : el('span', {class:'tag'}, 'default'),
-          ]),
-          el('div', {class:'swatch', style:'background:' + def.swatchBg},
-            el('img', {src: def.preview, alt: def.title + ' logo'})),
-          el('div', {class:'logo-slot-hint'}, def.hint),
-          el('div', {style:'display:flex;gap:6px;flex-wrap:wrap'}, [
-            el('button', {class:'ghost', onclick: () => input.click()}, set ? 'Replace' : 'Upload'),
-            set ? el('button', {class:'danger', onclick: async () => {
-              if (!confirm('Remove the ' + def.title + ' logo?')) return;
-              const r = await fetch('/api/branding/logo/' + def.slot, {method:'DELETE'});
-              if (r.ok || r.status === 204) {
-                logoMsg.textContent = def.title + ' logo cleared. Reloading…';
-                logoMsg.className = 'msg ok';
-                setTimeout(() => location.reload(), 500);
-              } else {
-                logoMsg.textContent = 'Clear failed: ' + (await r.text());
-                logoMsg.className = 'msg err';
-              }
-            }}, 'Remove') : null,
-          ]),
-          input,
-        ]);
+      const logoBust = '?v=' + Date.now(); // bust the browser cache after upload
+      logoFile.onchange = async () => {
+        if (!logoFile.files[0]) return;
+        const f = logoFile.files[0];
+        const fd = new FormData(); fd.append('file', f, f.name);
+        logoMsg.textContent = 'Uploading ' + f.name + ' (' + fmtBytes(f.size) + ')…';
+        logoMsg.className = 'msg';
+        const r = await fetch('/api/branding/logo', {method:'POST', body: fd});
+        if (r.ok) {
+          logoMsg.textContent = 'Custom logo installed. Reloading…';
+          logoMsg.className = 'msg ok';
+          setTimeout(() => location.reload(), 600);
+        } else {
+          const t = await r.text();
+          logoMsg.textContent = 'Upload failed: ' + t;
+          logoMsg.className = 'msg err';
+        }
       };
       const logoCard = el('div', {class:'card'}, [
         el('header', {}, el('h2', {}, 'Branding')),
         el('div', {class:'body'}, [
           el('p', {class:'msg', style:'margin-bottom:14px'},
-            'Upload your own brand marks. Up to 2 MB each; PNG, SVG, JPEG, ' +
-            'WebP, or GIF (the Client logo must be a raster). The Light and Dark ' +
-            'marks appear in the top-left and on the sign-in page depending on ' +
-            'theme; the Client mark sits above the PXE boot menu. The favicon ' +
-            'and the version string in the bottom-left always stay OpenPXE.'),
-          el('div', {class:'logo-slots'}, slotDefs.map(slotCol)),
-          logoMsg,
+            'Override the top-left brand mark with your own logo. Up to 2 MB; ' +
+            'PNG, SVG, JPEG, WebP, or GIF. The original OpenPXE version is ' +
+            'always shown in the bottom-left for support purposes.'),
+          el('div', {class:'logo-preview'}, [
+            el('div', {class:'swatch'},
+              el('img', {src: '/assets/logo.svg' + logoBust, alt:'current logo'})),
+            el('div', {class:'info'}, [
+              el('div', {class:'name'}, hasLogo ? 'Custom logo (uploaded)' : 'Default OpenPXE mark'),
+              el('div', {class:'meta'},
+                hasLogo
+                  ? 'Operator-uploaded; served from <work_dir>/branding/.'
+                  : 'Bundled rainbow-horizon mark. Upload an image to override.'),
+            ]),
+            el('div', {style:'display:flex;gap:8px;flex-wrap:wrap'}, [
+              el('button', {onclick: () => logoFile.click()},
+                hasLogo ? 'Replace logo' : 'Upload logo'),
+              hasLogo
+                ? el('button', {class:'danger', onclick: async () => {
+                    if (!confirm('Remove custom logo and revert to the OpenPXE mark?')) return;
+                    const r = await fetch('/api/branding/logo', {method:'DELETE'});
+                    if (r.ok || r.status === 204) {
+                      logoMsg.textContent = 'Reverted to default mark. Reloading…';
+                      logoMsg.className = 'msg ok';
+                      setTimeout(() => location.reload(), 500);
+                    } else {
+                      const t = await r.text();
+                      logoMsg.textContent = 'Clear failed: ' + t;
+                      logoMsg.className = 'msg err';
+                    }
+                  }}, 'Remove')
+                : null,
+            ]),
+          ]),
+          logoFile, logoMsg,
         ]),
       ]);
 
@@ -1938,13 +1582,13 @@
         smtp_implicit_tls: sTls.checked,
       });
 
-      const saveBtn = el('button', {onclick: async () => {
+      const saveBtn = el('button', {style:'margin-top:16px', onclick: async () => {
         nMsg.textContent = 'Saving…'; nMsg.className = 'msg';
         const r = await putJSON('/api/notify', collectNotify());
         if (r.ok) { nMsg.textContent = 'Saved.'; nMsg.className = 'msg ok'; render('settings'); }
         else { nMsg.textContent = 'Save failed: ' + (await r.text()); nMsg.className = 'msg err'; }
       }}, 'Save notification settings');
-      const testBtn = el('button', {class:'ghost', style:'margin-left:8px',
+      const testBtn = el('button', {class:'ghost', style:'margin-top:16px;margin-left:8px',
         onclick: async () => {
           nMsg.textContent = 'Sending test…'; nMsg.className = 'msg';
           // Save first so the test uses exactly what's on screen.
@@ -2119,23 +1763,11 @@
   function applyTheme(theme) {
     document.documentElement.setAttribute('data-theme', theme);
     try { localStorage.setItem('openpxe-theme', theme); } catch {}
-    applyBrandLogos(theme);
   }
   function currentTheme() {
     return document.documentElement.getAttribute('data-theme') === 'light' ? 'light' : 'dark';
   }
-  // v0.5.2: point the sidebar + login brand marks at the theme's logo
-  // slot so a light/dark toggle swaps the logo too (FleetDM-style).
-  function applyBrandLogos(theme) {
-    theme = theme || currentTheme();
-    const rev = (brandInfo && brandInfo.logo_rev) || 0;
-    const url = '/assets/logo.svg?theme=' + theme + '&r=' + rev;
-    document.querySelectorAll('.sidebar .brand img, .brand-row img').forEach(img => {
-      img.src = url;
-    });
-  }
   document.addEventListener('DOMContentLoaded', () => {
-    applyBrandLogos();
     const btn = $('#theme-toggle');
     if (btn) {
       btn.addEventListener('click', () => {
@@ -2236,7 +1868,7 @@
   // logo spans the card, no "OpenPXE" wordmark (the logo is the brand).
   // Default: bundled mark + "OpenPXE".
   function authBrandRow() {
-    const src = '/assets/logo.svg?theme=' + currentTheme() + '&r=' + (brandInfo.logo_rev || 0);
+    const src = '/assets/logo.svg?r=' + (brandInfo.logo_rev || 0);
     if (brandInfo.has_custom_logo) {
       return el('div', {class:'brand-row has-custom-logo'}, [
         el('img', {src, alt:'logo'}),
@@ -2276,29 +1908,18 @@
       window.history.replaceState({}, '', window.location.pathname);
     }
 
-    // v0.5.2: FleetDM-style separation. The local credential form is its
-    // own self-contained <form>; when SSO is enabled, a distinct
-    // "Sign in with …" button sits below a divider — the credential
-    // fields no longer double as the SSO trigger.
-    const ssoLive = ssoConfig && ssoConfig.enabled && (ssoConfig.metadata_url || ssoConfig.metadata);
-    const ssoBlock = ssoLive
-      ? el('div', {class:'sso-block'}, [
-          el('div', {class:'auth-divider'}, el('span', {}, 'or')),
-          el('button', {type:'button', class:'sso-btn', onclick: () => {
-            // SP-initiated SAML login: hand off to the IdP. /api/sso/acs
-            // verifies the response, mints the operator session, and
-            // redirects back to the dashboard.
-            window.location.assign('/api/sso/login');
-          }}, [
-            ssoConfig.idp_logo_url
-              ? el('img', {class:'sso-logo', src: ssoConfig.idp_logo_url, alt:'', onerror: function(){ this.style.display='none'; }})
-              : null,
-            el('span', {}, 'Sign in with ' + (ssoConfig.idp_name || 'SSO')),
-          ]),
+    const ssoButton = ssoConfig && ssoConfig.enabled && (ssoConfig.metadata_url || ssoConfig.metadata)
+      ? el('button', {type:'button', class:'sso-btn', onclick: () => {
+          // SP-initiated SAML login (v0.5.1): hand off to the IdP. The
+          // /api/sso/acs endpoint verifies the response, mints the
+          // operator session, and redirects back to the dashboard.
+          window.location.assign('/api/sso/login');
+        }}, [
+          el('div', {}, 'Sign in with ' + (ssoConfig.idp_name || 'SSO')),
         ])
       : null;
 
-    const form = el('form', {class:'auth-form local-login', onsubmit: async (e) => {
+    const form = el('form', {class:'auth-form', onsubmit: async (e) => {
       e.preventDefault();
       err.style.display = 'none';
       submit.disabled = true;
@@ -2326,6 +1947,9 @@
         submit.textContent = 'Sign in';
       }
     }}, [
+      authBrandRow(),
+      el('h2', {}, 'Sign in'),
+      el('p', {class:'lede'}, 'Enter your administrator credentials. Forgot them? SSH to the host and remove work_dir/auth.json — the next launch will re-prompt for setup.'),
       el('label', {class:'field'}, [
         el('div', {style:'color:var(--fg-dim);font-size:12px;margin-bottom:4px'}, 'Username'),
         usernameInput,
@@ -2335,16 +1959,11 @@
         passwordInput,
       ]),
       submit,
-    ]);
-    return el('div', {class:'login-stack'}, [
-      authBrandRow(),
-      el('h2', {}, 'Sign in'),
-      el('p', {class:'lede'}, 'Enter your administrator credentials. Forgot them? SSH to the host and remove work_dir/auth.json — the next launch will re-prompt for setup.'),
-      form,
-      ssoBlock,
+      ssoButton,
       err,
       el('div', {class:'auth-foot'}, 'OpenPXE · ' + (window.location.host || '')),
     ]);
+    return form;
   }
 
   function buildSetupCard() {

crates/webui/src/index.html

@@ -13,10 +13,7 @@
        on the asset handlers, the practical caching window is one
        version. -->
   <link rel="stylesheet" href="/assets/app.css?v={{ASSET_VERSION}}" />
-  <!-- v0.5.2: favicon is pinned to the bundled OpenPXE mark (its own
-       endpoint, decoupled from operator branding) for tab-icon
-       continuity regardless of any uploaded light/dark/client logo. -->
-  <link rel="icon" type="image/svg+xml" href="/assets/favicon.svg?v={{ASSET_VERSION}}" />
+  <link rel="icon" type="image/svg+xml" href="/assets/logo.svg?v={{ASSET_VERSION}}&r={{LOGO_REV}}" />
   <!-- Theme is read from localStorage *before* paint to avoid the
        dark→light flash on every navigation. Falls back to the OS
        preference and finally to dark. -->

deploy/docker/Dockerfile

@@ -60,41 +60,35 @@ COPY deploy/ipxe/local/ deploy/ipxe/local/
 RUN mkdir -p assets/ipxe && bash scripts/build-ipxe.sh /src/assets/ipxe
 
 ########## build openpxe ##########
-# v0.5.2: cross-compile the Rust binary NATIVELY — no QEMU.
-#
-# This stage is pinned to $BUILDPLATFORM (the builder's native arch — arm64
-# on an Apple-Silicon Mac, amd64 in x86 CI), exactly like `ipxe-build`. The
-# Rust compiler therefore runs at full native speed and emits an
-# x86_64-unknown-linux-musl binary via `cargo-zigbuild`, which uses `zig cc`
-# as the cross-linker (it bundles the musl sysroot for every target, so
-# there's no fiddly cross-gcc toolchain to assemble).
-#
-# Why this replaced the old `FROM rust ... --platform=linux/amd64` build:
-# that ran the *entire* compiler under QEMU x86_64 emulation on the arm64
-# host. It was ~15x slower (a single crate took >20 min) and the emulated
-# gcc/linker intermittently SIGSEGV'd or hung mid-link. Cross-compiling
-# sidesteps emulation entirely — the build is minutes, not half an hour,
-# and is deterministic.
-#
-# The output is still a fully static musl binary with no glibc dependency,
-# so the runtime stage stays free to be any Linux distro.
-FROM --platform=$BUILDPLATFORM rust:${RUST_VERSION}-bookworm AS build
+FROM rust:${RUST_VERSION}-bookworm AS build
 WORKDIR /src
-# zig (via the `ziglang` pip package — cargo-zigbuild auto-discovers it as
-# `python3 -m ziglang`) supplies the x86_64 musl sysroot + linker.
-# cargo-zigbuild is the thin cargo wrapper that wires zig in as the linker.
-RUN apt-get update \
- && apt-get install -y --no-install-recommends python3 python3-pip \
- && rm -rf /var/lib/apt/lists/* \
- && rustup target add x86_64-unknown-linux-musl \
- && pip3 install --no-cache-dir --break-system-packages ziglang \
- && cargo install --locked cargo-zigbuild
 
+# v0.4.5: build a fully static musl binary (matches Bootimus v0.1.70's
+# move). The resulting `/openpxe` has no glibc dependency at all, which:
+#   - Lets the runtime stage be any Linux distro (we still ship Debian
+#     slim for the `samba` / `wimtools` / `nfs-common` shellouts, but a
+#     scratch/distroless variant becomes a one-line swap).
+#   - Cuts a class of "GLIBC_2.39 not found" surprises when running on
+#     older RHEL/Rocky hosts that don't match Debian 12's libc version.
+#   - Sidesteps cross-compilation snags (the binary is its own world).
+#
+# x86_64-unknown-linux-musl is fully static by default (no extra
+# RUSTFLAGS needed). musl-tools provides the linker.
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends musl-tools \
+ && rm -rf /var/lib/apt/lists/* \
+ && rustup target add x86_64-unknown-linux-musl
+
+# Copy the whole workspace in one go. We used to do a two-pass "cache-prime
+# with stubs, then real build" dance for dep-compile reuse; that turned out
+# to silently serve stale stub binaries when cargo's fingerprint didn't
+# notice the source swap. A single build is ~1.5 min longer on cold cache
+# but guarantees the binary reflects the sources we copied.
 # Do not copy rust-toolchain.toml into the image. The local workspace pins
 # developer tooling, but inside Docker we intentionally use the Rust version
 # selected by the base image. Copying rust-toolchain.toml with
 # `channel = "stable"` makes rustup download a second full toolchain during
-# the build, which is slow and can exhaust small Colima/CI disks.
+# `cargo build`, which is slow and can exhaust small Colima/CI disks.
 COPY Cargo.toml Cargo.lock ./
 COPY crates/ crates/
 # Baseline binaries (BIOS / i386 / wimboot), then overlay the
@@ -106,11 +100,13 @@ COPY --from=fetch /src/assets/ipxe /src/assets/ipxe
 COPY --from=ipxe-build /src/assets/ipxe/snponly.efi /src/assets/ipxe/snponly.efi
 COPY --from=ipxe-build /src/assets/ipxe/ipxe.efi /src/assets/ipxe/ipxe.efi
 
-# Cache cargo registry + target across builds. `cargo zigbuild` runs the
-# native rustc (fast) and links for x86_64-musl with zig — no emulation.
+# Cache cargo registry + target across builds. The mtime touch is
+# belt-and-suspenders: cargo occasionally misses mtime-only changes on
+# networked FS; this forces a fingerprint check.
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
     --mount=type=cache,target=/src/target,sharing=locked \
-    cargo zigbuild --release --target x86_64-unknown-linux-musl --bin openpxe && \
+    find crates -name '*.rs' -exec touch {} + && \
+    cargo build --release --target x86_64-unknown-linux-musl --bin openpxe && \
     cp target/x86_64-unknown-linux-musl/release/openpxe /openpxe && \
     ls -l /openpxe
 

docs/openpxe-logo.svg

@@ -1,21 +0,0 @@
-<svg viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg" role="img" aria-label="OpenPXE">
-  <title>OpenPXE</title>
-  <!-- Static README mark: the "rainbow-horizon" medallion from the web UI,
-       with the SMIL animation removed so it renders reliably as an <img>
-       on Gitea/GitHub. -->
-  <defs>
-    <linearGradient id="opxRainbow" x1="0" y1="0" x2="1" y2="0">
-      <stop offset="0%"     stop-color="#330f1f"/>
-      <stop offset="12.56%" stop-color="#c83228"/>
-      <stop offset="25.06%" stop-color="#fb8841"/>
-      <stop offset="37.56%" stop-color="#d3dd92"/>
-      <stop offset="50.06%" stop-color="#59824f"/>
-      <stop offset="62.06%" stop-color="#002414"/>
-      <stop offset="74.06%" stop-color="#00143d"/>
-      <stop offset="86.06%" stop-color="#2874d7"/>
-      <stop offset="100%"   stop-color="#99c2ff"/>
-    </linearGradient>
-  </defs>
-  <circle cx="12" cy="12" r="10.5" fill="url(#opxRainbow)"
-          stroke="rgba(0,0,0,0.18)" stroke-width="0.6"/>
-</svg>